Require review before activating changed schedules

[owainlewis]

Goal

Prevent an agent-authored file change from silently creating or changing unattended recurring execution.

Context

Push currently lets an allowed conversation ask an agent to write complete job runbooks directly under the assistant repository. Preserve that useful direct-authoring flow, but treat schedule activation as a separate high-impact capability.

Scope

• Allow agents to continue creating and editing complete Markdown job files.
• Detect every new or materially changed enabled scheduled trigger.
• Keep an unapproved new or changed schedule inactive without preventing validation or manual inspection.
• Present the exact job name, content revision, schedule, backend, timeout, work directory, and delivery target for review.
• Bind approval to the allowlisted owner identity and the exact validated content revision.
• Revalidation or any file change invalidates stale approval.
• Persist approval so restarts do not lose an accepted schedule.
• Preserve existing installed schedules through an explicit, tested migration rule.
• Record proposed, approved, rejected, invalidated, and activated events in durable history and the audit log.
• Support review without introducing a UI. Use existing channel-aware durable questions and/or explicit CLI commands.

Non-goals

• Do not require approval to save a draft file or run validation.
• Do not give jobs permission to approve themselves.
• Do not restore removed permission-profile machinery.
• Do not add remote administration or a web server.

Acceptance criteria

• A newly authored enabled trigger cannot run before approval.
• Manual jobs and disabled triggers remain editable without activation approval.
• Approval is bound to both owner identity and exact content hash.
• Editing a reviewed job invalidates its schedule approval before the changed schedule can run.
• Duplicate, expired, mismatched, and replayed approvals fail closed.
• Existing installations retain their intended schedules through a documented migration.
• Tests cover restart, revision race, symlink/path replacement, invalid job edits, multiple channels, duplicate approval, rejection, and scheduler wake-up behavior.
• Security, jobs, service, and CLI documentation describe the activation boundary.

Verify

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked

[owainlewis]

Implemented in draft PR #177: #177

Verification on the final 4d83511-based state:

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked (398 unit, 2 docs, 14 init CLI, 14 JSON CLI, 3 crash tests)
• strict MkDocs build and diff hygiene
• two independent final reviews with no actionable findings
• GitHub CI passed on docs, Ubuntu, and macOS

The PR remains draft and has not been merged.