P2 BLOCKING exit green: approval interception chain end-to-end

- tc-tools: Effect declarations -> §15 GatedCategory mapping, deny-by-default
  external reach, taint invariant property-tested (tainted external effects
  are NEVER auto-allowed)
- tc-safety: pending approvals with exact payload+preview, CAS decide with
  audit + single-use grant in one tx, checkpoint suspend/load, exclusive
  resume claim, expiry sweep, decided-unresumed work queue (migration 0004
  adds the outbox the gated email.send tool writes)
- tc-runtime: resumable LoopState checkpointed to agent_runs; gated tool ->
  approval row -> approval_required/run_suspended events -> suspend; resume
  consumes the grant BEFORE executing (spent grant = no execution), rejection
  feeds a structured refusal in-band; durable resume sweeper; continuous
  journal seq across suspension (tested). ContentPart::Text became a struct
  variant — internally-tagged newtype primitives don't serialize
- tc-api: GET/decide approvals endpoints (409 double-decide, tenant
  isolation), decision triggers in-process resume; full chain proven over
  HTTP incl. gateway resumeFrom continuation
- frontend: approval_required/run_suspended events, suspended reply state,
  inline ApprovalCard (§10: summary, category, exact payload preview,
  approve/reject -> decide + stream re-attach), /approvals queue page, nav
- E2E (14 journeys, workers:1 to serialize the shared backend): gated email
  blocks with disabled composer -> approve -> continuation + ✓ step + reload
  replay; reject -> ✗ step, nothing executed; queue page decides pending

106 Rust + 61 frontend tests + 14 Playwright journeys green.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-safety/src/lib.rs

@@ -0,0 +1,111 @@
+//! The approval state machine (spec §15, acceptance-blocking).
+//!
+//! A gated tool call becomes a pending approval with the exact payload and
+//! rendered preview. Decisions are idempotent compare-and-swaps audited in
+//! the same transaction; approval mints a single-use execution grant the
+//! executor must consume before the action runs. Suspended runs checkpoint
+//! their full state and are claimed for resume exactly once.
+
+pub mod approvals;
+pub mod checkpoint;
+pub mod grants;
+
+use serde::{Deserialize, Serialize};
+use tc_domain::{AgentId, GatedCategory, UserId, WorkspaceId};
+use time::OffsetDateTime;
+use uuid::Uuid;
+
+#[derive(Debug, thiserror::Error)]
+pub enum SafetyError {
+    #[error("approval not found")]
+    NotFound,
+    #[error("approval already decided")]
+    AlreadyDecided,
+    #[error("no consumable grant for this approval")]
+    GrantUnavailable,
+    #[error(transparent)]
+    Db(#[from] sqlx::Error),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ApprovalStatus {
+    Pending,
+    Approved,
+    Rejected,
+    Expired,
+}
+
+impl ApprovalStatus {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            ApprovalStatus::Pending => "pending",
+            ApprovalStatus::Approved => "approved",
+            ApprovalStatus::Rejected => "rejected",
+            ApprovalStatus::Expired => "expired",
+        }
+    }
+}
+
+impl std::str::FromStr for ApprovalStatus {
+    type Err = String;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "pending" => Ok(ApprovalStatus::Pending),
+            "approved" => Ok(ApprovalStatus::Approved),
+            "rejected" => Ok(ApprovalStatus::Rejected),
+            "expired" => Ok(ApprovalStatus::Expired),
+            other => Err(format!("unknown approval status: {other}")),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Decision {
+    Approve,
+    Reject,
+}
+
+/// Input for a new pending approval.
+#[derive(Debug, Clone)]
+pub struct NewApproval {
+    pub workspace_id: WorkspaceId,
+    pub run_id: Uuid,
+    pub session_key: String,
+    pub action_type: String,
+    pub category: GatedCategory,
+    /// The exact tool input that will execute on approval.
+    pub payload: serde_json::Value,
+    /// The exact rendering shown to the human (§10 approval card).
+    pub preview: serde_json::Value,
+    pub requested_by_agent: AgentId,
+    pub taint_sources: Vec<String>,
+    pub expires_at: Option<OffsetDateTime>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Approval {
+    pub id: Uuid,
+    pub workspace_id: WorkspaceId,
+    pub run_id: Uuid,
+    pub session_key: String,
+    pub action_type: String,
+    pub category: GatedCategory,
+    pub payload: serde_json::Value,
+    pub preview: serde_json::Value,
+    pub requested_by_agent: AgentId,
+    pub taint_sources: Vec<String>,
+    pub status: ApprovalStatus,
+    pub decided_by: Option<UserId>,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+}
+
+/// A decided approval whose suspended run has not been resumed yet.
+#[derive(Debug, Clone, Copy)]
+pub struct ResumeReady {
+    pub run_id: Uuid,
+    pub approval_id: Uuid,
+    pub approved: bool,
+}