approve / deny
Review and act on pending approval requests.
treeship pending
List all pending approval requests.
treeship pendingOutput:
Pending approvals (2)
1. kubectl apply -f deploy.yaml
label: deploy to prod | requested 2m ago
hint: treeship approve 1
2. stripe charge --amount 500
label: charge customer acme | requested 5m ago
hint: treeship approve 2Use the numbered index to approve or deny a specific request.
treeship approve
Approve a pending request by number.
treeship approve 1This creates an approval artifact, generates a binding nonce, and passes it back to the requesting agent. The agent then includes the nonce in its action attestation to prove it had authorization.
treeship deny
Deny a pending request by number.
treeship deny 2This creates a denial artifact. The requesting agent receives the denial and should not proceed with the action.
Replay posture (v0.24)
Replay is enforced per device or workspace, not globally. The local Approval Use Journal is shipped and stable: treeship attest action reserves a use before it signs, so a reused nonce is refused at attest time on this device or workspace (could not reserve approval use in journal: … would exceed max_uses). Inspect it with treeship approval uses / status / journal verify. Distributed replay across machines needs a Hub that signs journal checkpoints; the consumer-side verifier for that exists, the Hub-side signer does not.
Until a Hub signs and you embed a checkpoint covering every use_id, a "global
single-use" claim would be overclaiming, and verify reports the narrower posture
rather than asserting one it cannot check.