feat: general gated run primitive + chat-assent approval (Layer 0)

Implements the first slice of plans/2026-07-10-general-gated-execution.md:
Nomos gets one general execution tool instead of only a fixed action enum,
gated by an automatic risk classifier, and approval can be granted by the
operator just replying in chat instead of clicking a button.

- internal/policy/command.go: ClassifyCommand(cmd, declaredRisk) — rule-based
  read-only allowlist + destructive denylist, default-escalate to
  config_mutation for anything else. Classification can only ESCALATE the
  caller's declared risk, never de-escalate it (destructive always wins even
  if declared read_only). Compound commands (&&, ;, |, $()) never qualify for
  the read-only fast path. Full test corpus.
- internal/mcp/server.go: new `run` MCP tool — target (host:/lxc:), command,
  purpose, optional declared_risk. Read-only commands execute immediately;
  everything else queues an approval exactly like pct_create today, executed
  via httpapi's existing executeApprovedAction. Also fixes a real latent bug:
  pct_exec resolved an LXC's host attribute without the "host:" prefix, so it
  could never find the Proxmox host — new resolveExecTarget/resolveRunTarget
  helpers (mcp + httpapi) fix this for both the new `run` action and existing
  actions that route through the same execution path.
- internal/httpapi/phase3.go: "run" case in executeApprovedAction; fixes two
  bugs found while wiring this up — (1) DecideApproval hardcoded risk_class to
  'config_mutation' on every approve, silently corrupting the audit ledger for
  every other risk class; (2) denying/revoking an approval never updated the
  linked execution's status, so it stayed 'pending_approval' forever instead
  of reflecting the decision.
- cmd/nomos/assent.go: deterministic (not LLM-judged) chat-assent detection.
  Scoped to the immediately-preceding assistant turn's pending approvals only
  — an old "yes" can't retroactively approve something new. Destructive-risk
  actions are excluded from loose assent. Approves via the same HTTP decision
  endpoint the UI button calls, so both paths share one audit trail.
- web/.../InlineApproval.svelte: self-healing poll — a pending approval card
  now picks up being decided via ANY path (chat assent, Ops page, Matrix), not
  just its own button. Previously the banner stayed stuck showing
  Approve/Deny even after the action had already run elsewhere.
- nomos/SOUL.md: `run` is now the general capability ("no fixed menu, only a
  risk gate"); documents chat-assent behavior and the destructive exception.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/mcp/server.go

@@ -4,6 +4,7 @@ package mcp
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"html"
@@ -21,6 +22,7 @@ import (
 	"github.com/dtoro/oikos/internal/db"
 	"github.com/dtoro/oikos/internal/db/sqlcgen"
 	"github.com/dtoro/oikos/internal/observability"
+	"github.com/dtoro/oikos/internal/policy"
 	"github.com/google/jsonschema-go/jsonschema"
 	"github.com/google/uuid"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
@@ -407,6 +409,83 @@ func newServer(pool *db.Pool, agentID uuid.UUID) *mcp.Server {
 		}
 	})
 
