feat(policy): add agentic approval loop (#1528)

.github/workflows/docker-build.yml

@@ -162,7 +162,7 @@ jobs:
       cargo-version: ${{ inputs['cargo-version'] }}
       image-tag: ${{ needs.resolve.outputs.image_tag_base }}
       checkout-ref: ${{ inputs['checkout-ref'] }}
-      features: openshell-core/dev-settings
+      features: ${{ inputs.component == 'gateway' && 'openshell-core/dev-settings bundled-z3' || 'openshell-core/dev-settings' }}
       artifact-name: ${{ needs.resolve.outputs.artifact_prefix }}-linux-${{ matrix.arch }}
     secrets: inherit
 

.github/workflows/e2e-test.yml

@@ -89,6 +89,10 @@ jobs:
           chown openshell-test: "/run/user/$(id -u openshell-test)"
           chmod 700 "/run/user/$(id -u openshell-test)"
           chown -R openshell-test: .
+          mkdir -p /home/openshell-test/.cache/mise /home/openshell-test/.cargo /home/openshell-test/.local/state/mise
+          chown -R openshell-test: /home/openshell-test/.cache /home/openshell-test/.cargo /home/openshell-test/.local
+          install -m 0755 "$(command -v mise)" /usr/local/bin/mise
+          chmod a+x /root /root/.local /root/.local/bin
           for dir in /root/.cargo /root/.rustup /root/.local/share/mise /opt/mise; do
             [ -d "$dir" ] && chmod -R a+rX "$dir"
           done
@@ -107,9 +111,12 @@ jobs:
             runuser -u openshell-test -- env \
               XDG_RUNTIME_DIR="/run/user/${TESTUID}" \
               HOME="/home/openshell-test" \
-              PATH="/root/.cargo/bin:/opt/mise/shims:/opt/mise/bin:${PATH}" \
-              CARGO_HOME="/root/.cargo" \
+              PATH="/usr/local/bin:/root/.cargo/bin:/opt/mise/shims:/root/.local/bin:${PATH}" \
+              CARGO_HOME="/home/openshell-test/.cargo" \
               RUSTUP_HOME="/root/.rustup" \
+              MISE_DATA_DIR="/opt/mise" \
+              MISE_CACHE_DIR="/home/openshell-test/.cache/mise" \
+              MISE_STATE_DIR="/home/openshell-test/.local/state/mise" \
               OPENSHELL_SUPERVISOR_IMAGE="${OPENSHELL_SUPERVISOR_IMAGE}" \
               OPENSHELL_REGISTRY="${OPENSHELL_REGISTRY}" \
               OPENSHELL_REGISTRY_HOST="${OPENSHELL_REGISTRY_HOST}" \

.github/workflows/release-dev.yml

@@ -435,7 +435,7 @@ jobs:
         run: |
           set -euo pipefail
           mise x -- rustup target add ${{ matrix.target }}
-          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway
+          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway --features bundled-z3
           mkdir -p artifacts/bin
           install -m 0755 target/${{ matrix.target }}/release/openshell-gateway artifacts/bin/openshell-gateway
 
@@ -445,6 +445,11 @@ jobs:
           OUTPUT="$(artifacts/bin/openshell-gateway --version)"
           echo "$OUTPUT"
           grep -q '^openshell-gateway ' <<<"$OUTPUT"
+          ldd artifacts/bin/openshell-gateway || true
+          if ldd artifacts/bin/openshell-gateway | grep -q 'libz3'; then
+            echo "gateway binary must not depend on shared libz3; build with bundled-z3" >&2
+            exit 1
+          fi
 
       - name: Verify glibc symbol floor
         run: tasks/scripts/verify-glibc-symbols.sh 2.31 artifacts/bin/openshell-gateway

.github/workflows/release-tag.yml

@@ -469,7 +469,7 @@ jobs:
         run: |
           set -euo pipefail
           mise x -- rustup target add ${{ matrix.target }}
-          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway
+          mise x -- cargo zigbuild --release --target ${{ matrix.zig_target }} -p openshell-server --bin openshell-gateway --features bundled-z3
           mkdir -p artifacts/bin
           install -m 0755 target/${{ matrix.target }}/release/openshell-gateway artifacts/bin/openshell-gateway
 
@@ -479,6 +479,11 @@ jobs:
           OUTPUT="$(artifacts/bin/openshell-gateway --version)"
           echo "$OUTPUT"
           grep -q '^openshell-gateway ' <<<"$OUTPUT"
+          ldd artifacts/bin/openshell-gateway || true
+          if ldd artifacts/bin/openshell-gateway | grep -q 'libz3'; then
+            echo "gateway binary must not depend on shared libz3; build with bundled-z3" >&2
+            exit 1
+          fi
 
       - name: Verify glibc symbol floor
         run: tasks/scripts/verify-glibc-symbols.sh 2.31 artifacts/bin/openshell-gateway

.github/workflows/rust-native-build.yml

@@ -245,6 +245,10 @@ jobs:
           # Record linkage so image runtime drift is visible in logs.
           ldd --version
           ldd "$BIN" || true
+          if [[ "${{ inputs.component }}" == "gateway" ]] && ldd "$BIN" | grep -q 'libz3'; then
+            echo "gateway binary must not depend on shared libz3; enable bundled-z3 for image artifacts" >&2
+            exit 1
+          fi
 
       - name: Verify glibc symbol floor
         if: inputs.component == 'gateway'