cardinal-ai 0.2.5 → 0.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea33d976c3ebc53402438e5dae5e6b480842034e1a77a1c58142d62ad1f347e2
-  data.tar.gz: 7571417a375ab611c9345a6b2d7ab6cea33233e668d90414edae44ea2d116048
+  metadata.gz: c16d402a271ff7a720232c12b775f43784eadd3268c1ce417fd2939d777be42e
+  data.tar.gz: 808ae0945e6f6104b3ef103468ce78c36406af25c78da223cd380a02336d5ef8
 SHA512:
-  metadata.gz: db9ec21facb032331fd8686f772e1c1313e0e84388f675eb723e92847c0c7638325d2af5ff8d392f2536c292d0929a79f64e53f040ef1206bb74097477c1f9e1
-  data.tar.gz: c290a471053fc66929db5fe9b3219bb49dc85f2b953b4a33beab0878e261d7ed4e815dc5b1b57ca9f8346f2ba9a7e73f7607a30f1af08e09a6665311dfdd6811
+  metadata.gz: 4bd7c1c24d5969321f07753a3c14e2a09ecc561537dfd6f6365502b07c54aafbf93c22f84ed8a0eec9782ce1b9135606f2bbdf3fd0afc8c21f34d06d87896197
+  data.tar.gz: 84270e725e825a11eb81abd67de4bbec459cc736fc9cf1e43b41e926f4a0df346f7df15f0afa906ec2b669671ae74f7cc0287a1ac0c7eb25d630d120b1da3ad4

data/README.md

@@ -43,12 +43,26 @@ That's the whole setup. Now:
 4. **Review** — read the final report and the pull request. Say what's wrong in the
    card's conversation to send it back, or approve.
 5. **QA** — the pull request goes live for formal review on GitHub.
-6. **Drag to Done** — the pull request merges. Shipped.
+6. **Drag to Done** — the pull request merges. Shipped. (If the project has CI and it's
+   red or still running, Cardinal refuses to merge and tells you why on the card.)
 
 Every column has a ⚙ gear where you can change the rules — which AI model works there,
 how many cards can run at once, spending limits, and what happens when a card arrives
 (written in plain English; Cardinal figures out the rest).
 
+### The deep dive
+
+The **🔍 Deep dive** button in the topbar sends a read-only agent (it can look, never
+touch) through your repo once and saves what it learns as a **repo brief** — what the
+project is, where things live, how to build and test it, the traps to avoid. Every worker
+agent gets the brief with its assignment, so agents skip re-exploring your codebase on
+every single card. It costs one AI call.
+
+Once a brief exists the button shows **🔍 Repo brief** — click it to read exactly what
+agents are being told, and to regenerate it. The button drifts from grey toward red as
+commits land that the brief hasn't seen; Cardinal won't silently re-run a dive that's
+already current.
+
 ## Good to know
 
 - Everything Cardinal knows about a project lives in a `.cardinal/` folder inside it,
@@ -57,6 +71,11 @@ how many cards can run at once, spending limits, and what happens when a card ar
   `cardinal logout` to unlink).
 - Agents can only push to their own card branches — merging is always your drag.
 - AI usage bills the Claude account you linked, the same as using Claude Code.
+- The board is only reachable from **your own machine** (localhost). To browse it from
+  another device on your network — a phone or tablet — start with `CARDINAL_HOST=0.0.0.0
+  cardinal`, and know that anyone on that network can then drive your board.
+- In a worker column's ⚙ gear you can turn off **Shell access**: the agent can then only
+  read and edit files — it can't run commands — and Cardinal commits its work for it.
 
 ## For developers
 

data/app/assets/stylesheets/cardinal.css

@@ -79,6 +79,14 @@ a { color: var(--blue); text-decoration: none; }
   50%      { opacity: .7; box-shadow: 0 0 0 3px rgba(212, 51, 51, 0); }
 }
 
