KernelHub Approval
A card appears when the task needs a decision only you can make. There are two kinds, and they grant different things.
Permission card
Raised when the task needs a tier it does not have. It carries the diff so far and the exact wording of what it is asking for. The button says Approve permission and continue.
Approving applies to that task only, in that workspace, and expires when the task ends. The task returns to the queue and continues — it does not start over.
Boundary card
Raised when the task would touch the delete / migrate boundary and the chosen agent cannot express a deny list on its command line. The card names the agent and says, in those words, that it cannot hold that boundary on this run.
The button says Release just this once and continue — and that is exactly what it does. It grants no permission tier. All six tiers stay as they were and the deny list does not shrink.
One tap must not buy two different things. A card that says “approve permission” while actually recording “allowed to run unguarded” would be the most expensive kind of lie this product could tell, so the two cards are worded and recorded separately.
Declining
Declining ends the task and says why — that you did not release it, not that something broke. Nothing is deleted: if the task had already moved on when you said no, it is stopped before the deletion, not carried out anyway. On a permission card, declining also means this task will not ask you for that tier again. Re-sending the same sentence as a new task will stop at the same place, which is correct: nothing about the situation changed.
Where cards appear
On the phone and on the desktop, in the task's own timeline. Both screens show the same card and either can answer it.