[HackTuah]

Two screenshots from a running build, near the top of the README, because what this project is about is easier to see than to read about. Deliberately two, not a gallery.

The approval card. The tool, the exact arguments it will be passed, the WRITE risk tier, the pattern offered for "always allow", and the four decisions.

The receipts page for that same call. Both halves on the signed chain: the gate asking (basis=default outcome=ask) and the owner allowing (basis=approval outcome=allow).

Together they are the whole argument in two images: it asks before it acts, and the answer is evidence afterwards.

The script is included so the assets can be regenerated

scripts/dev_demo_approval.sh is the slice 021 screenshot script with two changes, both found by it failing:

• The tool timeout is raised from the suite's 2s. Two seconds is right for tests and impossible for a person: an approval that waits on a human always expires and the turn records the tool as timed out.
• Migrations run before the application starts, not after. Oban is a supervised child and its tables must exist by the time it boots. The old ordering only ever appeared to work because a previous run had left a migrated file behind; on a fresh database it fails outright at failed to start child: Oban.

No GIF, and why

A GIF of the full sequence is what was wanted, and it is not in this PR because the sequence does not reliably complete. Driving the real browser, the session intermittently never leaves tool_wait after the approval is requested, so the decision that follows is postponed forever and the call ends at the tool timeout reporting error: the tool timed out for something the owner explicitly allowed:

run 3:   after card: t=0s status=approval_wait     -> resumed, receipt written 20ms after the click
run 4:   after card: t=0s status=tool_wait
         after card: t=1s status=tool_wait
         ...                                        (unchanged through t=9s and beyond)

That is slice 126, opened with the reproduction. The suite is green on it because every approval test calls collect(id, &match?({:state, :approval_wait}, &1)) before clicking, which is a synchronisation the product does not have. Clicking on the :requested broadcast instead, which is what the card actually renders on, the approval row ends as {"allowed", "once", consumed_at: nil}: granted, never consumed.

The GIF follows once that is fixed. Shipping one now would mean either filming a broken flow or cutting away before it breaks.

mix gate ; echo "EXIT=$?"
prod_check: PASS
trinity.names: OK over 647 tracked files
trinity.reuse: OK. Every commentable tracked file carries an SPDX header
Result: 821 passed (14 properties, 807 tests), 18 excluded
trinity.coverage: 042 80.31% vs 005 80.31%: OK
EXIT=0