Deskbot approval gate (proposal → approve, plan-gated mutation)
Generated from
mcp/patterns.registry.json— do not edit by hand; change the registry and runbun run patterns:build.
Category: AI · Tier: deep · Risk: high — the safety boundary for AI mutation
Write/destructive desk tools never mutate inside the agent loop; they return a requiresApproval sentinel that becomes a proposal (PlanCard), executed only via an approve-route replay that records the real approver and time.
When to use: Mandatory companion to any mutating AI tool: it converts 'the model wants to write' into an auditable human decision.
Docs
- docs/blueprint/ai/harness-lens.md — Where the gate sits in the harness (GitHub · GitLab)
- docs/blueprint/ai/desk-integration.md — Proposal lifecycle in the desk (GitHub · GitLab)
Code
src/lib/server/ai/tools/propose-plan.ts— Proposal creation (GitHub · GitLab)src/lib/server/ai/tools/desk-execute.ts— executeDeskToolCall — the one door (GitHub · GitLab)src/lib/server/ai/policy/governor.ts— requiresApproval(risk): write/destructive gated, read/create not (GitHub · GitLab)src/routes/api/ai/proposals/[id]/approve/+server.ts— Approve-route replay (GitHub · GitLab)
Tests
src/lib/server/ai/tools/propose-plan.test.ts(GitHub · GitLab)src/lib/server/ai/tools/desk-execute.test.ts(GitHub · GitLab)src/lib/server/ai/policy/governor.test.ts(GitHub · GitLab)
Invariants
- The hard gate is at the tool layer — write/destructive tools return a requiresApproval sentinel; requiresApproval(risk) is the single rule.
- Planning is soft guidance, not the gate — shouldRequirePlan only decides whether to instruct the model to plan.
- Approval binds execution — the post-approval resume turn is filtered to read-only scopes so it cannot re-mutate.
Emulation notes
- An earlier design (inline ConfirmCard with a model-minted confirmed=false→true handshake) was superseded and never shipped — do not emulate it; the proposal→approve flow is the proven shape.
- Record who approved and when at the approve route — the audit trail is the point.
Depends on
- AI tool manifest & harness split (tool defs, risk metadata, registry)
- AI surfaces (chatbot vs deskbot split over one guard)
Machine-readable record: deskbot-approval-gate in mcp/patterns.registry.json.