@cat-factory/app 0.200.3 → 0.201.0

package/app/components/settings/WorkspaceSettingsPanel.vue

@@ -174,6 +174,7 @@ const draft = reactive({
   publishPrVerificationReport: true,
   artifactRetentionDays: 14,
   kaizenEnabled: true,
+  allowInitiatorPat: true,
   reviewFrictionMode: 'off' as ReviewFrictionMode,
   reviewFrictionWarnCount: 3,
   reviewFrictionBlockCountEnabled: false,
@@ -193,6 +194,7 @@ function hydrate() {
   draft.publishPrVerificationReport = s.publishPrVerificationReport
   draft.artifactRetentionDays = s.artifactRetentionDays
   draft.kaizenEnabled = s.kaizenEnabled
+  draft.allowInitiatorPat = s.allowInitiatorPat
   draft.reviewFrictionMode = s.reviewFrictionMode
   draft.reviewFrictionWarnCount = s.reviewFrictionWarnCount
   // The hard-block knobs are nullable (null ⇒ that trigger is off); a per-trigger checkbox is
@@ -249,6 +251,7 @@ async function save() {
       publishPrVerificationReport: draft.publishPrVerificationReport,
       artifactRetentionDays: draft.artifactRetentionDays,
       kaizenEnabled: draft.kaizenEnabled,
+      allowInitiatorPat: draft.allowInitiatorPat,
       reviewFrictionMode: draft.reviewFrictionMode,
       reviewFrictionWarnCount: draft.reviewFrictionWarnCount,
       reviewFrictionBlockCount: blockCount,
@@ -484,6 +487,36 @@ async function save() {
               </label>
             </section>
 
+            <!-- Run credential: the App installation vs. the initiator's own token -->
+            <section class="space-y-2">
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.runCredential.heading') }}
+              </h3>
+              <p class="text-[11px] text-slate-400">
+                {{ t('settings.workspaceSettings.runCredential.body') }}
+              </p>
+              <label class="flex items-center gap-2">
+                <USwitch
+                  v-model="draft.allowInitiatorPat"
+                  size="sm"
+                  data-testid="allow-initiator-pat"
+                />
+                <span class="text-sm text-slate-200">{{
+                  t('settings.workspaceSettings.runCredential.toggle')
+                }}</span>
+              </label>
+              <p v-if="!draft.allowInitiatorPat" class="text-[11px] text-amber-300">
+                {{ t('settings.workspaceSettings.runCredential.offHint') }}
+              </p>
+              <!-- Stated rather than read: the account floor lives behind an ACCOUNT-admin
+                   endpoint, which a workspace admin may not hold, so probing it here would 403
+                   for exactly the people this note is for. A static line sets the expectation
+                   without pretending to report a value we cannot see. -->
+              <p v-if="draft.allowInitiatorPat" class="text-[11px] text-slate-500">
+                {{ t('settings.workspaceSettings.runCredential.accountFloorNote') }}
+              </p>
+            </section>
+
             <!-- Kaizen agent -->
             <section class="space-y-2">
               <h3 class="text-sm font-semibold text-slate-200">

package/app/composables/api/foundationalServices.ts

@@ -27,10 +27,11 @@ import type { ApiContext } from './context'
  * capabilities an organisation already runs, which an Architect designs against instead of
  * proposing a rebuild.
  *
- * Tiered exactly like the prompt-fragment library (`account` ⊕ `workspace`), so every route
- * reuses the same `scope(kind, id)` prefix. Three of them are workspace-only, because they are
- * about a tier having something ABOVE it: the merged catalog, and the suppress/restore pair
- * that opts a board out of an inherited account service.
+ * Tiered exactly like the prompt-fragment library (a deployment's code-registered `builtin`
+ * services ⊕ `account` ⊕ `workspace`), so every route reuses the same `scope(kind, id)` prefix.
+ * Only the merged catalog + the lazy document read are workspace-only, because a board is what
+ * runs agents; the suppress/restore pair serves both scopes, since an account inherits the
+ * deployment's registered tier exactly as a board inherits its account's.
  */
 export function foundationalServicesApi({ send, ws, scope }: ApiContext) {
   return {
@@ -82,21 +83,29 @@ export function foundationalServicesApi({ send, ws, scope }: ApiContext) {
         pathParams: { serviceId },
       }),
 
