@cat-factory/app 0.154.1 → 0.155.0

package/app/components/panels/ResultWindowShell.vue

@@ -20,10 +20,11 @@
 //
 // It also owns the one trailing section every step-backed window shows: the agent's effort
 // self-assessment (see the footer block below), so a window never renders it itself.
-import { computed, ref } from 'vue'
+import { computed, ref, watch } from 'vue'
 import { useModalBehavior } from '@modular-vue/core'
 import StepRestartControl from '~/components/panels/StepRestartControl.vue'
 import StepEffortReport from '~/components/panels/StepEffortReport.vue'
+import StepValidationReport from '~/components/panels/StepValidationReport.vue'
 import { effortBand, effortHint } from '~/utils/effort'
 
 /** A pipeline step reference — passed by step-result windows to surface the shared
@@ -85,11 +86,26 @@ const { dialogRef } = useModalBehavior({
 // step whose agent wrote no report both resolve to null, and the footer disappears.
 const ui = useUiStore()
 const execution = useExecutionStore()
-const effortReport = computed(() => {
+const activeStep = computed(() => {
   const view = ui.resultView
   if (!view || view.instanceId === null || view.stepIndex === null) return null
-  return execution.getInstance(view.instanceId)?.steps[view.stepIndex]?.effortReport ?? null
+  return execution.getInstance(view.instanceId)?.steps[view.stepIndex] ?? null
 })
+const effortReport = computed(() => activeStep.value?.effortReport ?? null)
+// The step's PRE-PR VALIDATION report — the second universal trailing section, resolved the same
+// way and for the same reason: every window whose step ran a coding job can show whether the
+// checkout actually passed the service's checks before the PR opened (and, on a red run, exactly
+// what failed). Absent for a service that configured no checks, and the footer disappears.
+const validationReport = computed(() => activeStep.value?.validation ?? null)
+const validationOpen = ref(false)
+// A failing report is the interesting one, so it opens expanded; a green one stays a one-line row.
+watch(
+  validationReport,
+  (report) => {
+    if (report && !report.passed) validationOpen.value = true
+  },
+  { immediate: true },
+)
 // Collapsed by default — the windows own the vertical space, and the row already carries the
 // difficulty plus the gist of what held the agent back.
 const effortOpen = ref(false)
@@ -204,6 +220,61 @@ const panelClass = computed(() => [
             <StepEffortReport :report="effortReport" variant="flat" />
           </div>
         </section>
+
+        <!-- Shared trailing section: the pre-PR validation report (the service's check commands
+             run against the checkout BEFORE the PR opened). Collapsed when green, expanded when
+             red — a failed checkout is the one an operator opened the window to read. -->
+        <section
+          v-if="validationReport"
+          class="shrink-0 border-t border-slate-800 bg-slate-900/60"
+          data-testid="result-window-validation"
+        >
+          <button
+            type="button"
+            class="flex w-full items-center gap-2 px-5 py-2 text-start hover:bg-slate-800/40"
+            :aria-expanded="validationOpen"
+            data-testid="result-window-validation-toggle"
+            @click="validationOpen = !validationOpen"
+          >
+            <UIcon
+              :name="validationReport.passed ? 'i-lucide-shield-check' : 'i-lucide-shield-alert'"
+              class="h-3.5 w-3.5 shrink-0"
+              :class="validationReport.passed ? 'text-emerald-400' : 'text-rose-400'"
+            />
+            <span class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+              {{ t('panels.stepDetail.validation.heading') }}
+            </span>
+            <span
+              class="shrink-0 rounded px-1.5 py-0.5 text-[11px] font-medium tabular-nums"
+              :class="
+                validationReport.passed
+                  ? 'bg-emerald-500/15 text-emerald-300'
+                  : 'bg-rose-500/15 text-rose-300'
+              "
+            >
+              {{
+                validationReport.passed
+                  ? t('panels.stepDetail.validation.passed')
+                  : t('panels.stepDetail.validation.failed')
+              }}
+            </span>
+            <span class="min-w-0 flex-1 truncate text-[12px] text-slate-400">
+              {{
+                t('panels.stepDetail.validation.attempts', {
+                  attempts: validationReport.attempts,
+                  maxAttempts: validationReport.maxAttempts,
+                })
+              }}
+            </span>
+            <UIcon
+              :name="validationOpen ? 'i-lucide-chevron-down' : 'i-lucide-chevron-up'"
+              class="ms-auto h-3.5 w-3.5 shrink-0 text-slate-500"
+            />
+          </button>
+          <div v-if="validationOpen" class="max-h-72 overflow-y-auto px-5 pb-3">
+            <StepValidationReport :report="validationReport" />
+          </div>
+        </section>
       </div>
     </div>
   </Teleport>

