feat: general gated run primitive + chat-assent approval (Layer 0)

Implements the first slice of plans/2026-07-10-general-gated-execution.md:
Nomos gets one general execution tool instead of only a fixed action enum,
gated by an automatic risk classifier, and approval can be granted by the
operator just replying in chat instead of clicking a button.

- internal/policy/command.go: ClassifyCommand(cmd, declaredRisk) — rule-based
  read-only allowlist + destructive denylist, default-escalate to
  config_mutation for anything else. Classification can only ESCALATE the
  caller's declared risk, never de-escalate it (destructive always wins even
  if declared read_only). Compound commands (&&, ;, |, $()) never qualify for
  the read-only fast path. Full test corpus.
- internal/mcp/server.go: new `run` MCP tool — target (host:/lxc:), command,
  purpose, optional declared_risk. Read-only commands execute immediately;
  everything else queues an approval exactly like pct_create today, executed
  via httpapi's existing executeApprovedAction. Also fixes a real latent bug:
  pct_exec resolved an LXC's host attribute without the "host:" prefix, so it
  could never find the Proxmox host — new resolveExecTarget/resolveRunTarget
  helpers (mcp + httpapi) fix this for both the new `run` action and existing
  actions that route through the same execution path.
- internal/httpapi/phase3.go: "run" case in executeApprovedAction; fixes two
  bugs found while wiring this up — (1) DecideApproval hardcoded risk_class to
  'config_mutation' on every approve, silently corrupting the audit ledger for
  every other risk class; (2) denying/revoking an approval never updated the
  linked execution's status, so it stayed 'pending_approval' forever instead
  of reflecting the decision.
- cmd/nomos/assent.go: deterministic (not LLM-judged) chat-assent detection.
  Scoped to the immediately-preceding assistant turn's pending approvals only
  — an old "yes" can't retroactively approve something new. Destructive-risk
  actions are excluded from loose assent. Approves via the same HTTP decision
  endpoint the UI button calls, so both paths share one audit trail.
- web/.../InlineApproval.svelte: self-healing poll — a pending approval card
  now picks up being decided via ANY path (chat assent, Ops page, Matrix), not
  just its own button. Previously the banner stayed stuck showing
  Approve/Deny even after the action had already run elsewhere.
- nomos/SOUL.md: `run` is now the general capability ("no fixed menu, only a
  risk gate"); documents chat-assent behavior and the destructive exception.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/httpapi/phase3.go

@@ -150,6 +150,39 @@ func resolveHostSSH(ctx context.Context, pool *db.Pool, entitySlug string) (stri
 	return "", "", fmt.Errorf("no IP found for %s", entitySlug)
 }
 
+// resolveRunTarget mirrors internal/mcp.resolveExecTarget for the approved-
+// execution side: any target slug (host: or lxc:) resolves to the SSH
+// endpoint that runs the command plus a wrap function that turns a plain
+// shell command into what actually needs to be sent — identity for a host,
+// `pct exec <pve_id>` for an LXC. Kept as a small duplicate rather than a
+// cross-package import to avoid coupling httpapi to mcp for one helper.
+func resolveRunTarget(ctx context.Context, pool *db.Pool, targetSlug string) (host, user string, wrap func(string) string, err error) {
+	if strings.HasPrefix(targetSlug, "host:") {
+		host, user, err = resolveHostSSH(ctx, pool, targetSlug)
+		return host, user, func(cmd string) string { return cmd }, err
+	}
+	if strings.HasPrefix(targetSlug, "lxc:") {
+		var pveID, hostAttr string
+		if qerr := pool.QueryRow(ctx, "SELECT attributes->>'pve_id', attributes->>'host' FROM entities WHERE slug = $1", targetSlug).Scan(&pveID, &hostAttr); qerr != nil || pveID == "" {
+			return "", "", nil, fmt.Errorf("LXC not found or missing pve_id: %s", targetSlug)
+		}
+		hostSlug := hostAttr
+		if hostSlug == "" {
+			hostSlug = "hubris"
+		}
+		if !strings.HasPrefix(hostSlug, "host:") {
+			hostSlug = "host:" + hostSlug
+		}
+		host, user, err = resolveHostSSH(ctx, pool, hostSlug)
+		id := pveID
+		return host, user, func(cmd string) string {
+			b64 := base64.StdEncoding.EncodeToString([]byte(cmd))
+			return fmt.Sprintf("pct exec %s -- bash -c 'echo %s | base64 -d | bash'", id, b64)
+		}, err
+	}
+	return "", "", nil, fmt.Errorf("unsupported target %q: must be host:<slug> or lxc:<slug>", targetSlug)
+}
+
 // executeApprovedAction runs a gated action after operator approval.
 // Runs in a background goroutine to not block the HTTP response.
 // emitExecutionEvent records an execution lifecycle event for SSE fan-out so
@@ -165,7 +198,7 @@ func emitExecutionEvent(ctx context.Context, pool *db.Pool, execID uuid.UUID, st
 func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID, targetSlug string, actionStr string) {
 	slog.Info("httpapi: executing approved action", "execution_id", execID, "target", targetSlug, "action", actionStr)
 