-    // ---- opting a board out of an inherited account service ---------------
+    // ---- opting a tier out of what it INHERITS ----------------------------
     // The LIST is what makes the pair usable: a suppressed id is by construction absent from the
     // merged catalog, so nothing else can tell the surface what to offer a restore for.
-    listFoundationalServiceSuppressions: (workspaceId: string) =>
-      send(listFoundationalServiceSuppressionsContract, { pathPrefix: ws(workspaceId) }),
+    listFoundationalServiceSuppressions: (kind: FoundationalServiceOwnerKind, id: string) =>
+      send(listFoundationalServiceSuppressionsContract, { pathPrefix: scope(kind, id) }),
 
-    suppressFoundationalService: (workspaceId: string, serviceId: string) =>
+    suppressFoundationalService: (
+      kind: FoundationalServiceOwnerKind,
+      id: string,
+      serviceId: string,
+    ) =>
       send(suppressFoundationalServiceContract, {
-        pathPrefix: ws(workspaceId),
+        pathPrefix: scope(kind, id),
         pathParams: { serviceId },
       }),
 
-    restoreFoundationalService: (workspaceId: string, serviceId: string) =>
+    restoreFoundationalService: (
+      kind: FoundationalServiceOwnerKind,
+      id: string,
+      serviceId: string,
+    ) =>
       send(restoreFoundationalServiceContract, {
-        pathPrefix: ws(workspaceId),
+        pathPrefix: scope(kind, id),
         pathParams: { serviceId },
       }),
 

package/app/composables/api/github.ts

@@ -12,6 +12,7 @@ import {
   listGitHubInstallationsContract,
   listGitHubIssuesContract,
   listGitHubPullsContract,
+  checkGitHubBranchProtectionContract,
   listGitHubReposContract,
   listGitHubRepoFilesContract,
   listGitHubRepoTreeContract,
@@ -66,6 +67,11 @@ export function githubApi({ send, ws }: ApiContext) {
     listGitHubRepos: (workspaceId: string) =>
       send(listGitHubReposContract, { pathPrefix: ws(workspaceId) }),
 
+    // The branch-protection preflight: a LIVE probe of each linked repo's default branch, so
+    // it is invoked on demand rather than folded into the projection reads above.
+    checkGitHubBranchProtection: (workspaceId: string) =>
+      send(checkGitHubBranchProtectionContract, { pathPrefix: ws(workspaceId) }),
+
     // Programmatic repo creation (privileged App tier). Only called when the
     // connection reports `canCreateRepos`; otherwise the UI opens GitHub directly.
     createGitHubRepo: (workspaceId: string, body: CreateRepoBody) =>

package/app/stores/foundationalServices.spec.ts

@@ -1,5 +1,8 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
-import { useFoundationalServicesStore } from '~/stores/foundationalServices'
+import {
+  useFoundationalServices,
+  useFoundationalServicesStore,
+} from '~/stores/foundationalServices'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 // The two store rules that the surface's correctness rests on, and that neither the backend
@@ -11,10 +14,11 @@ import { useWorkspaceStore } from '~/stores/workspace'
 //  - a suppress/restore must refresh the OPT-OUT list as well as the catalog. The two are
 //    complements — an entry leaves one exactly as it enters the other — so refreshing only the
 //    catalog leaves the way BACK stale, which is the failure the pair exists to prevent.
+//  - the ACCOUNT scope has an opt-out list too (it inherits the deployment's `builtin` tier), and
+//    it has no merged catalog to piggyback on — so the read must not be gated on that catalog.
 
 const SERVICE = {
   id: 'file-storage',
-  ownerKind: 'account' as const,
   name: 'File Storage',
   summary: 'Stores uploads.',
   description: '',
@@ -30,11 +34,6 @@ const SERVICE = {
       omittedOperations: 0,
     },
   ],
-  sourceId: null,
-  sourcePath: null,
-  pinnedCommit: null,
-  createdAt: 1,
-  updatedAt: 1,
 }
 
 function api(over: Record<string, unknown> = {}) {
@@ -119,3 +118,26 @@ describe('foundational-services store', () => {
     expect(client.getResolvedFoundationalServices.mock.calls.length).toBe(afterProbe + 2)
   })
 })
+
+describe('foundational-services store at the ACCOUNT scope', () => {
+  it('loads and refreshes the opt-out list even with no merged catalog to read', async () => {
+    // An account inherits the deployment's code-registered services, so it can suppress one — but
+    // it has no `resolved` read of its own. Gating the suppression list on that read (as it was
+    // while only a board inherited anything) leaves an account able to opt out and unable to see,
+    // or lift, what it opted out of.
+    const client = api()
+    vi.stubGlobal('useApi', () => client)
+    const store = useFoundationalServices('account', 'acct1')
+    await store.probe()
+    expect(client.listFoundationalServiceSuppressions).toHaveBeenCalledWith('account', 'acct1')
+    expect(client.getResolvedFoundationalServices).not.toHaveBeenCalled()
+
+    await store.suppress('file-storage')
+    expect(client.suppressFoundationalService).toHaveBeenCalledWith(
+      'account',
+      'acct1',
+      'file-storage',
+    )
+    expect(client.listFoundationalServiceSuppressions).toHaveBeenCalledTimes(2)
+  })
+})

package/app/stores/foundationalServices.ts

@@ -40,7 +40,11 @@ function foundationalServicesSetup(
 ) {
   const api = useApi()
 
-  /** The merged/resolved catalog only exists at the workspace tier. */
+  /**
+   * The merged/resolved catalog only exists at the workspace tier — a board is what runs agents.
+   * The SUPPRESSION pair is not gated on it: an account inherits the deployment's code-registered
+   * `builtin` services exactly as a board inherits its account's, so both tiers can opt out.
+   */
   const hasResolved = kind === 'workspace'
 
   /** null = not probed yet; true/false = the catalog is on/off for this deployment. */
@@ -70,7 +74,7 @@ function foundationalServicesSetup(
 
   /** How many entries of the merged catalog this board inherits rather than owns. */
   const inheritedCount = computed(
-    () => resolved.value.filter((entry) => entry.tier === 'account').length,
+    () => resolved.value.filter((entry) => entry.tier !== 'workspace').length,
   )
 
   function requireOwnerId(): string {
@@ -94,9 +98,7 @@ function foundationalServicesSetup(
         hasResolved
           ? api.getResolvedFoundationalServices(id)
           : Promise.resolve([] as ResolvedFoundationalService[]),
-        hasResolved
-          ? api.listFoundationalServiceSuppressions(id)
-          : Promise.resolve([] as FoundationalServiceSuppression[]),
+        api.listFoundationalServiceSuppressions(kind, id),
       ])
       services.value = tier
       resolved.value = merged
@@ -133,14 +135,15 @@ function foundationalServicesSetup(
   }
 
   async function refreshResolved() {
-    if (!hasResolved) return
     const id = requireOwnerId()
     // Both in one pass: a write that changes the merge routinely changes the opt-out list too
     // (suppressing removes an entry from one and adds it to the other), and refreshing only the
     // catalog would leave the way BACK stale — the exact state the pair exists to avoid.
     const [merged, opted] = await Promise.all([
-      api.getResolvedFoundationalServices(id),
-      api.listFoundationalServiceSuppressions(id),
+      hasResolved
+        ? api.getResolvedFoundationalServices(id)
+        : Promise.resolve([] as ResolvedFoundationalService[]),
+      api.listFoundationalServiceSuppressions(kind, id),
     ])
     resolved.value = merged
     suppressions.value = opted
@@ -171,15 +174,15 @@ function foundationalServicesSetup(
     await reload()
   }
 
-  /** Opt this board out of an inherited ACCOUNT service. Destroys nothing; reversible. */
+  /** Opt this tier out of a service it INHERITS. Destroys nothing; reversible. */
   async function suppress(serviceId: string) {
-    await api.suppressFoundationalService(requireWorkspaceId(), serviceId)
+    await api.suppressFoundationalService(kind, requireOwnerId(), serviceId)
     await reload()
   }
 
-  /** Lift a suppression, so the board inherits the account service again. */
+  /** Lift a suppression, so this tier inherits the service again. */
   async function restore(serviceId: string) {
-    await api.restoreFoundationalService(requireWorkspaceId(), serviceId)
+    await api.restoreFoundationalService(kind, requireOwnerId(), serviceId)
     await reload()
   }
 

package/app/stores/workspaceSettings.ts

@@ -25,6 +25,9 @@ const DEFAULTS: WorkspaceSettings = {
   // banner on every board before the snapshot even lands.
   defaultProvisionType: null,
   defaultProvisionManifestId: null,
+  // On: a run authenticates as its initiator when they stored a GitHub PAT, so pushes and PRs
+  // are attributed to them. Off bounds every run to the App installation's scope.
+  allowInitiatorPat: true,
   // The custom metadata bag: empty until someone fills a declared field in. Never null — an
   // external-tool resolver indexes it (`ctx.metadata.gameId`) with no guard.
   metadata: {},

package/app/types/foundationalServices.ts

@@ -16,6 +16,7 @@ export type {
   ApiContractFormat,
   ApiContractSummary,
   CreateFoundationalServiceInput,
+  FolderScanCoverage,
   FoundationalService,
   FoundationalServiceOwnerKind,
   FoundationalServiceSelection,

package/app/utils/connectionWarnings.ts

@@ -14,4 +14,10 @@ export const CONNECTION_WARNING_KEYS: Record<ConnectionWarningCode, string> = {
     'settings.providerConnection.test.warnings.runner_manifest_no_release',
   runner_manifest_no_status_path:
     'settings.providerConnection.test.warnings.runner_manifest_no_status_path',
+  github_pat_classic_account_wide:
+    'settings.providerConnection.test.warnings.github_pat_classic_account_wide',
+  github_pat_scopes_beyond_need:
+    'settings.providerConnection.test.warnings.github_pat_scopes_beyond_need',
+  github_pat_scope_unreadable:
+    'settings.providerConnection.test.warnings.github_pat_scope_unreadable',
 }

package/i18n/locales/de.json

@@ -303,7 +303,10 @@
         "warningsTitle": "Lücken in dieser Konfiguration",
         "warnings": {
           "runner_manifest_no_release": "Kein Release-Template: Beim Abbrechen eines Laufs kann dem Pool nicht mitgeteilt werden, dass er seinen Job stoppen soll. Ein verwaister Job belegt seinen Runner, bis der Pool ihn von selbst zurücknimmt.",
-          "runner_manifest_no_status_path": "Kein Statuspfad: Jede Abfrage wird als weiterhin laufend gelesen. Ein Job kann daher nur enden, wenn das Abfragebudget des Laufs aufgebraucht ist."
+          "runner_manifest_no_status_path": "Kein Statuspfad: Jede Abfrage wird als weiterhin laufend gelesen. Ein Job kann daher nur enden, wenn das Abfragebudget des Laufs aufgebraucht ist.",
+          "github_pat_classic_account_wide": "Dies ist ein klassisches Token mit dem Bereich 'repo': Es erreicht jedes Repository, in das du pushen kannst, auch solche, in denen die GitHub-App dieses Arbeitsbereichs nie installiert wurde. Ausführungen, die du startest, nutzen es bevorzugt vor der App. Ein fein abgestuftes Token, das auf die Repositories dieser Installation begrenzt ist, ist enger gefasst.",
+          "github_pat_scopes_beyond_need": "Dieses Token gewährt Berechtigungen, die cat-factory nie nutzt. Sie zu entfernen kostet nichts und verkleinert das, was eine kompromittierte Ausführung erreichen könnte.",
+          "github_pat_scope_unreadable": "GitHub hat dieses Token akzeptiert, aber keine Bereiche dafür gemeldet, daher lässt sich seine Reichweite hier nicht anzeigen. Prüfe in deinen GitHub-Token-Einstellungen, was es gewährt."
         }
       },
       "toast": {
@@ -407,6 +410,7 @@
       "optionalField": "{label} (optional)",
       "testConnection": "Verbindung testen",
       "tokenValid": "Token gültig",
+      "tokenReachTitle": "Was dieses Token erreicht",
       "tokenRejected": "Token abgelehnt",
       "secretFallback": "Secret",
       "toast": {
@@ -848,6 +852,13 @@
         "body": "Nach Abschluss jeder Ausführung bewertet der Kaizen-Agent, wie jeder Agentenschritt verlief, von reibungslos und effizient bis verwirrt und chaotisch, und empfiehlt Prompt-/Modellverbesserungen. Eine Kombination aus Prompt, Agent und Modell, die fünfmal in Folge hoch bewertet wird und keine Empfehlungen erhält, wird als verifiziert markiert und nicht mehr bewertet. Die Bewertung läuft im Hintergrund und wird in den Ausführungsdetails und im Kaizen-Bildschirm angezeigt. Lege das Modell des Bewerters in der Modellkonfiguration fest (der \"Kaizen\"-Agent).",
         "toggle": "Agenten-Ausführungen mit Kaizen bewerten"
       },
+      "runCredential": {
+        "heading": "Anmeldedaten für Ausführungen",
+        "body": "Standardmäßig authentifiziert sich eine Ausführung mit dem persönlichen Zugriffstoken der Person, die sie gestartet hat, sofern sie eines hinterlegt hat. Pushes und Pull Requests werden dann dieser Person zugeordnet. Die Reichweite ihres Tokens ist genau das, was sie ihm gewährt hat, und damit oft größer als die Repositories, die die GitHub-App-Installation dieses Arbeitsbereichs abdeckt. Schalte dies aus, damit sich jede Ausführung stattdessen als App-Installation authentifiziert.",
+        "toggle": "Ausführungen im Namen der startenden Person laufen lassen",
+        "offHint": "Ausführungen pushen und öffnen Pull Requests als GitHub-App, nicht als die Person, die sie gestartet hat.",
+        "accountFloorNote": "Eine kontoweite Richtlinie kann dies für jedes Board verbieten; ist eine gesetzt, verwenden Ausführungen hier unabhängig von diesem Schalter die GitHub-App."
+      },
       "metadata": {
         "heading": "Arbeitsbereich-Metadaten",
         "body": "Werte für die benutzerdefinierten Felder dieser Installation. Externe Tools lesen sie und öffnen direkt das richtige Projekt für diesen Arbeitsbereich.",
@@ -1021,6 +1032,15 @@
         "saveFailed": "Konsensgruppe konnte nicht gespeichert werden",
         "deleteFailed": "Konsensgruppe konnte nicht gelöscht werden"
       }
+    },
+    "runCredentialPolicy": {
+      "heading": "Richtlinie für Ausführungs-Anmeldedaten",
+      "body": "Ein Board kann zulassen, dass sich eine Ausführung mit dem persönlichen Zugriffstoken derjenigen Person authentifiziert, die sie gestartet hat. Das ist nützlich, und für eine einzelne Person in einer Organisation, die cat-factory nicht eingeführt hat, ist es oft die einzige Möglichkeit. Ein persönliches Token reicht jedoch so weit, wie seine Besitzerin oder sein Besitzer es erlaubt hat — meist weiter als die GitHub-App-Installation dieses Kontos —, und eine Board-Administration kann den Schalter des Boards wieder einschalten. Verbiete es hier, dann kann es kein Board in diesem Konto mehr.",
+      "toggle": "Ausführungen verbieten, das persönliche Zugriffstoken ihrer Starterin oder ihres Starters zu verwenden",
+      "onHint": "Jede Ausführung in diesem Konto authentifiziert sich als GitHub-App-Installation. Pushes und Pull Requests stammen dann von der App und nicht von der Person, die die Ausführung gestartet hat.",
+      "offHint": "Nicht gesetzt: Jedes Board entscheidet selbst. Bestehende Boards behalten ihre Auswahl.",
+      "saved": "Richtlinie für Ausführungs-Anmeldedaten gespeichert",
+      "saveFailed": "Richtlinie für Ausführungs-Anmeldedaten konnte nicht gespeichert werden"
     }
   },
   "inspector": {
@@ -2329,7 +2349,7 @@
       "action": "Standard wählen"
     },
     "accountFoundational": {
-      "intro": "Die gemeinsamen Fähigkeiten, die diese Organisation bereits betreibt - Dateiablage, Benachrichtigungen, Audit - samt ihren API-Verträgen. Jedes Board erbt sie, und einem Architekten wird gesagt, sie zu nutzen statt einen Neubau vorzuschlagen."
+      "intro": "Die gemeinsamen Fähigkeiten, die diese Organisation bereits betreibt - Dateiablage, Benachrichtigungen, Audit - samt ihren API-Verträgen. Jedes Board erbt sie, und einem Architekten wird gesagt, sie zu nutzen statt einen Neubau vorzuschlagen. Dienste, die dieses Deployment im Code registriert, werden hier ebenfalls geerbt und können per ID überschrieben oder unten abgewählt werden."
     }
   },
   "board": {
@@ -4232,6 +4252,7 @@
       "subtitle": "Die gemeinsamen Fähigkeiten, die eure Organisation bereits betreibt, damit ein Entwurf sie nutzt statt sie neu zu bauen."
     },
     "tier": {
+      "builtin": "Deployment",
       "account": "Konto",
       "workspace": "Board"
     },
@@ -4242,6 +4263,8 @@
     },
     "contracts": {
       "omitted": "+{count} weitere nicht aufgeführt",
+      "notIndexed": "Operationen werden für dieses Format nicht indexiert; öffne das Dokument",
+      "noOperations": "deklariert keine Operationen",
       "none": "Kein API-Vertrag hinterlegt. Einem Agenten wird gesagt, dass die Schnittstelle unbekannt ist, statt dass er sie errät."
     },
     "catalog": {
@@ -4252,8 +4275,14 @@
       "hideDocuments": "Vertragsdokumente ausblenden"
     },
     "suppressions": {
-      "title": "Auf diesem Board abgewählt",
-      "intro": "Diese Kontodienste sind für Entwürfe auf diesem Board ausgeblendet. Nichts wurde gelöscht, und das Konto behält sie für alle anderen Boards.",
+      "title": {
