@anthusai/papyrus 5.43.0 → 5.44.0

package/amplify/functions/category-action/handler.ts

@@ -24,6 +24,7 @@ import {
   requestDelegation,
   type DelegationStore,
 } from "../shared/curation-delegation-flow";
+import { claimGroups } from "../../../lib/staff-groups";
 
 type ReviewHandler = Schema["reviewSteeringProposal"]["functionHandler"];
 type ReferenceCurationHandler = Schema["reviewReferenceCuration"]["functionHandler"];
@@ -360,7 +361,7 @@ function requireSignedInPerson(event: { identity?: unknown }): { sub: string; la
   }
   const identity = event.identity as { sub?: unknown; claims?: Record<string, unknown> };
   const claims = identity.claims ?? {};
-  const groups = Array.isArray(claims["cognito:groups"]) ? (claims["cognito:groups"] as unknown[]) : [];
+  const groups = claimGroups(claims["cognito:groups"]);
   return {
     sub: normalizeRequiredString(claims.sub ?? identity.sub, "identity.sub"),
     label: normalizeOptionalString(claims.email) ?? normalizeOptionalString(claims.name) ?? "Newsroom editor",

package/amplify/functions/monitoring-view/schema.js

@@ -26,6 +26,14 @@ export const monitoringViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(functionHandler("monitoringView", monitoringView)),
+    // Accept ("release") or Reject ("discard") one held email submission. The function validates the
+    // signed-in editor and that the message is routed to this publication; the receiver applies it.
+    monitoringDecideEmailSubmission: a
+        .mutation()
+        .arguments({ receiptId: a.string().required(), decision: a.string().required(), reason: a.string() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(functionHandler("monitoringView", monitoringView)),
     monitoringResolveEmailArticleLink: a
         .mutation()
         .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/monitoring-view/schema.ts

@@ -28,6 +28,14 @@ export const monitoringViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(functionHandler("monitoringView", monitoringView)),
+  // Accept ("release") or Reject ("discard") one held email submission. The function validates the
+  // signed-in editor and that the message is routed to this publication; the receiver applies it.
+  monitoringDecideEmailSubmission: a
+    .mutation()
+    .arguments({ receiptId: a.string().required(), decision: a.string().required(), reason: a.string() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(functionHandler("monitoringView", monitoringView)),
   monitoringResolveEmailArticleLink: a
     .mutation()
     .arguments({ receiptId: a.string().required(), candidateIndex: a.integer().required() })

package/amplify/functions/procedure-action/handler.ts

@@ -3,6 +3,7 @@ import { getAmplifyDataClientConfig } from "@aws-amplify/backend/function/runtim
 import { Amplify } from "aws-amplify";
 import { generateClient } from "aws-amplify/data";
 import type { Schema } from "../../data/resource";
+import { claimGroups } from "../../../lib/staff-groups";
 
 type DataClient = ReturnType<typeof generateClient<Schema>>;
 type DataClientErrors = Array<{ message?: string | null } | string | null> | null | undefined;
@@ -474,20 +475,11 @@ function validateJsonSchemaInput(schema: Record<string, unknown>, input: Record<
 
 function requireAdmin(event: ProcedureEvent): void {
   const claims = objectValue(event.identity?.claims);
-  const groups = [
-    ...normalizeClaimGroups(claims["cognito:groups"]),
-    ...normalizeClaimGroups(claims.groups),
-  ];
+  const groups = [...claimGroups(claims["cognito:groups"]), ...claimGroups(claims.groups)];
   if (groups.includes("admin")) return;
   throw new Error("Admin role required.");
 }
 
