orchestrator-present-approval

Present Approval — Orchestrator Branch

Present trusted contract data exactly. Do not execute, derive, shorten, reorder, or silently expand it.

The surface is rendered, never composed

WHAT the user sees is produced Gaia-side from the sealed payload by one function -- hooks/adapters/consent_presentation.py::render_native_text, over that module's VISIBLE_FIELDS table -- and it comes out identical on every host. Its exact shape, field set, render order and absence semantics are stated in template.md. Show that text verbatim. Compose nothing, summarise nothing, reorder nothing, translate no label.

For an existing pending id, read both presentation pieces with gaia approvals show <approval_id> --consent-surface. The JSON visible_text field is that rendered surface byte-for-byte; print it unchanged. Use the JSON approve_label field unchanged for the approval control -- Gaia sources it from render_approve_label, so the presenter must not rebuild it. This read records no SHOWN event and makes no decision or grant.

Present the surface as text, then ask a minimal decision

A presentation is two pieces. Print the rendered surface verbatim as console text -- the MESSAGE. Then ask a binary decision -- the QUESTION -- carrying one line of operation, the command count, and the approval id, and nothing else. template.md states both shapes literally, together with the four rules that make the split safe: the id on both ends, adjacency with a reprint duty, the minimum the question carries, and a binary control set with no always.

That order is deliberate and the reason is narrow. When the surface travels inside a host's decision payload, whether the host's renderer displays every line of it is unverifiable from outside that host: nothing you can read back confirms the user saw the ROLLBACK line, or the eighth command's fingerprint, or anything past a truncation the renderer applied silently. Consent over a truncated surface is exactly the failure this whole protocol exists to prevent, and that exposure stands recorded as unmitigated -- closable only by real end-to-end work against each host, never by a claim made here. Printed as console text, completeness stops depending on a renderer nobody can inspect and starts depending on the user's own terminal.