Phase 5: File-based approval gates for ADF

Parent Epic

#637

Summary

Add file-based approval gates for high-impact agent actions (PR creation, config changes, deployments).

Changes Required

terraphim_orchestrator

• New approvals.rs module with ApprovalRequest, ApprovalStatus types
• Approval requests written to approvals/<uuid>.json
• Schema: {id, type, requested_by, status: "pending"|"approved"|"rejected", payload, decision_note, decided_at}
• Orchestrator checks approval status on reconciliation tick
• Blocked actions wait for approval (with configurable timeout)

ADF CLI

• adf approve <id> -- approve a pending request
• adf reject <id> --reason "..." -- reject with reason
• adf approvals -- list pending approval requests
• adf approvals --all -- list all (including decided)

Governed Actions (initial set)

• PR creation by compound review (when create_prs = true)
• Agent config changes proposed by agents
• Future: deployment actions, branch force-push

Config

[governance]
enabled = true
approval_timeout_secs = 86400  # 24h, then auto-reject
approvals_dir = "/opt/ai-dark-factory/approvals"

Reference

• Paperclip approvals: packages/db/src/schema/approvals.ts
• Paperclip approval service: server/src/services/approvals.ts, server/src/services/issue-approvals.ts

Acceptance Criteria

• Approval requests created as JSON files
• CLI commands for approve/reject/list
• Governed actions blocked until approved
• Timeout auto-rejects stale requests
• Activity log events for request/decision (depends on Phase 4)

Start with parent issue #637, then review the referenced Paperclip approval schema and service files before designing the new terraphim_orchestrator approvals.rs module and ADF CLI entry points. Done means JSON approval requests, approve/reject/list commands, governed actions that wait for decisions, timeout auto-rejection, and activity log events as listed in the acceptance criteria.