Approval Policy & Quorum

High-authority actions require multiple qualified approvers; policy defines who counts, how many, and what happens on timeout.

Not all approvals are equal

A routine, low-authority action may need one qualified approver; a first-of-its-kind breeder operating point or a change to the burner plug-field target may require a quorum of independent, qualified people. Approval policy formalizes the authority levels, the required quorum at each level, and the qualification each approver must hold. It is version-controlled safety policy, like the rules engine.

Authority levels and quorum

Independence and qualification

• Approvers at L2+ must be independent (no single person can satisfy the quorum alone).
• Each approver must hold the qualification for the action's domain (magnet, plasma, vacuum, DEC).
• The proposing copilot and the twin author are never counted as approvers.

Timeout defaults are safe

def resolve(req):
    if approvals(req) >= quorum(req.level) and all_independent(req):
        return APPROVE
    if now() > req.deadline:
        return SAFE_DEFAULT[req.action_class]   # energize->REJECT, abort->PROCEED
    return PENDING

Auditable and replayable

Every approval request records who was asked, who decided, the context shown (via routing), and the outcome, chained on the lineage bus. Policy changes follow the same two-person, audited process as rule changes. Because the breeder and burner are design-and-simulation studies, quorum policy is exercised in drills against the twin so the human process is practiced before FOAK.

Escalation and de-escalation

Authority level is a property of the action, not of the operator, so it cannot be lowered by choosing a more senior approver. What can change it is context: a setpoint that is L1 inside a proven breeder operating point becomes L2 when the campaign steps to an unproven point, and a burner plug-field change escalates to L3 whenever it would move the established 26.49 T target. The policy computes the level from the action and current machine state; approvers cannot self-elevate to satisfy their own quorum. Repeated low-authority approvals never aggregate into permission for a high-authority action, which closes a common privilege-creep path on shared consoles.