Lock screen: a push arrives. Straza. Approval needed. A request is waiting for
your decision. Open Straza to review it.
[PushNotification.kt:20-21; push payload is only {v,ref,kind} - APP-CONTRACT, Principles]
Open: STRAZA / MOBILE APPROVER splash [App.kt:109-110], then the app fetches
before showing actions. Loading. Fetching what needs your decision...
[App.kt:1034; fetch-before-render - APP-CONTRACT, Error contract]
To decide (1): midpoint:disable_user, 2m 0s left, nova - disable-user-needs-human.
[pending row: SummaryLabel.kt:27, Expiry.kt:64-79, App.kt:1084-1110;
values from the APP-CONTRACT.md:260-265 example row]
Decision screen: PENDING APPROVAL. Approve this action?
2m 0s left "left to decide - denied automatically at zero" [App.kt:1381-1383]
DEPLOYMENT straza-8c2f / TOOL midpoint:disable_user / REQUESTED BY nova /
RULE disable-user-needs-human [App.kt:1388-1400]
Args preview (server-redacted, verbatim, no chip): [App.kt:1509-1546]
{ "user": "c-8842", "idempotency_key": "[REDACTED]" } [APP-CONTRACT args-preview]
The requester's stated reason [UNVERIFIED]: [App.kt:1499-1505]
"Offboarding contractor c-8842 per ticket OPS-5521; access end-dated today." [illustrative]
preview only; approval binds tool identity (sha256:9b1c44e0a7f2...) [ArgsPreviewText.kt:30]
[ Deny ] [ Approve ] You'll confirm with your fingerprint. [App.kt:1431-1447]
Approve: the OS biometric sheet names the action and the tool.
Approve this request? / midpoint:disable_user / Cancel
[ApprovalController.kt:788-792; BiometricGate.kt:130; CryptoObject-gated signing]
Signed: ECDSA-P256 by the hardware-bound device key (StrongBox/TEE); the key
never leaves the phone. [APP-CONTRACT, decide + Enrollment]
Recorded: approved. Nothing waiting. You're all caught up.
[ApprovalController.kt:807; App.kt:1069]