+.brief-meta { font-size: 12px; color: var(--text-dim); }
+.brief-behind { color: var(--amber); }
+.brief-content {
+  background: var(--surface); border: 1px solid var(--border); border-radius: 8px;
+  padding: 4px 14px; margin: 10px 0; max-height: 50vh; overflow-y: auto;
+  font-size: 13px;
+}
+
 .pull-form { display: inline; }
 #repo-pull-status { font-size: 0.85rem; }
 #repo-pull-status .pull-ok  { color: var(--green); }
@@ -207,7 +215,18 @@ body.dragging .drop-hint { display: block; }
   font-size: 11px; color: var(--text-dim); font-weight: 600;
 }
 .card-footer:hover .footer-pr { color: var(--blue); }
-.footer-left { min-width: 1px; }
+.footer-left { min-width: 1px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.footer-right { display: flex; align-items: center; gap: 8px; flex-shrink: 0; }
+.footer-cost { white-space: nowrap; }
+.footer-pr { color: var(--text-dim); }
+
+/* Open-card cost tally: sits at the foot of the work panel, live-updating. */
+.work-footer {
+  display: flex; justify-content: space-between; align-items: center; gap: 8px;
+  margin-top: 16px; padding-top: 10px; border-top: 1px solid var(--border);
+  font-size: 12px; color: var(--text-dim); font-weight: 600;
+}
+.work-footer .footer-cost { white-space: nowrap; }
 .card-ghost { opacity: .4; }
 .card-title { font-weight: 600; }
 .card-number { color: var(--text-dim); font-weight: 400; }
@@ -366,6 +385,16 @@ body.dragging .drop-hint { display: block; }
 .zoom-tabs a { padding: 4px 12px; border-radius: 6px; color: var(--text-dim); }
 .zoom-tabs a.active { background: var(--surface-2); color: var(--text); }
 
+.summary-panel .summary-head { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+.summary-panel .summary-head h3 { margin: 0; }
+.summary-generate { white-space: nowrap; }
+.summary-blurb { margin: 6px 0 12px; }
+.summary-form textarea {
+  width: 100%; background: var(--surface-2); border: 1px solid var(--border);
+  border-radius: 6px; color: var(--text); padding: 8px 10px; font: inherit; resize: vertical;
+}
+.summary-stamp { margin-top: 8px; }
+
 .event { display: flex; gap: 10px; padding: 8px 4px; border-bottom: 1px solid var(--surface-2); }
 
 /* Column moves are chapter markers in the card's story */

data/app/controllers/boards_controller.rb

@@ -5,11 +5,14 @@ class BoardsController < ApplicationController
 
   # Kick off the repo deep dive (card #12). Non-blocking: flip the board into
   # its "Working" state, morph the topbar so the button reflects it, and let
-  # DeepDiveJob do the read-only exploration in the background. Ignored if a
-  # dive is already running.
+  # DeepDiveJob do the read-only exploration in the background. Skipped when a
+  # dive is already running, or when the brief already matches HEAD — nothing
+  # changed, so a re-dive would just burn a run (the brief modal's Regenerate
+  # button passes force=1 to override).
   def deep_dive
     board = Board.first!
-    unless board.brief_working?
+    fresh = board.brief? && board.commits_behind_brief == 0
+    unless board.brief_working? || (fresh && params[:force].blank?)
       board.update!(brief_status: "working")
       board.broadcast_refresh_to board
       DeepDiveJob.perform_later(board)
@@ -17,6 +20,39 @@ class BoardsController < ApplicationController
     redirect_to root_path
   end
 
+  # Board settings gear (the board-level analog of the column gear): name and
+  # default branch — the branch agents fork from and Done merges toward.
+  def edit
+    @board = Board.first!
+    redirect_to root_path and return unless turbo_frame_request?
+  end
+
+  def update
+    board = Board.first!
+    attrs = params.require(:board).permit(:name, :default_branch)
+    board.update!(
+      name: attrs[:name].presence || board.name,
+      default_branch: attrs[:default_branch].presence || board.default_branch
+    )
+    board.broadcast_refresh_to board
+    if params[:autosave]
+      render turbo_stream: [
+        turbo_stream.update("board-name", board.name),
+        turbo_stream.update("board-form-errors", "")
+      ]
+    else
+      redirect_to root_path
+    end
+  end
+
+  # Inspect the repo brief: what the deep dive wrote, when, from which SHA.
+  def brief
+    @board = Board.first!
+    redirect_to root_path and return unless turbo_frame_request?
+
+    render :brief
+  end
+
   # Cards reaching Done merge PRs on GitHub, so the checkout Cardinal runs
   # against falls behind. The topbar Pull button fast-forwards it. --ff-only
   # on purpose: never invent merge commits or rebase local work — if the tree
@@ -49,7 +85,20 @@ class BoardsController < ApplicationController
       ["Already up to date", true]
     else
       count, = Open3.capture2e("git", "-C", repo, "rev-list", "--count", "#{before.strip}..#{after.strip}")
-      ["Pulled #{helpers.pluralize(count.strip.to_i, "new commit")}", true]
+      migrated = run_pending_migrations
+      note = migrated.positive? ? " · ran #{helpers.pluralize(migrated, "migration")}" : ""
+      ["Pulled #{helpers.pluralize(count.strip.to_i, "new commit")}#{note}", true]
     end
   end
+
+  # When the board's repo IS this Cardinal instance (dogfooding) a pull can
+  # bring schema changes; without this the running server 500s until someone
+  # runs db:migrate by hand. A no-op everywhere else — `cardinal up` already
+  # covers cold boots via db:prepare.
+  def run_pending_migrations
+    context = ActiveRecord::Base.connection_pool.migration_context
+    pending = context.migrations.map(&:version) - context.get_all_versions
+    context.migrate if pending.any?
+    pending.size
+  end
 end

