feat(n8n-webhook): bridge approvals to gog executors

memory/2026-03-12.md

@@ -78,3 +78,19 @@
   - `send_notification_draft` returned `200` and produced pending id `approval-mmnr8pyq-tjxiqkps`
   - approving that item via `approval_queue_resolve` returned `executed: true` and `executed_action: "notify"`
   - `approval_queue_list` showed `pending_count: 0` afterward and recorded the execution metadata in history
+- Will explicitly reinforced a durable operating expectation: local n8n, including its live public API, should be treated as assistant-owned tooling. If the correct path is the n8n API, use it directly instead of re-asking for permission or acting blocked.
+- After Google Workspace auth was completed with `gog`, headless testing showed an important automation constraint: real non-TTY `gog` calls fail unless `GOG_KEYRING_PASSWORD` is present, because the current `gog` file keyring backend cannot prompt in automation. However, `gog --dry-run` for Gmail draft creation and Calendar event creation works without unlocking the keyring, which made it possible to fully validate executor plumbing safely.
+- Implemented a host-side bridge script at `skills/n8n-webhook/scripts/resolve-approval-with-gog.py`.
+  - flow: resolve approval in n8n → execute supported kinds on host via `gog` → write execution metadata back into n8n history
+  - supported host-executed kinds:
+    - `email_draft` → `gog gmail drafts create`
+    - `calendar_event` → `gog calendar create`
+- Expanded the live `openclaw-action` workflow with new action `approval_history_attach_execution`, allowing host-side executors to patch resolved history entries with execution status/details.
+- Live dry-run verification on 2026-03-12 succeeded end-to-end:
+  - queued one `email_draft` approval item and one `calendar_event` item
+  - resolved both via the new host bridge with `--dry-run`
+  - `gog` returned dry-run JSON for both operations without touching Google state
+  - `approvalHistory` entries were updated in n8n with execution metadata:
+    - email draft item id `approval-mmnsx7iz-k26qb60c` → `execution.op = gmail.drafts.create`, `status = dry_run`
+    - calendar item id `approval-mmnsx7ji-3rt7yd74` → `execution.op = calendar.create`, `status = dry_run`
+- Current practical next step for real Gmail/Calendar execution: provide `GOG_KEYRING_PASSWORD` to the runtime environment that will invoke the bridge script, or switch `gog` to a keyring backend that supports unattended access on this host.