A merge approval can require a security key touch

Press Release

In human mode, the technical facilitator's approval of a merge can require a touch of a hardware security key, so that an approval shows a person was present when it was given. Today an approval is a rule agents keep: anything running as the person's account can record one. With this, the key signs the approved head commit when touched, and the merge gate counts a recorded approval only when it carries a signature that key made. It is later work, after agents can work under a forge account of their own.

Why This Matters

Why this matters to the user — replace before planning.

Mechanism

Prompted (the claim-recording gradient): why the authors expect this to work, as a falsifiable "we expect X because Y" — not the outcome restated. Replace this line with the claim, or with the exact token None stated. alone on its line to record the claim as considered and declined.

Scope Conditions

Required (the claim-recording gradient): the population, platform, scale, or assumptions this claim holds under, one per top-level bullet — abcd intent plan stamps each with a persistent identity. Replace this line with those bullets, or with the exact token None stated. alone on its line.

Acceptance Criteria

Required (the itd-1 discipline): add at least one Given-When-Then bullet describing the verifiable bar for "shipped" before this draft can be planned.

Open Questions

None recorded yet.

Audit Notes

Empty. Populated by intent-auditor when intent moves to shipped/.