Function auto_approve_chunk

crates/openshell-server/src/grpc/policy.rs:883–954

(
    state: &Arc<ServerState>,
    sandbox_id: &str,
    sandbox_name: &str,
    chunk_id: &str,
    source: &str,
    resolved_from: &str,
)

}

async fn auto_approve_chunk(
    state: &Arc<ServerState>,
    sandbox_id: &str,
    sandbox_name: &str,
    chunk_id: &str,
    source: &str,
    resolved_from: &str,
) -> Result<(), Status> {
    // Same gate the human-driven approve paths apply: if a global policy is
    // active, sandbox-scoped chunk approvals are meaningless because
    // `GetSandboxConfig` prefers the global policy. Auto-approving here
    // would persist a sandbox revision that the runtime silently ignores
    // and leave a misleading "approved" chunk in the table. Bail before
    // touching state; the calling site logs this as `warn!` and leaves the
    // chunk pending.
    require_no_global_policy(state).await?;

    let chunk = state
        .store
        .get_draft_chunk(chunk_id)
        .await
        .map_err(|e| Status::internal(format!("fetch chunk failed: {e}")))?
        .ok_or_else(|| Status::not_found("chunk not found"))?;

    // The chunk may have been superseded or rejected by something else
    // between persist and auto-approve. Only approve from a pending state.
    if chunk.status != "pending" {
        return Ok(());
    }

    let (version, hash) = merge_chunk_into_policy(state.store.as_ref(), sandbox_id, &chunk).await?;
    let chunk_summary = summarize_draft_chunk_rule(&chunk)?;

    let now_ms = current_time_ms();
    state
        .store
        .update_draft_chunk_status(chunk_id, "approved", Some(now_ms), None)
        .await
        .map_err(|e| Status::internal(format!("update chunk status failed: {e}")))?;

    state.sandbox_watch_bus.notify(sandbox_id);

    let source_label = if source.is_empty() {
        "unspecified"
    } else {
        source
    };
    emit_gateway_policy_auto_approve_audit_log(
        sandbox_id,
        sandbox_name,
        format!(
            "auto-approved: no new prover findings (source={source_label}) — chunk {chunk_id}: {chunk_summary}"
        ),
        version,
        &hash,
        source_label,
        resolved_from,
    );