Bind approvals to reviewed evidence, sandbox validation network, fix flaky test

[christopherjnelson]

Third batch of audit fixes. Three commits:

Bind the human decision to the evidence the operator reviewed (3a1e627)

• New GET /api/runs/:id/decision returns the current evidence identity: evidenceDigest, pinnedBaseCommit, workerResponseId, validationId and recommendationId.
• API change: the approve and reject calls now require evidenceDigest (64 hex characters).
  • A missing or malformed digest gets 400.
  • A digest that no longer matches the run's current evidence gets 409 with "The evidence changed since you reviewed it; refresh and review the current result before deciding."
  • This closes the race where a retry or revalidation lands between the operator reading the result and clicking Approve.
• UI: the new ui/decision-digest.ts fetches the digest keyed on the evidence identity that is on screen.
  • It refuses to send if the identity changed.
  • It uses a generation counter to drop stale responses.
  • It turns a 409 into a refresh prompt.
  • Both Approve/Reject button pairs use it.
• docs/workspace-bridge.md is updated to cover the approve step.

Run validation commands without network unless they need it (906cd75)

• With the bwrap sandbox, each validation command runs with --unshare-net unless it needs network. A check therefore cannot reach services on the host (the bridge, local databases) or cloud credential endpoints.
• Validation commands have an optional network flag.
  • When the flag is absent, the default is applied at execution time: npm, pnpm and yarn installs get network, everything else does not.
  • Because the default is not written into stored commands, older recorded runs keep the same evidence digest and still promote. A regression test in tests/recorded-integration.test.ts covers this.
• Repository inspection sets network: true on the suggested install, cargo test and go test checks.
• The open-repository dialog shows a network toggle per suggested check, and the checks pipeline shows a network badge.
• With FOREMAN_VALIDATION_SANDBOX=none nothing changes: every command keeps host networking.

Fix the flaky live Worker persistence test (734d19e)

• The test now polls the persisted file on disk instead of the in-memory store, so it no longer races the debounced write.

Verification

• Typecheck is clean.
• vitest: 514/514 passing.
• pnpm test:bridge: 54/54 passing.
• Build succeeds.
• The open-repository dialog was smoke-tested in Chromium against a real backend: 3 network toggles rendered and there were no console errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DXCvrGWmmRNDLmy7nYS2QP

---

Generated by Claude Code