Recording a decision from the console

The previous console's queue (/console, also at /console/next) still draws a decision form on each row whose gate the record currently owes you: a choice of decision, a box for the ground, and the buttons Preview this decision and Record this decision.

⛔ Neither button records anything. The projection server holds no signing material and does not sign on your behalf, on any tier. Every Preview, every Record, and the bulk form beside them, is refused with 409, class owner-key-absent, and a reason that begins console-does-not-sign: this console does not sign, on any tier. Nothing is read and nothing is written. The same refusal answers the previous console's pull-request merge button.

Where a gate decision is recorded instead

An owner-class decision is authorised by a person's passkey, verified by the server — never by a password, and never by a key the console holds. Two places do that:

• The current console. Open the gate and act through its passkey prompt. What the prompt shows you — decision, reason, gate, revision — is exactly what your passkey signs. A browser needs an enrolled passkey first: saphan console device enrol --web, run on the machine where saphan-server runs, prints a one-use enrolment for one browser. See saphan console device.
• A terminal, with a FIDO2 security key and an enrolled credential: saphan gate <stream> --gate <gate> --decision <decision> --cli. See saphan gate for the decisions each gate accepts, and rehearse with saphan dry-run gate …, which runs the same checks and writes nothing.

Verify it from outside the console, the first time at least:

saphan gates --stream <your-stream> --workspace <workspace root>

Your row should be listed with a valid signature.

If the previous console refuses before that

Two answers can arrive first, and they mean something different from the one above:

• A redirect to /console/login — the request carried no live session. Sign in again; see Signing in.
• 403, class console-act-forgery — "this request carried a valid session cookie and no valid act token": the form you posted did not come from a freshly loaded console page of your session. Reload the queue. If you did not send that request, some other page did, and this check is what stopped it.

See What the console does not protect against for how the act token works.