package/app/components/panels/StepValidationReport.vue

@@ -0,0 +1,66 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import type { ValidationReport } from '~/types/validationChecks'
+
+// The PRE-PR VALIDATION report for a step: which of the service's configured check commands
+// passed against the checkout before the PR was allowed to open, their exit codes, and a
+// bounded, secret-scrubbed tail of each command's output. Produced by the executor-harness
+// running the commands — never a model self-report — so this is the run's captured PROOF on a
+// green run and its EVIDENCE on a failed one. See docs/initiatives/pre-pr-validation.md.
+const props = defineProps<{ report: ValidationReport }>()
+const { t } = useI18n()
+
+const failed = computed(() => props.report.outcomes.filter((o) => !o.passed))
+</script>
+
+<template>
+  <div class="space-y-2" data-testid="step-validation-report">
+    <p class="text-[11px] text-slate-400">
+      {{
+        report.passed
+          ? t('panels.stepDetail.validation.passedSummary', {
+              total: report.outcomes.length,
+              attempts: report.attempts,
+            })
+          : t('panels.stepDetail.validation.failedSummary', {
+              failed: failed.length,
+              total: report.outcomes.length,
+              attempts: report.attempts,
+              maxAttempts: report.maxAttempts,
+            })
+      }}
+    </p>
+
+    <div
+      v-for="outcome in report.outcomes"
+      :key="outcome.label"
+      class="rounded-md border border-slate-800 bg-slate-950/40 p-2"
+      data-testid="validation-outcome"
+    >
+      <div class="flex items-center gap-2">
+        <UIcon
+          :name="outcome.passed ? 'i-lucide-check' : 'i-lucide-x'"
+          class="h-3.5 w-3.5 shrink-0"
+          :class="outcome.passed ? 'text-emerald-400' : 'text-rose-400'"
+        />
+        <span class="text-[12px] font-medium text-slate-200">{{ outcome.label }}</span>
+        <span class="truncate font-mono text-[11px] text-slate-500">{{ outcome.command }}</span>
+        <span
+          v-if="!outcome.passed"
+          class="ms-auto shrink-0 rounded bg-rose-500/15 px-1.5 py-0.5 text-[11px] tabular-nums text-rose-300"
+        >
+          {{
+            outcome.timedOut
+              ? t('panels.stepDetail.validation.timedOut')
+              : t('panels.stepDetail.validation.exitCode', { code: outcome.exitCode })
+          }}
+        </span>
+      </div>
+      <pre
+        v-if="outcome.outputTail"
+        class="mt-1.5 max-h-48 overflow-auto whitespace-pre-wrap break-words rounded bg-slate-950 p-2 font-mono text-[11px] text-slate-400"
+        data-testid="validation-output"
+        >{{ outcome.outputTail }}</pre>
+    </div>
+  </div>
+</template>

package/app/components/panels/inspector/ServiceValidationConfig.vue

@@ -0,0 +1,208 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import type { Block } from '~/types/domain'
+import InspectorSection from '~/components/panels/inspector/InspectorSection.vue'
+import {
+  VALIDATION_DEFAULT_MAX_ATTEMPTS,
+  VALIDATION_MAX_ATTEMPTS_CEILING,
+  VALIDATION_MAX_CHECKS,
+  type ValidationCheck,
+} from '~/types/validationChecks'
+
+// Per-service (frame) PRE-PR VALIDATION CHECKS: the shell commands the executor-harness runs
+// against the checkout after the coder settles and BEFORE the PR opens. A failing command's
+// output is handed back to the agent, which retries under the attempt budget; only a green
+// checkout opens a PR, and an exhausted budget fails the step with the captured output.
+// Keyed by THIS block's id (service frames only — a task resolves its checks up the frame chain).
+const props = defineProps<{ block: Block }>()
+
+const store = useValidationChecksStore()
+const toast = useToast()
+const { t } = useI18n()
+const { confirmAction, toastDone } = useConfirmAction()
+
+const busy = ref(false)
+const rows = ref<ValidationCheck[]>([])
+const maxAttempts = ref(VALIDATION_DEFAULT_MAX_ATTEMPTS)
+
+const saved = computed(() => store.forBlock(props.block.id))
+const configured = computed(() => saved.value.checks.length > 0)
+const canAdd = computed(() => rows.value.length < VALIDATION_MAX_CHECKS)
+/** A row is only submittable once it has a command; the label falls back to the command. */
+const submittable = computed(() =>
+  rows.value
+    .map((r) => ({ label: r.label.trim() || r.command.trim(), command: r.command.trim() }))
+    .filter((r) => r.command.length > 0),
+)
+
+onMounted(() => {
+  store.ensureLoaded().catch(() => {})
+})
+watch(
+  saved,
+  (config) => {
+    rows.value = config.checks.map((c) => ({ ...c }))
+    maxAttempts.value = config.maxAttempts
+  },
+  { immediate: true },
+)
+
+function addRow() {
+  if (canAdd.value) rows.value.push({ label: '', command: '' })
+}
+
+function removeRow(index: number) {
+  rows.value.splice(index, 1)
+}
+
+function notifyError(title: string, e: unknown) {
+  toast.add({
+    title,
+    description: e instanceof Error ? e.message : String(e),
+    icon: 'i-lucide-triangle-alert',
+    color: 'error',
+  })
+}
+
+async function save() {
+  busy.value = true
+  try {
+    await store.save(props.block.id, submittable.value, maxAttempts.value)
+    toast.add({
+      title: t('inspector.validationChecks.savedToast'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    notifyError(t('inspector.validationChecks.saveFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function clear() {
+  const noun = t('inspector.validationChecks.configNoun')
+  if (!(await confirmAction('clear', noun))) return
+  busy.value = true
+  try {
+    await store.remove(props.block.id)
+    rows.value = []
+    toastDone('clear', noun)
+  } catch (e) {
+    notifyError(t('inspector.validationChecks.clearFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+</script>
+
+<template>
+  <InspectorSection
+    v-if="store.available !== false"
+    :title="t('inspector.validationChecks.title')"
+    :hint="t('inspector.validationChecks.sectionHint')"
+    data-testid="service-validation-config"
+  >
+    <template #actions>
+      <UButton
+        v-if="configured"
+        color="error"
+        variant="ghost"
+        size="xs"
+        icon="i-lucide-trash-2"
+        :loading="busy"
+        data-testid="validation-clear"
+        @click="clear"
+      >
+        {{ t('inspector.validationChecks.clear') }}
+      </UButton>
+    </template>
+
+    <div class="space-y-2">
+      <p class="text-[11px] text-slate-500">
+        {{ t('inspector.validationChecks.hint') }}
+      </p>
+
+      <div
+        v-for="(row, index) in rows"
+        :key="index"
+        class="flex items-end gap-2"
+        data-testid="validation-check-row"
+      >
+        <UFormField :label="t('inspector.validationChecks.label')" class="w-1/3">
+          <UInput
+            v-model="row.label"
+            :placeholder="t('inspector.validationChecks.labelPlaceholder')"
+            size="sm"
+            class="w-full"
+            data-testid="validation-check-label"
+          />
+        </UFormField>
+        <UFormField :label="t('inspector.validationChecks.command')" class="flex-1">
+          <UInput
+            v-model="row.command"
+            placeholder="pnpm lint"
+            size="sm"
+            class="w-full"
+            data-testid="validation-check-command"
+          />
+        </UFormField>
+        <UButton
+          color="neutral"
+          variant="ghost"
+          size="xs"
+          icon="i-lucide-x"
+          :aria-label="t('inspector.validationChecks.removeCheck')"
+          data-testid="validation-check-remove"
+          @click="removeRow(index)"
+        />
+      </div>
+
+      <p v-if="rows.length === 0" class="text-[11px] text-slate-500" data-testid="validation-empty">
+        {{ t('inspector.validationChecks.empty') }}
+      </p>
+
+      <div class="flex items-end justify-between gap-2">
+        <UFormField
+          :label="t('inspector.validationChecks.maxAttempts')"
+          :hint="t('inspector.validationChecks.maxAttemptsHint')"
+          class="w-40"
+        >
+          <UInput
+            v-model.number="maxAttempts"
+            type="number"
+            :min="1"
+            :max="VALIDATION_MAX_ATTEMPTS_CEILING"
+            size="sm"
+            class="w-full"
+            data-testid="validation-max-attempts"
+          />
+        </UFormField>
+        <div class="flex gap-2">
+          <UButton
+            color="neutral"
+            variant="soft"
+            size="xs"
+            icon="i-lucide-plus"
+            :disabled="!canAdd"
+            data-testid="validation-add-check"
+            @click="addRow"
+          >
+            {{ t('inspector.validationChecks.addCheck') }}
+          </UButton>
+          <UButton
+            color="primary"
+            variant="soft"
+            size="xs"
+            icon="i-lucide-save"
+            :loading="busy"
+            data-testid="validation-save"
+            @click="save"
+          >
+            {{ t('inspector.validationChecks.save') }}
+          </UButton>
+        </div>
+      </div>
+    </div>
+  </InspectorSection>
+</template>

