feat(n8n-webhook): bridge approvals to gog executors

skills/n8n-webhook/references/openclaw-action.md

@@ -20,6 +20,7 @@ It implements a real local OpenClaw → n8n router.
   - `approval_queue_add`
   - `approval_queue_list`
   - `approval_queue_resolve`
+  - `approval_history_attach_execution`
   - `fetch_and_normalize_url`
   - `inbound_event_filter`
 - returns normalized JSON responses
@@ -62,6 +63,13 @@ Example stored record:
 - appends the resolved entry into:
   - `approvalHistory`
 - supports optional notification on approval/rejection
+- executes notification drafts inline when the approved item kind is `notification`
+
+### `approval_history_attach_execution`
+
+- patches an existing resolved history item in `approvalHistory`
+- designed for host-side executors that run outside n8n itself
+- used by the included `scripts/resolve-approval-with-gog.py` bridge to attach Gmail/Calendar execution results
 
 ### `fetch_and_normalize_url`
 
@@ -158,6 +166,7 @@ scripts/call-action.sh fetch_and_normalize_url --args '{"url":"http://192.168.15
 scripts/call-action.sh fetch_and_normalize_url --args '{"url":"https://example.com","skip_ssl_certificate_validation":true}' --pretty
 scripts/call-action.sh approval_queue_list --args '{"limit":10,"include_history":true}' --pretty
 scripts/call-action.sh inbound_event_filter --args-file assets/test-inbound-event-filter.json --pretty
+python3 scripts/resolve-approval-with-gog.py --id <approval-id> --decision approve --dry-run
 ```
 
 ## Expected success examples
@@ -239,6 +248,22 @@ scripts/call-action.sh inbound_event_filter --args-file assets/test-inbound-even
 }
 ```
 
+## Host bridge notes
+
+The included host bridge `scripts/resolve-approval-with-gog.py` is for the case where Gmail/Calendar auth exists on the OpenClaw host via `gog`, not inside n8n itself.
+
+Behavior:
+- resolves an approval item through `openclaw-action`
+- executes supported kinds on the host:
+  - `email_draft` → `gog gmail drafts create`
+  - `calendar_event` → `gog calendar create`
+- writes execution metadata back via `approval_history_attach_execution`
+
+Important automation note:
+- real unattended execution needs `GOG_KEYRING_PASSWORD` in the environment
+- without it, non-TTY `gog` calls will fail when the file keyring tries to prompt
+- `--dry-run` works without touching Google state and is useful for plumbing verification
+
 ## Validation
 
 Run the local validator before import/package changes:

skills/n8n-webhook/references/payloads.md

@@ -239,6 +239,29 @@ Request:
 Purpose:
 - approve or reject a pending item
 - moves resolved entries into `approvalHistory`
+- executes notification drafts inline when the resolved item kind is `notification`
+
+### `approval_history_attach_execution`
+
+Request:
+
+```json
+{
+  "action": "approval_history_attach_execution",
+  "args": {
+    "id": "approval-abc123",
+    "execution": {
+      "driver": "gog",
+      "op": "gmail.drafts.create",
+      "status": "draft_created"
+    }
+  }
+}
+```
+
+Purpose:
+- patch a resolved history item with host-side execution metadata after a real executor runs outside n8n
+- intended for bridges such as `gog`-backed Gmail/Calendar execution
 
 ### `fetch_and_normalize_url`