Require approved artifact digests for apply

docs/architecture.md

@@ -112,10 +112,11 @@ render-only environment while making daemon ownership decisions explicit.
 `ampg apply --dry-run` turns daemon status and generated config artifacts into an ordered
 activation sequence. Each enabled protocol gets output, artifact, daemon, and health
 steps, plus an address step when AMPG must capture or confirm a generated transport
-identity. With `--write-artifacts`, it also prints planned copies from reviewed artifacts
-into managed state and planned supervisor start/reload actions. The command emits an
+identity. With `--write-artifacts`, it also prints copies from approved artifacts into
+managed state and planned supervisor start/reload actions. The command emits an
 `AMPG_APPLY_PREFLIGHT` verdict across activation, state-copy, and supervisor rows.
-Blocked preflight items stop the command before any live apply path can touch services.
+Blocked or unapproved preflight items stop mutation before any live apply path can touch
+services.
 
 The dry-run command is intentionally stricter than `doctor`: missing generated output is
 blocked during activation, because AMPG must not point a transport at an unbuilt output
@@ -130,7 +131,9 @@ future live apply support.
 
 With `--write-artifacts`, install-plan writes managed config and supervisor files under
 the configured `plan_root`; those files are review artifacts, not installed service
-state. Generated managed-daemon configs point runtime state at `gateway.state_dir`.
+state. `ampg approvals approve` records reviewed artifact digests under
+`gateway.state_dir`. Generated managed-daemon configs point runtime state at
+`gateway.state_dir`.
 
 Tor and I2P HTTP publishing include the transport daemon and the loopback web-serving
 layer in the install plan, because the hidden service or tunnel must have a local HTTP

docs/daemon-management.md

@@ -49,6 +49,8 @@ python3 -m ampg --config gateway.toml apply --dry-run
 python3 -m ampg --config gateway.toml apply --dry-run --profile mobile-i2p
 python3 -m ampg --config gateway.toml apply --dry-run --protocol i2p
 python3 -m ampg --config gateway.toml apply --dry-run --write-artifacts
+python3 -m ampg --config gateway.toml approvals list --profile mobile-i2p
+python3 -m ampg --config gateway.toml approvals approve --profile mobile-i2p --all
 python3 -m ampg --config gateway.toml doctor --platform android-termux
 ```
 
@@ -82,14 +84,19 @@ address registry under `state_dir`.
 target real transport URLs; preview checks target local loopback preview endpoints.
 Missing output blocks the plan, while placeholder transport addresses are review items.
 
+`approvals list` prints generated artifact candidates and their digest status. `approve`
+requires `--all` or a `--kind` filter, then records approvals only for artifacts that
+exist and match the current generator output. Missing, edited, or stale artifacts remain
+review items.
+
 `apply --dry-run` prints the activation sequence for each enabled protocol: generated
 output readiness, config artifacts to review, daemon action, address capture or reuse,
 and post-apply health checks. It also prints `AMPG_APPLY_PREFLIGHT` plus blocked or
 review preflight items across activation, managed-state copies, and supervisor actions.
 It exits nonzero when the preflight status is blocked. `--write-artifacts` writes
-reviewable config snippets to the configured plan root, then prints the planned copies
-from those reviewed artifacts into `gateway.state_dir` and the supervisor services that
-would be registered or started. It still does not install or reload services.
+reviewable config snippets to the configured plan root, then prints the copies from
+approved artifacts into `gateway.state_dir` and the supervisor services that would be
+registered or started. It still does not install or reload services.
 
 `--protocol` scopes operational commands to selected enabled protocols. A clearnet
 `adopt` failure will block a full activation run, but it will not block

docs/state-contract.md

@@ -4,7 +4,8 @@
 
 AMPG keeps managed daemon state under `gateway.state_dir`. The state contract describes
 which files AMPG owns, which files daemons or adapters write, which paths may contain
-private keys, and which public address files `addresses capture` reads.
+private keys, which artifact approvals AMPG records, and which public address files
+`addresses capture` reads.
 
 ## Command
 
@@ -22,6 +23,9 @@ Each `AMPG_STATE` row includes:
 - `sensitive`: whether the path may contain private identity material.
 - `path`: resolved path under `gateway.state_dir` unless an adapter documents otherwise.
 
+AMPG also stores `approvals.json` under `gateway.state_dir`. It records reviewed
+generated-artifact digests and contains no private daemon identity keys.
+
 ## Address Capture
 
 `addresses capture` uses the same contract. For each enabled protocol it checks explicit
@@ -39,8 +43,8 @@ Current managed defaults:
 
 AMPG must never delete sensitive contract paths without an explicit destructive command.
 `apply --dry-run --write-artifacts` prints `AMPG_APPLY_STATE_COPY` rows that show which
-reviewed artifacts would be copied into managed state and `AMPG_APPLY_SUPERVISOR` rows
+approved artifacts would be copied into managed state and `AMPG_APPLY_SUPERVISOR` rows
 for the services that would be registered or started. The accompanying
 `AMPG_APPLY_PREFLIGHT` verdict includes those rows so live apply can refuse mutation when
-state or supervisor inputs still need review. Live apply should perform reviewed copies,
+state or supervisor inputs still need review. Live apply should perform approved copies,
 start daemons, capture public addresses, and then run published health checks.