package/app/composables/api/validationChecks.ts

@@ -0,0 +1,39 @@
+import {
+  deleteServiceValidationConfigContract,
+  getServiceValidationConfigContract,
+  listServiceValidationConfigsContract,
+  setServiceValidationConfigContract,
+} from '@cat-factory/contracts'
+import type { UpsertServiceValidationConfigInput } from '~/types/validationChecks'
+import type { ApiContext } from './context'
+
+/** Pre-PR validation checks: the per-service-frame commands the harness runs before opening a PR. */
+export function validationChecksApi({ send, ws }: ApiContext) {
+  return {
+    listServiceValidationConfigs: (workspaceId: string) =>
+      send(listServiceValidationConfigsContract, { pathPrefix: ws(workspaceId) }),
+
+    getServiceValidationConfig: (workspaceId: string, blockId: string) =>
+      send(getServiceValidationConfigContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+      }),
+
+    setServiceValidationConfig: (
+      workspaceId: string,
+      blockId: string,
+      body: UpsertServiceValidationConfigInput,
+    ) =>
+      send(setServiceValidationConfigContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+        body,
+      }),
+
+    deleteServiceValidationConfig: (workspaceId: string, blockId: string) =>
+      send(deleteServiceValidationConfigContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+      }),
+  }
+}

package/app/composables/useApi.ts

@@ -35,6 +35,7 @@ import { recurringApi } from './api/recurring'
 import { previewApi } from './api/preview'
 import { environmentsApi } from './api/environments'
 import { releaseHealthApi } from './api/releaseHealth'
+import { validationChecksApi } from './api/validationChecks'
 import { sandboxApi } from './api/sandbox'
 import { reviewsApi } from './api/reviews'
 import { slackApi } from './api/slack'
@@ -135,6 +136,7 @@ export function useApi() {
     ...docInterviewApi(ctx),
     ...provisioningLogsApi(ctx),
     ...releaseHealthApi(ctx),
+    ...validationChecksApi(ctx),
     ...testSecretsApi(ctx),
     ...packageRegistriesApi(ctx),
     ...previewApi(ctx),

package/app/modular/panels/inspector.logic.spec.ts

@@ -41,6 +41,7 @@ describe('inspector panel group', () => {
       'service-test-secrets',
       'service-fragments',
       'service-release-health',
+      'service-validation-checks',
     ])
   })
 
@@ -59,6 +60,7 @@ describe('inspector panel group', () => {
       'service-test-secrets',
       'service-fragments',
       'service-release-health',
+      'service-validation-checks',
     ])
   })
 
@@ -70,6 +72,7 @@ describe('inspector panel group', () => {
       'service-test-secrets',
       'service-fragments',
       'service-release-health',
+      'service-validation-checks',
     ])
   })
 

package/app/modular/panels/inspector.logic.ts

@@ -53,6 +53,7 @@ export const INSPECTOR_PANEL_IDS = [
   'service-test-secrets',
   'service-fragments',
   'service-release-health',
+  'service-validation-checks',
   // epic / initiative body
   'epic-children',
   'initiative-inspector',
@@ -118,6 +119,10 @@ export const INSPECTOR_PANEL_SPECS: readonly InspectorPanelSpec[] = [
   { id: 'service-test-secrets', order: 150, when: isDeployableFrame },
   { id: 'service-fragments', order: 160, when: isFrame },
   { id: 'service-release-health', order: 170, when: isDeployableFrame },
+  // Pre-PR validation checks: the commands the harness runs before opening this service's PRs.
+  // Deployable frames only — a doc repo ships no build to install/lint/test, exactly like the
+  // test-infra and release-health panels above it.
+  { id: 'service-validation-checks', order: 180, when: isDeployableFrame },
   { id: 'epic-children', order: 200, when: (b) => b.level === 'epic' },
   { id: 'initiative-inspector', order: 210, when: (b) => b.level === 'initiative' },
 ]

package/app/modular/panels/inspector.ts

@@ -28,6 +28,7 @@ import ServiceTestConfig from '~/components/panels/inspector/ServiceTestConfig.v
 import ServiceTestSecrets from '~/components/panels/inspector/ServiceTestSecrets.vue'
 import ServiceFragments from '~/components/panels/inspector/ServiceFragments.vue'
 import ServiceReleaseHealthConfig from '~/components/panels/inspector/ServiceReleaseHealthConfig.vue'
+import ServiceValidationConfig from '~/components/panels/inspector/ServiceValidationConfig.vue'
 import EpicChildren from '~/components/panels/inspector/EpicChildren.vue'
 import InitiativeInspector from '~/components/panels/inspector/InitiativeInspector.vue'
 
