Show file provenance on the approval card

surfaces/gui/src/App.tsx

@@ -679,6 +679,7 @@ export function App() {
               category: d.category,
               standingTarget: d.standing_target || undefined,
               searchProvider: d.search_provider || undefined,
+              provenance: d.provenance || undefined,
             },
           ]);
           break;

surfaces/gui/src/components/ApprovalCard.tsx

@@ -296,6 +296,13 @@ export function ApprovalCard({
   const reason = item.reason && item.reason !== "requires approval" ? item.reason : "";
   const offerStanding = !!(runTask && item.standingTarget);
   const dock = compact ? " approval-dock" : "";
+  // OPE-114 §1: the command text cannot tell you the agent wrote this file a moment ago.
+  const provenance = item.provenance ? (
+    <div className="approval-provenance">
+      <Icon name="warning" size={13} />
+      <span>{item.provenance}</span>
+    </div>
+  ) : null;
 
   // §35 compact row: routine workspace writes — one line, preview expands inline from the
   // tool args. Standing/grant flows keep the full card (they carry §25 consent weight).
@@ -320,6 +327,7 @@ export function ApprovalCard({
           />
         </div>
         {peek && content && <PreviewBlock text={content} />}
+        {provenance}
         {reason && <div className="approval-reason">{reason}</div>}
       </div>
     );
@@ -392,6 +400,7 @@ export function ApprovalCard({
         !["run_shell", "send_message", "send_file", "save_skill"].includes(item.name) &&
         !grants.length &&
         shortArgs(item.args) && <div className="approval-rest">{shortArgs(item.args)}</div>}
+      {provenance}
       {reason && <div className="approval-reason">{reason}</div>}
 
       {item.resolved ? (

surfaces/gui/src/styles.css

@@ -432,6 +432,13 @@ body {
   display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden;
 }
 .approval-reason { margin-top: 8px; font-size: 12.5px; color: var(--muted); }
+/* OPE-114 §1: this action would run a file the agent itself just made. Warmer than the
+   reason line because it is the fact the command text cannot tell you. */
+.approval-provenance {
+  margin-top: 8px; display: flex; align-items: baseline; gap: 6px;
+  font-size: 12.5px; color: var(--warn-ink);
+}
+.approval-provenance code { font-family: var(--mono); font-size: 11.5px; }
 /* Standing-approval consent lines (§25): reads = quiet disclosure, writes = the grants. */
 .approval-grants {
   margin-top: 11px; border: 1px solid var(--line); border-radius: 8px; background: var(--paper);

surfaces/gui/src/types.ts

@@ -122,6 +122,11 @@ export type Item =
       // web_search only (§1.9): the LIVE configured provider name, resolved server-side
       // when the card was raised — the grant description names the actual destination.
       searchProvider?: string;
+      // OPE-114 §1: set when the action would run a file the agent itself created or
+      // downloaded this session ("setup.py was created by the agent 3 steps ago"). The
+      // one fact that cannot be read off the command text. Engine-authored, fixed
+      // vocabulary — never file contents.
+      provenance?: string;
       resolved?: ApprovalDecision;
     }
   | {