fix: approval UI was never mounted; add typed confirmation for destructive

Root cause of "chat gave me no further feedback — had to go to Ops": two
compounding bugs, found by reading the actual production session transcript.

1. InlineApproval.svelte — all of last session's live-status/self-heal work —
   was never imported or rendered anywhere. Chat.svelte had its own separate,
   much dumber approval bar (no status tracking, no destructive handling, just
   silently disappears after clicking) that WAS the one users actually saw.
   Deleted the dead bar and its state; InlineApproval now renders per-message.

2. chat.ts's extractApprovals hardcoded `tool.name === 'request_execution'`,
   so any approval raised by the newer `run` tool was invisible — no card, no
   feedback, nothing to self-heal, forcing the operator to the Ops page with
   zero acknowledgement in the conversation. This was the actual proximate
   cause of last night's destroy-135 session. Fixed to match on response
   shape, not tool name, so it doesn't silently break again for the next new
   gated tool.

3. Nomos was telling operators "type something like 'I confirm destroy 135'"
   for destructive actions (SOUL.md) but no backend path ever consumed that
   phrase — chat-assent explicitly (and correctly) excludes destructive from
   loose assent, but I never built the alternative. Added
   isTypedConfirmation() (cmd/nomos/assent.go): stricter than loose assent,
   requires an explicit "confirm" statement, only applies to destructive-
   flagged pending approvals.

4. InlineApproval's completed-state hardcoded "Provisioned successfully" —
   wrong/confusing for a destroy or arbitrary `run` command. Now says
   "Completed on <target>" and shows the actual command output, verified live
   against the real destroy-135 execution.

Verified live in a real browser against the production API/DB (dev server
proxying to :8090): the historical stuck session now retroactively renders
both executions as resolved with correct wording and real output.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/nomos/agent.go

@@ -170,14 +170,22 @@ func (a *agent) chat(ctx context.Context, sessionID, message string, emit func(a
 	// authorization ("go ahead", "yes", ...), grant them now — this is the
 	// primary approval path; the Approve button in the UI is a fallback for
 	// when the operator wants to click instead of type. Destructive-risk
-	// actions are never granted by loose assent.
-	if pending := extractPendingApprovals(lastAssistantCalls); len(pending) > 0 && isAssent(message) {
+	// actions are never granted by loose assent — they need the stricter
+	// isTypedConfirmation ("I confirm ...", per SOUL.md's guidance for what
+	// to ask the operator to type).
+	pending := extractPendingApprovals(lastAssistantCalls)
+	assent := isAssent(message)
+	typedConfirm := isTypedConfirmation(message)
+	if len(pending) > 0 && (assent || typedConfirm) {
 		var granted, blocked []string
 		for _, p := range pending {
-			if p.destructive {
+			if p.destructive && !typedConfirm {
 				blocked = append(blocked, p.execID)
 				continue
 			}
+			if !p.destructive && !assent {
+				continue // typed-confirm alone doesn't grant a non-destructive item without also reading as assent
+			}
 			ok, status, aerr := a.approveExecution(ctx, p.execID)
 			if aerr != nil {
 				slog.Error("nomos: chat-assent approve", "execution", p.execID, "error", aerr)

cmd/nomos/assent.go

@@ -85,6 +85,23 @@ func isAssent(msg string) bool {
 	return false
 }
 
+// isTypedConfirmation reports whether msg is an explicit confirmation strong
+// enough to grant a DESTRUCTIVE pending action. Deliberately a separate,
+// stricter check from isAssent: a bare "yes"/"go ahead"/"proceed" must never
+// grant something destructive, only an explicit "confirm" statement does —
+// this is the typed-confirmation phrase SOUL.md tells the operator to use
+// ("I confirm destroy 135"). Still negation-aware for the same reason as
+// isAssent: "don't confirm yet" must not accidentally match.
+func isTypedConfirmation(msg string) bool {
+	m := " " + strings.ToLower(strings.TrimSpace(msg)) + " "
+	for _, w := range negationWords {
+		if strings.Contains(m, " "+w+" ") || strings.HasPrefix(strings.TrimSpace(m), w+" ") || strings.HasPrefix(strings.TrimSpace(m), w+",") {
+			return false
+		}
+	}
+	return strings.Contains(m, "confirm")
+}
+
 // approveExecution grants (or denies) a pending execution via the same HTTP
 // endpoint the chat UI's Approve button calls, so both paths share one code
 // path server-side (executeApprovedAction) and one audit trail. Returns the

cmd/nomos/assent_test.go

@@ -45,6 +45,29 @@ func TestIsAssent_NegationBeatsAssentWord(t *testing.T) {
 	}
 }
 
+func TestIsTypedConfirmation(t *testing.T) {
+	positive := []string{
+		"I confirm destroy 135 in strong",
+		"confirm",
+		"Confirmed.",
+		"yes I confirm",
+	}
+	for _, c := range positive {
+		if !isTypedConfirmation(c) {
+			t.Errorf("isTypedConfirmation(%q) = false, want true", c)
+		}
+	}
+	negative := []string{
+		"yes", "go ahead", "do it", "proceed", "lgtm", // loose assent must NOT satisfy this
+		"no, don't confirm yet", "wait", "",
+	}
+	for _, c := range negative {
+		if isTypedConfirmation(c) {
+			t.Errorf("isTypedConfirmation(%q) = true, want false (only explicit confirm should pass)", c)
+		}
+	}
+}
+
 func TestExtractPendingApprovals(t *testing.T) {
 	mkCall := func(text string) persistedCall {
 		b, _ := json.Marshal(text)