data/app/controllers/cards_controller.rb

@@ -1,5 +1,5 @@
 class CardsController < ApplicationController
-  before_action :set_card, only: [:show, :update, :move, :approve, :destroy]
+  before_action :set_card, only: [:show, :update, :move, :approve, :summarize, :destroy]
 
   def new
     @board = Board.first!
@@ -30,10 +30,11 @@ class CardsController < ApplicationController
   end
 
   def show
-    @zoom = params[:zoom].presence_in(%w[conversation activity debug]) || "conversation"
+    @zoom = params[:zoom].presence_in(%w[conversation activity debug summary]) || "conversation"
     @events = case @zoom
               when "conversation" then @card.events.conversation
               when "activity" then @card.events.activity
+              when "summary" then Event.none # the Summary tab shows the card summary, not events
               else @card.events
               end
 
@@ -83,6 +84,19 @@ class CardsController < ApplicationController
     redirect_to card_path(@card)
   end
 
+  # Generate a customer-friendly summary on demand (card #35). Non-blocking,
+  # mirroring the board's deep dive: flip the card into its "working" state,
+  # morph the Summary panel so the button reflects it, and let SummaryJob do the
+  # one-shot synthesis in the background. Skipped when one is already running.
+  def summarize
+    unless @card.summary_working?
+      @card.update!(summary_status: "working")
+      SummaryJob.perform_later(@card)
+    end
+    render turbo_stream: turbo_stream.replace("card_summary",
+             partial: "cards/summary_panel", locals: { card: @card })
+  end
+
   def move
     from_column = @card.column
     to_column = @card.board.columns.find(params[:column_id])
@@ -106,7 +120,7 @@ class CardsController < ApplicationController
   end
 
   def card_params
-    attrs = params.require(:card).permit(:title, :description, :tags, :branch_name, :pr_url)
+    attrs = params.require(:card).permit(:title, :description, :tags, :branch_name, :pr_url, :summary)
     attrs[:tags] = attrs[:tags].to_s.split(",").map(&:strip).reject(&:blank?) if attrs.key?(:tags)
     attrs.to_h.symbolize_keys
   end
@@ -114,7 +128,7 @@ class CardsController < ApplicationController
   # Changelog in the activity timeline (the mechanism already exists). A burst
   # of autosaves coalesces into one entry instead of one per pause-in-typing.
   def log_changelog!
-    changed = @card.previous_changes.keys & %w[title description tags branch_name pr_url]
+    changed = @card.previous_changes.keys & %w[title description tags branch_name pr_url summary]
     return if changed.empty?
 
     last = @card.events.order(:id).last

data/app/controllers/columns_controller.rb

@@ -26,7 +26,7 @@ class ColumnsController < ApplicationController
       :name, :archetype, :instructions, :model, :effort,
       :concurrency_limit, :max_turns, :timeout_minutes, :plan_approval,
       :on_entry_text, :on_entry_json, :color, :custom_color, :arrivals, :ai,
-      :footer_text, accepts_from: []
+      :shell, :footer_text, accepts_from: []
     )
 
     policy = @column.policy.dup
@@ -38,6 +38,7 @@ class ColumnsController < ApplicationController
     policy["plan_approval"] = attrs[:plan_approval] == "1"
     policy["arrivals"] = attrs[:arrivals].presence_in(%w[top bottom])
     policy["ai"] = (attrs[:ai] == "1") if attrs.key?(:ai) # inbox forms omit it — never AI anyway
+    policy["shell"] = (attrs[:shell] == "1") if attrs.key?(:shell) # worker shell access (execution gear only)
     # Accept policy (card #15): store allowed source column ids as strings.
     # EXPLICIT ONLY — an empty list means the column accepts from nowhere.
     policy["accepts_from"] = attrs[:accepts_from].to_a.map(&:to_s).reject(&:blank?).presence

data/app/jobs/merge_pr_job.rb

@@ -6,6 +6,7 @@ class MergePrJob < ApplicationJob
   def perform(card_id)
     card = Card.find(card_id)
     return if card.pr_url.blank? || card.pr_state == "merged"
+    return unless checks_green?(card)
 
     # Best-effort undraft — a QA column may already have done it, and gh
     # errors on an already-ready PR; the merge step is the real gate.
@@ -18,6 +19,27 @@ class MergePrJob < ApplicationJob
 
   private
 
+  # The merge gate: never ship over failing CI. A repo with no checks
+  # configured passes (nothing to gate on); failing or still-running checks
+  # park the card as blocked with the reason — drag it out and back into Done
+  # to retry once CI is green.
+  def checks_green?(card)
+    out, status = Open3.capture2e("gh", "pr", "checks", card.pr_url)
+    return true if status.success?
+    return true if out.match?(/no checks reported/i)
+
+    reason =
+      if status.exitstatus == 8
+        "CI checks are still running — not merged. Drag out of Done and back once they finish."
+      else
+        failing = out.lines.map(&:strip).grep(/fail/i).first(3).join("; ").presence || out.strip.truncate(160)
+        "CI checks failing — not merged. #{failing}"
+      end
+    card.log!("error", text: reason)
+    card.update!(status: "blocked")
+    false
+  end
+
   def run_step(card, cmd)
     out, status = Open3.capture2e(*cmd)
     return true if status.success?

data/app/jobs/resume_run_job.rb

@@ -20,6 +20,13 @@ class ResumeRunJob < ApplicationJob
       return
     end
 
+    # Atomic claim (§ races): two finishing runs can both kick the queue and
+    # double-fire this job — exactly one claimer resumes the session. The
+    # claim value is "running", which is what a resume sets anyway.
+    return unless Run.where(id: run.id, status: "needs_input")
+                     .update_all(status: "running", updated_at: Time.current) == 1
+    run.reload
+
     if (pending = run.briefing["pending_resume"])
       run.update!(briefing: run.briefing.except("pending_resume"))
       message = [pending["message"], message].compact_blank.join("\n\n")

data/app/jobs/start_run_job.rb

@@ -3,11 +3,26 @@ class StartRunJob < ApplicationJob
 
   def perform(card_id)
     card = Card.find(card_id)
-    return unless card.queued? && card.column.execution? && card.column.ai?
-    return if card.column.at_wip_limit? # stays queued; kicked when a slot frees
+    column = card.column
+    return unless column.execution? && column.ai?
+    return if column.at_wip_limit? # stays queued; kicked when a slot frees
 
-    session = card.agent_sessions.create!(status: "provisioning", model: card.column.model)
-    run = session.runs.create!(status: "queued", briefing: { "card" => card.title, "column" => card.column.name })
+    # Atomic claim (§ races): two kicks can enqueue this job twice for the
+    # same card; exactly one claimer flips queued→working, the rest no-op.
+    return unless Card.where(id: card.id, status: "queued")
+                      .update_all(status: "working", updated_at: Time.current) == 1
+    card.reload.touch # update_all skips callbacks — nudge the board broadcast
+
+    # Re-check AFTER claiming: claims are atomic, so an over-subscribed slot
+    # shows up as strictly more running than allowed and the loser un-claims
+    # back into the queue (the next kick retries it).
+    if column.at_wip_limit_exceeded?
+      card.update!(status: "queued")
+      return
+    end
+
+    session = card.agent_sessions.create!(status: "provisioning", model: column.model)
+    run = session.runs.create!(status: "queued", briefing: { "card" => card.title, "column" => column.name })
     Agent::Runner.start(run)
   end
 end

