feat(grid-agent): add portable control plane (#126)

crates/metacrate-grid-agent/src/policy_tests.rs

@@ -411,6 +411,7 @@ fn approval_tool() -> PolicyTool {
 }
 
 #[test]
+#[allow(clippy::too_many_lines)] // One approval lifecycle includes deny and expiry paths.
 fn approvals_bind_principal_canonical_arguments_expiry_and_one_execution() {
     let (gateway, audit) = gateway_with(vec![approval_tool()], PolicyLimits::default());
     let requester = context(OriginClass::AuthorizedIm);
@@ -507,6 +508,24 @@ fn approvals_bind_principal_canonical_arguments_expiry_and_one_execution() {
             .expect("expired result"),
         PolicyReasonCode::ApprovalExpired
     );
+    let denied = gateway
+        .evaluate(&requester, &proposed, &arguments, None, 600)
+        .expect("denial pending")
+        .approval_id
+        .expect("approval ID");
+    assert_eq!(gateway.pending_approvals(600).len(), 1);
+    assert_eq!(
+        gateway.deny_approval(denied, &operator, 601).expect("deny"),
+        PolicyReasonCode::ApprovalNotGranted
+    );
+    assert!(gateway.pending_approvals(601).is_empty());
+    assert_eq!(
+        gateway
+            .evaluate(&requester, &proposed, &arguments, Some(denied), 601)
+            .expect("denied approval cannot execute")
+            .reason,
+        PolicyReasonCode::ApprovalReplayed
+    );
     assert!(
         audit
             .snapshot()