+        "workspace": "Auf diesem Board abgewählt",
+        "account": "Für dieses Konto abgewählt"
+      },
+      "intro": {
+        "workspace": "Diese geerbten Dienste sind für Entwürfe auf diesem Board ausgeblendet. Nichts wurde gelöscht, und alle anderen Boards behalten sie.",
+        "account": "Diese von diesem Deployment registrierten Dienste sind für Entwürfe in allen Boards dieses Kontos ausgeblendet. Nichts wurde gelöscht, und andere Konten behalten sie."
+      },
       "restore": "Wieder anbieten",
       "shadowsNothing": "Unter dieser ID wird derzeit nichts geerbt, diese Abwahl blendet also aktuell nichts aus."
     },
@@ -4346,6 +4375,7 @@
       "synced": "Synchronisiert: {updated} aktualisiert, {removed} entfernt",
       "syncSkipped": "{count} Datei sah wie ein Vertrag aus, war aber nicht verwendbar. | {count} Dateien sahen wie Verträge aus, waren aber nicht verwendbar.",
       "syncTruncated": "Der Ordner enthält mehr, als eine Synchronisierung aufnehmen kann; es wurde nur ein Teil gelesen.",
+      "syncFolderMissing": "Der verknüpfte Ordner ist nicht im Repository vorhanden. Prüfe den Pfad oder verknüpfe die Quelle neu, falls er verschoben wurde.",
       "syncFailed": "Repo konnte nicht synchronisiert werden",
       "changesAvailable": "Stromaufwärts liegen Änderungen vor",
       "upToDate": "Bereits aktuell",
@@ -6066,6 +6096,29 @@
       "title": "cat-factory mit {provider} verbinden",
       "titleAny": "cat-factory mit Ihren Repositorys verbinden",
       "intro": "cat-factory funktioniert, indem es Pull Requests in Ihren Repositorys öffnet. Verbinden Sie Ihren Repository-Anbieter, um fortzufahren."
+    },
+    "branchProtection": {
+      "heading": "Schutz des Standard-Branch",
+      "body": "Agenten-Ausführungen pushen mit einem Zugang, der in jedes abgedeckte Repository schreiben darf. Nichts hier kann verhindern, dass eine kompromittierte Ausführung direkt auf einen Standard-Branch pusht oder ihren eigenen Pull Request über die API des Hosts merged — beides deckt nur der Branch-Schutz beim Host ab, und den richtest du selbst ein. Diese Prüfung zeigt, ob er vorhanden ist.",
+      "check": "Schutz prüfen",
+      "allProtected": "Der Standard-Branch jedes verknüpften Repositories ist geschützt.",
+      "exposed": "{count} Repository hat einen ungeschützten Standard-Branch. | {count} Repositories haben einen ungeschützten Standard-Branch.",
+      "unavailable": "Der verbundene Anbieter kann keinen Branch-Schutz melden, daher sagt diese Prüfung nichts aus — das ist kein sauberes Ergebnis.",
+      "omitted": "{count} weiteres verknüpftes Repository wurde nicht geprüft. | {count} weitere verknüpfte Repositories wurden nicht geprüft.",
+      "state": {
+        "protected": "Geschützt",
+        "unprotected": "Ungeschützt",
+        "unknown": "Unbekannt"
+      },
+      "unprotectedHint": "der Zugang einer Ausführung kann hier direkt pushen und den eigenen Pull Request mergen",
+      "detailUnavailable": "geschützt, aber die Regel konnte nicht gelesen werden — direkte Pushes sind möglicherweise weiterhin erlaubt",
+      "requiresPr": "Pull Request erforderlich, {reviews} zustimmende Review(s), {checks} erforderliche Prüfung(en)",
+      "noPrRequired": "geschützt, aber kein Pull Request erforderlich",
+      "unknownReason": {
+        "branch_not_found": "der Standard-Branch wurde nicht gefunden — die Repository-Projektion ist möglicherweise veraltet",
+        "forbidden": "der Zugang darf die Branches dieses Repositories nicht lesen",
+        "error": "der Host war nicht erreichbar"
+      }
     }
   },
   "tutorial": {