data/app/jobs/summary_job.rb

@@ -0,0 +1,88 @@
+# On-demand, customer-friendly card summary (card #35): a one-shot, tool-less
+# Claude call (the same cheap tier the planning assistant and deep dive use)
+# that compresses everything a card did — its brief, timeline, runs, and code
+# commits — into a couple of non-technical lines you can drop into a customer
+# chat. Generation is user-triggered only; the result persists on the card and
+# stays fully editable. A prior summary (possibly hand-edited) rides along as
+# context so a regeneration refines rather than discards what the user cared about.
+class SummaryJob < ApplicationJob
+  queue_as :default
+
+  FALLBACK_MODEL = "claude-haiku-4-5-20251001".freeze
+
+  SYSTEM = <<~SYS.freeze
+    You write short, non-technical status updates for customers. Given everything
+    that happened on a work item, produce a plain-language recap the reader can
+    drop straight into a Teams or Slack message — what was asked for and what was
+    delivered, in outcome terms. No jargon, no file names, no code, no headings.
+    A couple of sentences up to a short paragraph. Write only the recap itself.
+  SYS
+
+  def perform(card)
+    return clear_working(card) unless ClaudeCli.available?
+
+    model = card.board.columns.find_by(archetype: "planning")&.model.presence || FALLBACK_MODEL
+    summary = ClaudeCli.prompt(build_prompt(card), system: SYSTEM, model: model, max_turns: 1)
+
+    card.update!(summary: summary.to_s.strip, summary_generated_at: Time.current, summary_status: nil)
+    card.broadcast_replace_to card, target: "card_summary",
+                              partial: "cards/summary_panel", locals: { card: card }
+  rescue StandardError
+    # A failed generation must not leave the button stuck on "Generating…".
+    clear_working(card)
+  end
+
+  private
+
+  def clear_working(card)
+    card.update!(summary_status: nil)
+    card.broadcast_replace_to card, target: "card_summary",
+                              partial: "cards/summary_panel", locals: { card: card }
+  end
+
+  def build_prompt(card)
+    parts = ["Work item ##{card.number}: #{card.title}"]
+    parts << "Tags: #{card.tags.join(", ")}" if card.tags.any?
+    parts << "\nDescription:\n#{card.description}" if card.description.present?
+
+    timeline = card.events.activity.filter_map { |e| event_line(e) }
+    parts << "\nWhat happened (timeline):\n#{timeline.join("\n")}" if timeline.any?
+
+    runs = card.runs.order(:id).map { |r| "- Run ##{r.id}: #{r.status}#{" (#{r.phase})" if r.phase.present?}" }
+    parts << "\nRuns:\n#{runs.join("\n")}" if runs.any?
+
+    commits = commit_lines(card)
+    parts << "\nCode changes (commit messages):\n#{commits.join("\n")}" if commits.any?
+
+    if card.summary.present?
+      parts << "\nThe user's current summary is below. They may have edited it by hand, " \
+               "so treat its wording and emphasis as a signal of what they care about — " \
+               "refine and update it with any new work rather than starting from scratch:\n#{card.summary}"
+    end
+
+    parts.join("\n")
+  end
+
+  def event_line(event)
+    text = event.payload["text"].to_s.strip
+    return nil if text.blank?
+    "- #{event.actor}: #{text.truncate(400)}"
+  end
+
+  # Commit messages for the card's branch, read from the per-card workspace
+  # checkout when it still exists. The checkout isn't guaranteed to be present
+  # (it's left in place after a run but may be pruned), so this is best-effort —
+  # the timeline already narrates the work when commits are unavailable.
+  def commit_lines(card)
+    return [] if card.branch_name.blank?
+    path = Agent::Workspace::Local.new(card).path
+    return [] unless File.directory?(path.join(".git"))
+
+    base = "origin/#{card.board.default_branch}"
+    out, ok = Open3.capture2e("git", "-C", path.to_s, "log", "--oneline", "--no-decorate", "#{base}..HEAD")
+    return [] unless ok.success?
+    out.lines.map(&:strip).reject(&:blank?).map { |l| "- #{l}" }
+  rescue StandardError
+    []
+  end
+end

