feat: queue Agent Lightning approvals

Author: lcalderon

README.md

@@ -337,6 +337,21 @@ flowchart LR
 
 The Library counts `.md`, `.mdx`, and `.txt` files from configured collections. Memory entries live in separate memory services and SQLite tables, so a collection file count is not the same thing as total memories.
 
+## Agent Lightning Approvals
+
+Sous Vide approvals are intentionally two-step:
+
+1. The UI/API approval moves the proposal into a durable `approved/` work queue.
+2. The worker CLI applies queued approvals and archives the proposal for audit history.
+
+Qwen is the default executor assignment for this queue:
+
+```bash
+npm --prefix apps/kitchen run apo:worker -- --executor qwen
+```
+
+Use `APO_APPROVAL_CLI=qwen` to keep that default for scheduled runs, or pass `--executor codex` / `--executor claude` when you explicitly want a different CLI to own the implementation pass.
+
 ## Security Model
 
 Kitchen is built for private-network production first.

apps/kitchen/package.json

@@ -8,6 +8,7 @@
     "build": "next build",
     "start": "next start",
     "start:all": "bash ../../start.sh",
+    "apo:worker": "node ../../scripts/apply-agent-lightning-approvals.mjs",
     "check:agents": "node ../../scripts/check-agent-systems.mjs",
     "curate:skills": "node ../../scripts/curate-agent-skills.mjs",
     "install:skill-curation": "node ../../scripts/install-skill-curation-launchd.mjs",

apps/kitchen/src/app/api/apo/__tests__/route.test.ts

@@ -59,18 +59,62 @@ describe("POST /api/apo approve", () => {
     rmSync(root, { recursive: true, force: true });
   });
 
-  it("appends the APO constraint to the target skill and archives the proposal", async () => {
+  it("queues an approved proposal without mutating the target skill", async () => {
     const { POST } = await loadRoute();
 
     const response = await POST(makeApproveRequest({ action: "approve", proposalId: proposalFilename }));
     const body = await response.json();
 
     expect(response.status).toBe(200);
-    expect(body).toMatchObject({ ok: true, proposalId: proposalFilename, skillId: "ceo", archived: true, applied: true });
-    expect(readFileSync(path.join(skillsPath, "ceo", "SKILL.md"), "utf-8")).toContain(
+    expect(body).toMatchObject({
+      ok: true,
+      proposalId: proposalFilename,
+      skillId: "ceo",
+      queued: true,
+      targetKind: "skill",
+      executorCli: "qwen",
+    });
+    expect(readFileSync(path.join(skillsPath, "ceo", "SKILL.md"), "utf-8")).not.toContain(
       "CRITICAL: Check provider auth before retrying blocked work."
     );
     expect(existsSync(path.join(proposalsPath, proposalFilename))).toBe(false);
+    expect(existsSync(path.join(proposalsPath, "approved", proposalFilename))).toBe(true);
+    expect(existsSync(path.join(proposalsPath, "approved", `${proposalFilename}.json`))).toBe(true);
+  });
+
+  it("lists queued approvals separately from pending and archived proposals", async () => {
+    const { GET, POST } = await loadRoute();
+
+    await POST(makeApproveRequest({ action: "approve", proposalId: proposalFilename }));
+    const response = await GET();
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.stats).toMatchObject({ pendingProposals: 0, approvedProposals: 1, archivedProposals: 0 });
+    expect(body.proposals[0]).toMatchObject({ id: proposalFilename, status: "approved" });
+  });
+
+  it("applies queued approved proposals and archives them from the worker action", async () => {
+    const { POST } = await loadRoute();
+
+    await POST(makeApproveRequest({ action: "approve", proposalId: proposalFilename }));
+    const response = await POST(makeApproveRequest({ action: "process-approved" }));
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toMatchObject({ ok: true, processed: 1, failed: 0 });
+    expect(body.results[0]).toMatchObject({
+      ok: true,
+      proposalId: proposalFilename,
+      skillId: "ceo",
+      archived: true,
+      applied: true,
+      executorCli: "qwen",
+    });
+    expect(readFileSync(path.join(skillsPath, "ceo", "SKILL.md"), "utf-8")).toContain(
+      "CRITICAL: Check provider auth before retrying blocked work."
+    );
+    expect(existsSync(path.join(proposalsPath, "approved", proposalFilename))).toBe(false);
     expect(existsSync(path.join(proposalsPath, "archived", proposalFilename))).toBe(true);
   });
 
@@ -97,7 +141,13 @@ describe("POST /api/apo approve", () => {
     const body = await response.json();
 
     expect(response.status).toBe(200);
-    expect(body).toMatchObject({ ok: true, proposalId: staffProposal, skillId: "chief-of-staff", targetKind: "agent" });
+    expect(body).toMatchObject({ ok: true, proposalId: staffProposal, skillId: "chief-of-staff", targetKind: "agent", queued: true });
+    expect(readFileSync(path.join(agentsPath, "chief_of_staff", "AGENTS.md"), "utf-8")).not.toContain(
+      "CRITICAL: Check provider auth before retrying blocked work."
+    );
+
+    const applyResponse = await POST(makeApproveRequest({ action: "apply-approved", proposalId: staffProposal }));
+    expect(applyResponse.status).toBe(200);
     expect(readFileSync(path.join(agentsPath, "chief_of_staff", "AGENTS.md"), "utf-8")).toContain(
       "CRITICAL: Check provider auth before retrying blocked work."
     );