Kandev Approvals

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

.claude/agents

.claude/skills

.github/CLAUDE.md

CLAUDE.md

apps/backend/CLAUDE.md

import { test, expect } from "../../fixtures/test-base";

apps/web/generated/licenses.json

Audit 0.4.1 · source sha 786d4817799e · 18 Oct 2026Report an issue or request a re-scan

• Publisherkdlbs GitHub organizationOwner of the repository this skill is read from
• Source folderkdlbs/kandev/apps/backend/internal/office/configloader/skills/kandev-approvalsThe exact folder we audited
• LicenceAGPL-3.0As the repository states it
• Commit pinned for this verdict786d4817799eA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Clear the CEO approval queue when hire requests, budget grants, or other sensitive Office mutations are waiting for approve or reject decisions.

---
name: kandev-approvals
description: Clear the CEO approval queue when hire requests, budget grants, or other sensitive Office mutations are waiting for approve or reject decisions.
kandev:
  system: true
  version: "0.42.0"
  default_for_roles: [ceo]
---

# Approvals — clear the queue

Sensitive office mutations (hire requests, budget grants, certain task transitions) are gated behind approvals. The CEO is the default decider.

## List the queue

```bash
$KANDEV_CLI kandev approvals list --status pending
```

Returns rows with `id`, `type` (e.g. `hire_agent`), `requester_agent_id`, `reason`, and `created_at`.

## Approve or reject

```bash
$KANDEV_CLI kandev approvals decide --id AP-1 --decision approve --note "Backlog supports the hire."
$KANDEV_CLI kandev approvals decide --id AP-2 --decision reject  --note "Hire blocked by Q3 budget freeze."
```

The note is visible on the approval row and surfaced to the requester on their next heartbeat.

## Decision criteria

For `hire_agent`:
- Does the role match the workload? (`agents list` to verify org composition first)
- Is the monthly budget available? (`kandev-team-admin`)
- Is the reason concrete?

For `budget_grant`:
- Does workspace spend justify the lift?
- Is there a less expensive alternative (smaller model, fewer agents)?

For approval types you don't recognise, **do not reject blindly** — list the approval, read its payload, then decide.

## Cadence

Approvals don't auto-fire reminders. If the CEO leaves them sitting, the requesters block indefinitely. Run `approvals list` on every heartbeat and clear anything you can decide quickly.

Excerpt, first 1,620 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/kdlbs/kandev
git -C kandev checkout 786d4817799e

Works in

1. 2026-10-18
   !CAUTION B 89 / 100

   first audit · source 786d4817799e

Questions about Kandev Approvals

• github.com/kdlbs/kandev/tree/main/apps/backend/internal/office/c — the audited source at commit 786d4817799e and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology