@cat-factory/app 0.18.0 → 0.19.0

package/app/components/board/nodes/TaskCard.vue

@@ -117,7 +117,9 @@ const reviewStageLabel = computed(() =>
     ? 'Incorporating answers…'
     : reviewStage.value === 'reviewing'
       ? 'Re-reviewing…'
-      : null,
+      : reviewStage.value === 'recommending'
+        ? 'Recommending…'
+        : null,
 )
 const pendingApproval = computed(() => {
   const a = execution.openApprovals.find((a) => a.blockId === props.taskId)

package/app/components/clarity/ClarityReviewWindow.vue

@@ -105,6 +105,9 @@ const STATUS_COLOR = {
   answered: 'info',
   resolved: 'success',
   dismissed: 'neutral',
+  // Clarity review doesn't request Requirement-Writer recommendations, but the item-status
+  // type is shared with the requirements review, so the map must be exhaustive.
+  recommend_requested: 'primary',
 } as const satisfies Record<ReviewItemStatus, string>
 
 function notifyError(title: string, e: unknown) {

package/app/components/layout/IntegrationsHub.vue

@@ -14,6 +14,7 @@ const documents = useDocumentsStore()
 const tasks = useTasksStore()
 const tracker = useTrackerStore()
 const releaseHealth = useReleaseHealthStore()
+const userSecrets = useUserSecretsStore()
 
 // The selected filing tracker, as a badge label ("GitHub Issues" / "Jira").
 const trackerLabel = computed(() => {
@@ -27,7 +28,10 @@ const trackerLabel = computed(() => {
 watch(
   () => ui.integrationsOpen,
   (isOpen) => {
-    if (isOpen) void releaseHealth.ensureLoaded().catch(() => {})
+    if (isOpen) {
+      void releaseHealth.ensureLoaded().catch(() => {})
+      void userSecrets.load().catch(() => {})
+    }
   },
 )
 
@@ -75,6 +79,20 @@ const groups = computed<IntegrationGroup[]>(() => {
       onClick: () => go(ui.openGitHub),
     })
   }
+  // Per-user GitHub PAT — works on every runtime (used for runs you initiate). Always
+  // offered; the badge reflects whether the signed-in user has stored one.
+  {
+    const pat = userSecrets.statusFor('github_pat')
+    code.push({
+      key: 'github-pat',
+      icon: 'i-lucide-key-round',
+      label: 'My GitHub token',
+      description: 'A personal access token used for runs you start (pushes, PRs, CI, merge).',
+      status: pat ? 'Connected' : undefined,
+      connected: !!pat,
+      onClick: () => go(ui.openUserSecrets),
+    })
+  }
   if (code.length) out.push({ title: 'Source control', items: code })
 
   // --- Communication ---------------------------------------------------------

package/app/components/panels/inspector/TaskExecution.vue

@@ -22,7 +22,9 @@ const reviewStageLabel = computed(() =>
     ? 'Incorporating…'
     : reviewStage.value === 'reviewing'
       ? 'Re-reviewing…'
-      : null,
+      : reviewStage.value === 'recommending'
+        ? 'Recommending…'
+        : null,
 )
 
 const instance = computed(() => execution.getInstance(props.block.executionId))

package/app/components/pipeline/PipelineProgress.vue

@@ -32,7 +32,9 @@ function reviewStageLabel(agentKind: string | undefined): string | null {
     ? 'Incorporating…'
     : stage === 'reviewing'
       ? 'Re-reviewing…'
-      : null
+      : stage === 'recommending'
+        ? 'Recommending…'
+        : null
 }
 
 // Clicking an agent opens its step-detail overlay — execution metadata (state,

package/app/components/requirements/RequirementsReviewWindow.vue

@@ -10,6 +10,7 @@
 import { parseOutputOutline } from '~/utils/agentOutput'
 import StepRestartControl from '~/components/panels/StepRestartControl.vue'
 import type {
+  RequirementRecommendation,
   RequirementReview,
   RequirementReviewItem,
   ReviewItemCategory,
@@ -23,6 +24,15 @@ const toast = useToast()
 
 // Draft replies, keyed by item id, so editing one item doesn't disturb others.
 const drafts = ref<Record<string, string>>({})
+// The server-side reply each draft was last seeded/synced to, so the seeding watch can refresh
+// a draft when the recorded reply changes server-side (e.g. accepting a recommendation sets the
+// finding's answer) WITHOUT clobbering a reply the human is actively editing.
+const seededReply = ref<Record<string, string>>({})
+// Findings the human marked for a Requirement-Writer recommendation, batched until they
+// click "Request recommendations" (so the Writer runs once over the whole batch).
+const markedForRecommend = ref<Set<string>>(new Set())
+// Re-request "do it differently" notes, keyed by recommendation id.
+const reRequestNotes = ref<Record<string, string>>({})
 // Freeform "do it differently" comment when redoing a merge the human was unhappy with.
 const redoComment = ref('')
 const showRedo = ref(false)
@@ -35,6 +45,9 @@ const showRedo = ref(false)
 const { open, blockId, instanceId, stepIndex, close } = useResultView('requirements-review', {
   onOpen: (id) => {
     drafts.value = {}
+    seededReply.value = {}
+    markedForRecommend.value = new Set()
+    reRequestNotes.value = {}
     redoComment.value = ''
     showRedo.value = false
     void requirements.load(id)
@@ -109,6 +122,7 @@ const STATUS_COLOR = {
   answered: 'info',
   resolved: 'success',
   dismissed: 'neutral',
+  recommend_requested: 'primary',
 } as const satisfies Record<ReviewItemStatus, string>
 
 function notifyError(title: string, e: unknown) {
@@ -120,18 +134,73 @@ function notifyError(title: string, e: unknown) {
   })
 }
 
-async function submitReply(item: RequirementReviewItem) {
-  if (!review.value) return
+// Answers auto-save: there is no explicit "save" button. The textarea is pre-seeded with
+// the recorded reply (see the watch below); editing and blurring persists it. Persist only
+// when the trimmed draft actually differs from what's already recorded, so blurring an
+// untouched field is a no-op.
+async function persistDraft(item: RequirementReviewItem) {
+  if (!review.value || frozen.value) return
   const text = (drafts.value[item.id] ?? '').trim()
-  if (!text) return
+  if (!text || text === (item.reply ?? '').trim()) return
   try {
     await requirements.reply(review.value, item.id, text)
-    drafts.value = { ...drafts.value, [item.id]: '' }
   } catch (e) {
     notifyError('Could not save the answer', e)
   }
 }
 
+// Persist every dirty draft before an action that consumes the answers, so a value the
+// user typed but never blurred out of isn't lost.
+async function flushDrafts() {
+  if (!review.value) return
+  for (const item of review.value.items) {
+    if (item.status === 'open' || item.status === 'answered') await persistDraft(item)
+  }
+}
+
+// Seed a draft for each finding from its recorded reply so the textarea shows the current
+// answer (editing in place). New findings from a re-review get seeded; and when the recorded
+// reply changes server-side (e.g. accepting a recommendation writes the finding's answer) a
+// draft the user hasn't diverged from is refreshed to match. Drafts the user is actively
+// editing are left untouched.
+watch(
+  review,
+  (r) => {
+    if (!r) return
+    const nextDrafts = { ...drafts.value }
+    const nextSeeded = { ...seededReply.value }
+    let changed = false
+    for (const item of r.items) {
+      const reply = item.reply ?? ''
+      if (!(item.id in nextDrafts)) {
+        nextDrafts[item.id] = reply
+        nextSeeded[item.id] = reply
+        changed = true
+        continue
+      }
+      const draft = nextDrafts[item.id] ?? ''
+      const seeded = nextSeeded[item.id] ?? ''
+      if (draft === seeded && draft !== reply) {
+        // The user hasn't diverged from the last seeded value but the server reply changed —
+        // refresh the textarea to the new answer (e.g. an accepted recommendation).
+        nextDrafts[item.id] = reply
+        nextSeeded[item.id] = reply
+        changed = true
+      } else if (draft === reply && seeded !== reply) {
+        // The draft already matches the server (e.g. the user's answer was just persisted) —
+        // record it so a later server-side change can be detected.
+        nextSeeded[item.id] = reply
+        changed = true
+      }
+    }
+    if (changed) {
+      drafts.value = nextDrafts
+      seededReply.value = nextSeeded
+    }
+  },
+  { immediate: true },
+)
+
 async function setStatus(item: RequirementReviewItem, itemStatus: ReviewItemStatus) {
   if (!review.value) return
   try {
@@ -141,9 +210,75 @@ async function setStatus(item: RequirementReviewItem, itemStatus: ReviewItemStat
   }
 }
 
+// --- Requirement Writer recommendations -----------------------------------
+const recommending = computed(() =>
+  blockId.value ? requirements.isRecommending(blockId.value) : false,
+)
+// Recommendations still awaiting a human decision (the ones to surface for review).
+const pendingRecommendations = computed<RequirementRecommendation[]>(() =>
+  (review.value?.recommendations ?? []).filter((r) => r.status === 'ready'),
+)
+function isMarkedForRecommend(item: RequirementReviewItem): boolean {
+  return markedForRecommend.value.has(item.id)
+}
+function toggleRecommend(item: RequirementReviewItem) {
+  const next = new Set(markedForRecommend.value)
+  if (next.has(item.id)) next.delete(item.id)
+  else next.add(item.id)
+  markedForRecommend.value = next
+}
+
+// Fire the Writer over the whole marked batch at once (grounded on the project's
+// best-practice standards, specs/tech-specs and web search).
+async function requestRecommendations() {
+  if (!blockId.value || markedForRecommend.value.size === 0) return
+  const ids = [...markedForRecommend.value]
+  try {
+    await requirements.requestRecommendations(blockId.value, ids)
+    markedForRecommend.value = new Set()
+    toast.add({
+      title: `Requesting ${ids.length} recommendation${ids.length === 1 ? '' : 's'}…`,
+      icon: 'i-lucide-sparkles',
+    })
+  } catch (e) {
+    notifyError('Could not request recommendations', e)
+  }
+}
+
+async function acceptRecommendation(rec: RequirementRecommendation) {
+  if (!review.value) return
+  try {
+    await requirements.acceptRecommendation(review.value, rec.id)
+  } catch (e) {
+    notifyError('Could not accept the recommendation', e)
+  }
+}
+
+async function rejectRecommendation(rec: RequirementRecommendation) {
+  if (!review.value) return
+  try {
+    await requirements.rejectRecommendation(review.value, rec.id)
+  } catch (e) {
+    notifyError('Could not reject the recommendation', e)
+  }
+}
+
+async function reRequestRecommendation(rec: RequirementRecommendation) {
+  if (!review.value) return
+  const note = (reRequestNotes.value[rec.id] ?? '').trim()
+  if (!note) return
+  try {
+    await requirements.reRequestRecommendation(review.value, rec.id, note)
+    reRequestNotes.value = { ...reRequestNotes.value, [rec.id]: '' }
+  } catch (e) {
+    notifyError('Could not re-request the recommendation', e)
+  }
+}
+
 async function incorporate(feedback?: string) {
   if (!review.value || !blockId.value) return
   try {
+    await flushDrafts()
     await requirements.incorporate(review.value, feedback)
   } catch (e) {
     notifyError('Could not incorporate the answers', e)
@@ -183,6 +318,7 @@ async function proceed() {
   if (!blockId.value) return
   acting.value = true
   try {
+    await flushDrafts()
     await requirements.proceed(blockId.value)
     toast.add({ title: 'Proceeding to the next phase', icon: 'i-lucide-arrow-right' })
   } catch (e) {
@@ -350,9 +486,10 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                         {{ item.detail }}
                       </p>
 
-                      <!-- recorded answer -->
+                      <!-- recorded answer (only for non-editable findings — for editable
+                           ones the answer lives in the textarea below, seeded from the reply) -->
                       <div
-                        v-if="item.reply"
+                        v-if="item.reply && item.status !== 'open' && item.status !== 'answered'"
                         class="mt-2 rounded-md border-l-2 border-slate-700 bg-slate-950/40 px-3 py-1.5 text-sm text-slate-300"
                       >
                         <span class="text-[10px] uppercase tracking-wide text-slate-500">
@@ -361,7 +498,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                         <p class="whitespace-pre-line">{{ item.reply }}</p>
                       </div>
 
-                      <!-- react: answer (relevant) or dismiss (irrelevant). Disabled once the
+                      <!-- react: answer (relevant) or dismiss (irrelevant). The answer
+                           auto-saves on blur — no explicit save button. Disabled once the
                            requirements are settled / awaiting a higher-level decision. -->
                       <template v-if="item.status === 'open' || item.status === 'answered'">
                         <UTextarea
@@ -370,20 +508,11 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                           autoresize
                           size="sm"
                           class="mt-2 w-full"
-                          :placeholder="item.reply ? 'Refine your answer…' : 'Answer this finding…'"
+                          placeholder="Answer this finding…"
                           :disabled="frozen"
+                          @blur="persistDraft(item)"
                         />
                         <div class="mt-2 flex flex-wrap items-center gap-2">
-                          <UButton
-                            color="primary"
-                            variant="soft"
-                            size="xs"
-                            icon="i-lucide-corner-down-left"
-                            :disabled="!(drafts[item.id] ?? '').trim() || frozen"
-                            @click="submitReply(item)"
-                          >
-                            Save answer
-                          </UButton>
                           <UButton
                             color="neutral"
                             variant="ghost"
@@ -394,9 +523,32 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                           >
                             Dismiss as irrelevant
                           </UButton>
+                          <UButton
+                            :color="isMarkedForRecommend(item) ? 'primary' : 'neutral'"
+                            :variant="isMarkedForRecommend(item) ? 'soft' : 'ghost'"
+                            size="xs"
+                            icon="i-lucide-wand-2"
+                            :disabled="frozen"
+                            @click="toggleRecommend(item)"
+                          >
+                            {{
+                              isMarkedForRecommend(item)
+                                ? 'Marked for recommendation'
+                                : 'Recommend something'
+                            }}
+                          </UButton>
                         </div>
                       </template>
 
+                      <!-- finding awaiting a recommendation batch -->
+                      <div
+                        v-else-if="item.status === 'recommend_requested'"
+                        class="mt-2 flex items-center gap-1.5 text-xs text-indigo-300"
+                      >
+                        <UIcon name="i-lucide-wand-2" class="h-3.5 w-3.5" />
+                        Recommendation requested — review the suggestion below.
+                      </div>
+
                       <!-- reopen a dismissed finding -->
                       <div v-else-if="item.status === 'dismissed'" class="mt-2">
                         <UButton
@@ -415,6 +567,87 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                 </div>
               </div>
 
+              <!-- Requirement-Writer recommendations awaiting a human decision -->
+              <section
+                v-if="pendingRecommendations.length"
+                class="mt-6 border-t border-slate-800 pt-5"
+              >
+                <div class="mb-3 flex items-center gap-1.5 text-[11px] text-indigo-300">
+                  <UIcon name="i-lucide-wand-2" class="h-3.5 w-3.5" />
+                  <span class="font-semibold uppercase tracking-wide">Recommended answers</span>
+                </div>
+                <div class="flex flex-col gap-3">
+                  <div
+                    v-for="rec in pendingRecommendations"
+                    :key="rec.id"
+                    class="rounded-lg border border-indigo-900/50 bg-indigo-950/20 p-3"
+                  >
+                    <div class="flex flex-wrap items-center gap-1.5">
+                      <span class="text-sm font-medium text-white">{{
+                        rec.sourceFinding.title
+                      }}</span>
+                      <UBadge
+                        v-if="rec.groundedInFragment"
+                        size="xs"
+                        variant="subtle"
+                        color="success"
+                        icon="i-lucide-badge-check"
+                      >
+                        Current standard: {{ rec.groundedInFragment.title }}
+                      </UBadge>
+                    </div>
+                    <p class="mt-2 whitespace-pre-line text-sm text-slate-300">
+                      {{ rec.recommendedText }}
+                    </p>
+                    <div class="mt-2 flex flex-wrap items-center gap-2">
+                      <UButton
+                        color="primary"
+                        variant="soft"
+                        size="xs"
+                        icon="i-lucide-check"
+                        :disabled="frozen"
+                        @click="acceptRecommendation(rec)"
+                      >
+                        Accept
+                      </UButton>
+                      <UButton
+                        color="neutral"
+                        variant="ghost"
+                        size="xs"
+                        icon="i-lucide-x"
+                        :disabled="frozen"
+                        @click="rejectRecommendation(rec)"
+                      >
+                        Reject
+                      </UButton>
+                    </div>
+                    <!-- re-request with a note (an alternative to rejecting outright) -->
+                    <div class="mt-2 flex items-start gap-2">
+                      <UTextarea
+                        v-model="reRequestNotes[rec.id]"
+                        :rows="1"
+                        autoresize
+                        size="sm"
+                        class="flex-1"
+                        placeholder="Ask for a different recommendation…"
+                        :disabled="frozen || recommending"
+                      />
+                      <UButton
+                        color="neutral"
+                        variant="soft"
+                        size="xs"
+                        icon="i-lucide-rotate-cw"
+                        :loading="recommending"
+                        :disabled="!(reRequestNotes[rec.id] ?? '').trim() || frozen"
+                        @click="reRequestRecommendation(rec)"
+                      >
+                        Re-request
+                      </UButton>
+                    </div>
+                  </div>
+                </div>
+              </section>
+
               <!-- incorporated document: the standard-format requirements -->
               <section v-if="outline" class="mt-6 border-t border-slate-800 pt-5">
                 <div class="mb-3 flex items-center gap-1.5 text-[11px] text-emerald-400">
@@ -500,6 +733,20 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                 >
                   Incorporate answers
                 </UButton>
+                <UButton
+                  v-if="markedForRecommend.size > 0"
+                  color="primary"
+                  variant="soft"
+                  size="sm"
+                  block
+                  icon="i-lucide-wand-2"
+                  :loading="recommending"
+                  @click="requestRecommendations"
+                >
+                  Request {{ markedForRecommend.size }} recommendation{{
+                    markedForRecommend.size === 1 ? '' : 's'
+                  }}
+                </UButton>
                 <p class="text-[11px] leading-relaxed text-slate-500">
                   <template v-if="canProceed">
                     Every finding is dismissed — proceed to the next phase without reworking.

package/app/components/settings/UserSecretsSection.vue

@@ -0,0 +1,214 @@
+<script setup lang="ts">
+// Per-user settings: "My GitHub token" (and future per-user repository/provider secrets).
+// A generic, descriptor-driven connect form: the backend declares each kind's fields
+// (one secret + optional metadata) and whether a connection test is available; this
+// renders them without hard-coding any kind. Stored PER USER (runs you initiate use YOUR
+// access); the secret is write-only server-side and never shown again.
+import { computed, ref, watch } from 'vue'
+import type { ProviderConfigField, UserSecretKind } from '~/types/userSecrets'
+
+const ui = useUiStore()
+const store = useUserSecretsStore()
+const toast = useToast()
+
+const open = computed({
+  get: () => ui.userSecretsOpen,
+  set: (v: boolean) => (v ? ui.openUserSecrets() : ui.closeUserSecrets()),
+})
+
+// The kind being edited (only `github_pat` today; descriptors drive the rest generically).
+const kind = ref<UserSecretKind>('github_pat')
+const descriptor = computed(() => store.descriptorFor(kind.value))
+const status = computed(() => store.statusFor(kind.value))
+
+// Per-field draft values, keyed by field key. The secret field maps to the wire `secret`;
+// all other fields map into `metadata`.
+const values = ref<Record<string, string>>({})
+const labelDraft = ref('')
+const testResult = ref<{ ok: boolean; message?: string } | null>(null)
+const testing = ref(false)
+const busy = ref(false)
+
+function resetDraft() {
+  values.value = {}
+  labelDraft.value = ''
+  testResult.value = null
+  // Prefill non-secret metadata from the stored status (secret stays blank — write-only).
+  const meta = status.value?.metadata
+  if (meta) for (const [k, v] of Object.entries(meta)) values.value[k] = v
+}
+
+watch(open, (isOpen) => {
+  if (isOpen) void store.load().then(resetDraft)
+})
+watch(kind, resetDraft)
+
+const secretField = computed<ProviderConfigField | undefined>(() =>
+  descriptor.value?.configFields.find((f) => f.secret),
+)
+const metadataFields = computed<ProviderConfigField[]>(() =>
+  (descriptor.value?.configFields ?? []).filter((f) => !f.secret),
+)
+
+/** Build the wire payload: the secret field → `secret`, the rest → `metadata`. */
+function buildPayload(): { secret: string; metadata?: Record<string, string> } | null {
+  const sf = secretField.value
+  if (!sf) return null
+  const secret = (values.value[sf.key] ?? '').trim()
+  if (!secret) return null
+  const metadata: Record<string, string> = {}
+  for (const f of metadataFields.value) {
+    const v = (values.value[f.key] ?? '').trim()
+    if (v) metadata[f.key] = v
+  }
+  return { secret, ...(Object.keys(metadata).length ? { metadata } : {}) }
+}
+
+function notifyError(title: string, e: unknown) {
+  toast.add({
+    title,
+    description: e instanceof Error ? e.message : String(e),
+    icon: 'i-lucide-triangle-alert',
+    color: 'error',
+  })
+}
+
+async function test() {
+  const payload = buildPayload()
+  if (!payload) return
+  testing.value = true
+  testResult.value = null
+  try {
+    testResult.value = await store.test(kind.value, payload)
+  } catch (e) {
+    testResult.value = { ok: false, message: e instanceof Error ? e.message : String(e) }
+  } finally {
+    testing.value = false
+  }
+}
+
+async function save() {
+  const payload = buildPayload()
+  if (!payload) return
+  busy.value = true
+  try {
+    await store.store(kind.value, { ...payload, label: labelDraft.value.trim() || undefined })
+    values.value[secretField.value!.key] = ''
+    testResult.value = null
+    toast.add({
+      title: `${descriptor.value?.label ?? 'Secret'} saved`,
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    notifyError('Could not save secret', e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function remove() {
+  busy.value = true
+  try {
+    await store.remove(kind.value)
+    resetDraft()
+    toast.add({ title: 'Secret removed', icon: 'i-lucide-check' })
+  } catch (e) {
+    notifyError('Could not remove secret', e)
+  } finally {
+    busy.value = false
+  }
+}
+</script>
+
+<template>
+  <UModal v-model:open="open" title="My GitHub token" :ui="{ content: 'max-w-xl' }">
+    <template #body>
+      <div class="space-y-4">
+        <p class="text-xs text-slate-400">
+          Store a personal access token used for the runs <strong>you</strong> start — pushes, pull
+          requests, the CI gate and merges are attributed to your GitHub access. Stored
+          <span class="text-slate-300">just for you</span>; the token is write-only and never shown
+          again.
+        </p>
+
+        <div
+          v-if="status"
+          class="flex items-center justify-between rounded-md border border-slate-700 bg-slate-900/50 px-3 py-2 text-sm"
+        >
+          <div>
+            <span class="font-medium text-slate-200">{{ status.label }}</span>
+            <div class="text-[11px] text-emerald-400">Connected · token stored</div>
+          </div>
+          <UButton
+            icon="i-lucide-trash-2"
+            color="error"
+            variant="ghost"
+            size="xs"
+            :disabled="busy"
+            @click="remove()"
+          />
+        </div>
+
+        <div
+          v-if="descriptor"
+          class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3"
+        >
+          <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+            {{ status ? 'Replace token' : 'Add a token' }}
+          </p>
+
+          <UFormField label="Label (optional)">
+            <UInput v-model="labelDraft" :placeholder="descriptor.label" />
+          </UFormField>
+
+          <UFormField
+            v-for="field in descriptor.configFields"
+            :key="field.key"
+            :label="field.label + (field.required ? '' : ' (optional)')"
+            :help="field.help"
+          >
+            <UInput
+              v-model="values[field.key]"
+              :type="field.secret ? 'password' : 'text'"
+              class="font-mono"
+              :placeholder="field.placeholder"
+            />
+          </UFormField>
+
+          <div v-if="descriptor.supportsTest" class="flex items-center gap-2">
+            <UButton
+              color="neutral"
+              variant="soft"
+              size="sm"
+              icon="i-lucide-plug-zap"
+              :loading="testing"
+              :disabled="!buildPayload()"
+              @click="test()"
+            >
+              Test connection
+            </UButton>
+            <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
+              {{ testResult.message ?? 'Token valid' }}
+            </span>
+            <span v-else-if="testResult" class="text-xs text-rose-400">
+              {{ testResult.message ?? 'Token rejected' }}
+            </span>
+          </div>
+
+          <div class="flex justify-end">
+            <UButton
+              color="primary"
+              size="sm"
+              :loading="busy"
+              :disabled="!buildPayload()"
+              @click="save()"
+            >
+              {{ status ? 'Save' : 'Add token' }}
+            </UButton>
+          </div>
+        </div>
+      </div>
+    </template>
+  </UModal>
+</template>

package/app/composables/api/reviews.ts

@@ -82,6 +82,39 @@ export function reviewsApi({ http, ws }: ApiContext) {
         { method: 'POST', body: { choice } },
       ),
 
+    // Ask the Requirement Writer to recommend grounded answers for a batch of findings (by
+    // item id). Returns the review with `ready` recommendations for the human to act on.
+    requestRecommendations: (workspaceId: string, blockId: string, itemIds: string[]) =>
+      http<RequirementReview | null>(
+        `${ws(workspaceId)}/blocks/${encodeURIComponent(blockId)}/requirement-review/recommend`,
+        { method: 'POST', body: { itemIds } },
+      ),
+
+    // Accept a recommendation (becomes the finding's answer), reject it, or re-request it
+    // with a "do it differently" note.
+    acceptRecommendation: (workspaceId: string, reviewId: string, recId: string) =>
+      http<RequirementReview>(
+        `${ws(workspaceId)}/requirement-reviews/${encodeURIComponent(reviewId)}/recommendations/${encodeURIComponent(recId)}/accept`,
+        { method: 'POST' },
+      ),
+
+    rejectRecommendation: (workspaceId: string, reviewId: string, recId: string) =>
+      http<RequirementReview>(
+        `${ws(workspaceId)}/requirement-reviews/${encodeURIComponent(reviewId)}/recommendations/${encodeURIComponent(recId)}/reject`,
+        { method: 'POST' },
+      ),
+
+    reRequestRecommendation: (
+      workspaceId: string,
+      reviewId: string,
+      recId: string,
+      note: string,
+    ) =>
+      http<RequirementReview>(
+        `${ws(workspaceId)}/requirement-reviews/${encodeURIComponent(reviewId)}/recommendations/${encodeURIComponent(recId)}/re-request`,
+        { method: 'POST', body: { note } },
+      ),
+
     // ---- clarity review (bug-report triage reviewer agent) ---------------
     // The current review for a block (null when none has been run). A 503 means
     // the feature is unconfigured (the panel hides on any error here).

package/app/composables/api/userSecrets.ts

@@ -0,0 +1,31 @@
+import type {
+  ConnectionTestResult,
+  StoreUserSecretInput,
+  TestUserSecretInput,
+  UserSecretDescriptor,
+  UserSecretKind,
+  UserSecretStatus,
+} from '~/types/userSecrets'
+import type { ApiContext } from './context'
+
+// Per-USER generic secrets (a GitHub PAT today). User-scoped (no workspace); the secret
+// is write-only server-side and never returned — only status metadata + a `hasSecret`
+// flag. `descriptors` drive the generic connect form; `test` probes before save.
+export function userSecretsApi({ http }: ApiContext) {
+  return {
+    listUserSecrets: () =>
+      http<{ secrets: UserSecretStatus[]; descriptors: UserSecretDescriptor[] }>('/user-secrets'),
+
+    storeUserSecret: (kind: UserSecretKind, body: StoreUserSecretInput) =>
+      http<UserSecretStatus>(`/user-secrets/${encodeURIComponent(kind)}`, { method: 'POST', body }),
+
+    deleteUserSecret: (kind: UserSecretKind) =>
+      http(`/user-secrets/${encodeURIComponent(kind)}`, { method: 'DELETE' }),
+
+    testUserSecret: (kind: UserSecretKind, body: TestUserSecretInput) =>
+      http<ConnectionTestResult>(`/user-secrets/${encodeURIComponent(kind)}/test`, {
+        method: 'POST',
+        body,
+      }),
+  }
+}

package/app/composables/useApi.ts

@@ -17,6 +17,7 @@ import { reviewsApi } from './api/reviews'
 import { slackApi } from './api/slack'
 import { specApi } from './api/spec'
 import { tasksApi } from './api/tasks'
+import { userSecretsApi } from './api/userSecrets'
 import { workspacesApi } from './api/workspaces'
 
 /**
@@ -87,5 +88,6 @@ export function useApi() {
     ...githubApi(ctx),
     ...slackApi(ctx),
     ...bootstrapApi(ctx),
+    ...userSecretsApi(ctx),
   }
 }

package/app/composables/useReviewStage.ts

@@ -2,7 +2,7 @@ import { useRequirementsStore } from '~/stores/requirements'
 import { useClarityStore } from '~/stores/clarity'
 
 /** The async stage an iterative reviewer gate is mid-cycle in, or null. */
-export type ReviewStage = 'incorporating' | 'reviewing' | null
+export type ReviewStage = 'incorporating' | 'reviewing' | 'recommending' | null
 
 // Both iterative reviewer gates (`requirements-review` over a feature brief and
 // `clarity-review` over a bug report) drive the same answer → incorporate → re-review

package/app/pages/index.vue

@@ -31,6 +31,7 @@ import WorkspaceSettingsPanel from '~/components/settings/WorkspaceSettingsPanel
 import ObservabilityConnectionPanel from '~/components/settings/ObservabilityConnectionPanel.vue'
 import ModelConfigurationPanel from '~/components/settings/ModelConfigurationPanel.vue'
 import LocalModelEndpointsPanel from '~/components/settings/LocalModelEndpointsPanel.vue'
+import UserSecretsSection from '~/components/settings/UserSecretsSection.vue'
 import OpenRouterCatalogPanel from '~/components/settings/OpenRouterCatalogPanel.vue'
 import VendorCredentialsModal from '~/components/providers/VendorCredentialsModal.vue'
 import PersonalCredentialModal from '~/components/providers/PersonalCredentialModal.vue'
@@ -183,6 +184,7 @@ watch(
       <ObservabilityConnectionPanel />
       <ModelConfigurationPanel />
       <LocalModelEndpointsPanel />
+      <UserSecretsSection />
       <OpenRouterCatalogPanel />
       <VendorCredentialsModal />
       <PersonalCredentialModal />

package/app/stores/requirements.ts

@@ -29,6 +29,8 @@ export const useRequirementsStore = defineStore('requirements', () => {
   const reviewing = ref<Set<string>>(new Set())
   /** Review ids currently incorporating their answers. */
   const incorporating = ref<Set<string>>(new Set())
+  /** Block ids whose Requirement Writer is currently producing recommendations. */
+  const recommending = ref<Set<string>>(new Set())
   /** Block ids whose current review is being fetched (the initial `load`). */
   const loadingByBlock = ref<Set<string>>(new Set())
   /**
@@ -48,7 +50,8 @@ export const useRequirementsStore = defineStore('requirements', () => {
    * needed — so the board suppresses the "Approval needed" gate and shows this working state
    * instead, with copy that names which of the two stages is running.
    */
-  function backgroundStage(blockId: string): 'incorporating' | 'reviewing' | null {
+  function backgroundStage(blockId: string): 'incorporating' | 'reviewing' | 'recommending' | null {
+    if (recommending.value.has(blockId)) return 'recommending'
     const status = reviews.value[blockId]?.status
     return status === 'incorporating' || status === 'reviewing' ? status : null
   }
@@ -172,6 +175,47 @@ export const useRequirementsStore = defineStore('requirements', () => {
     return updated
   }
 
+  function isRecommending(blockId: string): boolean {
+    return recommending.value.has(blockId)
+  }
+
+  /**
+   * Ask the Requirement Writer to recommend answers for a batch of findings (by item id).
+   * Runs the Writer inline (grounded on best-practice fragments → spec/tech-spec → web) and
+   * returns the review with `ready` recommendations to accept/reject. Shows a `recommending`
+   * background stage on the board while it runs.
+   */
+  async function requestRecommendations(blockId: string, itemIds: string[]) {
+    withFlag(recommending, blockId, true)
+    try {
+      const updated = await api.requestRecommendations(workspace.requireId(), blockId, itemIds)
+      if (updated) store(updated)
+      return updated
+    } finally {
+      withFlag(recommending, blockId, false)
+    }
+  }
+
+  /** Accept a recommendation (becomes the finding's answer, folded into the next incorporation). */
+  async function acceptRecommendation(review: RequirementReview, recId: string) {
+    store(await api.acceptRecommendation(workspace.requireId(), review.id, recId))
+  }
+
+  /** Reject a recommendation (the human then dismisses / answers manually / re-requests). */
+  async function rejectRecommendation(review: RequirementReview, recId: string) {
+    store(await api.rejectRecommendation(workspace.requireId(), review.id, recId))
+  }
+
+  /** Re-request a recommendation with a "do it differently" note. */
+  async function reRequestRecommendation(review: RequirementReview, recId: string, note: string) {
+    withFlag(recommending, review.blockId, true)
+    try {
+      store(await api.reRequestRecommendation(workspace.requireId(), review.id, recId, note))
+    } finally {
+      withFlag(recommending, review.blockId, false)
+    }
+  }
+
   /** Resolve a capped review: extra-round / proceed / stop-reset. */
   async function resolveExceeded(
     blockId: string,
@@ -190,6 +234,7 @@ export const useRequirementsStore = defineStore('requirements', () => {
     isReviewing,
     isLoading,
     isIncorporating,
+    isRecommending,
     openCount,
     answeredCount,
     allSettled,
@@ -202,6 +247,10 @@ export const useRequirementsStore = defineStore('requirements', () => {
     reReview,
     proceed,
     resolveExceeded,
+    requestRecommendations,
+    acceptRecommendation,
+    rejectRecommendation,
+    reRequestRecommendation,
     // Patch the cache from a live `requirements` stream event.
     upsert: store,
   }

package/app/stores/ui.ts

@@ -102,6 +102,7 @@ export const useUiStore = defineStore('ui', () => {
   const vendorCredentialsOpen = ref(false)
   // Per-user settings panel: the signed-in user's own-machine local model runners.
   const localModelsOpen = ref(false)
+  const userSecretsOpen = ref(false)
   // Per-workspace settings panel: the OpenRouter dynamic catalog (browse/enable gateway models).
   const openRouterOpen = ref(false)
 
@@ -358,6 +359,12 @@ export const useUiStore = defineStore('ui', () => {
   function closeLocalModels() {
     localModelsOpen.value = false
   }
+  function openUserSecrets() {
+    userSecretsOpen.value = true
+  }
+  function closeUserSecrets() {
+    userSecretsOpen.value = false
+  }
   function openOpenRouter() {
     openRouterOpen.value = true
   }
@@ -451,6 +458,7 @@ export const useUiStore = defineStore('ui', () => {
     modelConfigOpen,
     vendorCredentialsOpen,
     localModelsOpen,
+    userSecretsOpen,
     openRouterOpen,
     aiProviderSetupOpen,
     aiPresetMismatchOpen,
@@ -512,6 +520,8 @@ export const useUiStore = defineStore('ui', () => {
     closeVendorCredentials,
     openLocalModels,
     closeLocalModels,
+    openUserSecrets,
+    closeUserSecrets,
     openOpenRouter,
     closeOpenRouter,
     openAiProviderSetup,

package/app/stores/userSecrets.ts

@@ -0,0 +1,64 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type {
+  ConnectionTestResult,
+  StoreUserSecretInput,
+  TestUserSecretInput,
+  UserSecretDescriptor,
+  UserSecretKind,
+  UserSecretStatus,
+} from '~/types/userSecrets'
+
+// The signed-in user's generic secrets (a GitHub PAT today). Stored PER USER (a run you
+// initiate uses YOUR GitHub access), write-only server-side — this store carries only the
+// status metadata + a `hasSecret` flag, plus the kind descriptors that drive the generic
+// connect form. Loaded INDEPENDENTLY of the workspace snapshot, like local runners.
+export const useUserSecretsStore = defineStore('userSecrets', () => {
+  const api = useApi()
+  const secrets = ref<UserSecretStatus[]>([])
+  const descriptors = ref<UserSecretDescriptor[]>([])
+  const loading = ref(false)
+
+  async function load() {
+    loading.value = true
+    try {
+      const { secrets: list, descriptors: descs } = await api.listUserSecrets()
+      secrets.value = list
+      descriptors.value = descs
+    } catch {
+      // Auth disabled / not signed in / feature off → nothing to surface.
+      secrets.value = []
+      descriptors.value = []
+    } finally {
+      loading.value = false
+    }
+  }
+
+  function statusFor(kind: UserSecretKind): UserSecretStatus | undefined {
+    return secrets.value.find((s) => s.kind === kind)
+  }
+
+  function descriptorFor(kind: UserSecretKind): UserSecretDescriptor | undefined {
+    return descriptors.value.find((d) => d.kind === kind)
+  }
+
+  async function store(kind: UserSecretKind, input: StoreUserSecretInput) {
+    const status = await api.storeUserSecret(kind, input)
+    secrets.value = [...secrets.value.filter((s) => s.kind !== kind), status]
+    return status
+  }
+
+  async function remove(kind: UserSecretKind) {
+    await api.deleteUserSecret(kind)
+    secrets.value = secrets.value.filter((s) => s.kind !== kind)
+  }
+
+  async function test(
+    kind: UserSecretKind,
+    input: TestUserSecretInput,
+  ): Promise<ConnectionTestResult> {
+    return await api.testUserSecret(kind, input)
+  }
+
+  return { secrets, descriptors, loading, load, statusFor, descriptorFor, store, remove, test }
+})

package/app/types/requirements.ts

@@ -10,7 +10,12 @@ export type ReviewItemCategory = 'gap' | 'clarification' | 'assumption' | 'risk'
 
 export type ReviewItemSeverity = 'low' | 'medium' | 'high'
 
-export type ReviewItemStatus = 'open' | 'answered' | 'resolved' | 'dismissed'
+export type ReviewItemStatus =
+  | 'open'
+  | 'answered'
+  | 'resolved'
+  | 'dismissed'
+  | 'recommend_requested'
 
 export interface RequirementReviewItem {
   id: string
@@ -45,6 +50,25 @@ export type RequirementReviewStatus =
 /** How a human resolves a review that hit its iteration cap. */
 export type ResolveRequirementsExceededChoice = 'extra-round' | 'proceed' | 'stop-reset'
 
+/** Lifecycle of a Requirement-Writer recommendation. */
+export type RecommendationStatus = 'ready' | 'accepted' | 'rejected'
+
+/**
+ * A Requirement-Writer suggestion for one finding. First-class on the review (survives the
+ * re-review item churn); the source finding is snapshotted by title/detail. `groundedInFragment`
+ * marks a suggestion taken straight from a best-practice fragment (the "current standard").
+ */
+export interface RequirementRecommendation {
+  id: string
+  sourceFinding: { title: string; detail: string }
+  recommendedText: string
+  status: RecommendationStatus
+  note: string | null
+  groundedInFragment: { id: string; title: string } | null
+  createdAt: number
+  updatedAt: number
+}
+
 export interface RequirementReview {
   id: string
   blockId: string
@@ -56,6 +80,8 @@ export interface RequirementReview {
   iteration: number
   /** The reviewer-pass budget (from the task's merge preset; an extra round bumps it). */
   maxIterations: number
+  /** Requirement-Writer suggestions awaiting (or settled by) human accept/reject. */
+  recommendations: RequirementRecommendation[]
   createdAt: number
   updatedAt: number
 }

package/app/types/userSecrets.ts

@@ -0,0 +1,49 @@
+// Frontend mirrors of the per-user secret + provider-config wire contracts
+// (`@cat-factory/contracts` user-secret.ts + provider-config.ts).
+
+export type UserSecretKind = 'github_pat'
+
+/** One config value a kind needs, rendered as a single form field. */
+export interface ProviderConfigField {
+  key: string
+  label: string
+  help?: string
+  placeholder?: string
+  secret?: boolean
+  required?: boolean
+  type?: 'text' | 'password' | 'select'
+  options?: { value: string; label: string }[]
+}
+
+/** Read-only status of one stored per-user secret — never the secret value. */
+export interface UserSecretStatus {
+  kind: UserSecretKind
+  label: string
+  hasSecret: boolean
+  metadata?: Record<string, string>
+  connectedAt: number
+}
+
+/** A kind's self-description for the generic connect form. */
+export interface UserSecretDescriptor {
+  kind: UserSecretKind
+  label: string
+  configFields: ProviderConfigField[]
+  supportsTest: boolean
+}
+
+export interface StoreUserSecretInput {
+  label?: string
+  secret: string
+  metadata?: Record<string, string>
+}
+
+export interface TestUserSecretInput {
+  secret: string
+  metadata?: Record<string, string>
+}
+
+export interface ConnectionTestResult {
+  ok: boolean
+  message?: string
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",