feat(orchestrator): inbox console, deny by channel and agent rule requests

The inbox shows the console output of a command under its "Ausführen"
row, kept to the same tail the job list shows. A deny picks its radio
channel (post by default, call, newsletter, broadcast, pan-pan,
security) and an optional reason; the passkey signs denial, channel and
reason, the hub verifies the proof before it stores or sends anything,
and the PermissionRequest hook quotes a reason only when it verifies.

Agents ask for an auto-approval rule through the MCP tool rule_request;
the request shows in the inbox with a dry run over the last seven days
and is accepted only with a passkey assertion the hub verifies against
the pinned keys and the hub origin, for every rule kind. Requests lapse
with the ask lifetime and are capped per agent and in total.

The image runs as nobody by default and carries the health check
command; compose keeps the timing.

🎯 Fix: 93 %
💥 Break: 4 %
💸 Cost: 98 %
⏱️ Time: 75 %
🛡️ Security: 100 %
🏆 Score: 100
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/client/permission_hook.py

@@ -12,7 +12,8 @@
 Returns:
     stdout: the PermissionRequest decision JSON: allow only when a pinned
         passkey signed exactly this tool, command, cwd, session and ask id;
-        deny when the operator denied in the Agent Orchestrator. Nothing on timeout,
+        deny when the operator denied in the Agent Orchestrator, with the
+        reason only when a pinned passkey signed it. Nothing on timeout,
         error, a missing or invalid signature, a value longer than the hub
         takes or a hub that is down, so Claude Code shows its own dialog.
         The exit code is 0.
@@ -22,6 +23,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import sys
 import time
 import urllib.request
@@ -37,6 +39,8 @@ COMMAND_LIMIT = 4000
 PATH_LIMIT = 4096
 LIMITS = {"tool": NAME_LIMIT, "command": COMMAND_LIMIT, "cwd": PATH_LIMIT, "session": NAME_LIMIT, "agent": NAME_LIMIT}
 DENIED = "The operator denied this in the Agent Orchestrator."
+REASON_LIMIT = 2000
+CONTROL = re.compile(r"[\x00-\x1f\x7f]")
 
 
 def summary(tool_input: object) -> str:
@@ -74,9 +78,21 @@ def status(base: str, ask_id: str, wait: float) -> dict:
     return answer
 
 
+def denied(answer: dict, item: dict, trust: verifier.Trust) -> str:
+    reason, channel = answer.get("reason"), answer.get("channel")
+    if not isinstance(reason, str) or not isinstance(channel, str) or not reason.strip():
+        return DENIED
+    try:
+        verifier.check(answer.get("proof"), signing.denial_item(item, channel, reason), "", trust, time.time())
+    except (signing.Refused, OSError) as error:
+        print(f"kvb-orchestrator: the reason is not signed, the agent gets the denial without it: {error}", file=sys.stderr)
+        return DENIED
+    return f"{DENIED} Reason: {CONTROL.sub('?', reason.strip())[:REASON_LIMIT]}"
+
+
 def decision(answer: dict, item: dict, trust: verifier.Trust) -> dict | None:
     if answer["status"] == "denied":
-        return {"behavior": "deny", "message": DENIED}
+        return {"behavior": "deny", "message": denied(answer, item, trust)}
     if answer["status"] != "allowed":
         return None
     try:

orchestrator/client/signing.py

@@ -107,6 +107,23 @@ def office_problem(order: object) -> str | None:
     return None
 
 
+def rule_request_item(request_id: str, kind: str, tool: str, pattern: str, scope: str, expires: int) -> dict:
+    return {"kind": "rule-request", "id": request_id, "rule": kind, "tool": tool, "pattern": pattern, "scope": scope, "expires": expires}
+
+
+def denial_item(subject: dict, channel: str, reason: str) -> dict:
+    """Args:
+        subject: the item an approval of it would sign.
+        channel: the radio class that tells the requesting agent.
+        reason: the operator's reason, possibly empty.
+
+    Returns:
+        The item a denial signs: its hash never equals the subject's, so no
+        denial signature approves anything.
+    """
+    return {"kind": "deny", "subject": item_hash(subject), "channel": channel, "reason": reason}
+
+
 def approval_payload(hashes: list[str], nonce: str, expires: int) -> dict:
     return {"v": VERSION, "kind": "approve", "items": sorted(set(hashes)), "nonce": nonce, "expires": expires}