Review UX v0 (local-only)

Review UX v0 is a minimal, local-only “approval surface viewer”:

(decision.json, bundle) -> review_pack/

It is intentionally small: one deterministic page that answers “what exactly am I approving?” and how to produce a signed approval receipt without running any execution.

Render a review pack

From a Decision JSON + bundle directory (or .zip/.hxs bundle):

helix hub review render \
  --decision path/to/decision.json \
  --bundle path/to/bundle_or_zip \
  --out review_dir

Optional baseline diff:

helix hub review render \
  --decision path/to/decision.json \
  --baseline-decision path/to/baseline_decision.json \
  --bundle path/to/bundle_or_zip \
  --out review_dir

Output layout:

review_dir/
  index.html
  assets/style.css
  bundle/...
  decision.json
  baseline_decision.json   (only if provided)
  verifier.txt

Approve (emit a signed receipt + updated bundle)

Approval is local-only and writes:

• A new signed helix.receipt.approval.v1 JSON under receipts/
• An updated bundle_manifest_v1.json that includes the new receipt digest
• A new approved bundle directory under var/hub/bundles/<bundle_digest_hex>/
• An updated Decision record under var/hub/decisions/by_id/<decision_id>.json

Command:

helix hub review approve DECISION_ID \
  --bundle path/to/proposed_bundle_dir \
  --expected-bundle-digest sha256:... \
  --expected-bundle-core-digest sha256:... \
  --expected-approval-surface-digest sha256:... \
  --signing-key path/to/ed25519_private_key \
  --key-id hub-test \
  --approver-subject sub_example_reviewer \
  --approver-email reviewer@example.com \
  --approver-display-name "Example Reviewer" \
  --attestation "Reviewed and approved."

Notes:

• Approval is idempotent: running approve twice on the same already-approved decision is a no-op (prints no_op=true).
• Approval fails closed: the resulting approved bundle must be verifier-clean with --require-signatures.

Verify (offline)

The review page includes the verifier command it expects you to run:

cd review_dir
helix hub verify bundle ./bundle --require-signatures

Do not trust the page; trust the verifier output.