-function normalizeClaimGroups(value: unknown): string[] {
-  if (Array.isArray(value)) return value.map((entry) => String(entry).trim()).filter(Boolean);
-  if (typeof value === "string") return value.split(",").map((entry) => entry.trim()).filter(Boolean);
-  return [];
-}
-
 async function getDataClient(): Promise<DataClient> {
   if (!clientPromise) {
     clientPromise = (async () => {

package/amplify/functions/proposal-actions/proposals.py

@@ -92,6 +92,25 @@ def is_appsync_event(event: dict[str, Any]) -> bool:
     return "arguments" in event and ("info" in event or event_field_name(event) is not None)
 PROPOSER_AI = "ai"
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 #: The only moves an operator's IAM role may make, as (from, to). Everything after the draft is an editor's decision.
 OPERATOR_TRANSITIONS = frozenset({(DRAFT, IN_STEERING), (DRAFT, DECLINED)})
 BY_STAFF, BY_OPERATOR = "staff", "operator"
@@ -140,10 +159,8 @@ def staff_subject(identity: dict[str, Any]) -> str | None:
     """The Cognito subject of an editor or admin, or ``None`` for anyone else."""
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not has_editor_rights(groups):
         return None
     return subject
 

package/amplify/plugins/reader-steering/function/handler.py

@@ -1468,10 +1468,8 @@ def handle_staff_event(event: dict[str, Any], *, store: Any, settings: ReaderSet
     identity = event.get("identity") or {}
     claims = identity.get("claims") or {}
     groups = claims.get("cognito:groups") or identity.get("groups") or []
-    if isinstance(groups, str):
-        groups = [group.strip() for group in groups.strip("[]").replace(",", " ").split()]
     subject = identity.get("sub")
-    if not isinstance(subject, str) or not subject or not moderation_rules.STAFF_GROUPS.intersection(groups):
+    if not isinstance(subject, str) or not subject or not moderation_rules.has_editor_rights(groups):
         return moderation_rules.refused("not_staff", "Only editors and admins can moderate.").to_dict()
     arguments = event.get("arguments") or {}
     outcome = moderation_rules.apply_action(

package/amplify/plugins/reader-steering/function/moderation.py

@@ -37,6 +37,25 @@ READER_ID = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f
 ACTION_ID = re.compile(r"mod-[0-9a-f]{32}")
 MAXIMUM_REASON = 500
 STAFF_GROUPS = frozenset({"editor", "admin"})
+
+_GROUP_SEPARATORS = re.compile(r"[\s,]+")
+
+
+def claim_groups(value: Any) -> list[str]:
+    """Copy of ``papyrus_content.staff_groups.claim_groups`` (this function ships without that package; a test keeps them equal)."""
+    if isinstance(value, (list, tuple, set, frozenset)):
+        raw = [item for item in value if isinstance(item, str)]
+    elif isinstance(value, str):
+        raw = _GROUP_SEPARATORS.split(value)
+    else:
+        return []
+    cleaned = (item.strip().strip("\"'[](){}").strip() for item in raw)
+    return [item for item in cleaned if item]
+
+
+def has_editor_rights(groups: Any) -> bool:
+    """``admin`` has every editor right: an admin who is not in the ``editor`` group is staff."""
+    return any(group.lower() in STAFF_GROUPS for group in claim_groups(groups))
 ITEM_ID_PREFIX = "item-"
 
 

package/bin/papyrus-infra.mjs

@@ -3,6 +3,7 @@
  * papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]
  * papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]
  * papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader
+ * papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out]   (the private chat data stack)
  * papyrus-infra deploy --site infra/site.json [--only-branch main] [--only-app-id ID] [--out cdk.out] [--account A] [--region R]
  * Synthesizes the app-shell stack for a publication from its own site.json,
  * prints one of the generated Amplify build specs, or deploys the stack from
@@ -16,6 +17,7 @@ import { resolveCdkEnvironment } from "../src/cdk-environment.mjs";
 
 const USAGE = [
   "Usage: papyrus-infra synth --site infra/site.json [--out cdk.out] [--account A] [--region R]",
+  "       papyrus-infra synth --site infra/site.json --part chat [--chat-lambdas DIR] [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra synth --account-stack github-oidc [--out cdk.out] [--account A] [--region R]",
   "       papyrus-infra print-buildspec --site infra/site.json --app cms-production|cms-staging|reader",
   "       papyrus-infra deploy-edge --stack NAME --template FILE [--adoption-template FILE --adopt-resources FILE] [--parameter KEY=VALUE]... [--delete-function NAME] [--only-branch main] [--only-app-id ID] [--region R]",
@@ -186,8 +188,9 @@ if (command === "deploy") {
 }
 
 let AmplifyAppShellStack;
+let PapyrusChatStack;
 try {
-  ({ AmplifyAppShellStack } = await import("../infra/index.js"));
+  ({ AmplifyAppShellStack, PapyrusChatStack } = await import("../infra/index.js"));
 } catch (error) {
   console.error(`papyrus-infra: ${error instanceof Error ? error.message : error}`);
   process.exit(1);
@@ -195,6 +198,23 @@ try {
 
 const { App } = createRequire(path.join(process.cwd(), "noop.js"))("aws-cdk-lib");
 const app = new App({ outdir: path.resolve(opt("out", "cdk.out")) });
+if (opt("part", "shell") === "chat") {
+  // The site's private newsroom chat data stack (docs/private-newsroom-chat-per-site.md); deployed before the app shell enables chat.
+  if (!config.chat?.enabled) {
+    console.error(`papyrus-infra: site ${config.siteId} has no enabled chat block`);
+    process.exit(1);
+  }
+  const lambdaAssetDirectory = opt("chat-lambdas");
+  const chatStack = new PapyrusChatStack(app, {
+    config,
+    env: resolveEnvironmentOrExit(),
+    lambdaAssetDirectory: lambdaAssetDirectory ? path.resolve(lambdaAssetDirectory) : undefined,
+    description: `Private Papyrus newsroom chat data plane for ${config.siteId}.`,
+  });
+  app.synth();
+  console.log(`synthesized ${chatStack.stackName} -> ${path.resolve(opt("out", "cdk.out"))}`);
+  process.exit(0);
+}
 new AmplifyAppShellStack(app, `AmplifyAppShell-${config.siteId}`, config, {
   env: resolveEnvironmentOrExit(),
   stackName: resolveStackName(config),

package/components/dev-sandbox-editor-sign-in.tsx

@@ -2,9 +2,9 @@
 
 import { fetchAuthSession, signIn, signOut } from "aws-amplify/auth";
 import { configureAmplifyClient } from "./amplify-client-provider";
+import { hasEditorRights } from "../lib/staff-groups";
 import type { DevSandboxEditorAuth } from "../lib/dev-sandbox-editor-auth";
 
-const EDITOR_GROUPS = new Set(["editor", "admin"]);
 
 function readSessionGroups(session: Awaited<ReturnType<typeof fetchAuthSession>>): string[] {
   const accessPayload = session.tokens?.accessToken?.payload ?? {};
@@ -29,7 +29,7 @@ function readSessionGroups(session: Awaited<ReturnType<typeof fetchAuthSession>>
 
 function sessionHasEditorAccess(session: Awaited<ReturnType<typeof fetchAuthSession>>): boolean {
   if (!session.tokens?.accessToken) return false;
-  return readSessionGroups(session).some((group) => EDITOR_GROUPS.has(group));
+  return hasEditorRights(readSessionGroups(session));
 }
 
 export async function ensureDevSandboxEditorSession(

package/components/monitoring-overview-view.tsx

@@ -1,5 +1,6 @@
 import { useEffect, useRef, useState } from "react";
 import Link from "next/link";
+import { CheckIcon, XIcon } from "lucide-react";
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
 import {
   confidenceText,
@@ -12,6 +13,10 @@ import {
   beginEmailSubmissionAction,
   endEmailSubmissionAction,
   isCurrentEmailSubmissionAction,
+  emailSubmissionAccepted,
+  QUARANTINE_LABELS,
+  type EmailDecisionResult,
+  type EmailQuarantine,
   type MonitoringItem,
   type MonitoringEmailDetails,
   type MonitoringEmailArticleResolution,
@@ -97,8 +102,9 @@ function QueueItem({ item, ownId, demo }: { item: MonitoringItem; ownId: string
   );
 }
 
