wip(13-08): checkpoint before operator session restart — Task 1 GREEN (28/28), Task 2 in progress

Executor stopped deliberately for a session restart (bypass-permissions relaunch).
Executor's final report: 'cargo test assistant confirm-gate suite 28/28 green,
individual nonce test passes; committing Task 1 next — first verify the
tools.rs/grants.rs/backends diffs are formatting-only.'

Task 1 (D-07/D-11 confirm gate, backend) is implemented and test-green but this
checkpoint is verbatim-uncommitted-state, NOT the reviewed atomic Task 1 commit:
continuation executor should verify diffs, then reset --soft or commit-on-top
into proper feat(13-08) task commits. Task 2 (ToolConfirmModal.vue trusted
chrome, Chat.vue + contextBroker.ts wiring) is partially built, tests written.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/assistant/mod.rs

@@ -140,7 +140,11 @@ pub struct ToolExecCtx {
 }
 
 impl ToolExecCtx {
-    pub fn new(registry: tools::ToolRegistry, caller: CallerScope, handler: Arc<RpcHandler>) -> Self {
+    pub fn new(
+        registry: tools::ToolRegistry,
+        caller: CallerScope,
+        handler: Arc<RpcHandler>,
+    ) -> Self {
         Self::with_confirm_gate(registry, caller, handler, confirm::global())
     }
 
@@ -231,7 +235,11 @@ pub fn build_system_prompt(visible_tools: &[tools::ToolDef]) -> String {
 /// Builds the visible-tool set from the caller's granted categories only
 /// (D-16 — the model should never even see a tool it can't use), selects a
 /// backend (Claude only, in this tracer), and runs it to a final answer.
-pub async fn chat(handler: Arc<RpcHandler>, caller: CallerScope, user_text: String) -> Result<String> {
+pub async fn chat(
+    handler: Arc<RpcHandler>,
+    caller: CallerScope,
+    user_text: String,
+) -> Result<String> {
     let registry = tools::registry();
     let grants = caller.granted_categories(handler.data_dir()).await;
     let visible_tools = registry.visible_to(&grants);
@@ -249,7 +257,14 @@ pub async fn chat(handler: Arc<RpcHandler>, caller: CallerScope, user_text: Stri
 
     let ctx = ToolExecCtx::new(registry, caller, handler);
 
-    loop_::run_loop(backend.as_ref(), &system_prompt, &visible_tools, history, &ctx).await
+    loop_::run_loop(
+        backend.as_ref(),
+        &system_prompt,
+        &visible_tools,
+        history,
+        &ctx,
+    )
+    .await
 }
 
 #[cfg(test)]
@@ -286,7 +301,9 @@ mod tests {
     /// (`container-list`) finds it — the same cached-state path the real
     /// node serves, no orchestrator or podman needed.
     fn installed_entry(app_id: &str) -> crate::data_model::PackageDataEntry {
-        use crate::data_model::{Description, Manifest, PackageDataEntry, PackageState, StaticFiles};
+        use crate::data_model::{
+            Description, Manifest, PackageDataEntry, PackageState, StaticFiles,
+        };
         PackageDataEntry {
             state: PackageState::Running,
             health: None,
@@ -367,7 +384,9 @@ mod tests {
             }
             tokio::time::sleep(std::time::Duration::from_millis(5)).await;
         }
-        panic!("no pending confirmation appeared — the destructive branch did not suspend on the gate");
+        panic!(
+            "no pending confirmation appeared — the destructive branch did not suspend on the gate"
+        );
     }
 
     /// S-01 / D-07: a destructive tool call suspends before any execution
@@ -465,7 +484,10 @@ mod tests {
             session_id: "s".to_string(),
         };
         let granted = caller.granted_categories(handler.data_dir()).await;
-        assert!(granted.is_empty(), "fresh node must grant nothing: {granted:?}");
+        assert!(
+            granted.is_empty(),
+            "fresh node must grant nothing: {granted:?}"
+        );
     }
 
     /// The system prompt built for a caller must never mention a tool
@@ -494,7 +516,9 @@ mod tests {
         // Sanity: at least one granted tool IS present, so this isn't
         // trivially passing because the prompt is empty.
         assert!(
-            reg.visible_to(&grants).iter().any(|t| prompt.contains(t.name)),
+            reg.visible_to(&grants)
+                .iter()
+                .any(|t| prompt.contains(t.name)),
             "expected at least one granted-category tool name in the prompt"
         );
     }
@@ -560,7 +584,9 @@ mod tests {
             peer_id: "peer-2".to_string(),
             authorized: false,
         };
-        let peer_grants = unauthorized_peer.granted_categories(handler.data_dir()).await;
+        let peer_grants = unauthorized_peer
+            .granted_categories(handler.data_dir())
+            .await;
         assert!(
             peer_grants.is_empty(),
             "an unauthorized mesh peer must resolve to no authority regardless of what the operator granted"