Keep approval boundaries explicit.
Departments have two autonomy modes. Consequential actions have their own hard gates.
Reviewed September 16, 2026 · Casa v0.3.0 · Current Launchpad mainnet presets. Release notes
- AUTO
Routine eligible work
The department can proceed within its configured scope and playbook rules.
- APPROVE_FIRST
Review before action
Ask for approval before the department proceeds.
- HARD GATES
Consequential actions
spend_money, go_public, merge_to_main and destructive actions require founder approval regardless of the dial.
Connected publication has a continuing update path. Review the binding and autopush behavior when approving initial publication.
Department modes
| Mode | Ordinary eligible action |
|---|---|
| auto | Dispatch within the configured scope. |
| approve_first | Present the proposal and ask before proceeding. |
Actions that require approval
- spend_money: an action that spends money.
- go_public: a publication or public action.
- merge_to_main: merging into the main branch.
- destructive: destructive changes.
- Playbooks with human_gate or hard reversibility also require approval.
Gates are action-level decisions. A department set to auto does not bypass them. Record the proposed action, approval scope and outcome in the company history.
node scripts/gates.mjs decide '{"department":"Growth","publishes":true}'Publication and existing connections
The public repository includes the optional capx/ integration and a guarded SessionEnd hook. Binding is treated as initial go-public consent. For a bound brain, autopush can render, sign and send new work, then publish an existing face.json. An unbound brain is a no-op. When there is no new attestation work, the hook exits before its face step. Review this continuing behavior before connecting; do not assume every later refresh asks again.
The Phase 0 publication play asks for approval of the reviewed face, collateral and destinations. The integration also has a continuing bound-update path. These are separate behaviors: inspect the installed hooks and treat initial binding as a public connection, rather than relying on a promise of a new prompt for every update.