Durable approval gates, cost caps, approver scoping, signed webhooks

[renezander030]

Six governance gaps, found by mining recurring pains across humanlayer, n8n, dagu, dify, langfuse, litellm and agentgateway, then checked against what draftcat already ships. Common theme: the gate must hold when things go wrong — restart, misconfig, replay, overspend, wrong approver, wrong channel.

Where nothing is configured, behavior is unchanged: no cost keys, no approvers, and no signature header all mean today's semantics.

What's in here

1. Durable approval gates — pending_approvals + reconcileInterruptedApprovals

A gate lived only in an in-process poll loop: the draft went out, the engine blocked on a ticker, and action_approvals was written only once a decision arrived. A redeploy or crash mid-approval left no trace at all — the operator saw a live-looking message with buttons attached to a run that no longer existed, and UnapprovedActions couldn't see the hole either.

A row is now written before the draft is sent, resolved on any terminal decision, and reconciled to interrupted on the next boot: an audit row so the compliance queries count it, plus a message telling the operator the action did not run.

Deliberately not resuming the run — the in-memory data context is gone after a crash. A gate whose outcome is unknown is never treated as an approval.

2. Cost caps in money — budgets.per_day_cost / per_pipeline_cost

Per-call cost was already computed from the model rates and thrown away. It now accumulates and blocks. The check sits inside check(), which already guards every LLM call, so a call site added later can't spend uncapped by forgetting to wire it.

Enforced between calls — a pre-call estimate needs the response token count, which doesn't exist yet — so one in-flight call may overshoot by at most a step. Documented; bound it with per_step_tokens. 0 = off.

3. Per-operator approver scoping — steps[].approvers

allowed_users was one flat list and quorum only a count, so whoever could approve an inbox draft could also release an invoice. Quorum says how many; this says which ones. It intersects with allowed_users and never widens, so a step can't grant rights to someone the channel doesn't already trust.

4. channel: slack validated OK but was never implemented

The validator's allow-list carried slack while no Slack channel existed and step.Channel was never read at runtime — so approvals silently went to Telegram. A gate routing somewhere the operator isn't watching is worse than no gate, because it still looks like it held.

internal/channels is now the single list both the validator and the engine read. Unimplemented channel = hard error; the engine also rejects a step naming a channel it isn't running. The honest fix was deleting the phantom entry, not building Slack. The README's "Telegram / Slack" claim was wrong too, and is corrected.

5. Body-bound webhook signatures — webhook.require_signature

A bearer token proves only that the caller once saw it: the body isn't bound and a captured header replays forever — and this endpoint starts pipelines. Adds X-Draftcat-Signature: t=<unix>,v1=<hmac-sha256(t + "." + body)>, a skew window, and single-use signatures via the existing dedup table.

Verified whenever present (so a broken signer fails loudly), demanded when require_signature: true. Bearer auth is unchanged and still required. The existing constant-time compare and body size limit were already good.

6. Config validation on the boot path — validate.CheckAtStartup

The validator was thorough but opt-in, so a bad config booted fine and failed hours later mid-pipeline. Errors are now fatal at startup, warnings logged. DRAFTCAT_SKIP_VALIDATE=1 overrides. Shares one check body with draftcat validate so the two can't drift.

Verification

44 new tests. Build, go vet, gofmt, full suite, go run . validate, and golangci-lint --new-from-rev all pass; no new lint issues against the 139-issue baseline. Both commits build and test independently.

The three security-critical fixes were mutation-checked — each was deliberately broken to confirm the test actually bites:

Mutation	Result
Re-add phantom slack to the registry	channel test fails
Let approvers widen past allowed_users	"privilege escalation" test fails
Remove the webhook replay guard	replay test fails

End-to-end against the built binary: a bad config refuses to boot (exit 1, names the offending step), the escape hatch overrides, draftcat test is unchanged, and a simulated crashed gate reconciled correctly — pending→0, interrupted→1, audit row written, and UnapprovedActions now sees it.

Review notes

• main.go carries four of the six changes, which is why this is one feature commit rather than six — splitting it would have produced non-building intermediates.
• New config keys are all additive and default to off.
• internal/channels exists specifically so the validator and engine can't drift again; adding a name there without an implementation reintroduces the bug.