A developer never approves their own manifest: it’s done by someone on the account with permission to manage the copilot from the Platform → Channels → your instance → “Copilot” (manual 24 and the operator’s manual, number 58, section 2). There they can paste the JSON by hand or “capture from the latest boot” of your site, see the status, the fingerprint and the diff against the previously approved version, and tap “Approve” or “Revoke”.
7.1 Why it’s reviewed and approved (and doesn’t just turn itself on)
Section titled “7.1 Why it’s reviewed and approved (and doesn’t just turn itself on)”The manifest is written and served by your code — that is, from the Platform’s backend’s point of view, it’s data sent by the client, not something to trust blindly. That’s why a new version never activates itself, even if it’s legitimate: someone with permission looks at it, sees the diff, and decides. This isn’t distrust toward you as an integrator — it’s the same rule that would apply to any external input to the system, and it’s what makes the rest of the next section’s defenses possible.
Also, approving the manifest doesn’t turn on any action: every action (the buttons that save, send or delete) starts off and gets turned on one by one, each with its own audience (Internal or Both) — see manual 58, section 2.