ResolvedApprovals

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1227

The fully-defaulted approvals posture for one command. allow/deny/escalate are the declared lists straight from config — read-only input that the runner merges with the runtime stores the escalation menu writes, and that is never written back to config (§9.1).

Properties

alignmentChecker?

optional alignmentChecker?: string

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1244

[[EXT-127]] — identity profile the alignment checker runs under, or undefined for the session model.

This one IS defaulted here, unlike every other field on this object, and the exception is deliberate. Its default is not a constant but another resolved field — the rater above — so leaving it undefined would push “which profile does the checker use?” out to every reader, and a second reader that forgot the fallback would silently rate on the session model while the user believed they had configured a checker. Nothing about the effective-config snapshot changes, because the default is applied to this resolved view and never written back into the approvals object the /config panel renders.

allow

allow: ApprovalEntry[]

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1246

Declared allow-list entries (§3.1). Empty when none are declared.

deny

deny: ApprovalEntry[]

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1248

Declared deny-list entries (§3.1). Empty when none are declared.

escalate

escalate: ApprovalEntry[]

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1250

Declared escalate-list entries (§3.1). Empty when none are declared.

mcp?

optional mcp?: McpApprovalsConfig

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1263

EXT-70 §4.7 — the declared per-server MCP relationship, or undefined when no scope states one (which reads the same as an empty block: nothing external is believed). Left undefined rather than defaulted here for the same reason rater is — so the effective-config snapshot does not churn.

rater?

optional rater?: string

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1231

Identity profile the rater runs under, or undefined for the session model.

raterTimeoutMs?

optional raterTimeoutMs?: number

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1256

EXT-66 — wall-clock budget (ms) for one rating call, or undefined to let the rater apply RATER_DEFAULT_TIMEOUT_MS. Left undefined rather than defaulted here so the effective-config snapshot does not churn, exactly as rater is.

rung

rung: "manual" | "write" | "assisted" | "auto" | "bypass"

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/config/shell-policy.ts:1229

The rung in force.