Skip to content

Bind Approval to the Exact Dispatch Artifact

Status

Accepted: Approval for a routed request is valid only for the exact approval-relevant dispatch payload identified by its payload version and SHA-256 digest.

Context

Using a dispatch identifier as the only approval reference leaves a mutation gap. A request could retain its identifier while its target, environment, execution plane, rationale, checks, or approval posture changes. An earlier approval must not authorise those new contents.

Decision

The dispatcher computes a versioned canonical payload from the fields that matter to approval and writes:

  • approval_payload_version
  • approval_artifact_sha256

The consumer verifies the request identity before applying approval posture. When approval is required, the approval record must carry the same dispatch identifier, payload version, digest, approver identity, and approval time. Immediately before promotion, the consumer recomputes the digest from the current request.

A missing, malformed, or stale identity cannot produce an approved-ready record. Routes with requires_approval: false retain their no-approval semantics after request identity verification. Their execution records still carry the artifact identity for provenance.

The current executor remains dry-run. This decision does not claim a final live-state precondition gate or signed approval mechanism.

Consequences

Positive

  • Approval cannot be reused after an approval-relevant request mutation.
  • Execution records preserve what was authorised and by whom.
  • No-approval routes remain compatible while gaining request provenance.

Negative

  • Existing approval writers must include the payload version and digest.
  • The request and approval directories remain trusted filesystem boundaries.
  • A future live executor still requires its own final precondition checks.

Alternatives considered

  • Bind only to dispatch_id: rejected because the identifier does not prove payload integrity.
  • Sign requests in the current release: deferred because identity binding and writer authentication are separate controls.

References