Clarify approval evaluation boundary

[raghubetina]

Summary

• permit read-only local inspection during phase-one semantic read-back
• keep First Draft/API, network, mutation, Compile, and Publication effects forbidden before approval
• require one continuing agent/session/context plus a durable sanitized pre-cleanup audit

Verification

• npm run check — 70/70
• exact CLI d37d8b6 package check — pass
• rebuilt plugin digest remains e89a14b7a28ec5b6384038cec106f31c7496f076344726b02b3a674b344755f5
• packaged Skill inputs and cases.json unchanged
• independent conversation-aware documentation review — pass

This is a process-only correction after an inconclusive qualification attempt. It does not change the 0.1.2 package bytes or claim that qualification has passed.

[raghubetina]

Post-merge review, hosted CI green. Small, well-aimed policy fix: phase one of the release qualification
previously read as forbidding all local activity, which made an honest semantic read-back impossible (the
agent must read the staged Plan to describe it). This PR permits read-only local inspection while keeping
First Draft API calls, network, writes, Compile, and Publication forbidden before approval, and it states the
boundary in terms of effects and capabilities rather than command names.

The effects-based framing is the part that lasted: it survived intact through #39's ceremony peak, #40's
simplification, and #41's sequence approvals. The single-continuing-session requirement (no context reset
between read-back and approved execution, so approval continuity is observable) also originates here and
remains in the current smoke. The durable sanitized pre-cleanup audit requirement was later absorbed into the
retained-transcript rule. Nothing to flag.

[raghubetina]

A one-sentence policy bug: "the agent must not run any commands before approval" sounds safe until you notice
the agent's first job is to describe a file it has not been allowed to read.

The fix distinguishes two things that loose policies blur. What an action touches (its effects) matters; what
the action is called does not. Reading the staged Plan with cat, a file API, or an editor buffer are the
same act with three names. So the amended rule permits read-only local inspection and forbids categories of
effect: API invocation, network, writes, Compile, Publication. Enumerate effects, not command names, and the
policy stops being a blocklist you can end-run with a synonym. Pundit teaches the same move: authorize the
action on the record, not the route name.

The second idea here is approval continuity. The read-back and the approved execution must happen in one
continuing agent session, no reset between phases. Why: approval attaches to a semantic model the agent
presented from its actual context. Reset the context and the thing that got approved no longer exists inside
the executor; you would be approving a screenshot of a mind that has since been replaced. Keeping one session
makes "the agent that asked is the agent that acts" an observable property rather than an assumption.

Both ideas outlived every later revision of this gate, which is a decent definition of getting the foundations
right.