@@ -80,6 +81,7 @@ const COMPONENTS: Record<InspectorPanelId, Component> = {
   'service-test-secrets': ServiceTestSecrets,
   'service-fragments': ServiceFragments,
   'service-release-health': ServiceReleaseHealthConfig,
+  'service-validation-checks': ServiceValidationConfig,
   'epic-children': EpicChildren,
   'initiative-inspector': InitiativeInspector,
 }

package/app/stores/validationChecks.ts

@@ -0,0 +1,111 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { ServiceValidationConfig, ValidationCheck } from '~/types/validationChecks'
+import { VALIDATION_DEFAULT_MAX_ATTEMPTS } from '~/types/validationChecks'
+import { useUpsertList } from '~/composables/useUpsertList'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/**
+ * The workspace's PRE-PR VALIDATION CHECKS: per service frame, the shell commands the
+ * executor-harness runs against the checkout after the coder settles and BEFORE the PR opens.
+ * A failing command is fed back into the agent loop; only a green checkout opens a PR.
+ *
+ * Loaded on demand by the service inspector rather than from the workspace snapshot — it's
+ * operator configuration read on one panel, not something every board load needs.
+ */
+/**
+ * Whether a failed load is a SETTLED "you can't have this" — the facade wired no store (503) or
+ * this user lacks `settings.manage` (403) — rather than a transient fault. Only the settled cases
+ * latch `available` to false; everything else stays unresolved so a later visit retries.
+ */
+function isSettledUnavailable(error: unknown): boolean {
+  const status =
+    error && typeof error === 'object' && 'statusCode' in error
+      ? (error as { statusCode?: number }).statusCode
+      : undefined
+  return status === 503 || status === 403
+}
+
+export const useValidationChecksStore = defineStore('validationChecks', () => {
+  const api = useApi()
+
+  const {
+    items: configs,
+    upsert: upsertLocal,
+    remove: dropLocal,
+  } = useUpsertList<ServiceValidationConfig>({ key: (c) => c.blockId })
+  const loading = ref(false)
+  /**
+   * Mirrors the backend's wiring: `null` until first probed, then true/false. The inspector
+   * panel hides itself when false, so a facade that didn't wire the store shows no dead control.
+   */
+  const available = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /** Force a refresh of every configured service's checks (used after a save/remove). */
+  async function load() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      configs.value = await api.listServiceValidationConfigs(ws.requireId())
+      available.value = true
+    } catch (error) {
+      // A 503 means the facade wired no store and a 403 means this user may not manage settings:
+      // both are STABLE answers, so latch them and hide the entry point rather than showing a
+      // dead control. Anything else (a network blip, a 5xx) is TRANSIENT — leaving `available`
+      // unresolved so the next `ensureLoaded` retries, instead of hiding the panel for the rest
+      // of the session over one dropped request.
+      available.value = isSettledUnavailable(error) ? false : null
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Load once per session; concurrent callers share the in-flight request. */
+  async function ensureLoaded(): Promise<void> {
+    if (available.value !== null) return
+    inFlight ??= load().finally(() => {
+      inFlight = null
+    })
+    return inFlight
+  }
+
+  /** The checks configured for a service frame (an empty default when it has none). */
+  function forBlock(blockId: string): ServiceValidationConfig {
+    return (
+      configs.value.find((c) => c.blockId === blockId) ?? {
+        blockId,
+        checks: [],
+        maxAttempts: VALIDATION_DEFAULT_MAX_ATTEMPTS,
+      }
+    )
+  }
+
+  /**
+   * Save a service frame's checks. An EMPTY list clears the config on the backend (the service
+   * deletes the row), which restores the exact pre-feature behaviour — so the local list drops
+   * the entry rather than keeping an empty one that reads as "configured".
+   */
+  async function save(
+    blockId: string,
+    checks: ValidationCheck[],
+    maxAttempts: number,
+  ): Promise<void> {
+    const ws = useWorkspaceStore()
+    const saved = await api.setServiceValidationConfig(ws.requireId(), blockId, {
+      checks,
+      maxAttempts,
+    })
+    if (saved.checks.length === 0) dropLocal(blockId)
+    else upsertLocal(saved)
+  }
+
+  /** Remove a service frame's checks entirely. */
+  async function remove(blockId: string): Promise<void> {
+    const ws = useWorkspaceStore()
+    await api.deleteServiceValidationConfig(ws.requireId(), blockId)
+    dropLocal(blockId)
+  }
+
+  return { configs, loading, available, load, ensureLoaded, forBlock, save, remove }
+})

