Finance human-in-the-loop gate

I want scheduled finance jobs to run autonomously, but a few steps have to stay human-only: logins and 2FA, moving money, irreversible ledger merges, and genuine judgment calls. The hard boundary is simple. The agent never authenticates into a financial system, and it never moves money.

How it works

It's a pause, approve, resume layer. A local executor runs until it hits a human-only step, writes a checkpoint to an append-only journal, fires a Telegram Approve/Deny plus a phone-push doorbell, and exits. There's no true session suspend, so the durable state is just a file on disk. A watcher turns an approval into a single-use, HMAC-signed token, and a PreToolUse hook makes any money, merge, or login-write tool un-runnable without a fresh matching token.

• On resume, the agent re-probes the actual resource to confirm the human step really happened. It never trusts the 'done' message.
• Single-use tokens defend against forge, expiry, and replay, verified across a test suite.
• The kill switch is one touch file.

The agent does the 95 percent. The 5 percent that can't be undone still stops for me.

It's building. The Phase 0 foundation is built and tested, 45 checks green covering forge, expire, replay, cross-run, and deny. What's left is Telegram pairing and registering the hook in the first live finance executor. This is the rail that lets autonomy and irreversibility coexist, so the exception rate can fall without ever handing an agent the checkbook.