Phase 2: Connector-routed approval callbacks

[AbirAbbas]

Important

Blocked on connector implementation. This issue depends on the AgentField connector (and accompanying SaaS relay) being shipped first. There is no actionable scope here until that transport layer exists. Do not start implementation work against this issue until the connector is in place.

Background

Carved out from #237 (Phase 1 shipped in #504). For fully isolated control planes that aren't internet-reachable, the approval webhook flow doesn't work — the external approval service can't reach the CP directly.

Proposal

Route approval callbacks through the connector WebSocket channel instead of a public webhook:

• External approval service → SaaS platform
• SaaS platform → connector (existing WebSocket)
• Connector → CP (local)

No public CP URL required.

Required pieces

• approval_response command type added to the connector protocol
• CP-side handler to process forwarded approval responses (reuse the shared processor introduced in fix(control-plane): require signed approval webhooks #504 where possible)
• SaaS-side receiver + forwarding logic
• Connector transport for end-to-end delivery

Why this is blocked

The CP-side change is small — capability flag, route, shared processor reuse. But it has no value until the SaaS relay and connector transport exist, and shipping CP plumbing now means carrying a protocol that may not match what the connector actually supports once it lands. Better to design this once the transport layer is real.

Revisit when the connector + SaaS relay are released.