The RFC seated the exit approval on the approval seam because that was
the only asking machinery in flight when it was written. ask_user_question
has since merged (PR #108): the exit moment is a question, not a
permission — the user-interaction seam gives the review options plus a
free-text channel, so a keep-planning answer carries the user's feedback
to the model verbatim, and an approval can later grow options. The gate
no longer returns ask (that vocabulary stays free for genuine permission
gating); the tool conducts the review inside its own execution and
degrades to manual mode-toggling without a provider. The approval-seam
shape moves to Alternatives considered with the reasoning.
Consequences: the roadmap's hard prerequisite on the sandbox branch
disappears (this stack bases on master), the recorded scenarios script
elicitation answers instead of permission answers, and the ACP v2
session-mode-removal direction is recorded as an accepted migration
risk.
'validates against config' plus "'default' rejected as a key" read
together let an implementer reject set(agent, 'default'), which would
contradict the picker's default entry and block the user-driven exit
the no-answerer degrade relies on. Validation is against list()'s
vocabulary: config keys plus the reserved default.
Reorganize along Problem / Proposal / High-level API / Detailed design /
Roadmap / FAQ / Prior art / Alternatives / Acceptance / Risks. The
product survey and Pi failure shapes move to Prior art; user-facing
behavior (walkthrough, cordis.yml config, stdio, ACP, ctx.modes) gets
its own High-level API section; FAQ collects behavioral clarifications
of the chosen design, disjoint from Alternatives (rejected designs) and
Risks (accepted costs). The zh counterpart and its pairing metadata are
removed; the RFC is English-only (not in the required-pairs manifest).
A folded mode name the current config no longer defines behaves as default
plus one boundary notice naming the dropped definition — set()'s loud
validation covers only the write path.
