Batch action application with per-action veto

packages/gatekeeper-kit/__tests__/actions.test.ts

@@ -889,9 +889,13 @@ describe("defineActions", () => {
     }
   });
 
-  it("puts no pushedCommits key on the wire when the description declares none", async () => {
-    // Absent, not `undefined`: the overseer reads presence as "this action pushes".
-    const { actions } = bind();
+  it.each([
+    { declared: "no key", present: undefined },
+    { declared: "an empty list", present: () => ({ ...presentation, pushedCommits: [] }) },
+  ])("puts no pushedCommits key on the wire when the description declares $declared",
+      async ({ present }) => {
+    // Absent, not `undefined` or `[]`: the overseer reads presence as "this action pushes".
+    const { actions } = bind({ describe: present });
     const submitAction = submitSpy();
 
     await actions.submit(fakeQueue(submitAction), "execute", { sql: "one" });

packages/gatekeeper-kit/src/actions.ts

@@ -720,10 +720,12 @@ export function defineActions<Host, M extends Record<string, unknown>>(
             description,
             implementsRevert,
             // Spread, so an action with no fields, no git, no kind, no awaited decision, or no claim
-            // of completeness puts no key on the wire at all. A push is never complete, whatever the
-            // hook claims: the approver sees commit ids, not the bytes they carry.
+            // of completeness puts no key on the wire at all. An empty list is "no git" too: the
+            // overseer reads presence as a push, and `[]` is a push of nothing it refuses to build a
+            // pack for. A push is never complete, whatever the hook claims: the approver sees commit
+            // ids, not the bytes they carry.
             ...(fields?.length ? { fields } : {}),
-            ...(pushedCommits ? { pushedCommits } : {}),
+            ...(pushedCommits?.length ? { pushedCommits } : {}),
             ...(descriptionIsComplete === true && !pushedCommits?.length
               ? { descriptionIsComplete: true }
               : {}),

packages/integration-tests/__tests__/auto-approval-policy.test.ts

@@ -7,8 +7,8 @@
 //
 // The fixture gatekeeper's session drives this through the real ApprovalQueue funnel:
 // `writeValue()` submits a `set-value` action with the given verdict and resolves once the action
-// is decided, and `applyAction` succeeds, so the drain's submit -> auto-approve -> apply round
-// trip is the real one.
+// is decided, and `applyAction` succeeds, so the apply pass's submit -> auto-approve -> apply
+// round trip is the real one.
 
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import type { RpcStub } from "capnweb";
@@ -89,8 +89,9 @@ async function listWrites(ws: Workspace): Promise<Array<ActionLogEntry & { type:
       .toSorted((a, b) => a.id - b.id);
 }
 
-// The drain runs via ctx.waitUntil after submit, so "did not auto-approve" needs a settle window.
-// One further RPC round trip plus a beat is far beyond the drain's synchronous storage work.
+// Auto-approval runs in an apply pass via ctx.waitUntil after submit, so "did not auto-approve"
+// needs a settle window. One further RPC round trip plus a beat is far beyond that pass's
+// synchronous storage work.
 async function settle(ws: Workspace): Promise<void> {
   await ws.overseer.listActions();
   await new Promise(resolve => setTimeout(resolve, 300));
@@ -101,7 +102,7 @@ describe("auto-approval policy", () => {
     await withSession(async publicApi => {
       const ws = await newWorkspace(publicApi, "auto-happy");
       await ws.overseer.setAutoApprovedActionKind(ws.gatekeeperId, SET_VALUE);
-      // Resolves once the action is decided -- here, by the drain, with no human involved.
+      // Resolves once the action is decided -- here, by an apply pass, with no human involved.
       await expect(ws.session.writeValue(1, { autoApprovable: true }))
           .resolves.toEqual(expect.any(Number));
 

packages/workshop-backend/__tests__/action-log-pagination.test.ts

@@ -1,30 +1,16 @@
 import { describe, expect, it, vi } from "vitest";
-import type { RpcStub } from "capnweb";
-import type { ActionLogEntry, ActionsSubscriber } from "@gadgets/workshop-shared/api";
+import type { ActionLogEntry } from "@gadgets/workshop-shared/api";
 import {
   ACTION_HISTORY_PAGE_DEFAULT_LIMIT, ACTION_REPLAY_PAGE_SIZE,
 } from "../src/overseer.js";
 import { makeMockStorage } from "./mock-storage.js";
 import {
-  FIXTURE_EPOCH, makeActionStorage, makePreIndexActionStorage, openFakeOverseer, putAction,
+  FIXTURE_EPOCH, makeActionStorage, makePreIndexActionStorage, makeSubscriber, openFakeOverseer,
+  putAction,
 } from "./fixtures.js";
 
 vi.mock("capnweb-validate", () => ({ validateRpc: () => () => undefined }));
 
-// Hand-rolled ActionsSubscriber stub. `events` interleaves entry ids with "ready", so tests can
-// assert both content and ordering of the delivered stream.
-function makeSubscriber(entry?: (record: ActionLogEntry) => Promise<void>) {
-  let events: Array<number | "ready"> = [];
-  let subscriber = {
-    entry: entry ?? (async (record: ActionLogEntry) => { events.push(record.id); }),
-    ready: async () => { events.push("ready"); },
-    dup: () => subscriber,
-    onRpcBroken: () => {},
-    [Symbol.dispose]: () => {},
-  };
-  return { subscriber: subscriber as unknown as RpcStub<ActionsSubscriber>, events };
-}
-
 describe("subscribeToActions", () => {
   it("delivers no pre-existing records: ready fires immediately", async () => {
     // Live deltas only — the current pending set is queried via listActions({filter: "pending"}).