Approval needs a defined action and scope. A continuing publication connection must be understood before it is enabled.
Two modes per department
Casa departments use auto or approve_first. The former permits ordinary eligible work within scope; the latter asks before proceeding. There is no low, medium and high autonomy ladder.
Action-level gates are separate. Spending money, going public, merging to main and destructive actions require founder approval regardless of the department dial. Playbook human gates and hard-to-reverse actions can also stop execution.
Department autonomy answers how ordinary eligible work can proceed. An action gate answers whether a specific consequence needs approval. Keeping the two questions separate prevents a permissive department setting from being interpreted as permission to spend, publish, merge or delete. A session can make substantial local progress and still stop at the consequential action.
Review the material before going public
Phase 0’s publication play presents the face, collateral and destination for approval after readiness review. Its publication record should contain confirmed URLs and the approved scope. Failures and missing integration remain open work.
A face validation pass, full coverage indicator or signed CAF envelope does not replace this review. The founder should understand the claims and files being sent.
Good approval is attached to material a person can actually inspect. Show the artifact or proposed change, describe the destination and state what the approval covers. “Publish the company” is too vague if the reviewer cannot see which claims, files and public links are involved. The review packet should make the consequences of that decision concrete.
The same principle applies after an attempted action. Record what succeeded, which public URLs were confirmed and what still needs attention. A plan to publish is not a successful publication, and a partial failure should not disappear behind a completed status.
A bound brain has a continuing update path
The public Casa repository includes a guarded SessionEnd hook. With a connection receipt present, autopush can render and sign new work, send it to the service and then publish an existing face. An unbound brain is a no-op; no new attestation work causes an earlier exit.
This behavior means initial binding establishes a public connection. Do not rely on a promise that every later refresh prompts again. Inspect the installed integration and hooks when deciding what scope to connect.
This is why the first connection deserves more attention than a one-off upload. Review both the material being disclosed now and the installed behavior that can send later work. The meaningful boundary is the scope the founder has connected, together with the action gates that still apply. A blanket promise of a fresh prompt for every refresh would misdescribe the current integration.