fix(ingest): bind an inferred approval to the action that was approved

[blitzcrieg1]

The bug

infer_approval_payloads matched a pending approval to an executed call by tool name only. It even unpacked the executed hash and then discarded it:

qualified, _server, _hash = _tool_ident(canonical)   # _hash never used
for i, pending in enumerate(bucket):
    if not pending["tool"] or pending["tool"] == qualified:

So an approval for Bash(rm -rf /tmp/x) was silently consumed by a later Bash(ls), and the trail then asserted a human had approved an action they never saw. For a tool whose central claim is recording what the human approved, that is the wrong thing to be wrong about.

This is the "diff between what the agent proposed and what actually ran" gap raised in the r/ClaudeAI feedback. The denial path already bound by hash (rules.py:350-374); the approval path did not.

The fix

Match on the most specific identity both sides carry, mirroring the precedence rule_approval_denied_then_executed already uses:

1. tool name must agree (unchanged)
2. if both sides carry an input_hash, they must be equal
3. otherwise fall back to name only, for pre-hash adapters

An approval recorded with no tool name still matches anything, as before.

What a mismatch now produces

The approval is not consumed, so it stays pending and resolves as inferred:session_ended_pending (denied) at session end. The trail then shows both halves of the gap:

• an approval request that was never satisfied, carrying the proposed input_hash
• a successful tool call carrying a different hash and no approval

That is the proposed-versus-executed diff recorded honestly, and it means autonomous-unapproved-write can fire on the call that actually ran instead of being masked by a bogus approval.

Tests

Five cases in test_external_ingest.py: exact-hash bind, mismatch on the same tool, name fallback when a hash is absent, cross-tool isolation, and finding the correct approval past a queued mismatched one.

Verified they catch the regression: restoring the old name-only matcher fails exactly the two tests that pin the new behaviour, while the other twelve still pass (so existing semantics are preserved).

319 passed, ruff clean.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.