package/app/types/validationChecks.ts

@@ -0,0 +1,17 @@
+// Pre-PR validation-check shapes: the per-service-frame commands the executor-harness runs
+// against the checkout before opening a PR, and the report it produces.
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth).
+
+export type {
+  ValidationCheck,
+  ValidationCheckOutcome,
+  ValidationReport,
+  ServiceValidationConfig,
+  UpsertServiceValidationConfigInput,
+} from '@cat-factory/contracts'
+export {
+  VALIDATION_DEFAULT_MAX_ATTEMPTS,
+  VALIDATION_MAX_ATTEMPTS_CEILING,
+  VALIDATION_MAX_CHECKS,
+} from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -1346,6 +1346,25 @@
       "remove": "{repo} entfernen",
       "connectFirst": "Verbinde GitHub, um Referenz-Repositories anzuhängen.",
       "hint": "Der Dokument-Writer klont diese schreibgeschützt, um beim Entwerfen vorhandene Lösungen als Referenz wiederzuverwenden. Er ändert sie nie."
+    },
+    "validationChecks": {
+      "title": "Prüfungen vor dem PR",
+      "sectionHint": "Befehle, die nach dem Coder und vor dem Öffnen eines Pull Requests im Checkout laufen. Ein Fehlschlag geht zur Behebung an den Agenten zurück; nur ein fehlerfreier Checkout öffnet einen PR.",
+      "hint": "Jeder Befehl läuft der Reihe nach mit `sh -c` im Checkout dieses Dienstes. Der Agent soll den Code reparieren, nicht die Prüfung abschwächen.",
+      "clear": "Leeren",
+      "configNoun": "Prüfungen",
+      "label": "Name",
+      "labelPlaceholder": "lint",
+      "command": "Befehl",
+      "addCheck": "Prüfung hinzufügen",
+      "removeCheck": "Diese Prüfung entfernen",
+      "empty": "Keine Prüfungen konfiguriert. Läufe für diesen Dienst öffnen einen Pull Request ohne lokale Überprüfung.",
+      "maxAttempts": "Versuche",
+      "maxAttemptsHint": "Korrekturrunden",
+      "save": "Prüfungen speichern",
+      "savedToast": "Prüfungen gespeichert",
+      "saveFailed": "Prüfungen konnten nicht gespeichert werden",
+      "clearFailed": "Prüfungen konnten nicht geleert werden"
     }
   },
   "panels": {
@@ -1512,6 +1531,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Zugehörige Befunde",
         "unnamed": "Standard"
+      },
+      "validation": {
+        "heading": "Prüfungen vor dem PR",
+        "passed": "Bestanden",
+        "failed": "Fehlgeschlagen",
+        "attempts": "Versuch {attempts} von {maxAttempts}",
+        "passedSummary": "Alle {total} Prüfungen wurden in Versuch {attempts} bestanden. Der Pull Request wurde aus einem fehlerfreien Checkout geöffnet.",
+        "failedSummary": "{failed} von {total} Prüfungen schlugen nach {attempts} von {maxAttempts} Versuchen weiterhin fehl, daher wurde kein Pull Request geöffnet.",
+        "exitCode": "Exit-Code {code}",
+        "timedOut": "Zeitüberschreitung"
       }
     },
     "inspector": {

package/i18n/locales/en.json

@@ -1117,6 +1117,25 @@
       "remove": "Remove {repo}",
       "connectFirst": "Connect GitHub to attach reference repositories.",
       "hint": "The document writer clones these read-only to reuse existing solutions as a reference while drafting. It never changes them."
+    },
+    "validationChecks": {
+      "title": "Pre-PR validation",
+      "sectionHint": "Commands run against the checkout after the coder finishes and before a pull request is opened. A failure is handed back to the agent to fix; only a passing checkout opens a PR.",
+      "hint": "Each command runs with `sh -c` in this service's checkout, in order. Fix the code, not the check — the agent is told not to weaken them.",
+      "clear": "Clear",
+      "configNoun": "validation checks",
+      "label": "Name",
+      "labelPlaceholder": "lint",
+      "command": "Command",
+      "addCheck": "Add check",
+      "removeCheck": "Remove this check",
+      "empty": "No checks configured. Runs for this service open a pull request without any local verification.",
+      "maxAttempts": "Attempts",
+      "maxAttemptsHint": "Rounds of fixing",
+      "save": "Save checks",
+      "savedToast": "Validation checks saved",
+      "saveFailed": "Could not save the validation checks",
+      "clearFailed": "Could not clear the validation checks"
     }
   },
   "panels": {
@@ -1283,6 +1302,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Related findings",
         "unnamed": "Standard"
+      },
+      "validation": {
+        "heading": "Pre-PR validation",
+        "passed": "Passed",
+        "failed": "Failed",
+        "attempts": "Attempt {attempts} of {maxAttempts}",
+        "passedSummary": "All {total} checks passed on attempt {attempts}. The pull request was opened from a green checkout.",
+        "failedSummary": "{failed} of {total} checks were still failing after {attempts} of {maxAttempts} attempts, so no pull request was opened.",
+        "exitCode": "exit {code}",
+        "timedOut": "timed out"
       }
     },
     "inspector": {

package/i18n/locales/es.json

@@ -1060,6 +1060,25 @@
       "remove": "Quitar {repo}",
       "connectFirst": "Conecta GitHub para adjuntar repositorios de referencia.",
       "hint": "El escritor de documentos los clona en modo de solo lectura para reutilizar soluciones existentes como referencia al redactar. Nunca los modifica."
+    },
+    "validationChecks": {
+      "title": "Validación previa al PR",
+      "sectionHint": "Comandos que se ejecutan sobre la copia de trabajo cuando el programador termina y antes de abrir una solicitud de incorporación. Un fallo vuelve al agente para que lo corrija; solo una copia sin errores abre un PR.",
+      "hint": "Cada comando se ejecuta con `sh -c` en la copia de trabajo de este servicio, en orden. Hay que arreglar el código, no la comprobación: al agente se le indica que no las debilite.",
+      "clear": "Vaciar",
+      "configNoun": "comprobaciones de validación",
+      "label": "Nombre",
+      "labelPlaceholder": "lint",
+      "command": "Comando",
+      "addCheck": "Añadir comprobación",
+      "removeCheck": "Quitar esta comprobación",
+      "empty": "No hay comprobaciones configuradas. Las ejecuciones de este servicio abren una solicitud de incorporación sin verificación local.",
+      "maxAttempts": "Intentos",
+      "maxAttemptsHint": "Rondas de corrección",
+      "save": "Guardar comprobaciones",
+      "savedToast": "Comprobaciones guardadas",
+      "saveFailed": "No se pudieron guardar las comprobaciones",
+      "clearFailed": "No se pudieron vaciar las comprobaciones"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Hallazgos relacionados",
         "unnamed": "Estándar"
+      },
+      "validation": {
+        "heading": "Validación previa al PR",
+        "passed": "Superada",
+        "failed": "Fallida",
+        "attempts": "Intento {attempts} de {maxAttempts}",
+        "passedSummary": "Las {total} comprobaciones se superaron en el intento {attempts}. La solicitud de incorporación se abrió desde una copia sin errores.",
+        "failedSummary": "{failed} de {total} comprobaciones seguían fallando tras {attempts} de {maxAttempts} intentos, así que no se abrió ninguna solicitud de incorporación.",
+        "exitCode": "código de salida {code}",
+        "timedOut": "tiempo agotado"
       }
     },
     "inspector": {

