Write-tool approval compatibility carrier

Scope corrected 2026-08-05: This document records only the explicitly retained opt-in approval compatibility leg. It is not a managed-turn prompt, tool-dispatch, content-review, or reply-delivery design. The removed P4.7 P1 classifier/allowlist/manifest design remains only in Git history.

Decision

ApprovalRequest is the compatibility carrier for a write action that the server-side action policy requires a human to approve. ExpertQueueItem remains a draft/reply concept and is not repurposed as a tool-action payload.

The compatibility leg may:

• receive a concrete write action requested through Hermes' normal tool loop;
• resolve the action class and authorization from server-owned registry and runtime identity, never from a model claim;
• create an org/OSA/run-scoped ApprovalRequest before any side effect;
• store the minimum replay input encrypted at rest and expose only redacted review data;
• execute the exact approved action once, server-side, after an authorized approve decision;
• audit create, approve/reject, execution, and failure transitions.

It must not:

• classify a user message or preselect/narrow Hermes tools per turn;
• inject tool grants, approval instructions, status prose, or any other block into the user message or transcript;
• turn every successful Hermes reply into a draft/review gate;
• execute before approval, treat a missing approval service as allow, or reuse approval across another org, OSA, run, tool, action, or parameter set;
• fabricate an ACP session or append a synthetic delivery/continuation message.

Normal/native tool discovery stays with Hermes. MCP may expose a capability that has no native equivalent, but it is not the source of approval policy.

Verification boundary

Acceptance for this compatibility leg requires a real write request proving:

1. no side effect occurs before approval;
2. an unauthorized/cross-scope decision is rejected;
3. reject/cancel never executes;
4. approve executes the bound action once with the original encrypted input;
5. retry is idempotent;
6. the canonical Hermes SessionDB transcript is not replaced by approval-table or Postgres prose.