data/app/models/board.rb

@@ -10,6 +10,7 @@ class Board < ApplicationRecord
       policy: { "ai" => true, "model" => "claude-haiku-4-5-20251001", "plan_approval" => false,
                 "on_entry" => [{ "action" => "assistant_greeting" }],
                 "on_entry_text" => "The planning assistant reads the card and opens the discussion.",
+                "footer" => [{ "label" => "Model:", "compute" => "model" }],
                 "accepts_from_names" => ["Tasks", "In Progress", "Review", "QA"] } },
     { name: "In Progress", archetype: "execution",
       policy: { "ai" => true, "model" => "claude-opus-4-8", "effort" => "high",
@@ -18,6 +19,7 @@ class Board < ApplicationRecord
                 "tools" => %w[read edit run_commands git_commit_push],
                 "on_entry" => [{ "action" => "start_agent_run" }],
                 "accepts_from_names" => ["Planning", "Review", "QA"],
+                "footer" => [{ "label" => "Model:", "compute" => "model" }],
                 "instructions" => "Follow repo conventions. Write tests when the repo has a suite." } },
     { name: "Review",      archetype: "review",
       policy: { "ai" => true, "plan_approval" => false,
@@ -60,18 +62,30 @@ class Board < ApplicationRecord
     # Raw configured URL (get-url applies insteadOf rewrites, which can embed
     # credential-helper tokens); strip any userinfo defensively either way.
     origin, origin_ok = Open3.capture2e("git", "-C", repo_path, "config", "--get", "remote.origin.url")
-    branch, branch_ok = Open3.capture2e("git", "-C", repo_path, "rev-parse", "--abbrev-ref", "HEAD")
 
     board = create!(
       name: File.basename(repo_path),
       repo_url: origin_ok.success? ? sanitize_remote_url(origin.strip) : nil,
-      default_branch: branch_ok.success? && branch.strip.present? ? branch.strip : "main",
+      default_branch: detect_default_branch(repo_path),
       local_path: repo_path
     )
     board.install_default_columns!
     board
   end
 
+  # The REMOTE's default branch, not whatever happened to be checked out when
+  # `cardinal up` first ran — launching from a feature branch must not make
+  # Done merge toward that feature branch forever. Fallback chain: origin's
+  # HEAD → current branch → "main". Editable later in board settings.
+  def self.detect_default_branch(repo_path)
+    head, ok = Open3.capture2e("git", "-C", repo_path, "symbolic-ref", "refs/remotes/origin/HEAD")
+    return head.strip.delete_prefix("refs/remotes/origin/") if ok.success? && head.strip.present?
+
+    # symbolic-ref, not rev-parse: works even on an unborn branch (fresh init).
+    branch, ok = Open3.capture2e("git", "-C", repo_path, "symbolic-ref", "--short", "HEAD")
+    ok.success? && branch.strip.present? ? branch.strip : "main"
+  end
+
   def self.sanitize_remote_url(url)
     # Drop any userinfo (tokens from credential-helper rewrites). Regex, not
     # URI#userinfo= — Ruby 3.4's RFC3986 parser silently ignores that setter.
@@ -94,7 +108,11 @@ class Board < ApplicationRecord
   # underneath later without a migration.
   BRIEF_STALE_AT = 10 # commits behind → the "refresh me" red/flashing state
 
-  def brief_path = Rails.root.join(".cardinal", "repo-brief.md")
+  # Honor CARDINAL_DATA_DIR: in gem mode Rails.root is the installed gem
+  # (read-only); the instance's data lives in the target repo's .cardinal/.
+  def brief_path
+    Pathname(File.expand_path(ENV["CARDINAL_DATA_DIR"].presence || Rails.root.join(".cardinal"))).join("repo-brief.md")
+  end
 
   def repo_brief
     File.read(brief_path) if File.exist?(brief_path)

data/app/models/card.rb

@@ -11,7 +11,7 @@ class Card < ApplicationRecord
     "planning"  => %w[draft discussing archived],
     "execution" => %w[queued working needs_input blocked failed work_complete archived],
     "review"    => %w[in_review changes_requested approved archived],
-    "terminal"  => %w[done archived]
+    "terminal"  => %w[done blocked archived] # blocked: merge gate refused (CI red/pending)
   }.freeze
 
   belongs_to :board
@@ -39,6 +39,9 @@ class Card < ApplicationRecord
 
   def needs_attention? = %w[needs_input blocked failed work_complete].include?(status)
 
+  # A customer-friendly summary is being (re)generated in the background (§card #35).
+  def summary_working? = summary_status == "working"
+
   def running? = %w[queued working needs_input].include?(status)
 
