[getappz]

Committed on task/197-approval-gate-command-class-autonomy-tie (not pushed).

Status: Implemented the safety core for item #197 (child of epic #131, Phase 2/4 — approval flow + policy engine), adapting openhuman's approval-gate design (refs/openhuman/src/openhuman/approval/).

What landed:

• agentflare-store/src/approval.rs — restart-safe pending_approvals + allowlist tables (own module, using refactor(mcp): split item_inner's dispatch arms into src/mcp_server/item.rs #187's Store engine, not kv), race-safe decide() (WHERE decided_at IS NULL), lazy TTL expiry, write-once execution audit rows.
• New agentflare-approval crate: classifier (fail-closed Read/Write/Network/Install/Destructive, handles pipes/&&/;, $(...)/backtick substitution, sudo, env prefixes — highest class wins), policy (tier matrix: ReadOnly/Supervised/Full → Allow/Prompt/Block), redact (home-path scrubbing, secret masking, JSON redaction), gate (ApprovalGate: park on oneshot + TTL, first-wins race between decide() callers, re-reads the store before denying on timeout, persists "approve always" onto the allowlist).

Tests: 148 unit tests, all passing — classifier checklist cases (incl. piped commands), tier matrix, first-wins decide race, TTL fail-closed deny, restart persistence (reopened SQLite file), redaction (paths/secrets/JSON). cargo clippy clean (-A unsafe_code -A clippy::pedantic per this repo's gate command), cargo fmt clean, full cargo check --workspace clean (only pre-existing unrelated warnings elsewhere).

Not done / explicit scope gap: the actual channel-card delivery wired to flare-channels (#131 Phase 1/2) and a terminal-prompt call site in the CLI's real tool-execution path aren't wired up yet — this lands the tested library both of those can call into (ApprovalGate::intercept / decide), same pattern flare-channels itself shipped as "behavior-free" infra. Worth a follow-up item before this is load-bearing in the live binary.

---

Opened by claude-code on flared:c997d745ae66 for item #197 via agentflare.

[coderabbitai]

Warning

Review limit reached

Next included review available in 40 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 60 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 46062cbf-45db-4428-9deb-e8725e4ff73b

📥 Commits

Reviewing files that changed from the base of the PR and between fd385be and c43f2dc.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (11)

• Cargo.toml
• crates/agentflare-approval/Cargo.toml
• crates/agentflare-approval/src/classifier.rs
• crates/agentflare-approval/src/gate.rs
• crates/agentflare-approval/src/lib.rs
• crates/agentflare-approval/src/policy.rs
• crates/agentflare-approval/src/redact.rs
• crates/agentflare-approval/src/types.rs
• crates/agentflare-store/src/approval.rs
• crates/agentflare-store/src/lib.rs
• crates/agentflare-store/src/migrations.rs

---

_{Comment @coderabbitai help to get the list of available commands.}