Stabilize OpenSim agent runtime and Mentra integration

crates/metacrate-grid-agent/src/policy_tests.rs

@@ -926,6 +926,60 @@ async fn policy_executor_is_the_only_backend_path_and_emits_final_outcome() {
     assert_eq!(denied_backend.calls.load(Ordering::Acquire), 0);
 }
 
+#[tokio::test]
+async fn policy_executor_uses_one_shot_reviewer_for_exact_approval() {
+    let (gateway, audit) = gateway();
+    let backend = Arc::new(FakeBackend {
+        calls: AtomicUsize::new(0),
+        fail: false,
+    });
+    let erased: Arc<dyn AuthorizedToolBackend> = backend.clone();
+    let reviewer: ApprovalReviewer = Arc::new(|request, _cancellation| {
+        Box::pin(async move {
+            assert_eq!(request.tool, "build");
+            assert_eq!(request.arguments, json!({"count":1,"label":"cube"}));
+            assert_eq!(request.cost.build_prims, 1);
+            Ok(true)
+        })
+    });
+    let executor = PolicyToolExecutor::new(
+        Arc::clone(&gateway),
+        erased,
+        context(OriginClass::AuthorizedIm),
+        BTreeMap::new(),
+        Arc::new(|| 100),
+    )
+    .expect("executor")
+    .with_approval_reviewer(reviewer);
+    let definition = gateway
+        .tools_for(&context(OriginClass::AuthorizedIm), 100)
+        .into_iter()
+        .find(|tool| tool.name.as_str() == "build")
+        .expect("build tool");
+    let arguments = json!({"count":1,"label":"cube"});
+    let outcome = executor
+        .execute(
+            &definition,
+            &call("build", &arguments),
+            &arguments,
+            &CancellationToken::default(),
+        )
+        .await;
+    if let ToolExecution::Rejected(reason) | ToolExecution::Failed(reason) = &outcome {
+        panic!("{}", reason.as_str());
+    }
+    assert!(
+        matches!(outcome, ToolExecution::Completed(_)),
+        "{outcome:?}"
+    );
+    assert_eq!(backend.calls.load(Ordering::Acquire), 1);
+    assert!(gateway.pending_approvals(100).is_empty());
+    assert!(audit.snapshot().iter().any(|record| {
+        record.tool.as_str() == "build"
+            && record.final_outcome == PolicyFinalOutcome::ApprovalGranted
+    }));
+}
+
 #[tokio::test]
 async fn non_idempotent_backend_failure_is_audited_as_ambiguous_without_retry() {
     let (gateway, audit) = gateway_with(standard_tools(), PolicyLimits::default());