Module consent 

Wait out a requireConsent gate from a CLI.

A consent-gated task is not refused, it is deferred: the VTA raises a question, pushes it to the approver set, and holds the answer. Until this existed, no CLI could answer it — pnm printed auth:consent_required and exited, so every gated task was simply unreachable from the command line however privileged the operator was. The browser extension implemented the loop; nothing in Rust did.

Re-submitting is the only way to ask

There is no read-only status surface for task-consent, so “has it been approved yet?” can only be asked by submitting the task again. That is safe while the request is pending and unsafe once it is resolved, and the difference is load-bearing:

• Pending: the gate recognises the same payload, returns the same challenge, and deliberately does not re-notify. The push follows the question, not the submit — so polling cannot ring the approver’s device.
• Denied or lapsed: the pending record is deleted. The next submit finds nothing, raises a new question, and pushes again.

So the loop stops the moment the challenge changes. Continuing would turn a “no” into a nag, which is the habituation attack the gate’s own design notes warn about — a consent prompt an attacker can summon on demand is worth more to them than one they must wait for. One re-prompt is unavoidable without a server-side status task; an unbounded stream of them is not.

What the operator has to do

Compare the code printed here against the code on the approving device, and approve only if they match. That comparison is the entire security value of the flow: the digest is what the approver signs, so two screens showing the same code means the thing being approved is the thing that will run.

Enums

ConsentOutcome

Why the wait ended without the task running.

Functions

with_consent

Run submit, and if the VTA defers it for consent, wait for the approval and run it again.

with_consent_timeout

with_consent with an explicit deadline. Separate so tests do not sleep for the production timeout.