Version: v5.7.0

opschain approvals show

packs:change-governance

opschain approvals show <run-id>

Reads one subject's checklist (ChangeGovernanceService.GetApprovalChecklist) and prints the subject, its lines and — for a change, workflow run or trust raise — the approval context: WHY the subject was raised, so an approver decides on evidence rather than on a requester's name.

change 0192…c0de — patch_preflight on /projects/limebank/environments/prod/assets/core_banking
status: pending · requested by svc-agent-limebank-felix at 2026-11-06T01:00:05Z
quorum deadline: 2026-11-13T01:00:05Z

requested by: felix (agent, SUPERVISED, owner release_managers) · agent 0192…a1 · trust review /api/agents/0192…a1/trust_review
rationale:
  Incident INC-2041: patch level drift on core_banking.
  Observed 3 pending CVEs under the tiered read; patch_preflight is the standing remediation.
recommendation: 0192…rec — Apply the quarterly patch (open, 2026-11-06T00:59:00Z)
transcript: /api/projects/limebank/agents/felix/adapter_transcripts/exch-42
images:
  consumed web_image — harbor.limebank.internal/web/web:dev-42 (sha256:9f3c…) · provider buildkit-shared · registry harbor-web · commit c0ffee1 · run 0192…b1ld
    input image = artifact://projects/limebank/environments/dev/assets/web/web_image@sha256:9f3c…
chain: 0192…chain (opschain chains show 0192…chain)
  2026-11-06T01:00:00Z  event info:agent:invoked
  2026-11-06T01:00:01Z  event info:agent:request
  2026-11-06T01:00:02Z  event info:recommendation:filed
  2026-11-06T01:00:03Z  event info:agent:adapter_transcript
  2026-11-06T01:00:05Z  change patch_preflight

lines:
  Production change control — 0/2 · waiting on you
    waiting on sarah, priya

requested by names the requester as the inbox shows it: an agent's code with its trust tier at creation and its owner, or a user.
rationale is the requester's stated reason verbatim (the create request's rationale attribute; mandatory for an agent principal).
recommendation appears when the subject implements one.
transcript is the redacted adapter transcript the agent's reasoning left on the chain, when one was sealed and its agent path is readable.
images lists the kind: image artifacts the subject produced or consumes (opschain docs image-builds): the role, the artifact code, the identifier and digest, the build provider and registry it was dispatched with, the sealed commit it was built from and the producing run; a consumed image also names the input that references it. A dash marks a fact the record lacks — what the core.image_provenance rule refuses on.
chain lists the correlation chain's most recent hops in order — the incident or operator request that invoked the agent, each governed read, the recommendation, this subject. Hops outside your read grant render as (redacted); … earlier hops omitted marks a longer chain, which opschain chains show renders in full.
lines prints each line's progress (live/quorum, ✓ once satisfied, · waiting on you while you may still approve it), then the line's live approval rows — approved by <user> at <instant>: <comment>, every line's own on a multi-line checklist — and the identities it still waits on:
```
lines:
  Patch assurance control — 1/1 ✓
    approved by asset-owner at 2026-11-06T02:00:00Z: assured
  External CAB review — 1/1 ✓
    approved by cab-external at 2026-11-06T02:05:00Z: CAB-7
```

The context is served to the checklist's approvers (any line, group membership resolved), its requester, and holders of the agent-governance reviewer determination; other readers see the checklist alone. A trust raise's context names the agent whose trust is being raised (the granter as requester, the grant's note as rationale, no chain); a transport or release subject carries no context block.

-o json / -o yaml emit the typed checklist, context included.

Exit codes

Code	Meaning
0	Checklist printed.
1	The read failed — the error names the server's Connect code and message (`not_found` when no checklist holds the run, or its target is outside your read grant).
2	Usage error, including a missing server target.

Exit codes​

Exit codes