feat(orchestrator): W1 operator tasks, diff previews and bound commit asks

Operator tasks move from the Inbox into Tasks with the Waits on Operator filter. Review and commit asks carry the staged diff; a file whose old or new blob holds an armour line or a detection-pattern match, or every file when no pattern loads, ships only its path, status, mode and counts. The approval binds to the staged tree id from git write-tree, the encoded request body respects the hub limit, and the hub image ships every client module signed.py loads. Committed below the bar on the operator's word 2026-11-12 (no further per-bundle tests, one gate after the merge): the full hub suite and the W1 e2e never ran, two high MEDUSA rows (sandbox_paths.py FLOOR, permission_hook.py ask POST) wait for their acceptance.

🎯 Fix: 85 %
💥 Break: 12 %
💸 Cost: 30 %
⏱️ Time: 30 %
🛡️ Security: 50 %
🏆 Score: 100
🚦 Gate: ⛔ fix 85 % < 90, break 12 % > 5; security 50 % < 100: ask the operator before the commit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/client/approval.py

@@ -9,10 +9,21 @@
         fetches the review's signature from the Agent Orchestrator on 127.0.0.1:<port>
         and checks it against the repository, worktree, branch and the tree
         git write-tree prints, as this process sees them.
+    request --port <port> --title <subject> --page <file> --notes <file>
+        --gate <pass|fail> --score <line> --agent <name> [--rules <dir>]:
+        run in the worktree; asks the operator to approve the staged tree,
+        with the repository, worktree, branch and tree as git prints them
+        here, the notes file's text (refused past NOTES_LIMIT characters),
+        and the diff of the tree git write-tree prints against HEAD
+        (staged_diff.tree_diff, content withheld per the MEDUSA rules under
+        <dir>, by default those of the pipx install); without the diff when
+        the body would pass DIFF_BODY_LIMIT.
 
 Returns:
     pin: exit code 0 and the pinned credential on stdout; 1 and the reason
         on stderr when the blob is no valid registration.
+    request: exit code 0 and the hub's {"id", "status", "url"} on stdout;
+        1 and the reason on stderr.
     verify: exit code 0 when a pinned key signed this exact commit; 1 and
         the reason on stderr otherwise. Commit only on 0.
 """
@@ -21,28 +32,24 @@ from __future__ import annotations
 
 import argparse
 import json
-import subprocess
 import sys
 import time
 import urllib.request
 from pathlib import Path
 
+import staged_diff
 from hub_api import GUARD, SLACK, base_url, load
+from hub_limits import DIFF_BODY_LIMIT, NOTES_LIMIT
 from passkey import attested, b64decode
 from signing import ALGORITHMS, ID, Refused, origin_of, review_item
 from verifier import Trust, check, pin
 
-GIT_TIMEOUT = 30
-
 
 def git(cwd: Path, args: list[str]) -> str:
     try:
-        done = subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True, timeout=GIT_TIMEOUT, check=False)
-    except (OSError, subprocess.TimeoutExpired) as error:
-        raise Refused(f"git {args[0]} did not run: {error}") from error
-    if done.returncode != 0:
-        raise Refused(f"git {' '.join(args)} failed: {done.stderr.strip()}")
-    return done.stdout.strip()
+        return staged_diff.git(cwd, args, None).decode("utf-8", "surrogateescape").strip()
+    except staged_diff.DiffError as error:
+        raise Refused(str(error)) from error
 
 
 def staged(cwd: Path, review_id: str) -> dict:
@@ -72,6 +79,38 @@ def verify_commit(args: argparse.Namespace) -> str:
     return f"verified: the operator signed review {args.review}, tree {item['tree']} on {item['branch']} in {item['worktree']}"
 
 
+def review_body(arguments: dict) -> bytes:
+    call = {"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "review_request", "arguments": arguments}}
+    return json.dumps(call, ensure_ascii=False).encode("utf-8")
+
+
+def request_review(args: argparse.Namespace) -> str:
+    cwd = Path.cwd()
+    item = staged(cwd, "0" * 16)
+    try:
+        notes = args.notes.read_text(encoding="utf-8")
+        diff = staged_diff.tree_diff(cwd, item["tree"], args.rules or staged_diff.rules_root())
+    except (OSError, ValueError, staged_diff.DiffError) as error:
+        raise Refused(f"the review cannot be prepared: {error}") from error
+    if len(notes) > NOTES_LIMIT:
+        raise Refused(f"the notes hold {len(notes)} characters, the hub takes at most {NOTES_LIMIT}")
+    arguments = {key: item[key] for key in ("repo", "worktree", "branch", "tree")}
+    arguments.update(title=args.title, page=str(args.page), notes=notes, gate=args.gate, score=args.score, agent=args.agent)
+    body = review_body({**arguments, "diff": diff})
+    if len(body) > DIFF_BODY_LIMIT:
+        print(f"approval: the review goes without its diff, its {len(body)} bytes pass the hub's {DIFF_BODY_LIMIT}", file=sys.stderr)
+        body = review_body(arguments)
+    headers = {"Content-Type": "application/json", "Accept": "application/json, text/event-stream"}
+    try:
+        answer = load(urllib.request.Request(f"{base_url(args.port)}/mcp", data=body, headers=headers, method="POST"), SLACK)
+    except (OSError, ValueError) as error:
+        raise Refused(f"the Agent Orchestrator gave no answer: {error}") from error
+    result = answer.get("result") if isinstance(answer, dict) else None
+    if not isinstance(result, dict) or result.get("isError") or not isinstance(result.get("structuredContent"), dict):
+        raise Refused(f"the Agent Orchestrator refused the review: {json.dumps(answer)[:500]}")
+    return json.dumps(result["structuredContent"])
+
+
 def pin_credential(args: argparse.Namespace) -> str:
     try:
         credential = json.loads(b64decode(args.credential, "credential"))
@@ -100,9 +139,18 @@ def main() -> int:
     verifying.add_argument("--replay", type=Path, required=True)
     verifying.add_argument("--review", type=review_id, required=True)
     verifying.add_argument("--gate", choices=("pass", "fail"), required=True)
+    requesting = commands.add_parser("request")
+    requesting.add_argument("--port", type=int, required=True)
+    for name in ("--title", "--score", "--agent"):
+        requesting.add_argument(name, required=True)
+    requesting.add_argument("--page", type=Path, required=True)
+    requesting.add_argument("--notes", type=Path, required=True)
+    requesting.add_argument("--gate", choices=("pass", "fail"), required=True)
+    requesting.add_argument("--rules", type=Path)
     args = parser.parse_args()
+    run = {"pin": pin_credential, "verify": verify_commit, "request": request_review}[args.command]
     try:
-        print(pin_credential(args) if args.command == "pin" else verify_commit(args))
+        print(run(args))
     except (Refused, OSError) as error:
         print(f"refused: {error}", file=sys.stderr)
         return 1