Skill · Approval gate

The skill every MEDIUM and HEAVY command loads to render its gate. It handles tier lookup, gate rendering, budget overlays, ledger writes, and the --yesbypass — so commands don't reinvent approval UX.

When it activates

Every time a command with tier: MEDIUM or tier: HEAVY in its frontmatter dispatches an agent. The skill reads the tier, constructs the frame, and asks the user.

What it teaches

Gate shape per tier — LIGHT: none. MEDIUM: one line + y/n/tweak. HEAVY: full block (agents, skills, ~tokens, MoSCoW, alternatives).
MoSCoW scoping for HEAVY — always emit MUST/SHOULD/COULD/WON'T, with WON'T explicit so users see what's left out.
Budget overlay — if .hub/budget.json exists, the gate adds a line comparing the estimate to the budget.
Ledger write — every gate, approved or declined, appends to .hub/usage.json. Declined runs log zero spend but are still visible in /hub:ledger.
Bypass handling — --yes or -y as the first argument skips the prompt. Everything else still logs.

The HEAVY frame

HEAVY — /hub:<command> "<summary>"

Planned agents:
  - hub:<agent-1>    (<role>)
  - hub:<agent-2>    (<role>)
  ...

Skills loaded:
  <skill-1>, <skill-2>, ...

Token estimate:  ~<P50>  (P50: ~<P50>, P95: ~<P95>)
Session budget:  <OK | WARN | OVER>  (<used> / <cap>)   [only if .hub/budget.json set]

MoSCoW scope:
  MUST   — ...
  SHOULD — ...
  COULD  — ...
  WON'T  — ...

Lighter alternatives:
  A) /hub:<other>  — <why>
  B) /hub:plan only — ship a plan first, build later

Proceed? [y/n/tweak]

Every HEAVY gate matches this template. If a command's frontmatter or dispatch information doesn't supply a section, the skill refuses to dispatch — better to ask than to silently skip.

Tweak mode

Replying tweak at the prompt lets you adjust scope without retyping the whole command. Common tweaks:

drop backend-specialist — remove an agent from the chain.
reduce scope: keep MUST only — cut SHOULD/COULD to shrink the estimate.
tighter: no email, no billing — free-form constraints.

Ledger mechanics

.hub/usage.json is append-only, project-local, and gitignored. Each entry stores: timestamp, command, tier, planned agents/skills, estimate, actual tokens, disposition (approved / declined / bypassed), and optional ROI tag. /hub:ledger is the read-only view.

Pro tips

Don't blanket-bypass. --yes is for cases you've run before. New or HEAVY commands deserve a look at the frame.
Set a budget early. /hub:budget low overlays a useful reminder without changing behaviour.
Tag after runs. /hub:ledger tag last useful|partial|wasted feeds the ROI view.