-export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates }: {
+export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink, onImportCandidates, onDecide }: {
   items: MonitoringEmailSummary[]; detail: MonitoringEmailDetails | null; onOpen?: (receiptId: string) => void;
+  onDecide?: (receiptId: string, decision: "accept" | "reject", reason: string) => Promise<EmailDecisionResult>;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
 }) {
@@ -108,8 +114,15 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
   const [busyImportByReceipt, setBusyImportByReceipt] = useState<Record<string, boolean>>({});
   const [noticeByReceipt, setNoticeByReceipt] = useState<Record<string, string>>({});
   const [importedByReceipt, setImportedByReceipt] = useState<Record<string, EmailReferenceImportOutcome["references"]>>({});
+  const [decidedByReceipt, setDecidedByReceipt] = useState<Record<string, EmailQuarantine>>({});
+  const [reasonByReceipt, setReasonByReceipt] = useState<Record<string, string>>({});
+  const [busyDecisionByReceipt, setBusyDecisionByReceipt] = useState<Record<string, boolean>>({});
   const receiptId = detail && "submission" in detail ? detail.submission.receiptId : null;
   const receiptKey = receiptId ?? "";
+  const quarantine = (detail && "submission" in detail ? decidedByReceipt[receiptKey] ?? detail.submission.quarantine : null);
+  const accepted = emailSubmissionAccepted(quarantine);
+  const reason = reasonByReceipt[receiptKey] ?? "";
+  const busyDecision = busyDecisionByReceipt[receiptKey] ?? false;
   const selected = selectedByReceipt[receiptKey] ?? {};
   const resolved = resolvedByReceipt[receiptKey] ?? {};
   const busyIndex = busyIndexByReceipt[receiptKey] ?? null;
@@ -139,7 +152,7 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
       if (!isCurrentEmailSubmissionAction(activeReceiptId.current, requestReceiptId)) return;
       if (!("url" in result)) {
         const reason = "reason" in result && typeof result.reason === "string"
-          && /^(?:redirect_[a-z_]+|resolution_record_invalid|resolution_not_recorded)$/.test(result.reason)
+          && /^(?:redirect_[a-z_]+|resolution_record_invalid|resolution_not_recorded|invalid_url|not_public|dns|timeout|connection|tls|loop|http_4xx|http_5xx|blocked|too_large|unreadable|unsafe_destination|no_query|search_unavailable|search_error|no_match)$/.test(result.reason)
           ? ` (${result.reason})` : "";
         setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: `The article destination could not be resolved safely${reason}. The original link remains private and unchanged.` }));
         return;
@@ -147,7 +160,9 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
       const candidate = detail && "submission" in detail ? detail.candidateLinks[index] : null;
       setResolvedByReceipt((current) => ({ ...current, [requestReceiptId]: { ...current[requestReceiptId], [index]: { url: result.url, title: result.title || candidate?.title || "Article" } } }));
       setSelectedByReceipt((current) => ({ ...current, [requestReceiptId]: { ...current[requestReceiptId], [index]: true } }));
-      setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "Resolved. This request may be recorded as a click by the newsletter sender." }));
+      setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: result.foundVia === "search"
+        ? `The newsletter link could not be followed, so this article was found by searching the headline (match ${Math.round((result.search?.matchScore ?? 0) * 100)}%). Check that it is the right article before importing it.`
+        : "Resolved. This request may be recorded as a click by the newsletter sender." }));
     } catch {
       if (isCurrentEmailSubmissionAction(activeReceiptId.current, requestReceiptId)) {
         setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "The article destination could not be resolved. Try again later." }));
@@ -158,6 +173,34 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
     }
   };
 
