Q110: an approval pins the content it approved, and later changes show against it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/shared/approval-pin.ts

@@ -0,0 +1,15 @@
+/** Exactly what an approved deliverable was when the board approved it. */
+export type ApprovalPin =
+  | { kind: "file"; storagePath: string; sha256: string }
+  | { kind: "document"; documentId: string; version: number };
+
+/** How an approved deliverable stands now against its pin. */
+export type ApprovalDrift = "changed" | "removed";
+
+/** The pin of an approval, or null when it carries none (task approvals keep a task snapshot instead). */
+export function parseApprovalPin(subjectSnapshot: string | null): ApprovalPin | null {
+  if (!subjectSnapshot) return null;
+  const value = JSON.parse(subjectSnapshot) as Partial<ApprovalPin> & { kind?: string };
+  if (value.kind === "file" || value.kind === "document") return value as ApprovalPin;
+  return null;
+}

src/shared/desktop-api.ts

@@ -1,3 +1,4 @@
+import type { ApprovalDrift } from "./approval-pin";
 import type { DesktopResult } from "./result";
 import type { AppSnapshot, SearchResultRecord } from "./domain";
 import type { ProviderModelEntry } from "./provider-models";
@@ -203,6 +204,8 @@ export interface DesktopApi {
   disconnectComposioToolkit(input: DisconnectComposioToolkitInput): Promise<DesktopResult<AppSnapshot>>;
   refreshComposioAccounts(input: RefreshComposioAccountsInput): Promise<DesktopResult<AppSnapshot>>;
   grantConnector(input: GrantConnectorInput): Promise<DesktopResult<AppSnapshot>>;
+  /** Approved deliverables whose content changed or vanished since approval, checked on disk now. */
+  approvalDrifts(input: { orgId: string }): Promise<DesktopResult<Record<string, ApprovalDrift>>>;
   revokeConnector(input: RevokeConnectorInput): Promise<DesktopResult<AppSnapshot>>;
   search(input: SearchInput): Promise<DesktopResult<SearchResultRecord[]>>;
   subscribe(callback: (event: RendererEvent) => void): () => void;

src/shared/domain.ts

@@ -179,6 +179,8 @@ export interface ApprovalRecord {
   requestedById: string | null;
   sourceEntityType: string | null;
   sourceEntityId: string | null;
+  /** JSON of what the approval covers: a task snapshot, or the pin of an approved deliverable. */
+  subjectSnapshot: string | null;
   state: ApprovalState;
   decisionNotes: string | null;
   decidedByEmployeeId: string | null;

src/shared/ipc.ts

@@ -86,6 +86,7 @@ export const IPC_CHANNELS = {
   disconnectComposioToolkit: "agentcompany:disconnect-composio-toolkit",
   refreshComposioAccounts: "agentcompany:refresh-composio-accounts",
   grantConnector: "agentcompany:grant-connector",
+  approvalDrifts: "agentcompany:approval-drifts",
   revokeConnector: "agentcompany:revoke-connector",
   search: "agentcompany:search",
   rendererEvent: "agentcompany:renderer-event",