feat: appove and go

packages/casan-harness/scripts/bash/goal-patch-executor.py

@@ -97,14 +97,29 @@ def _manifest_for_files(files: list[str]) -> dict:
 
 def verification_commands(files: list[str], manifest: dict | None = None) -> list[list[str]]:
     project = manifest or _manifest_for_files(files)
-    return [["git", "diff", "--check", "--", *files], *PROJECT_MANIFEST.verification_commands(project, files)]
+    # `git apply --check --whitespace=error` already validates the exact patch
+    # before mutation. Runtime images intentionally do not need repository
+    # metadata, so post-apply verification is limited to manifest build/tests.
+    return PROJECT_MANIFEST.verification_commands(project, files)
+
+
+def ready_for_apply(job: dict) -> bool:
+    if not job.get("patch_artifact"):
+        return False
+    if job.get("status") == "requires_approval":
+        return True
+    return (
+        job.get("status") == "failed"
+        and job.get("error") == "GOAL_APPLY_VERIFICATION_FAILED_ROLLED_BACK"
+    )
 
 
 def execute(job_path: str, actor: str) -> dict:
     job = load(job_path)
-    if job.get("status") != "requires_approval" or not job.get("patch_artifact"):
+    if not ready_for_apply(job):
         raise RuntimeError("GOAL_APPLY_JOB_NOT_READY")
     proposal = verify_approval(job)
+    job.setdefault("approval", {})["status"] = "approved"
     if proposal.get("approver") != actor:
         raise PermissionError("GOAL_APPLY_APPROVER_IDENTITY_MISMATCH")
     artifact = job["patch_artifact"]
@@ -135,7 +150,8 @@ def execute(job_path: str, actor: str) -> dict:
         rollback = run(["git", "apply", "--reverse", patch_path], 30)
         if rollback.returncode != 0:
             raise RuntimeError("GOAL_APPLY_ROLLBACK_FAILED")
-        job.update(status="failed", error="GOAL_APPLY_VERIFICATION_FAILED_ROLLED_BACK", verification=checks, finished_at=now(), updated_at=now())
+        artifact["status"] = "awaiting_apply_retry"
+        job.update(status="requires_approval", error="GOAL_APPLY_VERIFICATION_FAILED_ROLLED_BACK", patch_artifact=artifact, verification=checks, finished_at=now(), updated_at=now())
         save(job_path, job)
         raise