package/i18n/locales/fr.json

@@ -1060,6 +1060,25 @@
       "remove": "Retirer {repo}",
       "connectFirst": "Connectez GitHub pour joindre des dépôts de référence.",
       "hint": "Le rédacteur de documents les clone en lecture seule pour réutiliser des solutions existantes comme référence lors de la rédaction. Il ne les modifie jamais."
+    },
+    "validationChecks": {
+      "title": "Validation avant la PR",
+      "sectionHint": "Commandes exécutées sur la copie de travail une fois le développeur terminé et avant l'ouverture d'une demande de tirage. Un échec est renvoyé à l'agent pour correction ; seule une copie sans erreur ouvre une PR.",
+      "hint": "Chaque commande s'exécute avec `sh -c` dans la copie de travail de ce service, dans l'ordre. Il faut corriger le code, pas la vérification : il est demandé à l'agent de ne pas les affaiblir.",
+      "clear": "Vider",
+      "configNoun": "vérifications de validation",
+      "label": "Nom",
+      "labelPlaceholder": "lint",
+      "command": "Commande",
+      "addCheck": "Ajouter une vérification",
+      "removeCheck": "Supprimer cette vérification",
+      "empty": "Aucune vérification configurée. Les exécutions de ce service ouvrent une demande de tirage sans vérification locale.",
+      "maxAttempts": "Tentatives",
+      "maxAttemptsHint": "Cycles de correction",
+      "save": "Enregistrer les vérifications",
+      "savedToast": "Vérifications enregistrées",
+      "saveFailed": "Impossible d'enregistrer les vérifications",
+      "clearFailed": "Impossible de vider les vérifications"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Constats associés",
         "unnamed": "Standard"
+      },
+      "validation": {
+        "heading": "Validation avant la PR",
+        "passed": "Réussie",
+        "failed": "Échouée",
+        "attempts": "Tentative {attempts} sur {maxAttempts}",
+        "passedSummary": "Les {total} vérifications ont réussi à la tentative {attempts}. La demande de tirage a été ouverte depuis une copie sans erreur.",
+        "failedSummary": "{failed} vérifications sur {total} échouaient encore après {attempts} tentatives sur {maxAttempts}, aucune demande de tirage n'a donc été ouverte.",
+        "exitCode": "code de sortie {code}",
+        "timedOut": "délai dépassé"
       }
     },
     "inspector": {

package/i18n/locales/he.json

@@ -1060,6 +1060,25 @@
       "remove": "Remove {repo}",
       "connectFirst": "Connect GitHub to attach reference repositories.",
       "hint": "The document writer clones these read-only to reuse existing solutions as a reference while drafting. It never changes them."
+    },
+    "validationChecks": {
+      "title": "בדיקות לפני בקשת משיכה",
+      "sectionHint": "פקודות שרצות על העותק המקומי אחרי שהמפתח מסיים ולפני פתיחת בקשת משיכה. כישלון מוחזר לסוכן לתיקון; רק עותק תקין פותח בקשת משיכה.",
+      "hint": "כל פקודה רצה עם ‎`sh -c`‎ בעותק המקומי של שירות זה, לפי הסדר. יש לתקן את הקוד ולא את הבדיקה — הסוכן מונחה לא להחליש אותן.",
+      "clear": "ניקוי",
+      "configNoun": "בדיקות אימות",
+      "label": "שם",
+      "labelPlaceholder": "lint",
+      "command": "פקודה",
+      "addCheck": "הוספת בדיקה",
+      "removeCheck": "הסרת בדיקה זו",
+      "empty": "לא הוגדרו בדיקות. הרצות של שירות זה פותחות בקשת משיכה ללא אימות מקומי.",
+      "maxAttempts": "ניסיונות",
+      "maxAttemptsHint": "סבבי תיקון",
+      "save": "שמירת בדיקות",
+      "savedToast": "הבדיקות נשמרו",
+      "saveFailed": "לא ניתן היה לשמור את הבדיקות",
+      "clearFailed": "לא ניתן היה לנקות את הבדיקות"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "ממצאים קשורים",
         "unnamed": "תקן"
+      },
+      "validation": {
+        "heading": "בדיקות לפני בקשת משיכה",
+        "passed": "עברו",
+        "failed": "נכשלו",
+        "attempts": "ניסיון {attempts} מתוך {maxAttempts}",
+        "passedSummary": "כל {total} הבדיקות עברו בניסיון {attempts}. בקשת המשיכה נפתחה מעותק תקין.",
+        "failedSummary": "{failed} מתוך {total} בדיקות עדיין נכשלו אחרי {attempts} מתוך {maxAttempts} ניסיונות, ולכן לא נפתחה בקשת משיכה.",
+        "exitCode": "קוד יציאה {code}",
+        "timedOut": "חריגת זמן"
       }
     },
     "inspector": {

