docs(netvm): document watchdog, swarm-worker, and alert relay in README; track approvals CLI

bin/box-ctl.py

@@ -981,6 +981,49 @@ def act_fleet_status():
     fail("FLEET_ERROR", "failed to collect fleet data", {"stderr": r.stderr})
 
 
+def act_approval_check(node=None):
+    audit("approval-check", node)
+    import approvals
+    nodes = [node] if node else list(VALID_AGENTS)
+    res = approvals.check_fleet_approvals(nodes)
+    out(True, approvals=res)
+
+
+def act_approval_allow(node, always=False, force=False):
+    audit("approval-allow", node)
+    if node not in VALID_AGENTS:
+        fail("BAD_NODE", f"unknown node: {node}")
+    import approvals
+    res = approvals.allow_node_approval(node, always=always, force=force, caller="box-ctl")
+    if res.get("ok"):
+        kw = {k: v for k, v in res.items() if k != "ok"}
+        out(True, **kw)
+    else:
+        fail("APPROVAL_FAILED", res.get("error", "approval failed"), res)
+
+
+def act_approval_deny(node):
+    audit("approval-deny", node)
+    if node not in VALID_AGENTS:
+        fail("BAD_NODE", f"unknown node: {node}")
+    import approvals
+    res = approvals.deny_node_approval(node, caller="box-ctl")
+    if res.get("ok"):
+        kw = {k: v for k, v in res.items() if k != "ok"}
+        out(True, **kw)
+    else:
+        fail("APPROVAL_FAILED", res.get("error", "deny failed"), res)
+
+
+def act_approval_auto(node=None):
+    audit("approval-auto", node)
+    import approvals
+    nodes = [node] if node else list(VALID_AGENTS)
+    res = approvals.auto_approve_fleet(nodes, caller="box-ctl")
+    kw = {k: v for k, v in res.items() if k != "ok"}
+    out(True, **kw)
+
+
 def act_relay_health():
     """Run relay-health-check.sh and return JSON results."""
     audit("relay-health")
@@ -3513,6 +3556,24 @@ def main(argv):
                 fail("BAD_ARGS", "usage: quality validate <action> [args...]")
             audit("quality-validate", rest[1])
             act_quality_validate(rest[1], rest[2:])
+    elif action in ("approval-check", "approval-list"):
+        node = rest[0] if rest else None
+        act_approval_check(node)
+    elif action in ("approval-allow", "approval-approve"):
+        if not rest:
+            fail("BAD_ARGS", "usage: approval-allow <node> [--always] [--force]")
+        node = rest[0]
+        always = "--always" in rest[1:]
+        force = "--force" in rest[1:]
+        act_approval_allow(node, always=always, force=force)
+    elif action == "approval-deny":
+        if not rest:
+            fail("BAD_ARGS", "usage: approval-deny <node>")
+        node = rest[0]
+        act_approval_deny(node)
+    elif action == "approval-auto":
+        node = rest[0] if rest else None
+        act_approval_auto(node)
     elif action == "dm-log":
         limit = 50
         if rest: