[Daanish2003]

Summary

Implements the spec Approval rules, with all nine tickets, #990–#998. Before this, a blocked call failed after 15 seconds when the user wasn't looking. Now:

• An unanswered Approval stays pending. After the 15-second wait, a blocked shell command or Connector tool call stays pending for up to 7 days, and the Bot carries on with other work.
  • A later yes runs exactly the stored call once, through the approved-call job, and its result wakes the Bot.
  • A later no wakes the Bot too.
  • Screen actions (Computer use) keep the strict 15 seconds.
• Custom Rules. A sentence in the user's own words with a mode: without asking, if pre-approved, ask before, or hand off to me. Auto-review reads them, and they live on Settings → Rules.
  • A Bot can propose a rule with propose_rule. The user answers it on a rule_approval card, and it applies only after their yes.
• Never-allowed actions are a fixed list: moving money or trading, acting on someone else's account, changing passwords or 2FA, sending a Secret or card or government ID numbers off the Computer, and weakening the Bot's own safety. No rule or Approval can unlock them. The Bot tells the user to do it themselves. A Host can add to the list (rules.neverAllowed lists it).
• Waiting N popover. It sits in the Bot's header and lists every pending Approval and proposal with the full call. Notifications link back to the app and never approve anything.

This also merges ADRs 0030, 0031 and 0032 from docs/973-approval-rules.

Closes #989

How it was tested

• Each ticket was built test-first. Every new test was seen red before going green: integration suites against Postgres and Redis, plus UI tests.
• The full verify.sh passed on the integration tip (68391ba): format, lint, check-types, and vitest with 2491 passed and 34 skipped.
• The full Playwright e2e passed: 58/58 under --workers=2.
• A branch code review found 11 issues. 10 are fixed here, each with a test seen red first:
  • an interrupted wait now leaves the pending result in the next Turn's transcript;
  • a late Allow just past the deadline counts once, while Screen actions stay strict;
  • the rules page's mode-pill click is no longer lost while a text save is in flight;
  • the approved call gets a real Turn id;
  • the Computer rebuild note is shared;
  • one open proposal per Bot;
  • a proposal's rule change reaches every Bot's thread live;
  • the eval's softened rate leaves reviewer failures out.
• A real-Model safety eval ran on the owner's ChatGPT plan with the reviewer on openai:gpt-6.1-sol. It was 147/147 right, with one reviewer timeout scored as a block. A rerun of that case set was 49/49.

Decisions I made

• ⚠️ Database schema (owner-approved): one migration, 20261029113355_approval_rules. It adds the custom_rule table (two enums, with proposed_by_bot_id set null when that Bot is deleted), the review state pending, the bot_review.expires_at column, the verdict never and the Trigger source approval. Enum values are only added, never removed. The owner approved it as specced.
• ⚠️ Public API (owner-approved): a new rules router (list, create, update, delete, approve, deny, neverAllowed) and the reviews router's late answers. The owner chose to keep the rules.neverAllowed route.
• Owner-approved: one open proposal per Bot. A second propose_rule is refused until the user answers the first.
• Owner-approved: lint-staged's oxfmt runs with --no-error-on-unmatched-pattern, so a snapshot-only commit passes the hook.
• Strictness for late answers comes from the Helper's type (computer_use Screens), not a per-row flag, so no second migration was needed.
• The approved call builds features up to the one that owns the tool. The review row doesn't record its feature, and a duplicate tool name resolves to the first feature.
• A stale Deny on an already-active rule does nothing and shows nothing.
• The Bot's system prompt doesn't mention propose_rule. The Bot finds it through the tool's description.

Risk

• Schema migration: new states and tables only. Existing rows keep their states.
• Exactly-once: a late Allow runs the stored call through a job guarded by row locks. Integration tests cover a crash re-queue and a race with the wait.
• Known gaps (follow-ups):
  • A hand-off has no thread line. The spec only draws the never divider.
  • Custom Rules aren't in the user export.
  • A proposal whose Bot was deleted can only be answered from the rules page.
  • The real-eval script exits 1 when the reviewer times out.

🤖 Generated with Claude Code