Proposal Envelope Pattern

Let the agent propose, not commit: the envelope that has to arrive before a write

A dev.to post specifies a twelve-field proposal record carrying risk class, approval owner, expiry, idempotency key and rollback path. The field that matters most depends on endpoints nobody has checked.