#1716 feat: workspace review for other clients — your requests in one view, withdraw and remove from the TUI and serve, decisions for plugins

Stacked on #1708 (withdraw and remove). This brings workspace review to clients other than the TUI: the VS Code extension and the Claude Code and Codex plugins. It also adds withdraw and remove to the TUI.

What changes

• GET /altimate/workspace/requests: your own requests on the linked workspace in one list.
  • Rule proposals come from local state; skill and knowledge requests come from the server, read with one captured credential that is checked against the signed-in account.
  • Each request carries its status, reviewer, reason and version, and the actions you can take (withdraw a waiting one, remove an approved one).
  • review_status says why skills and knowledge are missing when they are.
• POST /altimate/workspace/requests/{id}/withdraw|remove: acts on one of your skill or knowledge requests. Refusals keep the server's code, and clients are told to refresh.
• decisions in the rules summary: rule reviews and skill and knowledge decisions in one list, newest first, keyed kind:public_id:status. notices and review_notices stay for released clients.
• TUI /rules:
  • Your skill and knowledge requests are listed under your rule proposals, and picking one offers Withdraw or Remove from the workspace after a confirm.
  • The list waits at most 5 seconds; a slow server opens the menu without it.
• Plugin session start (learn hook session-start):
  • It polls once, for 3 seconds at most, then falls back to what was kept.
  • It tells the session about skill and knowledge decisions not reported yet (host_review_seen) and how many requests are still waiting.
• "Sync now" (POST /altimate/rules/sync) also checks skill and knowledge decisions (pollReviewDecisions), so an approval or removal shows at once.
  • A decision another process recorded first still makes clients replay.
• workspace review decisions --json [--unseen] [--mark-seen] [--host H]: for the Claude Code plugin's toast. It always answers in JSON and exits 0.
• skill publish refusals carry a stable code: review_disabled, too_many_requests, and others.
• Server text in these routes and in workspace review status --json is made printable.

Verification

• Tests: typecheck is clean, and the marker guard passes.
  • The review, rules and server-route suites pass: 347 tests.
  • New tests cover listing with actions, withdraw and remove with the version, refusal codes, the combined decisions list, the session-start poll with one-time reporting, decisions per host (including a linked person with nothing decided yet), "Sync now" polling, and the route checks.
  • Removing each fix made its test fail.
• End to end: I built the Linux binary from this branch and ran it in code-server with the VS Code extension branch, against a local backend that has review, roles and withdraw/remove. I signed in as a workspace member and ran publish, /rules, withdraw, an owner removal noticed through "Sync now", and an author removal.
• Review: an independent review across the CLI, the extension and both plugins found a false "not linked" from decisions, decisions recorded by another process not reaching a running client, a /rules fetch with no time limit, and unsanitised text. All are fixed in 0d97fd5214.

Your requests in /rules (extension)	Withdrawn	Removed by the owner, noticed after "Sync now"

Clients: AltimateAI/vscode-altimate-mcp-server#545, AltimateAI/altimate-claude-plugin#22, AltimateAI/altimate-codex-plugin#8.

🤖 Generated with Claude Code