fix(agent): don't auto-complete sessions with pending approvals

The auto-complete fired when the agent hit the P5 approval gate — it
queued a config_mutation run for approval, the P5 gate blocked further
runs, the turn ended, and auto-complete closed the session as 'partial'.
The operator's approval would then land on a dead task.

Fix: hasPendingApprovals check — if the session has any executions in
pending_approval state, skip auto-complete. The session stays in
'executing' until the operator approves (or denies).

VERSION 0.7.5 → 0.7.6

cmd/nomos/tasks.go

@@ -376,6 +376,15 @@ func (a *agent) autoCompleteIfPlanDone(ctx context.Context, sessionID, responseT
 	if err != nil || sess.Status != "executing" {
 		return
 	}
+	// Don't auto-complete if there are pending approvals — the agent is
+	// blocked waiting for the operator, not done. Auto-completing here
+	// would close the session and the operator's approval would land on a
+	// dead task. Confirmed in eval: agent hits P5 approval gate, turn
+	// ends, auto-complete fires incorrectly because the approval-queue
+	// `run` responses were logged as success=true in agent_activity.
+	if a.store.hasPendingApprovals(ctx, sessionID) {
+		return
+	}
 	discovery := a.store.hadDiscovery(ctx, sessionID)
 	writeback := a.store.hadEntityWriteback(ctx, sessionID)
 	// (a) all plan steps terminal, OR (b) agent did discovery (ran `run`).