02 — L2 Council & L4 Sovereign Approval / E-Sign Wording

Package: one-roof-human-ratification-handoff-2026-06-02 Copy-paste-ready text for the human ratification. The Agent prepared this wording; humans paste, vote, and sign. Nothing here has been entered. No row was written.

---

1. The request text (for APR-BOOT-AUTHMODEL-1)

Paste into the approval_requests row (field placement in doc 03 §A). proposed_action is JSON.

title:

Ratify auth model: redefine M-1 -> per-step governance_build_authorization (SB-0, L3); reserve os_proposal_approvals for L4 sovereign e-sign only (D-BOOT-1 + D-BOOT-2)

proposed_action:

{
  "kind": "adopt_authorization_model",
  "D-BOOT-1": "redefine M-1 from 'any os_proposal_approvals row exists' to per-step governance_build_authorization (SB-0) L3 grant, recomputed from L2 quorum",
  "D-BOOT-2": "adopt SB-0 governance_build_authorization as the L3 technical build gate; reserve os_proposal_approvals for L4 sovereign e-sign only",
  "ladder": "L0..L4 per hardening doc 02",
  "scope": "one-time constitutional adoption; authorizes the SB-0 build and the per-step grant regime; authorizes SB-1 to create the governance apr_action_types rows",
  "risk_level": "high",
  "reversible": false,
  "constitutional": true
}

evidence:

Bootstrap rehearsal REHEARSED-GREEN: one-roof-auth-axis-bootstrap-ratification-rehearsal-go-nogo-2026-06-02 (docs 03-05). Build-ready design: one-roof-axis-auth-proposal-operational-hardening-build-ready-design-2026-06-02 (docs 02,03,12,13). Intake analysis + human packet: one-roof-auth-model-ratification-intake-2026-06-02 (docs 03,04). Human handoff: one-roof-human-ratification-handoff-2026-06-02.

review_note:

Constitutional bootstrap. Cannot be self-authorized by SB-0 (circular). Requires one-time L2 council quorum + L4 sovereign e-sign. proposed_action_code intentionally blank: no apr_action_types row carries build-authorization semantics yet (the 6 live types are add_field/amend_law/create_item/enact_nrm/patch_ops_code/update_item). The council ratifies the TEXT of the decision; building the proper governance action-types is part of what this ratification authorizes (later SB-1 step).

⚠ action = modify (NOT add). The add default fires fn_auto_approve_add (L0 auto-approve). A constitutional act must not be auto-approved; modify keeps it on the L2 council path. ⚠ proposed_action_code stays blank. Do not invent or borrow a code — the semantics live in proposed_action + title.

---

2. L2 — Council decision wording (votes on apr_approvals)

The quorum rule for this high-risk act (enforced live by fn_apr_quorum_check):

• ≥ 1 president-human APPROVE — a human approver whose name matches %president% (F-AUTH-LIVE-1: it is matched by name + human, not by approver_type='president');
• ≥ 2 ai_council APPROVE;
• 0 rejects (any single REJECT blocks);
• the proposer (BOX-1 filer) is not among the approvers.

Council decision record (paste into each vote's rationale / the decision log):

DECISION: ADOPT the authorization model (D-BOOT-1 + D-BOOT-2) and the L0-L4 ladder.
SCOPE:    One-time constitutional adoption. Authorizes the SB-0 build
          (governance_build_authorization) and the subsequent per-step L3 grant regime.
          Authorizes SB-1 to create the governance apr_action_types rows.
BASIS:    Rehearsed-green bootstrap package (docs 03-05); build-ready design (docs 02,03);
          intake human packet (doc 04). Live gate verified: os_proposal_approvals=0,
          governance_build_authorization ABSENT (build correctly NOT yet done).
VOTES:    president-human = APPROVE ; ai_council#1 = APPROVE ; ai_council#2 = APPROVE ;
          rejects = 0 ; proposer excluded.
RESULT:   QUORUM PASSED (high-risk rule satisfied).
NOT YET:  This L2 decision alone does NOT authorize build. L4 sovereign e-sign (Section 3)
          is still required before any COMMIT. No table/grant is created by this vote.

Per-vote decision value = the system's approve token (e.g. approve); each voter sets their own approver / approver_type. When recorded correctly the trigger moves approval_requests.status pending → approved. Do not hand-edit status.

---

3. L4 — Sovereign e-sign wording (os_proposal_approvals)

Only the President may enter this, personally, out-of-band in Directus. The interim L4 surface is os_proposal_approvals until governance_sovereign_esign (hardening doc 12) is built.

Sovereign adoption statement (paste into metadata / signing note):

SOVEREIGN ADOPTION (L4). I, the President, personally adopt the authorization model
D-BOOT-1 + D-BOOT-2 and the L0-L4 ladder, as ratified by council quorum on
APR-BOOT-AUTHMODEL-1. This sovereign e-signature, together with the L2 quorum, authorizes
the gated SB-0 build to begin, one per-step L3 grant at a time. From this adoption forward,
os_proposal_approvals is reserved for L4 sovereign e-sign only; the old M-1 ("any
os_proposal_approvals row") is retired in favour of per-step SB-0 grants.

Genuine signature fields (entered by the President):

signature_text:        <President's typed full legal name>
signature_image:       <President's signature, optional>
first_name:            <President's first name>
last_name:             <President's last name>
email:                 <President's email>
esignature_agreement:  true
proposal:              <link/reference to APR-BOOT-AUTHMODEL-1>   # ties the e-sign to the adoption
ip_address / date:     <captured automatically by Directus>

This is the single act that makes os_proposal_approvals > 0 true for this constitutional act.

---

4. L2 vs L4 — explicit difference

Aspect	L2 — Council ratification	L4 — Sovereign e-sign
Authority	Collective council	The President alone
Question answered	"Is the decision text technically/collectively ratified?"	"Does the sovereign personally sign it into force?"
Surface	apr_approvals (votes on the request)	os_proposal_approvals (e-signature)
Mechanism	Quorum: 1 president-human + 2 ai_council, 0 rejects, proposer excluded	A genuine e-signature with esignature_agreement=true
Moves status?	Yes — via fn_apr_quorum_check trigger to approved	No — independent e-sign record
Sufficient alone?	No	No
Forgeable by Agent?	No — casting a vote = forgery	No — signing = e-sign forgery
Required for build?	Yes — both are required, together	Yes — both are required, together

---

5. Attestation

No approval_requests row was written; no apr_approvals vote cast; no os_proposal_approvals e-sign created. The above is prepared text for humans to enter and sign. (Forbidden-compliance: doc 06.)

Cross-links: checklist [[01-one-page-human-checklist]] · Directus steps [[03-directus-manual-action-guide]] · verify [[04-post-human-verification-checklist]]. Source packet [[one-roof-auth-model-ratification-intake-2026-06-02]] doc 04.