@cat-factory/app 0.223.0 → 0.224.1

package/app/components/inputGate/InputGateNotice.vue

@@ -64,6 +64,10 @@ const ISSUE_KEYS = {
     title: 'inputGate.issue.success_criteria_missing.title',
     hint: 'inputGate.issue.success_criteria_missing.hint',
   },
+  required_field_missing: {
+    title: 'inputGate.issue.required_field_missing.title',
+    hint: 'inputGate.issue.required_field_missing.hint',
+  },
 } as const satisfies Record<InputGateIssueCode, { title: string; hint: string }>
 
 /**
@@ -87,16 +91,30 @@ const TONE_COPY: Record<InputGateTone, { title: string; body: string }> = {
 }
 const copy = computed(() => TONE_COPY[props.tone])
 
+/**
+ * The interpolation a finding's copy is rendered with. Only `required_field_missing` carries a
+ * `field`, and its copy is the one line that cannot be written without knowing which input is
+ * missing: a deployment registers its own task types, so the platform has no vocabulary for
+ * "the incident's severity" and names the field instead. The label is deployment-supplied
+ * English, exactly as a custom agent kind's is.
+ *
+ * A finding whose `field` is somehow absent still renders: the copy falls back to naming no
+ * field rather than printing `undefined` into a sentence a human is meant to act on.
+ */
+function issueValues(issue: InputGateIssue): Record<string, string> {
+  return { field: issue.field?.label ?? t('inputGate.issue.required_field_missing.unnamedField') }
+}
+
 /** A finding's translated title, falling back to the generic line for a retired code. */
-function issueTitle(code: InputGateIssueCode): string {
-  const key = ISSUE_KEYS[code]?.title
-  return key && te(key) ? t(key) : t('inputGate.issue.unknown.title')
+function issueTitle(issue: InputGateIssue): string {
+  const key = ISSUE_KEYS[issue.code]?.title
+  return key && te(key) ? t(key, issueValues(issue)) : t('inputGate.issue.unknown.title')
 }
 
 /** A finding's translated remedy hint, on the same fallback. */
-function issueHint(code: InputGateIssueCode): string {
-  const key = ISSUE_KEYS[code]?.hint
-  return key && te(key) ? t(key) : t('inputGate.issue.unknown.hint')
+function issueHint(issue: InputGateIssue): string {
+  const key = ISSUE_KEYS[issue.code]?.hint
+  return key && te(key) ? t(key, issueValues(issue)) : t('inputGate.issue.unknown.hint')
 }
 
 async function resolve(choice: 'recheck' | 'proceed') {
@@ -126,7 +144,11 @@ async function resolve(choice: 'recheck' | 'proceed') {
         <p v-if="!compact" class="text-muted mt-0.5 text-xs">{{ t(copy.body) }}</p>
 
         <ul class="mt-2 space-y-1.5">
-          <li v-for="issue in issues" :key="issue.code" class="flex items-start gap-2 text-xs">
+          <li
+            v-for="issue in issues"
+            :key="`${issue.code}:${issue.field?.key ?? ''}`"
+            class="flex items-start gap-2 text-xs"
+          >
             <UBadge
               :color="issue.severity === 'blocking' ? 'warning' : 'neutral'"
               variant="subtle"
@@ -139,8 +161,8 @@ async function resolve(choice: 'recheck' | 'proceed') {
               }}
             </UBadge>
             <span class="min-w-0">
-              <span class="font-medium">{{ issueTitle(issue.code) }}</span>
-              <span class="text-muted">, {{ issueHint(issue.code) }}</span>
+              <span class="font-medium">{{ issueTitle(issue) }}</span>
+              <span class="text-muted">, {{ issueHint(issue) }}</span>
             </span>
           </li>
         </ul>

