[bborbe]

Scope

Adds the vault-cli goal approve and vault-cli topic approve verbs and closes the generic-set bypass that would otherwise let a row leave the approval inbox with no approval record.

Surfaces this migrates, all in this repo:

• pkg/domain — unchanged (GoalPhase / TopicPhase already existed).
• pkg/ops — new GoalApproveOperation / TopicApproveOperation + shared refuseExistingEntityApprovalRecord; new goalTodoPlanningSetRefusal / topicTodoPlanningSetRefusal guards in frontmatter_entity.go.
• pkg/cli — goal approve / topic approve subcommands with --by.
• commands/plan-goal.md, commands/execute-topic.md — the phase: todo arms now point at the approve verb.
• docs/goal-writing.md — new § Phase and approval.
• CHANGELOG.md — two feat: bullets.

Not touched: task approve, the task-side guards, the frontmatter serializers, or bborbe/claude-supervisor (the manager-start gate is a follow-up spec in that repo).

Behaviour

• goal approve <goal> / topic approve <topic> move phase: todo → planning and write approved_by (default operator, --by overrides) and approved_at in one write.
• Refused with nothing written: a row not at phase: todo (including no phase key), a row already carrying approved_by or approved_at, an empty --by, an unknown row.
• goal set … phase planning / topic set … phase planning on a todo row is refused and points at the approve verb. Only that one (key, value, current-phase) triple is guarded.
• A row with no phase stays exempt — absent phase does not mean todo.

Evidence

Spec specs/completed/061-goal-topic-approve.md carries the ## Verification Result. Verified against a scratch vault copy (never a live vault): happy path on goal and topic, --by override, 16 refusal cases each with an unchanged sha256sum, set-path guard on both entities, narrowness (set phase execution and set priority still succeed), and unknown-key preservation. make precommit and make test both exit 0.

[bborbe]

Superseded — split into #319 (ops + guard) and #320 (CLI + docs) to fit the auto-reviewer's 1200-line limit. Same code, no changes.