+  const decide = async (decision: "accept" | "reject") => {
+    if (!receiptId || !onDecide) return;
+    const requestReceiptId = receiptId;
+    const actionKey = `decide:${requestReceiptId}`;
+    if (!beginEmailSubmissionAction(inFlightActions.current, actionKey)) return;
+    setBusyDecisionByReceipt((current) => ({ ...current, [requestReceiptId]: true }));
+    setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "" }));
+    try {
+      const result = await onDecide(requestReceiptId, decision, reason.trim());
+      if ("ok" in result) {
+        setDecidedByReceipt((current) => ({ ...current, [requestReceiptId]: result.quarantine }));
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: decision === "accept"
+          ? "Accepted. The receiver queues it within a minute; the links can be added to References once it is queued."
+          : "Rejected. The message is closed and kept privately until it expires." }));
+      } else if ("error" in result && result.quarantine) {
+        setDecidedByReceipt((current) => ({ ...current, [requestReceiptId]: result.quarantine as EmailQuarantine }));
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "Another decision was already recorded for this message; it cannot be changed." }));
+      } else {
+        setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "The decision was not recorded. Check your editor access and try again." }));
+      }
+    } catch {
+      setNoticeByReceipt((current) => ({ ...current, [requestReceiptId]: "The decision was not recorded. It is safe to try again." }));
+    } finally {
+      endEmailSubmissionAction(inFlightActions.current, actionKey);
+      setBusyDecisionByReceipt((current) => ({ ...current, [requestReceiptId]: false }));
+    }
+  };
+
   const importSelected = async () => {
     if (!receiptId || !detail || !("submission" in detail) || !onImportCandidates) return;
     const requestReceiptId = receiptId;
@@ -210,6 +253,7 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
           <span>SES signals — SPF {item.verdicts.spf}, DKIM {item.verdicts.dkim}, DMARC {item.verdicts.dmarc}; spam {item.verdicts.spam}, virus {item.verdicts.virus}</span>
           {item.warnings.length ? <span>Warnings: {item.warnings.join(", ")}</span> : null}
           {item.errorCode ? <span>State: {item.status} ({item.errorCode})</span> : <span>State: {item.status}</span>}
+          {item.quarantine ? <span data-email-quarantine-state={item.quarantine.state}>{QUARANTINE_LABELS[item.quarantine.state]}</span> : null}
           {onOpen ? <button type="button" onClick={() => onOpen(item.receiptId)}>Read email and review candidate links</button> : null}
         </li>)}
       </ul> : <p>No email submissions are available for this publication.</p>}
@@ -218,32 +262,60 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
           <h4>{detail.submission.subject || "Submitted email"}</h4>
           <p>Original content is shown as inert text. Sender and message content are untrusted; no instructions are executed.</p>
           <pre style={{ whiteSpace: "pre-wrap", overflowWrap: "anywhere" }}>{detail.safeBodyText}</pre>
+          {quarantine ? <section aria-label="Held for review" data-email-quarantine={quarantine.state}>
+            <h5>{QUARANTINE_LABELS[quarantine.state]}</h5>
+            {quarantine.state === "quarantined" ? <>
+              <p>This message was held privately and nothing was routed. Accept it to queue its links as if it had been accepted, or Reject it to close it. Sender identity and authentication signals never grant access; the decision is yours and is recorded.</p>
+              <label>Why? (optional)
+                <textarea value={reason} rows={3} maxLength={500} style={{ display: "block", width: "100%" }}
+                  onChange={(event) => setReasonByReceipt((current) => ({ ...current, [receiptKey]: event.target.value }))} />
+              </label>
+              <button type="button" data-email-decision="accept" disabled={busyDecision || !onDecide} onClick={() => void decide("accept")}>
+                <CheckIcon aria-hidden="true" size={16} /> Accept
+              </button>
+              <button type="button" data-email-decision="reject" disabled={busyDecision || !onDecide} onClick={() => void decide("reject")}>
+                <XIcon aria-hidden="true" size={16} /> Reject
+              </button>
+            </> : null}
