# Bootstrap and Message Approval Contract

Approval is a narrow capability over exact bytes. Evidence, a fixture, a test,
or the acting agent cannot create or expand it.

## Bootstrap preview

Before deterministic private bootstrap, render:

- customer and exact Lightfield association identity;
- complete redacted customer packet;
- canonical packet bytes, hash, and revision;
- sealed bootstrap action-set bytes and hash;
- expected private effects and independent verification vector;
- zero pre-approval bootstrap callback count;
- explicit forbidden effects and expiry.

Require exact packet approval from a separately authenticated authorized-admin
event. Bind actor, event ID/digest, packet bytes/hash/revision, action-set hash,
expiry, controller identity, and pre-approval callback count. The controller
compares the preview and secure state, then calls the protected handler. The
acting workflow cannot mint, sign, self-request, or write this event.

Consumption is one-shot and non-transferable. Replay is read-only. Packet,
association, action-set, actor, event, expiry, or callback-count drift fails
closed.

## Welcome decision and message authority

Bootstrap approval does not authorize customer-visible communication. Make a
welcome decision independently: not needed, draft retained, or exact draft
prepared.

Slack and Gmail require distinct Slack/Gmail exact-message approval. Each event
binds provider, sender, target/recipient, exact rendered bytes, presentation
hash, packet hash/revision, effect identity, approval revision, actor, event,
expiry, and configuration identity.

For Slack, the only allowed command surface after separate approval is:

```text
/Users/christianreyes/.local/bin/slack-pp-cli --agent --json --data-source live
```

For Gmail, show the recipient(s), subject, and full body in chat before send and
wait for explicit approval. Gmail send approval is separate from bootstrap approval and separate from Slack approval.

Edit, regeneration, packet drift, provider/sender/target/configuration drift,
cancellation, or expiry revokes the corresponding message capability. A send
or cancel owns one locked effect. An uncertain provider result is reconciled by
stable effect identity and authoritative readback before another mutation.

## Independent closure

The approval receipt is an input to proof, not proof itself. A read-only verifier
must independently match association, packet, approval, action set, zero
pre-approval callbacks, stable effects, private binding/fact/profile state,
welcome state, and zero forbidden effects. Regression runs only after independent proof and closure stops at `launch_call_handoff`.