Justifications screen

The Justifications screen reads recorded file reasons, records the operator's test approvals and provides CUA consent management. Every control runs tama request, one process per operation, with the same validation as the CLI.

#File justifications

The registry view reads requirements declared by requires_justification hooks. Search matches the target and justification. Select a record to inspect its reason, target existence, word count and expiry. An unreadable registry is an error; missing evidence or expiry does not mean the service is down.

Record justification opens a sheet for the absolute target path and the justification. The backend validates and writes the entry; its refusal remains visible in the sheet. The target file's contents are not read by the registry view.

#Test approvals

Test approvals opens the operator's record of where test code may be written: the same record tama tests reads and writes, at ~/.config/agent-policy/approved_tests.json. It lists every approved path with the time it was approved. Enter an absolute file or directory path and choose Approve to run tama request tests/approve; an approved directory covers everything below it. Revoke asks for confirmation and runs tama request tests/revoke, after which test code under that path is refused again. The list shown after either action is the record as written. A refusal appears under Refused in the product's exact words.

The application runs outside any agent session, so an approval here is the operator's own; block-unapproved-tests refuses an agent that tries to run the same command or write the record.

#Review tracked test files

Inside Test approvals, enter a repository path in Review tracked test files and choose Review. The view owns tama request tests/review with {"root":"<repository>"}, the same foreground operation as tama tests review <repository>. Relative paths are resolved against the operator's home. Reviewing classifies tracked test content through Brama and retains verdicts; it neither approves nor executes tests.

The waiting indicator remains visible until the operation answers. Cancel or closing the view cancels its native request. The prior result is cleared before a new review. A backend failure appears under Review failed with its actual cause, rather than keeping an earlier success; a completed request displays the backend's result. An unreadable verdict store is a failure, not an empty review.

#CUA consent

CUA consent opens a separate grant sheet even when the catalogue has no file justification requirements. The form takes the OMP session ID, installed application name, comma-separated actions and either an exact quote or text matching one original user message. The default matching mode retrieves the full message without retyping its whitespace.

Record consent sends those fields as the body of tama request justifications/cua/record. Tama verifies the real message and installed application, then the sheet rereads the registry. A refusal appears under Refused using the product's exact message. A successful recording does not start the driver or claim that a GUI action ran.

#Inspect and remove consent

Recorded grants shows the original user quotation, application, allowed actions, session, lifetime, bundle identifier and executable. Refresh reruns tama request justifications/cua; a failed read is not represented as an empty success. CUA grants are not judged by file existence or a justification word count.

Remove opens a confirmation quoting the exact consent to retire. Confirming removes every grant with that exact quote through tama request justifications/cua/remove and rereads persisted state. It does not change any hook source or runtime capability.

#SSH consent

SSH consent opens the grant sheet for block-unauthorized-ssh. The form takes the OMP session ID, the SSH destinations the user's message names (one per line), the operation in the hook's words (read, write, exec, transfer, tunnel or git), exact ssh:// or sftp:// URLs for a read or write, exact full commands for every other operation, and either an exact quote or text matching one original user message. Record consent sends those fields as the body of tama request justifications/ssh/record; Tama verifies the message, that it names every destination, and that the hook's own matcher would admit each destination with each path or command, then the sheet rereads the registry. A refusal appears under Refused using the product's exact message. Recording grants nothing by itself: the hook reads the session capability {"tool": "ssh"} and the session's transcript on each use.

Recorded grants shows the destinations, operation, paths or commands, the original quotation, session and lifetime; Refresh reruns tama request justifications/ssh. Remove confirms and removes every grant with that exact quote through tama request justifications/ssh/remove, then rereads persisted state.

#What the result proves

A record proves that Tama accepted and stored the quoted consent. The installed hook still checks the current session, app and action for every CUA operation. Driver availability and macOS permissions are separate requirements; an operation that cannot run remains failed even when the grant is recorded.

See tama justify for exact input rules, refusals and registry behavior, and tama request for the request contract.