-	host, user, err := resolveHostSSH(ctx, pool, targetSlug)
+	host, user, wrap, err := resolveRunTarget(ctx, pool, targetSlug)
 	if err != nil {
 		slog.Error("httpapi: resolve host for approved execution", "error", err, "target", targetSlug)
 		pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
@@ -420,6 +453,24 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
 			slog.Info("httpapi: pct_create entity registered", "slug", slug, "vmid", cfg.VMID, "host", targetSlug)
 		}
 
+	case "run":
+		// The general gated primitive: arbitrary shell against any host or
+		// LXC, approved and classified by internal/policy.ClassifyCommand at
+		// request time (see mcp/server.go's "run" tool). No fixed action
+		// enum — new capability doesn't require new Go code here.
+		var cfg struct {
+			Command string `json:"command"`
+			Purpose string `json:"purpose"`
+		}
+		if perr := json.Unmarshal([]byte(params), &cfg); perr != nil {
+			pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
+				execID, jsonErr("invalid run params: %v", perr))
+			emitExecutionEvent(ctx, pool, execID, "failed", map[string]any{"target": targetSlug, "error": perr.Error()})
+			return
+		}
+		cmd = wrap(cfg.Command)
+		output, err = sshExec(ctx, host, user, cmd)
+
 	default:
 		slog.Error("httpapi: unknown gated action for approved execution", "action", action, "execution_id", execID)
 		pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`,
@@ -1336,13 +1387,23 @@ func (s *Server) DecideApproval(ctx context.Context, req gen.DecideApprovalReque
 			_ = tx.QueryRow(ctx, "SELECT slug FROM entities WHERE id = $1", targetID).Scan(&targetSlug)
 
 			go executeApprovedAction(context.Background(), s.pool, execID, targetSlug, actionStr)
-			_, _ = tx.Exec(ctx, `UPDATE executions SET status = 'approved', risk_class = 'config_mutation' WHERE entity_id = $1`, execID)
+			// Status only — risk_class was set correctly at request time
+			// (e.g. by policy.ClassifyCommand for `run`); overwriting it to
+			// a hardcoded 'config_mutation' here corrupted the audit ledger
+			// for every other risk class, including destructive.
+			_, _ = tx.Exec(ctx, `UPDATE executions SET status = 'approved' WHERE entity_id = $1`, execID)
 
 			slog.Info("httpapi: approved execution queued",
 				"execution_id", execID, "target", targetSlug, "action", actionStr)
 		} else {
 			slog.Warn("httpapi: no pending execution found for approval", "approval_id", id, "error", err)
 		}
+	} else {
+		// Denied/revoked: reflect it on the linked execution too. Previously
+		// only the approvals row changed, so the execution stayed
+		// 'pending_approval' forever — any UI/poller reading execution
+		// status (not approval status) never saw the decision.
+		_, _ = tx.Exec(ctx, `UPDATE executions SET status = $2, completed_at = now() WHERE approval_id = $1 AND status = 'pending_approval'`, id, status)
 	}
 
 	if err := tx.Commit(ctx); err != nil {