   # Latest one-line progress event, shown live on the card face (§6).
@@ -46,6 +49,11 @@ class Card < ApplicationRecord
     events.where(kind: "progress").last&.payload&.[]("text")
   end
 
+  # Running tally across every run on the card — the closed-card cost footer
+  # (card #20). Sums stopped/restarted segments so the total reflects real spend.
+  def total_cost = runs.sum(:cost)
+  def total_output_tokens = runs.sum(:output_tokens)
+
   # Is the planning assistant expected to post next? True right after entering
   # a planning column (kickoff inspection pending) or after a user message.
   def awaiting_assistant?

data/app/models/column.rb

@@ -40,7 +40,7 @@ class Column < ApplicationRecord
   # Aggregations a footer row may compute over the column's cards (card #18).
   # A compute key not listed here renders blank, so config that outruns the
   # code degrades gracefully instead of erroring.
-  FOOTER_COMPUTES = %w[sum_cost sum_tokens count_cards].freeze
+  FOOTER_COMPUTES = %w[sum_cost sum_tokens count_cards model].freeze
 
   # Only ever emit a validated hex color into inline styles.
   def safe_color
@@ -56,6 +56,15 @@ class Column < ApplicationRecord
     policy["ai"] != false
   end
 
+  # Worker shell access (execution columns). ON (default): the agent gets the
+  # full toolset — shell, git, everything — inside its workspace clone, which
+  # means it can also touch the host beyond the clone. OFF: file tools only
+  # (read/search/edit); it physically cannot execute commands, and Cardinal
+  # commits and pushes its edits for it.
+  def shell_access?
+    policy["shell"] != false
+  end
+
   # Which columns may move cards INTO this one (§ accept policy, card #15).
   # Stored as an array of column-id strings. EXPLICIT ONLY: an empty list
   # means this column accepts from nowhere — there is no permissive default.
@@ -67,18 +76,15 @@ class Column < ApplicationRecord
   # {"label" => "Total cost:", "compute" => "sum_cost"} hashes; each row pairs
   # static label text with an optional computed aggregate over this column's
   # cards. Returns [] when unconfigured, so existing columns render no footer.
+  # No auto-rows (de-magic): the model row that used to be hardcoded for AI
+  # columns is now the "model" compute — visible in the gear, deletable.
   def footer_rows
-    rows = Array(footer).filter_map do |row|
+    Array(footer).filter_map do |row|
       label = row["label"].to_s
       value = footer_value(row["compute"])
       next if label.blank? && value.blank?
       { label:, value: }
     end
-    # AI columns advertise their active model as a final auto-row (card #32).
-    # Guarded on model presence so an AI column without one adds nothing,
-    # rather than emitting a "Model:" row with a blank value.
-    rows << { label: "Model:", value: model_short } if ai? && model.present?
-    rows
   end
 
   # Start the next queued card when a run slot frees up. A queued card whose
@@ -103,6 +109,14 @@ class Column < ApplicationRecord
     model.to_s[/claude-([a-z]+)/, 1] || model
   end
 
+  # "Opus - High" — human label for cost footers (card #20). Effort is optional,
+  # so a model with no configured effort renders just "Opus".
+  def model_label
+    return if model.blank?
+    label = model_short.to_s.capitalize
+    effort.present? ? "#{label} - #{effort.to_s.capitalize}" : label
+  end
+
   validates :name, presence: true
   validates :position, presence: true
 
@@ -113,6 +127,12 @@ class Column < ApplicationRecord
     execution? && concurrency_limit.present? && running_count >= concurrency_limit.to_i
   end
 
+  # Post-claim variant (§ races): a starter first claims working atomically,
+  # THEN checks — over-subscription reads as strictly more running than allowed.
+  def at_wip_limit_exceeded?
+    execution? && concurrency_limit.present? && running_count > concurrency_limit.to_i
+  end
+
   # Aggregate a single footer row over the runs/cards in this column (card #18).
   # Unknown keys return "" so the row shows just its static label.
   def footer_value(compute)
@@ -123,6 +143,10 @@ class Column < ApplicationRecord
       ActiveSupport::NumberHelper.number_to_delimited(column_runs.sum("input_tokens + output_tokens"))
     when "count_cards"
       cards.count.to_s
+    when "model"
+      # The column's active AI model, short form. Blank when AI is off or no
+      # model is set — the row then shows just its label, telling the truth.
+      ai? ? model_short.to_s : ""
     else
       ""
     end