close-approval-workflow

Skill: close-approval-workflow

Purpose: Make the close's controls enforced by construction, not documented. Every deliverable is submitted into a state machine that refuses illegal transitions and refuses a same-actor approval above the entity's SoD threshold, writing every event to an append-only, hash-chained audit log.

Engine: ../../scripts/close_state.py (stdlib only).

Why it exists

The failure mode behind the public "AP agent released ~$92K past a documented control" incident (2025) is a control that was written down but not enforced. Here the enforcement is code: the state machine is the only path a package can advance, and the SoD check is a hard refusal, not a policy note.

State model

draft → submitted → in_review → approved → locked
                  ↘ (reject) → draft        ↘ (authorized reopen) → draft

• submit records the preparer + package amount.
• approve refuses when actor == preparer and amount ≥ sod_threshold (logged denial).
• lock needs a non-agent approval token; without it the package is badged self-certified, single-actor (a stderr warning + a state.json flag).
• verify recomputes the hash chain end-to-end; any retroactive edit breaks it (exit non-zero).

Invocation

D=.ravenclaude/runs/close/<entity>/<period>
python3 scripts/close_state.py --run-dir $D submit  --actor autopilot --amount 1852500
python3 scripts/close_state.py --run-dir $D review  --actor controller
python3 scripts/close_state.py --run-dir $D approve --actor controller --threshold 100000
python3 scripts/close_state.py --run-dir $D lock    --actor controller --approval-token <out-of-band>
python3 scripts/close_state.py --run-dir $D verify

HONEST TIER CAVEAT (do not overclaim)

Identity here is config-asserted, not authenticated — --actor NAME is a caller-supplied string with no identity-provider binding. The hash chain is therefore tamper-evident (a third party detects an edit), not tamper-preventing against the operator who holds the file. At this local tier the SoD check stops the same declared actor self-approving above threshold and stops the accidental single-process auto-approve — it does not, by itself, make the close auditor-grade, and it does not "design out" the Ramp incident. Real auditor-reliable segregation needs an identity provider + an immutable store, which lands at the warehouse/ELT tier. LOCK's non-agent approval-token requirement is the bridge: absent it, the package is explicitly self-certified. State this caveat wherever the workflow's controls are described.

Orchestrator boundary

The close orchestrator (run-controller-cycle) calls submit only — reaching approved/locked always requires a separate, later, human-invoked call. This is regression-tested (test_controller_autopilot.py) so an unattended run can never collapse the review gate.