security(terminal): command approvals take the approver from the request body/WS payload (or record none) — a command's run is approved by a forgeable identity #17052

What

Approving a pending terminal command lets that command run. Three paths approve commands, and none of them records a trustworthy approver:

1. api/agent_terminal.py, the approve-command route (around line 515): current_user = Depends(get_current_user) is injected but unused for attribution. service.approve_command(..., user_id=request.user_id, ...) takes the approver from the request body (TerminalApproveCommandRequest.user_id), so any authenticated caller can claim to be any user.
2. api/websockets.py _handle_command_approval (around lines 410-435): user_id = data.get("user_id", "web_user"). The approver comes from the WebSocket message payload, with a hard-coded fallback when it's absent.
3. api/security.py approve_command (around line 73): admin-gated at the router (check_admin_permission), but security_layer.approve_command(command_id, approved) records no approver at all.

All three reach services/command_execution_queue.approve_command(command_id, user_id, comment), which records whatever user_id it's given.

Not yet determined: whether paths 1 and 2 check that the approving user owns the session whose command is pending, or whether any authenticated user can approve another user's agent's command. Treat it as unverified until traced.

Found by the #17043 implementer (same class as #17042). Owner rules (2026-09-18, #17038): approvals are made by a human, and every decision leaves a trustworthy paper trail.

Acceptance criteria

• Every command approval records the verified caller as the approver. Body and payload user_id are ignored with a logged warning.
• Only the owner of the session whose command is pending, or an admin, can approve or reject it. Tests: a cross-user approval is refused on paths 1 and 2.
• Only an interactive human can approve, using the security(approvals): an LLC approval's decided_by comes from the request body — any credential can decide and attribute it to anyone; neither approval system requires a human #17042/fix(auth): attribute approval decisions to the verified human caller (#17042) #17051 predicate (require_interactive_human), not a fork. A negative control per non-human credential type.
• Path 3 records its admin approver.
• The consolidated approval service (refactor(approvals): consolidate the general and LLC approval systems into one platform approval service with optional company scope (#17038) #17043) either absorbs command approvals or documents why they stay separate. It's linked either way.