feat: add governed chat agent selection

packages/casan-control-panel/backend/test/chat.test.ts

@@ -6,6 +6,7 @@ import { join } from 'node:path';
 import { ChatService } from '../src/chat/chat.service.js';
 
 const viewer = { actor: 'chat-viewer', role: 'viewer', project: 'default', tenant: 'default' };
+const operator = { actor: 'chat-operator', role: 'operator', project: 'default', tenant: 'default' };
 
 function withTempChatState(fn: () => void) {
   const saved = {
@@ -66,15 +67,38 @@ test('chat ask marks side-effect requests unsupported in MVP-0', () => {
 test('chat ask executes registered operator action through action-gate', () => {
   withTempChatState(() => {
     const svc = new ChatService();
-    const actions = svc.listActions(viewer) as any;
+    const actions = svc.listActions(operator) as any;
     assert.ok(actions.actions.some((a: any) => a.id === 'run-chat-tests'));
+    const agents = svc.listAgents(operator) as any;
+    assert.ok(agents.agents.some((a: any) => a.id === 'ops-operator' && a.allowed_for_role === true));
 
-    const res = svc.ask({ message: 'run tests', chatId: 'operator-chat' }, viewer) as any;
+    const res = svc.ask({
+      message: 'run tests',
+      chatId: 'operator-chat',
+      agentId: 'ops-operator',
+      skillId: 'registered-actions',
+    }, operator) as any;
     assert.equal(res.success, true);
     assert.equal(res.mode, 'OPERATOR');
     assert.equal(res.decision, 'ACTION_COMPLETED');
     assert.equal(res.action.id, 'run-chat-tests');
     assert.equal(res.action_gate.outcome, 'ALLOW');
+    assert.equal(res.agent_binding.agent_selected, 'ops-operator');
+    assert.equal(res.agent_binding.skill_selected, 'registered-actions');
     assert.equal(res.audit_verify.ok, true);
   });
 });
+
+test('chat ask denies selected agent outside actor role', () => {
+  withTempChatState(() => {
+    const svc = new ChatService();
+    const agents = svc.listAgents(viewer) as any;
+    assert.ok(agents.agents.some((a: any) => a.id === 'ops-operator' && a.allowed_for_role === false));
+
+    const res = svc.ask({ message: 'run tests', agentId: 'ops-operator' }, viewer) as any;
+    assert.equal(res.success, false);
+    assert.equal(res.decision, 'DENIED');
+    assert.equal(res.agent_selected, 'ops-operator');
+    assert.equal(res.reason, 'role_not_allowed_for_agent');
+  });
+});