[fabicarvano]

Summary

Follow-up to the six non-blocking recommendations in the maintainer's approved review of PR #65.

• Return private, generic feedback when a channel approval is denied: ephemeral Slack responses, Telegram callback-query alerts, and ephemeral Discord interaction responses.
• Record denied approval attempts through AuditService, including tenant, channel, actor, action, and denial reason.
• Replace the ambiguous approvedBy field with actorId in new gateway job payloads. Already-queued jobs using approvedBy remain supported.
• Keep approval_decision.content stable and record the acting user in structured event metadata instead.
• Expose per-channel approverIds in the Mission Control connector settings and API, with input validation, persistence, and explicit allowlist clearing.
• Add regression tests for missing platform user IDs, authorization denials, private responses, audit entries, and decision attribution.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking configuration support)
• Breaking change
• Documentation update
• Refactor / performance improvement
• Dependency update
• CI/CD or build system change

Testing

• 140 targeted tests passed across five suites covering gateway authorization, run execution, connector configuration, and Slack/Telegram/Discord adapters.
• bun install --frozen-lockfile — passed.
• TypeScript checks — passed for libs/claw-studio, apps/mission-control, and apps/workers.
• git diff --check — passed.
• GitHub Actions: PR #70 CI run (see live status).
• Not run: end-to-end interactions with real Slack, Telegram, or Discord accounts. These should be verified in an integration environment before production rollout.

Compatibility and Scope

• The policy approved in PR fix: channel approval buttons are not authorized to a specific user (known issue #11) #65 remains unchanged: one-time approve/reject actions retain backward-compatible behavior if no allowlist is configured. Standing grants via approve_always continue to require an explicit nonempty allowlist.
• Existing queued jobs containing approvedBy are accepted during the transition to actorId.
• Per-operator identity inside Mission Control (known issue fix: playground execution errors and add KB upload page #13) is outside the scope of this PR.
• No database migration or automatic merge.

Checklist

• Changes follow existing project conventions
• Relevant tests have been added or updated
• Local targeted tests and TypeScript checks pass
• Documentation updated
• Real-channel integration testing completed
• GitHub CI confirmed successful

Refs #65.