feat(session-store): file-backed approval store

[Shearerbeard]

What

A file-backed ApprovalStore backend: one JSON file per decision id ({root}/tickets/{id}.json, {root}/decisions/{id}.json), reusing ParkedApprovalRecord/DecisionRecord as the on-disk shape. Selected by AURA_SESSION_STORE=file with a required AURA_SESSION_STORE_PATH; the A2A task store and event bus stay in memory (single-pod, single-writer model).

Contract (what park mode keys on)

• resolve refuses past the ticket's expires_at, uniformly with an unknown id - enforced on BOTH the file and memory backends, so the contract holds on whichever is configured.
• get returns the ticket before and after the decision, and decision returns the recorded decision, both until remove (retention until removed, not a TTL margin).
• resolve moves the ticket into the decision file rather than deleting it; at-most-once via File::create_new on the decision file (AlreadyExists reads as NotFound).
• cancel_request removes undecided tickets by owner id; decision ids are validated as canonical UUIDs at every path-building site, so nothing escapes the store root.
• Ticket publication is temp-file + same-directory rename; the create_new-to-sync crash window is fail-closed and documented (module doc) with a one-file operator recovery.

Testing

• The backend-agnostic approval battery is factored out of the redis integration test into tests/common and run against BOTH the file and memory backends without Docker, plus retention, expiry, resolve-moves-ticket, cancel-by-owner, and restart-durability cases (register, drop the store, reopen, resolve, read the decision).
• cargo test -p aura -p aura-web-server and cargo clippy --workspace --all-targets -- -D warnings clean; live restart check passed (register, kill -9, restart, resolve 204, decision file on disk).

Review trail

Two fresh-context reviews returned explicit PASS: a granular Rust review (at-most-once, expiry on both backends, path containment) and a feature-scope frontier review (poll-shape coherence with the planned run-resource resume UX, durability boundary). The frontier round's three doc-coherence findings were fixed in e3195f45 and re-reviewed clean. Full findings ledgers live on the board cards.

[greptile-apps]

Greptile Summary

The PR adds an environment-selected, file-backed approval store that persists tickets and decisions across process restarts while retaining in-memory task and event capabilities.

• Adds file-backend configuration and web-server factory wiring.
• Implements per-decision JSON persistence, expiry checks, resolution claims, cancellation, and removal.
• Expands backend-agnostic conformance and restart-durability tests.

Confidence Score: 4/5

The PR should not merge until file-backed resolution cannot return an error after durably applying the decision; the remaining executor-blocking and documentation issues are non-blocking.

A ticket-deletion error after the decision file is synced makes the HTTP result disagree with the authoritative stored decision, allowing the protected operation to continue despite the approver receiving an error.

Files Needing Attention: crates/aura/src/session_store/file.rs, crates/aura-config/src/session_store.rs

Important Files Changed

Filename	Overview
crates/aura/src/session_store/file.rs	Implements the durable approval backend, but resolution can report failure after committing a decision and its synchronous filesystem work can block executor threads.
crates/aura/src/session_store/memory.rs	Adds expiry refusal to the memory backend while preserving its existing at-most-once resolution behavior.
crates/aura-config/src/session_store.rs	Adds validated file-backend environment configuration; some behavioral documentation is attached to data definitions.
crates/aura-web-server/src/session_store.rs	Wires the file approval store into the backend factory while intentionally retaining in-memory task and event implementations.
crates/aura-web-server/tests/file_session_store_test.rs	Covers conformance, retention, expiry, cancellation, on-disk layout, and restart durability, but not post-commit ticket-deletion failures.

Sequence Diagram

sequenceDiagram
    participant Client as Approver client
    participant Registry as Pending approvals
    participant Store as File approval store
    Client->>Registry: Resolve decision
    Registry->>Store: resolve(id, decision)
    Store->>Store: Read ticket and check expiry
    Store->>Store: create_new decision file
    Store->>Store: Write and sync decision
    Store->>Store: Remove ticket file
    Registry->>Registry: Publish wake event
    Registry-->>Client: Accepted
    Note over Registry,Store: Polling the decision file is the lost-publish fallback

Loading

_{Reviews (1): Last reviewed commit: "docs(session-store): name the resolve cr..." | Re-trigger Greptile}

[Shearerbeard]

Closing in favor of #643: nightly is now the primary PR target, and the retarget path causes odd GitHub behavior, so the store ships as a fresh PR against nightly carrying the v2 fix round (blocking-pool restructure, resolve commit-point semantics, comment pass).