Sync action decisions to gatekeepers in batches

[ndisidore]

Stacked on #238. This is the overseer side of the batch contract: AutoApprovalDrainer evolves in place into ActionSyncDriver (action-sync.ts), and the per-action gatekeeper calls are gone from the overseer.

A sync pass snapshots the gatekeeper's records, computes the decision frontier (staged manual approvals, then auto-approval rules walking upward exactly like the old drain, then any vetoes deliverable at that point), makes one applyActionsThrough(frontier, vetoes) call, and translates the result back: covered records become approved with the right attribution (captured before the RPC, so this stays the single pending→approved chokepoint), a stopped action stays pending with a display-safe failure, and invalidatedByVeto entries become rejected with cascadedFrom + the vetoing user's identity. Passes are single-flight per gatekeeper — two simultaneous approvals coalesce into one call at the higher frontier.

For approve/reject semantics: approving stages the frontier and awaits the pass (still throws → toast if its action couldn't be applied), and attribution is bookkept honestly — earlier actions riding along under your approval are audited as resolved by you, auto-extended ones by whoever enabled the rule. Rejecting is decided synchronously and never advances the frontier; the veto is marked with a durable vetoPending flag and delivered opportunistically on the next pass, so a reject never blocks on (or races) a gatekeeper RPC.

Un-migrated gatekeepers still work: on workerd's method-missing error the driver falls back to legacy per-action calls in batch order, caches the verdict per isolate, and logs a warning — that log going quiet is the signal to delete the fallback.

Driver behavior is pinned in __tests__/action-sync.test.ts (attribution, manual gates, stopped/retry, veto durability across hibernation, cascades, coalescing, fallback ordering).

[ask-bonk]

github run

[ask-bonk]

@ndisidore Bonk workflow failed. Check the logs for details.

View workflow run · To retry, trigger Bonk again.

[ask-bonk]

github run

[ask-bonk]

APIError: Invalid Anthropic API Key

github run

[ask-bonk]

APIError: Invalid Anthropic API Key

github run

[ask-bonk]

APIError: Invalid Anthropic API Key

github run