- Shipped
- October 21, 2026 at 4:39 AM UTC
- Author
- Kamo
- Commit
- 41525f9
CharterPolicy reads resolved.toolApprovals and each rule's standing flag. A member's rule about one tool stands for its class's rule for that tool; a standing permission (granted from an approval) holds under a SUPERVISED ceiling but never for a SHADOW SI or a charter that could not be read, and a FORBIDDEN class still wins. The pipeline and the first-contact check judge by tool, so an always-allowed send still asks before a first contact. The approval card gains alwaysAllow: offered unless the tool is person-only, moves money, touches security or devices, or its kind of action is never allowed for good, with the reason in plain words, the tool's title, the kind in plain words and the rights the tool needs.