approvals: route MCP tool-call approvals through platform.approvals

[haasonsaas]

When the user connects an MCP server (filesystem, GitHub, database, etc.) and the AI calls a tool with side effects, kestrel today relies on the user's Claude Desktop-compatible config to decide what's allowed. There's no central trail of which tools were invoked, no habit-learning, no cross-device policy.

Platform's `approvals` service (`evalops/platform/internal/approvals/`) already solves this for every other consumer — `ensemble` routes through it, `chat` uses the ConnectRPC external client, and even `maestro` has an open issue (`evalops/maestro-internal#1350`) to stop using its local service and route through platform.

Ask

When `KESTREL_APPROVALS_BASE` + `KESTREL_APPROVALS_TOKEN` are set, gate MCP tool calls through `approvals.v1.ApprovalService/RequestApproval`:

• Request carries `agent_id = "kestrel-mcp-client"`, `action = <tool_name>`, `risk_level` inferred from tool schema (read → LOW, write → MEDIUM, destructive → HIGH)
• Blocking wait for decision; surface in the Electron UI as a modal with full context (tool name, arguments, server name)
• Habit-learning on the platform side means repeat-approved patterns auto-approve after N observations

Offline fallback: when platform is unreachable, fall back to today's prompt-on-first-use flow with an `approvals_offline_total` metric so ops see when it happens.

Related

• evalops/maestro-internal#1350 — same exact ask; kestrel + maestro should share the pattern
• evalops/platform#618 — habit Bayesian upgrade; kestrel approvals would flow into it
• evalops/platform#547 — governance flywheel; dev-tool approvals are the richest training signal

Scope

~3 days if written in parallel with the maestro-internal PR (shared client pattern).

[haasonsaas]

Backend approval gating is now merged via #44.

What landed:

• MCP tool execution now requests EvalOps RequestApproval before invoking the local MCP server manager.
• Kestrel polls GetApproval, denies rejected/expired/escalated requests, and uses the existing offline fallback path when EvalOps is unavailable.
• Wide events now carry approval risk, request id, decision, allowed/offline state, and the MCP manager exposes tool metadata for approval context.

Validation:

• npm run build
• git diff --check
• PR CI: Desktop build, ContextKit build, Socket checks passed. Cursor posted only a risk summary with no actionable findings.

Remaining #17 work is the dedicated Electron approval UI/modal; this PR adds the enforcement seam first so Kestrel is inside the EvalOps approvals loop.

[haasonsaas]

Closing this now that backend approval gating is merged and verified via #44.

Merged evidence:

• PR: feat: gate MCP tool calls through EvalOps approvals #44
• Merge commit: 631e18b
• Scope: MCP tool execution requests EvalOps RequestApproval, polls GetApproval, denies rejected/expired/escalated decisions, and falls back offline when EvalOps is unavailable.

The remaining work from the umbrella is now memory sync (#15), arena trace annotations (#18), and prompt sync (#19), plus the already-merged registration contract fix in #46.