+            {quarantine.decision ? <p data-email-decision-record>
+              {quarantine.decision.action === "accept" ? "Accepted" : "Rejected"}
+              {quarantine.decision.by ? ` by ${quarantine.decision.by}` : ""}{quarantine.decision.at ? ` on ${formatUtc(quarantine.decision.at)}` : ""}
+              {quarantine.decision.reason ? `. Why: ${quarantine.decision.reason}` : "."}
+            </p> : null}
+            {quarantine.failure ? <p role="alert">The decision could not be applied ({quarantine.failure}).</p> : null}
+            {quarantine.state === "expired" ? <p>This message expired and can no longer be accepted.</p> : null}
+            {notice && !accepted ? <p role="status" data-email-decision-result>{notice}</p> : null}
+          </section> : null}
           <h5>Candidate references ({detail.candidateLinks.length})</h5>
           <ul>{detail.candidateLinks.map((link, index) => <li key={`${link.url}-${index}`}>
-            {link.resolutionStatus === "unresolved" && !resolved[index]
+            {!accepted
+              ? <span>{link.title || "Source link"} <code>{link.url}</code></span>
+              : link.resolutionStatus === "unresolved" && !resolved[index]
               ? <span>{link.title || "Newsletter article link"} (tracking redirect not opened)</span>
               : <a href={(resolved[index]?.url ?? link.url)} target="_blank" rel="noreferrer noopener">{resolved[index]?.title ?? (link.title || "Source link")}</a>}
-            <label>
+            {accepted ? <label>
               <input type="checkbox" checked={selected[index] ?? false}
                 disabled={link.resolutionStatus === "unresolved" && !resolved[index]}
                 onChange={(event) => setSelectedByReceipt((current) => ({ ...current, [receiptKey]: { ...current[receiptKey], [index]: event.target.checked } }))} />
               Add as pending Reference
-            </label>
-            {link.resolutionStatus === "unresolved" && !resolved[index] ? (
+            </label> : null}
+            {accepted && link.resolutionStatus === "unresolved" && !resolved[index] ? (
               <button type="button" disabled={busyIndex !== null || !onResolveArticleLink} onClick={() => void resolveLink(index)}>
                 {busyIndex === index ? "Resolving…" : "Resolve article redirect (may register a click)"}
               </button>
             ) : null}
           </li>)}</ul>
-          <p>Adding links creates or reuses pending References. It does not approve, label, classify, or publish them.</p>
-          <button type="button" disabled={busyImport || !onImportCandidates || !detail.submission.corpusId}
-            onClick={() => void importSelected()}>
-            {busyImport ? "Adding References…" : "Add selected links to References"}
-          </button>
-          {notice ? <p role="status" data-email-import-result>{notice}</p> : null}
-          {importedReferences.length ? <ul>{importedReferences.map((reference, index) => (
-            <li key={`${reference.id}-${index}`}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, false)}>Review imported Reference {index + 1}</Link></li>
-          ))}</ul> : null}
+          {accepted ? <>
+            <p>Adding links creates or reuses pending References. It does not approve, label, classify, or publish them.</p>
+            <button type="button" disabled={busyImport || !onImportCandidates || !detail.submission.corpusId}
+              onClick={() => void importSelected()}>
+              {busyImport ? "Adding References…" : "Add selected links to References"}
+            </button>
+            {notice ? <p role="status" data-email-import-result>{notice}</p> : null}
+            {importedReferences.length ? <ul>{importedReferences.map((reference, index) => (
+              <li key={`${reference.id}-${index}`}><Link href={getNewsroomNavHref(`/newsroom/references/${encodeURIComponent(reference.lineageId)}`, false)}>Review imported Reference {index + 1}</Link></li>
+            ))}</ul> : null}
+          </> : <p>Links stay inert text, and nothing can be added to References, until this message is accepted.</p>}
         </section>
       ) : detail && "error" in detail ? <p role="alert">You cannot read this submission.</p>
         : detail && "state" in detail ? <p role="alert">Submission details are unavailable.</p> : null}
@@ -251,8 +323,9 @@ export function EmailSubmissions({ items, detail, onOpen, onResolveArticleLink,
   );
 }
 
