The budget checks

Part of team doctor — the owner's approved checks, run as the watch runs them.

The budget checks run from the approved budgets copy, the way the watch runs them: the approved command's file, hashed again before it runs, with the watch's timeout. A check that was changed after its approval never runs — the warning above says so. One line per account that names a check: the reading it gave (ok ), or that its output broke the contract, or that it failed or timed out (both warn: that account reads unknown; neither changes the exit code). The command's raw output is never shown, logged or written anywhere, and a reading is reported, not stored. A caller who is not the owner runs no check: one line says so, and everything else is as the owner's. An account nothing can read — its sources name the status line but no seat's CLI ships a quota pattern for it — has a warning of its own: no pattern can read this account. An account read only by a check is fine.

The warning that paragraph's above names — an account whose check is unapproved or changed after approval reads unknown — is one of the findings on the report page.

A caller who is not the owner

A seat's doctor runs no check — only the owner's approvals may run them — and one line says so; everything else is as the owner's:

$ team doctor ; echo "exit $?"
warn  the file, line 3: `coordinator:` is now `leads: true` on the lead's seat, and is still read
warn  claude-beacon: its name repeats "beacon"; the session already carries it
ok    the file is the one the owner approved (approval #1, 2026-10-04, key fe21ef6293de)
--    the budget checks were not run: only the owner runs them
ok    herdr 0.7.1
--    session beacon is running
ok    claude 2.1.288
ok    claude-code: logged in
ok    the watch is running
ok    the lobby ~/.config/team/lobby: will be created at the first launch
team doctor: nothing missing, 2 warnings
exit 0

A check changed after approval

A check that was edited after its approval never runs: the file on disk no longer hashes to what the owner approved, and the account reads unknown until team approve is run again. The file itself is back to the approved one here; only the script changed:

format: 1
project: beacon
coordinator: claude-keeper
operator: claude-keeper

trust:
  - ~/.config/team/lobby
  - ~/Code/beacon

workspace:
  mode: shared

budgets:                       # owner-only; the checks run from the approved copy
  accounts:
    openai: { kind: subscription, reserve: 10%, sources: [check], check: .agents/openai-quota }

seats:
  - role: coordinator
    name: claude-keeper
    label: coordinator
    cli: claude-code
    vendor: anthropic
    model: Claude Opus
    version: "5.5"
    launch: claude --model claude-opus-5-5

  - role: implementer
    name: claude-beacon
    label: implementer
    cli: claude-code
    vendor: anthropic
    model: Claude Opus
    version: "5.5"
    launch: claude --model claude-opus-5-5

#!/bin/sh
echo "weekly 99% used"

$ team doctor ; echo "exit $?"
warn  the file, line 3: `coordinator:` is now `leads: true` on the lead's seat, and is still read
warn  claude-beacon: its name repeats "beacon"; the session already carries it
ok    the file is the one the owner approved (approval #1, 2026-10-04, key fe21ef6293de)
warn  the check for openai changed after approval and was not run; that account reads unknown
ok    herdr 0.7.1
--    session beacon is running
ok    claude 2.1.288
ok    claude-code: logged in
ok    the watch is running
ok    the lobby ~/.config/team/lobby: will be created at the first launch
team doctor: nothing missing, 3 warnings
exit 0