docs(n8n-webhook): add operator approval runbook

WIP.md

@@ -105,10 +105,10 @@ Started: `2026-03-12`
 - [ ] Decide whether Drive/Docs/Sheets need action-bus verbs next or can stay direct-tool only for now
 
 ### Then polish the operator experience
-- [ ] Add a compact operator command/reference section for common approval flows
-- [ ] Add one or two canned test payloads for real bridge verification flows
-- [ ] Decide whether some Google actions should stay approval-gated by default
-- [ ] Add low-noise reporting so history clearly shows:
+- [x] Add a compact operator command/reference section for common approval flows
+- [x] Add one or two canned test payloads for real bridge verification flows
+- [x] Decide/document approval defaults clearly per action family
+- [x] Add low-noise reporting so history clearly shows:
   - queued
   - approved/rejected
   - executed
@@ -139,12 +139,12 @@ Planned passes:
    - added `delete_calendar_event`
    - added `list_upcoming_events`
    - updated workflow contract/docs/test payloads/bridge + WIP evidence
-3. Operator/polish pass:
-   - decide approval defaults for each action
-   - add low-noise execution/result reporting
-   - add compact operator command/reference docs
-   - add one or two canned recurring test payloads
-   - update `WIP.md` with evidence before ending the pass
+3. Operator/polish pass: ✅ complete
+   - documented approval defaults by action family (`notification`, `gmail`, `calendar`, `manual`)
+   - added low-noise queue/history reporting (`pending_compact`, `history_compact`, `summary_line`, `result_refs`)
+   - added compact operator command/reference docs
+   - added two canned recurring verification payloads
+   - refreshed `WIP.md` with evidence before ending the pass
 
 ## Fresh-session proof refresh (2026-03-12 19:44Z)
 - Re-ran both target proofs through the real approval-routed path in a clean implementation session.
@@ -220,15 +220,60 @@ Targeted verification evidence:
   - `calendar_event_delete` → `gog calendar delete primary example-calendar-event-id --account will@example.com --json --no-input --force --send-updates none --dry-run`
 - `python3 -m py_compile skills/n8n-webhook/scripts/resolve-approval-with-gog.py` passed.
 
+## Operator/polish pass 3 completion (2026-03-12)
+Implemented in this pass:
+- added explicit approval-family defaults in the shipped workflow + docs:
+  - `notification` → required `high`
+  - `gmail` read-only (`list_email_drafts`) → required `low`
+  - `gmail` mutating (`send_email_draft`, `delete_email_draft`, `send_gmail_draft`) → required `high`
+  - `calendar` read-only (`list_upcoming_events`) → required `low`
+  - `calendar` mutating (`create_calendar_event`, `update_calendar_event`, `delete_calendar_event`) → required `high`
+- added compact operator-facing queue/history fields in the workflow:
+  - `payload_preview`
+  - `operator.summary_line`
+  - `operator.execution_state`
+  - `operator.result_refs`
+  - `approval_queue_list.result.pending_compact`
+  - `approval_queue_list.result.history_compact`
+  - `approval_queue_resolve.result.item_compact`
+  - `approval_history_attach_execution.result.item_compact`
+- taught the host bridge to attach `execution.summary` + `execution.result_refs`
+- added recurring verification payloads:
+  - `skills/n8n-webhook/assets/test-verify-email-draft-cycle.json`
+  - `skills/n8n-webhook/assets/test-verify-calendar-event-cycle.json`
+- added operator runbook / recurring verification docs in:
+  - `skills/n8n-webhook/references/openclaw-action.md`
+  - `skills/n8n-webhook/references/payloads.md`
+  - `skills/n8n-webhook/SKILL.md`
+
+Targeted verification evidence:
+- `python3 skills/n8n-webhook/scripts/validate-workflow.py skills/n8n-webhook/assets/openclaw-action.workflow.json`
+  - result: `OK: workflow asset structure looks consistent`
+  - validator now also checks the two new recurring verification payload files
+- `python3 -m py_compile skills/n8n-webhook/scripts/resolve-approval-with-gog.py`
+  - result: passed
+- bridge helper proof via direct import/execution:
+  - `execution_result_refs('gmail.drafts.create', {'draft': {'id': 'r-proof-draft-123'}})` → `{'draft_id': 'r-proof-draft-123'}`
+  - `execution_summary(...)` → `gmail.drafts.create draft created (draft_id=r-proof-draft-123)`
+  - `execution_result_refs('calendar.create', {'event': {'id': 'evt-proof-456'}, 'calendar': 'primary'})` → `{'event_id': 'evt-proof-456', 'calendar': 'primary'}`
+  - `execution_summary(...)` → `calendar.create event created (event_id=evt-proof-456, calendar=primary)`
+- workflow asset inspection confirmed low-noise operator fields are present:
+  - `pending_compact`
+  - `history_compact`
+  - `summary_line`
+  - `result_refs`
+  - `default_mode`
+  - `approval.family`
+- recurring verification payload identity proofs:
+  - `test-verify-email-draft-cycle.json` → request id `verify-email-draft-cycle-001`
+  - `test-verify-calendar-event-cycle.json` → request id `verify-calendar-event-cycle-001`
+
 ## Next-session handoff
 For the next fresh implementation session, start from `HANDOFF.md` + `WIP.md` rather than from old chat context.
 
 Immediate target:
-- operator/polish pass only:
-  - add a compact operator command/reference section for common approval flows
-  - add one or two canned recurring verification flows
-  - decide/document approval defaults clearly per action family
-  - improve low-noise execution/result reporting in history
+- decide whether Drive / Docs / Sheets actually need action-bus verbs or can remain direct-tool workflows for now
+- if Google action coverage expands again, preserve the same approval-family defaults and compact history contract
 - refresh WIP/memory/tasks before ending
 
 ## Relevant files