-function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onImportCandidates }: {
+function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onImportCandidates, onDecide }: {
   data: MonitoringOverview; demo: boolean; emailDetail: MonitoringEmailDetails | null; onEmailOpen: (id: string) => void;
+  onDecide?: (receiptId: string, decision: "accept" | "reject", reason: string) => Promise<EmailDecisionResult>;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
 }) {
@@ -265,7 +338,8 @@ function Ready({ data, demo, emailDetail, onEmailOpen, onResolveArticleLink, onI
 
       <EmailSubmissions items={data.emailSubmissions ?? []} detail={emailDetail} onOpen={onEmailOpen}
         onResolveArticleLink={demo ? undefined : onResolveArticleLink}
-        onImportCandidates={demo ? undefined : onImportCandidates} />
+        onImportCandidates={demo ? undefined : onImportCandidates}
+        onDecide={demo ? undefined : onDecide} />
 
       <article className="news-desk-doctrine-card" data-monitoring-section="router">
         <div className="news-desk-doctrine-card__header"><div><h3>Router</h3><span>Sends collected items to the shared Cyclotron and delivers relevant ones to References</span></div></div>
@@ -373,6 +447,7 @@ export function MonitoringOverviewView({
   onEmailOpen = () => {},
   onResolveArticleLink,
   onImportCandidates,
+  onDecide,
 }: {
   result: MonitoringResult | null;
   canViewAll: boolean;
@@ -383,6 +458,7 @@ export function MonitoringOverviewView({
   onEmailOpen?: (receiptId: string) => void;
   onResolveArticleLink?: (receiptId: string, candidateIndex: number) => Promise<MonitoringEmailArticleResolution>;
   onImportCandidates?: (receiptId: string, items: EmailReferenceImportItem[]) => Promise<EmailReferenceImportOutcome>;
+  onDecide?: (receiptId: string, decision: "accept" | "reject", reason: string) => Promise<EmailDecisionResult>;
 }) {
   let body: React.ReactNode;
   if (result === null) {
@@ -399,7 +475,7 @@ export function MonitoringOverviewView({
     body = <Message kind="empty" title="Nothing has been collected yet">No feed is configured and no run has been recorded. Items appear here after the collector&apos;s first run.</Message>;
   } else {
     body = <Ready data={result} demo={demo} emailDetail={emailDetail} onEmailOpen={onEmailOpen}
-      onResolveArticleLink={onResolveArticleLink} onImportCandidates={onImportCandidates} />;
+      onResolveArticleLink={onResolveArticleLink} onImportCandidates={onImportCandidates} onDecide={onDecide} />;
   }
   const scopeLine = result && "scope" in result
     ? (result.scope.mode === "all" ? "Showing the whole shared pipeline, every publication." : `Showing what is relevant to ${result.scope.publicationId ?? "this publication"}.`)

package/components/monitoring-panel.tsx

@@ -3,6 +3,7 @@
 import { useEffect, useState } from "react";
 import { useSearchParams } from "next/navigation";
 import {
+  decideMonitoringEmailSubmission,
   importMonitoringEmailCandidates,
   loadMonitoringEmailSubmission,
   loadMonitoringOverview,
@@ -39,7 +40,8 @@ function MonitoringEmailReceipt({ receiptId, isDemo }: { receiptId: string; isDe
   return <div data-news-desk-admin-panel="monitoring">
     {detail === null ? <p role="status">Loading email submission…</p> :
       <EmailSubmissions items={"submission" in detail ? [detail.submission] : []} detail={detail}
-        onResolveArticleLink={resolveMonitoringEmailArticleLink} onImportCandidates={importMonitoringEmailCandidates} />}
+        onResolveArticleLink={resolveMonitoringEmailArticleLink} onImportCandidates={importMonitoringEmailCandidates}
+        onDecide={decideMonitoringEmailSubmission} />}
   </div>;
 }
 
@@ -86,5 +88,5 @@ function MonitoringOverviewPanel({ isAdmin, isDemo }: { isAdmin: boolean; isDemo
 
   return <MonitoringOverviewView result={result} canViewAll={isAdmin} mode={mode} onModeChange={setMode} demo={isDemo}
     emailDetail={emailDetail} onEmailOpen={isDemo ? () => {} : openEmail} onResolveArticleLink={isDemo ? undefined : resolveEmailArticleLink}
-    onImportCandidates={importEmailCandidates} />;
+    onImportCandidates={importEmailCandidates} onDecide={isDemo ? undefined : decideMonitoringEmailSubmission} />;
 }

package/components/news-desk-client-provider.tsx

@@ -113,7 +113,8 @@ export function NewsDeskClientProvider({
         return;
       }
       if (isAuthorizationError(error)) {
-        setShell((current) => resolveForbidden(current, access.auth));
+        // The session already has editor rights, so the backend refusing a read is not a missing role. Say what was refused.
+        setShell((current) => resolveDashboardFailure(current, access.auth, refusedReadMessage(error)));
         return;
       }
       setShell((current) => resolveDashboardFailure(
@@ -215,9 +216,14 @@ function isAuthorizationError(error: unknown): boolean {
   return /not authorized|unauthorized|access denied|forbidden/i.test(message);
 }
 