package/i18n/locales/it.json

@@ -1346,6 +1346,25 @@
       "remove": "Rimuovi {repo}",
       "connectFirst": "Collega GitHub per allegare repository di riferimento.",
       "hint": "Il document writer li clona in sola lettura per riutilizzare soluzioni esistenti come riferimento durante la stesura. Non li modifica mai."
+    },
+    "validationChecks": {
+      "title": "Validazione prima della PR",
+      "sectionHint": "Comandi eseguiti sulla copia di lavoro quando lo sviluppatore ha finito e prima di aprire una richiesta di modifica. Un errore torna all'agente perché lo corregga; solo una copia senza errori apre una PR.",
+      "hint": "Ogni comando viene eseguito con `sh -c` nella copia di lavoro di questo servizio, in ordine. Va corretto il codice, non il controllo: all'agente viene chiesto di non indebolirli.",
+      "clear": "Svuota",
+      "configNoun": "controlli di validazione",
+      "label": "Nome",
+      "labelPlaceholder": "lint",
+      "command": "Comando",
+      "addCheck": "Aggiungi controllo",
+      "removeCheck": "Rimuovi questo controllo",
+      "empty": "Nessun controllo configurato. Le esecuzioni di questo servizio aprono una richiesta di modifica senza verifica locale.",
+      "maxAttempts": "Tentativi",
+      "maxAttemptsHint": "Cicli di correzione",
+      "save": "Salva controlli",
+      "savedToast": "Controlli salvati",
+      "saveFailed": "Impossibile salvare i controlli",
+      "clearFailed": "Impossibile svuotare i controlli"
     }
   },
   "panels": {
@@ -1512,6 +1531,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Rilievi correlati",
         "unnamed": "Standard"
+      },
+      "validation": {
+        "heading": "Validazione prima della PR",
+        "passed": "Superata",
+        "failed": "Fallita",
+        "attempts": "Tentativo {attempts} di {maxAttempts}",
+        "passedSummary": "Tutti i {total} controlli sono stati superati al tentativo {attempts}. La richiesta di modifica è stata aperta da una copia senza errori.",
+        "failedSummary": "{failed} controlli su {total} fallivano ancora dopo {attempts} tentativi su {maxAttempts}, quindi non è stata aperta alcuna richiesta di modifica.",
+        "exitCode": "codice di uscita {code}",
+        "timedOut": "tempo scaduto"
       }
     },
     "inspector": {

package/i18n/locales/ja.json

@@ -1060,6 +1060,25 @@
       "remove": "Remove {repo}",
       "connectFirst": "Connect GitHub to attach reference repositories.",
       "hint": "The document writer clones these read-only to reuse existing solutions as a reference while drafting. It never changes them."
+    },
+    "validationChecks": {
+      "title": "PR 前の検証",
+      "sectionHint": "コーダーの作業完了後、プルリクエストを開く前にチェックアウトに対して実行されるコマンドです。失敗した場合はエージェントに差し戻して修正させ、問題のないチェックアウトだけが PR を開きます。",
+      "hint": "各コマンドはこのサービスのチェックアウト内で `sh -c` により順番に実行されます。修正すべきはコードであり検査ではありません。エージェントには検査を弱めないよう指示しています。",
+      "clear": "消去",
+      "configNoun": "検証コマンド",
+      "label": "名前",
+      "labelPlaceholder": "lint",
+      "command": "コマンド",
+      "addCheck": "検査を追加",
+      "removeCheck": "この検査を削除",
+      "empty": "検査が設定されていません。このサービスの実行はローカル検証なしでプルリクエストを開きます。",
+      "maxAttempts": "試行回数",
+      "maxAttemptsHint": "修正の反復回数",
+      "save": "検査を保存",
+      "savedToast": "検査を保存しました",
+      "saveFailed": "検査を保存できませんでした",
+      "clearFailed": "検査を消去できませんでした"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "関連する指摘",
         "unnamed": "基準"
+      },
+      "validation": {
+        "heading": "PR 前の検証",
+        "passed": "成功",
+        "failed": "失敗",
+        "attempts": "試行 {attempts}/{maxAttempts}",
+        "passedSummary": "{total} 件すべての検査が {attempts} 回目の試行で成功しました。プルリクエストは問題のないチェックアウトから開かれました。",
+        "failedSummary": "{maxAttempts} 回中 {attempts} 回試行しても {total} 件中 {failed} 件の検査が失敗したままだったため、プルリクエストは開かれませんでした。",
+        "exitCode": "終了コード {code}",
+        "timedOut": "タイムアウト"
       }
     },
     "inspector": {

package/i18n/locales/pl.json

@@ -1060,6 +1060,25 @@
       "remove": "Remove {repo}",
       "connectFirst": "Connect GitHub to attach reference repositories.",
       "hint": "The document writer clones these read-only to reuse existing solutions as a reference while drafting. It never changes them."
+    },
+    "validationChecks": {
+      "title": "Walidacja przed PR",
+      "sectionHint": "Polecenia uruchamiane na kopii roboczej po zakończeniu pracy programisty, a przed otwarciem żądania scalenia. Niepowodzenie wraca do agenta do naprawy; tylko czysta kopia otwiera żądanie scalenia.",
+      "hint": "Każde polecenie jest uruchamiane przez `sh -c` w kopii roboczej tej usługi, po kolei. Poprawiaj kod, a nie sprawdzenie — agent ma polecenie ich nie osłabiać.",
+      "clear": "Wyczyść",
+      "configNoun": "sprawdzenia walidacyjne",
+      "label": "Nazwa",
+      "labelPlaceholder": "lint",
+      "command": "Polecenie",
+      "addCheck": "Dodaj sprawdzenie",
+      "removeCheck": "Usuń to sprawdzenie",
+      "empty": "Nie skonfigurowano żadnych sprawdzeń. Uruchomienia tej usługi otwierają żądanie scalenia bez lokalnej weryfikacji.",
+      "maxAttempts": "Próby",
+      "maxAttemptsHint": "Rundy poprawek",
+      "save": "Zapisz sprawdzenia",
+      "savedToast": "Sprawdzenia zapisane",
+      "saveFailed": "Nie udało się zapisać sprawdzeń",
+      "clearFailed": "Nie udało się wyczyścić sprawdzeń"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Powiązane ustalenia",
         "unnamed": "Standard"
+      },
+      "validation": {
+        "heading": "Walidacja przed PR",
+        "passed": "Zaliczona",
+        "failed": "Niezaliczona",
+        "attempts": "Próba {attempts} z {maxAttempts}",
+        "passedSummary": "Wszystkie sprawdzenia ({total}) przeszły w próbie {attempts}. Żądanie scalenia zostało otwarte z czystej kopii roboczej.",
+        "failedSummary": "Po {attempts} z {maxAttempts} prób nadal nie przechodziło {failed} z {total} sprawdzeń, więc nie otwarto żądania scalenia.",
+        "exitCode": "kod wyjścia {code}",
+        "timedOut": "przekroczono czas"
       }
     },
     "inspector": {