+	register(&mcp.Tool{Name: "run", Description: "Run ANY shell command against any host or LXC. This is the general execution primitive — prefer it over asking the operator to run something manually, and don't wait for a matching fixed action to exist. Every command is automatically risk-classified: read-only inspection (cat, systemctl status, docker ps, journalctl, df, git status, ...) runs immediately; anything that changes state requires operator approval (granted by the operator replying \"go ahead\"/\"yes\" in chat, or via the Approve button); commands matching a destructive pattern (rm -rf, dd, mkfs, pct/qm destroy, DROP TABLE, reboot, piping curl into a shell, ...) always require approval regardless of what you declare. You cannot talk your way past the destructive check by declaring a lower risk.",
+		InputSchema: objSchema(
+			prop{"target", "string", "Target entity slug: host:<slug> (e.g. host:strong) or lxc:<slug> (e.g. lxc:caddy). LXC commands run via pct exec on its Proxmox host automatically."},
+			prop{"command", "string", "The shell command to run. Can be a full script (multi-line, &&-chained). Runs as root."},
+			prop{"purpose", "string", "One sentence: why you're running this. Shown to the operator alongside the approval — be specific, this is what they're approving."},
+			prop{"declared_risk", "string", "Optional self-assessment: read_only, reversible_low, config_mutation, or destructive. This can only ESCALATE the automatic classification, never lower it — declaring a mutating command as read_only has no effect."},
+		),
+	}, func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+		args := argsMap(req)
+		targetSlug, _ := args["target"].(string)
+		command, _ := args["command"].(string)
+		purpose, _ := args["purpose"].(string)
+		declaredRisk, _ := args["declared_risk"].(string)
+		if targetSlug == "" || command == "" {
+			return textResult("error: target and command are required"), nil
+		}
+
+		var targetID uuid.UUID
+		if err := pool.QueryRow(ctx, "SELECT id FROM entities WHERE slug = $1", targetSlug).Scan(&targetID); err != nil {
+			return textResult(fmt.Sprintf("target not found: %s", targetSlug)), nil
+		}
+
+		riskClass := policy.ClassifyCommand(command, declaredRisk)
+		runParams, _ := json.Marshal(map[string]string{"command": command, "purpose": purpose})
+		actionCol := "run:" + string(runParams)
+
+		// Dedup: an identical pending command (same target, command, and
+		// purpose) blocks a re-request — stops a tool-calling loop from
+		// queuing the same approval repeatedly.
+		var existingID string
+		derr := pool.QueryRow(ctx, `
+			SELECT e.id::text FROM entities e
+			JOIN executions ex ON ex.entity_id = e.id
+			WHERE e.type = 'execution' AND ex.target_entity_id = $1
+			  AND ex.action = $2 AND ex.status = 'pending_approval'
+			ORDER BY e.created_at DESC LIMIT 1`,
+			targetID, actionCol).Scan(&existingID)
+		if derr == nil && existingID != "" {
+			return textResult(fmt.Sprintf("An identical command is already queued for approval on %s — execution %s. Wait for the operator, don't re-request.", targetSlug, existingID)), nil
+		}
+
+		id, _ := uuid.NewV7()
+		correlationID := uuid.New().String()
+		execName := "run on " + targetSlug + " (" + id.String()[:8] + ")"
+		execSlug := "exec:" + targetSlug + ":" + id.String()[:8]
+		if _, err := pool.Exec(ctx, `INSERT INTO entities (id, slug, type, name, attributes) VALUES ($1, $2, 'execution', $3, '{}')`,
+			id, execSlug, execName); err != nil {
+			return textResult(fmt.Sprintf("error: failed to create execution: %v", err)), nil
+		}
+		pool.Exec(ctx, `INSERT INTO executions (entity_id, target_entity_id, action, risk_class, status, correlation_id, agent_id) VALUES ($1, $2, $3, $4, 'running', $5, $6) ON CONFLICT DO NOTHING`,
+			id, targetID, actionCol, riskClass, correlationID, agentID)
+
+		if riskClass == policy.RiskReadOnly {
+			host, user, wrap, rerr := resolveExecTarget(ctx, pool, targetSlug)
+			if rerr != nil {
+				pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`, id, jsonErr("%s", rerr.Error()))
+				return textResult(fmt.Sprintf("resolve target: %v", rerr)), nil
+			}
+			out, xerr := sshExec(ctx, host, user, wrap(command))
+			if xerr != nil {
+				pool.Exec(ctx, `UPDATE executions SET status='failed', result=$2::jsonb WHERE entity_id=$1`, id, jsonErr("%s: %s", xerr.Error(), out))
+				return textResult(fmt.Sprintf("run on %s: ERROR %v\n%s", targetSlug, xerr, out)), nil
+			}
+			pool.Exec(ctx, `UPDATE executions SET status='completed', result=$2::jsonb WHERE entity_id=$1`, id, jsonOut(out))
+			return textResult(fmt.Sprintf("run on %s (read_only, auto): %s", targetSlug, out)), nil
+		}
+
+		pool.Exec(ctx, `UPDATE executions SET status='pending_approval', risk_class=$2 WHERE entity_id=$1`, id, riskClass)
+		createApproval(ctx, pool, id, targetID, "run", string(runParams), riskClass)
+		confirmNote := ""
+		if riskClass == policy.RiskDestructive {
+			confirmNote = " This is classified DESTRUCTIVE — flag that clearly to the operator; it needs explicit confirmation, not just a casual \"go ahead\"."
+		}
+		return textResult(fmt.Sprintf("run on %s requires approval (risk: %s) — execution %s queued.%s Present the command and purpose to the operator and wait; do not re-request.",
+			targetSlug, riskClass, id, confirmNote)), nil
+	})
+
 	register(&mcp.Tool{Name: "http_get", Description: "Fetch a public web page or raw file (e.g. a GitHub README/raw URL) and return sanitized text. Use this to research how to deploy a service before provisioning. HTTP/HTTPS only; body is truncated to ~16KB.",
 		InputSchema: objSchema(
 			prop{"url", "string", "Absolute http(s) URL to fetch"},
@@ -881,6 +960,13 @@ func jsonOut(out string) []byte {
 	return b
 }
 
