raxit approvals

raxit approvals lists, approves, and denies the pending human-in-the-loop defers created when a call matches a review (or step_up) rule.

Usage

$ raxit approvals list --addr localhost:8181
TOKEN                  AGENT            RESOURCE               STATUS
dt_1373bb3e0bcf139d    default-agent    post_to_webhook        pending
dt_28930b3bf7da664a    default-agent    post_to_webhook        pending

$ raxit approvals approve dt_28930b3bf7da664a --reason "looks right" --addr localhost:8181
dt_28930b3bf7da664a: approved (approver=operator)

$ raxit approvals deny dt_1373bb3e0bcf139d --reason "not now" --addr localhost:8181
dt_1373bb3e0bcf139d: denied (approver=operator)

$ raxit approvals list --addr localhost:8181
TOKEN                  AGENT            RESOURCE               STATUS

Approving a pending defer unblocks the agent process waiting on it (see raxit run); denying it resolves the wait immediately rather than letting it time out.

Flags

• list — show pending approvals for the attached daemon.
• approve <token> [--reason <text>] — approve a deferred call.
• deny <token> [--reason <text>] — deny a deferred call.
• --addr <host:port> — daemon to talk to (defaults to localhost:8181).
• --token <token> — explicit operator bearer token (see gotcha below for the default).

Gotchas

• approvals authenticates to the daemon by auto-reading a 0600-permission local token file at .raxit/var/approvals.token — no --token flag is needed in the common case; both raxit dev and raxit serve write this file. Pass --token (or set RAXIT_APPROVALS_TOKEN) only when running approvals from a different working directory or against a remote daemon.
• Denying an already-expired token still succeeds — it simply records the operator's explicit denial after the fact; it is not an error to deny something that timed out on its own.
• approve/deny reasons are free text but are written into the audit record — treat them as part of the evidence trail, not a throwaway comment.