package/i18n/locales/en.json

@@ -2351,7 +2351,7 @@
       "action": "Choose default"
     },
     "accountFoundational": {
-      "intro": "The shared capabilities this organisation already runs - file storage, notifications, audit - with their API contracts. Every board inherits them, and an architect is told to consume them instead of proposing a rebuild."
+      "intro": "The shared capabilities this organisation already runs - file storage, notifications, audit - with their API contracts. Every board inherits them, and an architect is told to consume them instead of proposing a rebuild. Services this deployment registers in code are inherited here too, and can be overridden by id or opted out of below."
     }
   },
   "settings": {
@@ -2661,7 +2661,10 @@
         "warningsTitle": "Gaps in this configuration",
         "warnings": {
           "runner_manifest_no_release": "No release template: cancelling a run cannot tell the pool to stop its job, so an orphaned job keeps its runner until the pool reclaims it on its own.",
-          "runner_manifest_no_status_path": "No status path: every poll reads as still running, so a job can only end by exhausting the run's poll budget."
+          "runner_manifest_no_status_path": "No status path: every poll reads as still running, so a job can only end by exhausting the run's poll budget.",
+          "github_pat_classic_account_wide": "This is a classic token with the 'repo' scope: it reaches every repository you can push to, including ones this workspace's GitHub App was never installed on. Runs you start use it in preference to the App. A fine-grained token limited to this deployment's repositories is narrower.",
+          "github_pat_scopes_beyond_need": "This token grants permissions cat-factory never uses. Removing them costs nothing and narrows what a compromised run could reach.",
+          "github_pat_scope_unreadable": "GitHub accepted this token but reported no scopes for it, so its reach cannot be shown here. Check what it grants in your GitHub token settings."
         }
       },
       "toast": {
@@ -2765,6 +2768,7 @@
       "optionalField": "{label} (optional)",
       "testConnection": "Test connection",
       "tokenValid": "Token valid",
+      "tokenReachTitle": "What this token reaches",
       "tokenRejected": "Token rejected",
       "secretFallback": "Secret",
       "toast": {
@@ -3215,6 +3219,13 @@
         },
         "toggle": "Grade agent runs with Kaizen"
       },
+      "runCredential": {
+        "heading": "Run credential",
+        "body": "By default a run authenticates with the personal access token of whoever started it, when they have stored one, so pushes and pull requests are attributed to that person. Their token's reach is whatever they granted it, which is often wider than the repositories this workspace's GitHub App installation covers. Turn this off to make every run authenticate as the App installation instead.",
+        "toggle": "Let runs act as the person who started them",
+        "offHint": "Runs will push and open pull requests as the GitHub App, not as their initiator.",
+        "accountFloorNote": "An account-wide policy can forbid this for every board; if one is set, runs here use the GitHub App regardless of this switch."
+      },
       "metadata": {
         "heading": "Workspace metadata",
         "body": "Values for the custom fields this deployment defines. External tools read them, so a tool opens on the right project for this workspace.",
@@ -3388,6 +3399,15 @@
         "saveFailed": "Could not save the consensus group",
         "deleteFailed": "Could not delete the consensus group"
       }
+    },
+    "runCredentialPolicy": {
+      "heading": "Run credential policy",
+      "body": "A board can let a run authenticate with the personal access token of whoever started it. That is useful, and for a single person working inside an org that has not adopted cat-factory it is often the only option. But a personal token reaches whatever its owner granted it, which is usually wider than this account's GitHub App installation, and a board admin can turn the board's own switch back on. Forbid it here and no board in this account can.",
+      "toggle": "Forbid runs from using their initiator’s personal access token",
+      "onHint": "Every run in this account will authenticate as the GitHub App installation. Pushes and pull requests will come from the app rather than from the person who started the run.",
+      "offHint": "Not set: each board decides for itself. Existing boards keep whatever they have chosen.",
+      "saved": "Run credential policy saved",
+      "saveFailed": "Could not save the run credential policy"
     }
   },
   "providers": {
@@ -5440,6 +5460,7 @@
       "subtitle": "The shared capabilities your organisation already runs, so a design consumes them instead of rebuilding them."
     },
     "tier": {
+      "builtin": "Deployment",
       "account": "Account",
       "workspace": "Board"
     },
@@ -5450,6 +5471,8 @@
     },
     "contracts": {
       "omitted": "+{count} more not listed",
+      "notIndexed": "operations are not indexed for this format; open the document",
+      "noOperations": "declares no operations",
       "none": "No API contract attached. An agent will be told the interface is unknown rather than guessing at it."
     },
     "catalog": {
@@ -5460,8 +5483,14 @@
       "hideDocuments": "Hide contract documents"
     },
     "suppressions": {
-      "title": "Opted out on this board",
-      "intro": "These account services are hidden from designs on this board. Nothing was deleted, and the account keeps them for every other board.",
+      "title": {
+        "workspace": "Opted out on this board",
+        "account": "Opted out for this account"
+      },
+      "intro": {
+        "workspace": "These inherited services are hidden from designs on this board. Nothing was deleted, and every other board keeps them.",
+        "account": "These services registered by this deployment are hidden from designs in every board of this account. Nothing was deleted, and other accounts keep them."
+      },
       "restore": "Offer again",
       "shadowsNothing": "Nothing is inherited under this id right now, so this opt-out currently hides nothing."
     },
@@ -5554,6 +5583,7 @@
       "synced": "Synced: {updated} updated, {removed} removed",
       "syncSkipped": "{count} file looked like a contract but could not be used. | {count} files looked like contracts but could not be used.",
       "syncTruncated": "The folder holds more than one sync can take, so only part of it was read.",
+      "syncFolderMissing": "The linked folder is not in the repository. Check the path, or relink the source if it moved.",
       "syncFailed": "Could not sync the repo",
       "changesAvailable": "Changes available upstream",
       "upToDate": "Already up to date",
@@ -6270,6 +6300,29 @@
       "title": "Connect cat-factory to {provider}",
       "titleAny": "Connect cat-factory to your repositories",
       "intro": "cat-factory works by opening pull requests on your repositories. Connect your repository host to continue."
+    },
+    "branchProtection": {
+      "heading": "Default-branch protection",
+      "body": "Agent runs push with a credential that can write to every repository it covers. Nothing here can stop a compromised run pushing straight to a default branch, or merging its own pull request through the host's API — branch protection on the host is what covers both, and it is yours to configure. This checks whether it is in place.",
+      "check": "Check protection",
+      "allProtected": "Every linked repository's default branch is protected.",
+      "exposed": "{count} repository has an unprotected default branch. | {count} repositories have an unprotected default branch.",
+      "unavailable": "The connected provider cannot report branch protection, so this check has nothing to say — it is not a clean result.",
+      "omitted": "{count} further linked repository was not checked. | {count} further linked repositories were not checked.",
+      "state": {
+        "protected": "Protected",
+        "unprotected": "Unprotected",
+        "unknown": "Unknown"
+      },
+      "unprotectedHint": "a run's credential can push here directly and merge its own pull request",
+      "detailUnavailable": "protected, but the rule could not be read — it may still allow direct pushes",
+      "requiresPr": "pull request required, {reviews} approving review(s), {checks} required check(s)",
+      "noPrRequired": "protected, but no pull request is required",
+      "unknownReason": {
+        "branch_not_found": "the default branch was not found — the repository projection may be stale",
+        "forbidden": "the credential is not allowed to read this repository's branches",
+        "error": "the host could not be reached"
+      }
     }
   },
   "tutorial": {