feat: Phase 9 gaps closed — ApprovalService.Decide convergence, execlog fold, execworker poller

- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
  full decide transaction: HMAC token verify, approval flip, execution un-gate,
  session-scoped window keys (+session suffix matching GovernanceStore gate),
  nomos session flip, audit+event on failure abort. httpapi DecideApproval now
  a thin presenter delegating to the service. ListPending payload format fixed
  (json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
  / ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
  fixed (defer/recover per execution), correlation_id preserved via Finalize
  event emission (ExecRunRepo.Finalize now emits execution.{status} with
  correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
  exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.

internal/core/ports/governance.go

@@ -83,17 +83,32 @@ type ExecutionRepository interface {
 type ApprovalDecideInput struct {
 	ApprovalID domain.UUID
 	Token      string
-	Approved   bool
+	Status     string // "approved" | "denied" | "revoked"
 	Actor      string
 	Audit      []AuditEntry
 	Event      *Event
 }
 
+// ApprovalResume identifies an un-gated execution the driving adapter should
+// dispatch after an approved decision (SSH work is adapter-specific).
+type ApprovalResume struct {
+	ExecutionID domain.UUID
+	TargetSlug  string
+	Action      string
+}
+
+// ApprovalDecideResult carries the updated approval and, on approve, the
+// linked execution to resume.
+type ApprovalDecideResult struct {
+	Approval domain.Approval
+	Resume   *ApprovalResume
+}
+
 // ApprovalRepository is the approval aggregate.
 type ApprovalRepository interface {
 	ListPending(ctx context.Context, entityID domain.UUID, limit int) ([]domain.Approval, error)
 
-	Decide(ctx context.Context, input ApprovalDecideInput) (domain.Approval, error)
+	Decide(ctx context.Context, input ApprovalDecideInput) (ApprovalDecideResult, error)
 }
 
 // GovernanceStore is the policy read model: the facts the gating decision

internal/core/ports/portstest/fakes.go

@@ -17,11 +17,11 @@ import (
 // EntityRepo is an in-memory ports.EntityRepository. Command inputs' audit,
 // event, and derived-check fields are recorded for assertion.
 type EntityRepo struct {
-	mu      sync.Mutex
-	byID    map[domain.UUID]domain.Entity
-	bySlug  map[string]domain.UUID
-	order   []domain.UUID
-	nextID  int
+	mu         sync.Mutex
+	byID       map[domain.UUID]domain.Entity
+	bySlug     map[string]domain.UUID
+	order      []domain.UUID
+	nextID     int
 	Audits     []ports.AuditEntry
 	Events     []ports.Event
 	Checks     map[domain.UUID][]ports.CheckDef
@@ -34,8 +34,8 @@ type EntityRepo struct {
 // NewEntityRepo builds an empty in-memory entity repository.
 func NewEntityRepo() *EntityRepo {
 	return &EntityRepo{
-		byID:   make(map[domain.UUID]domain.Entity),
-		bySlug: make(map[string]domain.UUID),
+		byID:       make(map[domain.UUID]domain.Entity),
+		bySlug:     make(map[string]domain.UUID),
 		Checks:     make(map[domain.UUID][]ports.CheckDef),
 		Idempotent: make(map[string]ports.IdempotentResponse),
 	}
@@ -404,12 +404,12 @@ func (r *FakeResolver) IsGuest(entityType string) bool {
 // FakeProvisioner records provision requests and replies with canned
 // results (default: a successful create echoing the request's VMID).
 type FakeProvisioner struct {
-	mu      sync.Mutex
-	LXCs    []ports.LXCInput
-	VMs     []ports.VMInput
-	LXCRes  ports.ProvisionResult
-	LXCErr  error
-	VMErr   error
+	mu     sync.Mutex
+	LXCs   []ports.LXCInput
+	VMs    []ports.VMInput
+	LXCRes ports.ProvisionResult
+	LXCErr error
+	VMErr  error
 }
 
 // CreateLXC records the request and replies with the canned result.
@@ -623,7 +623,42 @@ func (r *ExecutionRecorder) QueueApproval(_ context.Context, in ports.QueueAppro
 
 // MuLock exposes the internal mutex for tests that need to inspect state
 // racing the async dispatch goroutine.
-func (r *ExecutionRecorder) MuLock()   { r.mu.Lock() }
+func (r *ExecutionRecorder) MuLock() { r.mu.Lock() }
 
 // MuUnlock releases the internal mutex.
 func (r *ExecutionRecorder) MuUnlock() { r.mu.Unlock() }
+
+// ApprovalRepo is an in-memory ports.ApprovalRepository. ListPending returns
+// the canned pending list; Decide records the input and replies with a canned
+// result or the ErrStub.
+type ApprovalRepo struct {
+	mu sync.Mutex
+	// Pending is returned by ListPending.
+	Pending []domain.Approval
+	// Decided records every Decide input for assertion.
+	Decided []ports.ApprovalDecideInput
+	// Result is returned by Decide (default: empty approval).
+	Result  ports.ApprovalDecideResult
+	ErrStub error
+}
+
+// NewApprovalRepo builds an empty in-memory approval repository.
+func NewApprovalRepo() *ApprovalRepo { return &ApprovalRepo{} }
+
+// ListPending returns the canned pending list.
+func (r *ApprovalRepo) ListPending(_ context.Context, _ domain.UUID, _ int) ([]domain.Approval, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.Pending, r.ErrStub
+}
+
+// Decide records the input and replies with the canned result.
+func (r *ApprovalRepo) Decide(_ context.Context, in ports.ApprovalDecideInput) (ports.ApprovalDecideResult, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.Decided = append(r.Decided, in)
+	if r.ErrStub != nil {
+		return ports.ApprovalDecideResult{}, r.ErrStub
+	}
+	return r.Result, nil
+}