---
name: CTO Hermes Consumed Approval Evidence PRD
status: validated
lifecycle_classification: sot
owner: jp
created: 2026-06-01
last_reviewed: 2026-06-01
core_promotion_status: not-promoted
---

# CTO Hermes Consumed Approval Evidence PRD

Local planning SOT only. Not a Core Protocol. Not active Core authority.

## Problem Statement

Hermes already exposes approval state and approval packet data, and the approved Stage 5 Case run already has pass evidence. The WebUI needs to show that this approval is consumed, not still available for rerun.

## Solution

Record the Hermes plugin closeout for consumed approval evidence. The `/api/cto/control-summary` route now exposes `governed_execution`, `approval_consumed`, and `consumed_by_pass_evidence`. The CTO panel shows consumed pass and consumed proof paths.

## Scope

- Record Hermes plugin commit `6f694b4 feat(plugin): surface consumed CTO approval evidence`.
- Record the governed execution consumed approval state.
- Record that execution_allowed remains false after consumption.
- Record Stage 5 pass and Stage 5 proof replay paths.
- Record that Case runtime default active remains false.
- Record that target repository mutation remains false.
- Record that upstream `hermes-webui` edited: false.
- Record that upstream `hermes-agent` edited: false.

## Non-goals

- Do not rerun Case.
- Do not create a new JP approval.
- Do not activate Case as default backend.
- Do not mutate target repositories.
- Do not edit upstream `hermes-webui`.
- Do not edit upstream `hermes-agent`.

## Acceptance Criteria

- `WORKBOARD.yaml` records `CTO-WORK-072` and `CTO-WORK-073` as validated.
- The PRD records `governed_execution`.
- The PRD records `approval_consumed`.
- The PRD records `consumed_by_pass_evidence`.
- The closeout references plugin commit `6f694b4 feat(plugin): surface consumed CTO approval evidence`.
- The closeout records `/api/cto/control-summary`.
- The closeout records `cto_control_panel.js`.
- The closeout records `routes/cto_control_summary.py`.
- The closeout records `python3 -m pytest tests/ -q` and `108 passed`.
- The closeout records `python3 scripts/ast-connection-map.py --check` and `CONNECTION-MAP.md is fresh`.

## Validation

- `python3 tools/validate_cto_child.py`
- `python3 /home/svrnty/workspaces/cortex-os/core/tools/check_s69_caveman_prose_discipline.py`

## Required Evidence

- Hermes consumed approval evidence
- CTO-WORK-072
- CTO-WORK-073
- 6f694b4 feat(plugin): surface consumed CTO approval evidence
- /api/cto/control-summary
- governed_execution
- approval_consumed
- consumed_by_pass_evidence
- execution_allowed: false
- approval_granted: true
- approval_required: true
- Stage 5 pass replay path
- Stage 5 proof replay path
- cto_control_panel.js
- routes/cto_control_summary.py
- python3 -m pytest tests/ -q
- 108 passed
- python3 scripts/ast-connection-map.py --check
- CONNECTION-MAP.md is fresh
- Case runtime default active: false
- target repository mutation: false
- upstream `hermes-webui` edited: false
- upstream `hermes-agent` edited: false
- Do not activate Case as default backend.
- This closeout does not authorize another Case run.