[angel-manuel]

Summary

"Allow & Remember" used to create a permanent rule unless the reviewer changed the picker: "Never" was preselected, and an API resolve that left out ttl meant forever. Orgs can now set the default expiry, and it starts at 7 days.

• DB: migration 139 adds orgs.default_remember_ttl_secs. NULL means forever, the range is 60s to 365d, and the column default is 604800, which also backfills existing orgs.
• API:
  • The setting is on GET/PATCH /v1/orgs/{id}/execution-settings. PATCH is admin-only and three-valued (absent / null / number).
  • POST /v1/approvals/{id}/resolve with allow_remember and no ttl now applies the org default.
  • ttl: "forever" is accepted explicitly; it used to 400.
  • A single parser, parse_rule_ttl, now serves both /resolve and PATCH /v1/permissions/{id}.
• MCP:
  • The remember dialog preselects the org default; a default that isn't one of the dialog's menu values is added as a "{n}s" option.
  • forever is now passed through instead of being dropped.
  • The tool description documents the default.
• Dashboard:
  • A new "Default 'Allow & Remember' expiry" select in Org Settings. It sits below the call timeouts with a divider, because it is not a creation-time default like the rows above it.
  • Rebased onto feat(dashboard): single Allow split button with duration menu on approval detail #844's Allow split button, which still starts on Once. Its duration menu tags the org default "· default", and a default that isn't one of the menu's durations gets its own "For …" entry. Every remember choice sends ttl, so "Always" is an explicit forever.
• SDK card: a new "Org default" option, selected by default, omits ttl; forever is sent explicitly.
• Docs: SPEC, UI_SPEC (this replaces the old per-user "Default approval TTL" idea), and a D-NEXT decision.

Behaviour change

API callers that relied on leaving out ttl to get a permanent rule now get the org default (7 days). Pass ttl: "forever" for a permanent rule. Rules that already exist keep their expiry.

Screenshots (real stack, dashboard/scripts/screenshot-remember-ttl-default.mjs)

Org setting:

The default changed to 30 days through the UI; a new approval's Allow menu then tags it:

Test plan

• New integration tests (approvals_remember_keys.rs):
  • an omitted ttl gets about 7 days;
  • explicit forever writes a rule with no expiry;
  • an explicit 1h wins over the default;
  • a changed default (and a forever default) is applied;
  • bounds are enforced (400);
  • a non-admin is refused.
• Unit tests: parse_rule_ttl, the elicitation default and off-menu option, remember_resolve_body passing forever through, humanize_secs.
• mcp_elicitation::remember_dialog_without_scope_saves_the_exact_keys updated: no duration picked now means 7 days.
• Full cargo nextest run --workspace: 3851 passed. Clippy -D warnings clean, svelte-check clean, SDK vitest 138 passed.
• vet --agentic: no issues.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
overslash	Ready	Preview	Oct 28, 2026 12:23pm UTC

[github-actions]

Code diff size

+359 / −61 across 20 files (net +298)

Area	Files	Added	Removed	Net
overslash-api	9	+150	−41	+109
dashboard	6	+137	−15	+122
overslash-db	1	+34	−1	+33
overslash-core	1	+25	−0	+25
sdk	3	+13	−4	+9

_{Source files under src/ only (.cjs, .go, .js, .jsx, .mjs, .py, .rs, .svelte, .ts, .tsx); test files and inline #[cfg(test)] modules excluded. 15 other changed files not counted.}

[codecov]

Codecov Report

❌ Patch coverage is 93.20988% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/overslash-api/src/routes/mcp/elicitation.rs	84.74%	9 Missing ⚠️
crates/overslash-api/src/routes/mcp/modern.rs	95.65%	1 Missing ⚠️
crates/overslash-api/src/routes/mcp/tools_call.rs	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!