feat(talon): audit reaction approval attempts

[John Kennedy (jkennedyvz)]

Stacked on #4345.

Adds host-side tool_approval.reaction audit events for reaction approval attempts. The event records provider, stable hashed channel conversation/prompt/sender references, emoji, decision, match status, and resolution mode. Raw provider IDs are included only when DEEPAGENTS_TALON_APPROVAL_LOG_RAW_IDS=true; raw provider metadata, approval prompt text, arbitrary message text, and tool arguments are not logged. Matched reaction approvals use operator_reaction as the resolution so they can be distinguished from text approvals.

When this is useful

Reaction approvals are a one-tap action that's easy to fire off and easy to miss-context (wrong message, wrong channel, stale prompt). Without an audit trail there's no way to answer "did someone try to approve that tool call, and why didn't it take?" after the fact. These events let operators and security reviewers trace every reaction attempt — matched or ignored — back to a specific provider, conversation, prompt message, and sender, without leaking raw IDs or prompt/message contents by default. Distinguishing operator_reaction from text approve/deny also makes it possible to monitor how often the reaction path is actually used versus the text fallback.

Example

An operator reacts 👍 to the approval prompt. The host emits a structured tool_approval.reaction event:

{
  "event": "tool_approval.reaction",
  "provider": "slack",
  "channel_conversation_ref": "9f1c…a4e2",
  "prompt_message_ref": "b7d3…0c91",
  "reacting_sender_ref": "e2a8…77f0",
  "emoji": "👍",
  "decision": "approve",
  "match_status": "matched",
  "resolution": "operator_reaction"
}

Conversation/prompt/sender references are stable hashes (via stable_log_ref), so the same IDs correlate across events without exposing the underlying Slack IDs. Ignored attempts are logged too, with a precise resolution explaining why:

• no_pending_approval — reaction arrived with no pending tool approval
• unsupported_emoji — emoji wasn't 👍/👎
• missing_prompt_message_id — channel didn't supply a prompt message id (falls back to text)
• provider_mismatch / conversation_mismatch / message_mismatch — reaction didn't target the prompt that issued the request
• sender_missing / sender_mismatch — reactor wasn't the initiating operator (when sender is known)

For debugging a specific incident, set DEEPAGENTS_TALON_APPROVAL_LOG_RAW_IDS=true to additionally include raw_channel_conversation_id, raw_prompt_message_id, and raw_reacting_sender_id. Sensitive values — provider metadata, approval prompt text, arbitrary message text, and tool arguments — are never logged regardless of that flag.

Validation run:

• uv run --group test pytest --disable-socket --allow-unix-socket tests/test_host.py --timeout 10
• make lint_diff
• make test

[open-swe]

✅ Open SWE Review: No issues found

Open SWE reviewed this PR and found no potential bugs to report.

Open in Web • View Open SWE trace