+// jsonErr builds a valid {"error": "..."} JSON payload for an execution's
+// result column — same rationale as jsonOut, for the failure path.
+func jsonErr(format string, args ...any) []byte {
+	b, _ := json.Marshal(map[string]any{"error": fmt.Sprintf(format, args...)})
+	return b
+}
+
 func queryEntity(ctx context.Context, pool *db.Pool, idOrSlug string) *mcp.CallToolResult {
 	var id uuid.UUID
 	if u, err := uuid.Parse(idOrSlug); err == nil {
@@ -1093,6 +1179,43 @@ func isPrivateHost(host string) bool {
 	return ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsUnspecified()
 }
 
+// resolveExecTarget resolves any target slug (host: or lxc:) to the SSH
+// endpoint that will actually run the command, and a wrap function that turns
+// a plain shell command into whatever must actually be sent over that SSH
+// connection: identity for a host, `pct exec <pve_id> -- ...` for an LXC.
+//
+// The lxc.attributes.host value is stored WITHOUT a "host:" prefix (e.g.
+// "strong", not "host:strong") — see pct_create's entity registration. The
+// pre-existing pct_exec handler queried resolveHost with that bare value
+// directly, which can never match a "host:*" slug and always fails; this
+// prefixes it correctly.
+func resolveExecTarget(ctx context.Context, pool *db.Pool, targetSlug string) (host, user string, wrap func(cmd string) string, err error) {
+	if strings.HasPrefix(targetSlug, "host:") {
+		host, user, err = resolveHost(ctx, pool, targetSlug)
+		return host, user, func(cmd string) string { return cmd }, err
+	}
+	if strings.HasPrefix(targetSlug, "lxc:") {
+		var pveID, hostAttr string
+		if qerr := pool.QueryRow(ctx, "SELECT attributes->>'pve_id', attributes->>'host' FROM entities WHERE slug = $1", targetSlug).Scan(&pveID, &hostAttr); qerr != nil || pveID == "" {
+			return "", "", nil, fmt.Errorf("LXC not found or missing pve_id: %s", targetSlug)
+		}
+		hostSlug := hostAttr
+		if hostSlug == "" {
+			hostSlug = "hubris" // documented default Proxmox host when unset
+		}
+		if !strings.HasPrefix(hostSlug, "host:") {
+			hostSlug = "host:" + hostSlug
+		}
+		host, user, err = resolveHost(ctx, pool, hostSlug)
+		id := pveID
+		return host, user, func(cmd string) string {
+			b64 := base64.StdEncoding.EncodeToString([]byte(cmd))
+			return fmt.Sprintf("pct exec %s -- bash -c 'echo %s | base64 -d | bash'", id, b64)
+		}, err
+	}
+	return "", "", nil, fmt.Errorf("unsupported target %q: must be host:<slug> or lxc:<slug>", targetSlug)
+}
+
 func createApproval(ctx context.Context, pool *db.Pool, execID, targetID uuid.UUID, action, params, riskClass string) {
 	p := map[string]any{"action": action, "params": params, "execution_id": execID.String()}
 	payload, _ := json.Marshal(p)