+function refusedReadMessage(error: unknown): string {
+  const detail = error instanceof Error ? error.message : String(error ?? "");
+  return `The Newsroom backend refused a read for this signed-in account (${detail}). The account has editor or admin rights, so this is a backend authorization rule, not a missing role.`;
+}
+
 function resolvePrivateReadFailure(state: NewsDeskShellState, auth: NewsDeskShellState["auth"], error: unknown, fallback: string): NewsDeskShellState {
   if (isUnauthenticatedError(error)) return resolveSignedOut(state, { status: "signedOut", label: "Signed out" });
-  if (isAuthorizationError(error)) return resolveForbidden(state, auth);
+  if (isAuthorizationError(error)) return resolveDashboardFailure(state, auth, refusedReadMessage(error));
   return resolveDashboardFailure(state, auth, error instanceof Error ? error.message : fallback);
 }
 

package/components/news-desk-taxonomy-client.ts

@@ -1,6 +1,7 @@
 "use client";
 
 import { loadReferenceReviewDetails } from "../lib/reference-review-details";
+import { hasEditorRights } from "../lib/staff-groups";
 
 import { isEditorialWorkAssignment } from "../lib/newsroom-assignments";
 import { isLocalPreviewEnabled } from "../lib/local-preview";
@@ -838,7 +839,7 @@ export async function loadEditorResolvedAccessState(): Promise<EditorAccessState
     if (!refreshed.hasSession || refreshed.auth.status === "signedOut") {
       return { status: "signedOut", isEditor: false, isAdmin: false, auth: refreshed.auth, error: null };
     }
-    const isEditor = refreshed.groups.some((group) => group === "editor" || group === "admin");
+    const isEditor = hasEditorRights(refreshed.groups);
     if (!isEditor) {
       return {
         status: "forbidden",

package/components/newsroom-ops-overview.tsx

@@ -24,6 +24,7 @@ import {
 import { newsroomInboxRowClassName } from "../lib/newsroom-list-selection";
 import type { RelevanceDecisionView } from "../lib/relevance-decisions";
 import { NotificationCenter } from "./notification-center";
+import { CyclotronRow, predictionFromDecision } from "./reference-review-card";
 
 type NewsroomOpsOverviewProps = {
   assignments: AssignmentRecord[];
@@ -105,9 +106,13 @@ export function NewsroomOpsOverview({
                     href={href}
                     key={lineageId}
                   >
-                    <div className="min-w-0 flex-1">
+                    <div className="min-w-0 flex-1 space-y-1">
                       <p className="truncate text-sm font-medium text-foreground">{referenceDisplayTitle(reference)}</p>
                       <p className="text-xs text-muted-foreground">Review source intake · {formatReferenceListDate(reference)}</p>
+                      <div data-needs-attention-suggestion={lineageId}>
+                        <CyclotronRow prediction={decisions.get(lineageId) ? predictionFromDecision(decisions.get(lineageId)!) : { state: "none" }} />
+                      </div>
+                      <p className="text-xs font-medium text-foreground">Open it to Accept or Reject in the review queue</p>
                     </div>
                     <Badge className="mt-0.5 shrink-0" variant="outline">Pending</Badge>
                   </Link>

package/components/newsroom-references-view.tsx

@@ -44,6 +44,7 @@ import { newsroomListRowClassName } from "../lib/newsroom-list-selection";
 import { ReferenceSourcePreview } from "./reference-source-preview";
 import {
   ReviewCard,
+  predictionFromDecision,
   ReviewQueueBar,
   useQueueGestures,
   type CardPrediction,
@@ -269,10 +270,7 @@ function summaryOf(reference: ReferenceRecord): string | null {
 }
 
 function cardPrediction(decision: RelevanceDecisionView | undefined, predictionState: PredictionState): CardPrediction {
-  if (decision) {
-    const positive = decision.positiveLabel ?? "include";
-    return { state: "ready", choice: decision.label === positive ? "accept" : "reject", confidence: decision.confidence };
-  }
+  if (decision) return predictionFromDecision(decision);
   if (predictionState === "loading") return { state: "loading" };
   if (predictionState === "error") return { state: "error" };
   return { state: "none" };