02 — Approval packet (what every real approver must see before voting)

This file records WHAT an approver must review and HOW they must vote. It records no approval. Each approval must be cast by the approver's own authenticated identity/channel. The proposing agent records no vote.

Approval packet

APR code:           APR-0415  (id 415)
Action:             patch_ops_code
Risk:               high
Purpose:            deploy additive execute_authorize_build_step handler for C1 W7 only
Payload sha256:     a5f79847…f94ef7fca  (patched dot-apr-execute v2.3.0, +142 lines, additive)
Payload base64 md5: 3aa36821a66127ca9e3d93e6c2f3d987   (len 46672) — live MATCH to APR-0415
Expected file:      /opt/incomex/dot/bin/dot-apr-execute  (patch_mode=full_replace)
Expected change:    add execute_authorize_build_step handler only (1 dispatch arm + 1 function)
Forbidden effects:  no handler_ref bind · no grant mint · no dot-c1 registration · no W1→W9 · no dry-run
Rollback:           restore the .bak-<session> backup produced by patch_ops_code execution (additive revert)
Current status:     pending  ·  quorum_passed=false  ·  0/3 approvals

Required quorum (live rule, risk=high)

• ≥1 human president — apr_approvals row: approver_type='human', approver ILIKE '%president%', decision='approve'.
• ≥2 ai_council — apr_approvals rows: approver_type='ai_council', decision='approve'.
• 0 rejects · proposer excluded · 3 distinct real approver identities.

Required rationale text (each approver must affirm, scoped to APR-0415 only)

I approve APR-0415 only for deploying the additive C1 W7 execute_authorize_build_step handler
patch. I do not approve handler_ref binding, grant minting, dot-c1-grant-issue registration,
W1→W9, dry-run, Codex, or production activation.

Approval mechanism (the lawful path)

An approval is a row in apr_approvals (apr_id=415, approver=<real identity>, approver_type∈{'human','ai_council'}, decision='approve', rationale=<scoped text above>) recorded by each real approver through their own authenticated identity/channel — e.g. the human president and each ai_council seat acting under their own credentials. There is no agent-runnable approval CLI (dot-content-approve is unrelated content tooling; no dot-apr-approve exists). The proposing agent holds no president/council seat and casts no vote.

Outcome this turn

The packet above was prepared and is on record. No real approver acted through this session, so no approval row was created. See files 03 (president) and 04 (ai_council).