package/i18n/locales/tr.json

@@ -1060,6 +1060,25 @@
       "remove": "Remove {repo}",
       "connectFirst": "Connect GitHub to attach reference repositories.",
       "hint": "The document writer clones these read-only to reuse existing solutions as a reference while drafting. It never changes them."
+    },
+    "validationChecks": {
+      "title": "PR öncesi doğrulama",
+      "sectionHint": "Kodlayıcı işini bitirdikten sonra ve bir çekme isteği açılmadan önce çalışma kopyası üzerinde çalıştırılan komutlar. Bir hata düzeltilmesi için aracıya geri verilir; yalnızca sorunsuz bir çalışma kopyası çekme isteği açar.",
+      "hint": "Her komut bu hizmetin çalışma kopyasında sırayla `sh -c` ile çalıştırılır. Denetimi değil kodu düzeltin — aracıya denetimleri zayıflatmaması söylenir.",
+      "clear": "Temizle",
+      "configNoun": "doğrulama denetimleri",
+      "label": "Ad",
+      "labelPlaceholder": "lint",
+      "command": "Komut",
+      "addCheck": "Denetim ekle",
+      "removeCheck": "Bu denetimi kaldır",
+      "empty": "Yapılandırılmış denetim yok. Bu hizmetin çalıştırmaları yerel doğrulama olmadan çekme isteği açar.",
+      "maxAttempts": "Deneme",
+      "maxAttemptsHint": "Düzeltme turu",
+      "save": "Denetimleri kaydet",
+      "savedToast": "Denetimler kaydedildi",
+      "saveFailed": "Denetimler kaydedilemedi",
+      "clearFailed": "Denetimler temizlenemedi"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "İlgili bulgular",
         "unnamed": "Standart"
+      },
+      "validation": {
+        "heading": "PR öncesi doğrulama",
+        "passed": "Geçti",
+        "failed": "Başarısız",
+        "attempts": "Deneme {attempts}/{maxAttempts}",
+        "passedSummary": "{total} denetimin tamamı {attempts}. denemede geçti. Çekme isteği sorunsuz bir çalışma kopyasından açıldı.",
+        "failedSummary": "{maxAttempts} denemenin {attempts} tanesinden sonra {total} denetimden {failed} tanesi hâlâ başarısızdı, bu yüzden çekme isteği açılmadı.",
+        "exitCode": "çıkış kodu {code}",
+        "timedOut": "zaman aşımı"
       }
     },
     "inspector": {

package/i18n/locales/uk.json

@@ -1060,6 +1060,25 @@
       "remove": "Remove {repo}",
       "connectFirst": "Connect GitHub to attach reference repositories.",
       "hint": "The document writer clones these read-only to reuse existing solutions as a reference while drafting. It never changes them."
+    },
+    "validationChecks": {
+      "title": "Перевірки перед PR",
+      "sectionHint": "Команди, які виконуються на робочій копії після завершення роботи розробника та перед відкриттям запиту на злиття. Невдача повертається до агента на виправлення; лише чиста копія відкриває запит на злиття.",
+      "hint": "Кожна команда виконується через `sh -c` у робочій копії цієї служби, по черзі. Виправляйте код, а не перевірку — агенту наказано не послаблювати їх.",
+      "clear": "Очистити",
+      "configNoun": "перевірки",
+      "label": "Назва",
+      "labelPlaceholder": "lint",
+      "command": "Команда",
+      "addCheck": "Додати перевірку",
+      "removeCheck": "Вилучити цю перевірку",
+      "empty": "Перевірок не налаштовано. Запуски цієї служби відкривають запит на злиття без локальної перевірки.",
+      "maxAttempts": "Спроби",
+      "maxAttemptsHint": "Раунди виправлень",
+      "save": "Зберегти перевірки",
+      "savedToast": "Перевірки збережено",
+      "saveFailed": "Не вдалося зберегти перевірки",
+      "clearFailed": "Не вдалося очистити перевірки"
     }
   },
   "panels": {
@@ -1226,6 +1245,16 @@
         "outOfTen": "{value}/10",
         "relatedFindings": "Пов’язані зауваження",
         "unnamed": "Стандарт"
+      },
+      "validation": {
+        "heading": "Перевірки перед PR",
+        "passed": "Пройдено",
+        "failed": "Не пройдено",
+        "attempts": "Спроба {attempts} з {maxAttempts}",
+        "passedSummary": "Усі перевірки ({total}) пройшли у спробі {attempts}. Запит на злиття відкрито з чистої робочої копії.",
+        "failedSummary": "Після {attempts} із {maxAttempts} спроб {failed} із {total} перевірок усе ще не проходили, тому запит на злиття не відкрито.",
+        "exitCode": "код виходу {code}",
+        "timedOut": "перевищено час"
       }
     },
     "inspector": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.154.1",
+  "version": "0.155.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.163.0"
+    "@cat-factory/contracts": "0.164.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",