package/app/components/panels/AgentStepDetail.vue

@@ -13,6 +13,7 @@ import BinaryOutputReport from '~/components/binaryOutput/BinaryOutputReport.vue
 import EnvironmentStatusPanel from '~/components/environments/EnvironmentStatusPanel.vue'
 import FrontendBindingsResolved from '~/components/panels/inspector/FrontendBindingsResolved.vue'
 import { UI_TESTER_AGENT_KIND } from '@cat-factory/contracts'
+import type { GateApprovalRefusal } from '@cat-factory/contracts'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import IterationCapPrompt from '~/components/pipeline/IterationCapPrompt.vue'
 import StepExecutionHistory from '~/components/board/StepExecutionHistory.vue'
@@ -227,6 +228,10 @@ const {
   draftProposal,
   rejectArmed,
   canRequestChanges,
+  quorum: gateQuorum,
+  viewerHasApproved,
+  approvalWouldClearGate,
+  refusal: gateRefusal,
   onProseClick,
   addDraftComment,
   cancelDraft,
@@ -241,6 +246,25 @@ const {
   reject,
 } = approval
 
+/**
+ * Why the gate refuses this viewer, worded for them. An exhaustive Record over the shared refusal
+ * vocabulary with LITERAL keys, so the typed-message-key check sees them and a new refusal reason
+ * fails the typecheck instead of rendering as a blank line under a disabled button.
+ */
+const GATE_REFUSAL_KEYS: Record<GateApprovalRefusal, string> = {
+  not_a_gate_approver: 'panels.stepDetail.notAnApprover',
+  gate_approver_identity_required: 'panels.stepDetail.approverIdentityRequired',
+}
+
+/**
+ * Whether "approve with corrections" is offered RIGHT NOW. Two independent reasons withhold it,
+ * and they are kept apart because their remedies differ: an output that is a rendering can never
+ * be edited here, while an unmet quorum only means not yet: this viewer's approval is not the
+ * one that clears the gate, and an edit under it would move the artifact beneath the approvals
+ * already recorded. Each states itself below rather than the button quietly vanishing.
+ */
+const proposalEditableNow = computed(() => proposalEditable.value && approvalWouldClearGate.value)
+
 const resolvingCap = ref(false)
 async function resolveCompanionCap(choice: IterationCapChoice) {
   if (!ctx.value || !approvalId.value || resolvingCap.value) return
@@ -692,6 +716,30 @@ async function copyOutput() {
             <p class="mt-1 text-[12px] text-slate-400">
               {{ editing ? t('panels.stepDetail.editHint') : t('panels.stepDetail.reviewHint') }}
             </p>
+            <!-- The gate's configured POLICY, when it has one. Both lines exist because an
+               approve on such a gate legitimately may not advance the run: without the tally, a
+               correctly-recorded approval is indistinguishable from a call that failed, and
+               without the refusal a person would press a button the server answers 403. -->
+            <p
+              v-if="gateQuorum"
+              class="mt-1 text-[12px] text-amber-300/90"
+              data-testid="gate-quorum"
+            >
+              {{
+                t('panels.stepDetail.quorumProgress', {
+                  recorded: gateQuorum.recorded,
+                  required: gateQuorum.required,
+                })
+              }}
+              <span v-if="viewerHasApproved">{{ t('panels.stepDetail.quorumYours') }}</span>
+            </p>
+            <p
+              v-if="gateRefusal"
+              class="mt-1 text-[12px] text-slate-400"
+              data-testid="gate-not-approver"
+            >
+              {{ t(GATE_REFUSAL_KEYS[gateRefusal]) }}
+            </p>
           </div>
 
           <div class="flex-1 space-y-3 overflow-auto overscroll-contain px-4 py-3">
@@ -820,27 +868,36 @@ async function copyOutput() {
               size="sm"
               icon="i-lucide-check"
               block
-              :disabled="rejectArmed"
+              :disabled="rejectArmed || !!gateRefusal"
               :loading="submitting"
               @click="approve"
             >
               {{ t('panels.stepDetail.approveAndProceed') }}
             </UButton>
             <UButton
-              v-if="proposalEditable"
+              v-if="proposalEditableNow"
               color="primary"
               variant="soft"
               size="sm"
               icon="i-lucide-pencil"
               block
-              :disabled="rejectArmed || submitting"
+              :disabled="rejectArmed || submitting || !!gateRefusal"
               @click="startEditing"
             >
               {{ t('panels.stepDetail.approveWithCorrections') }}
             </UButton>
-            <p v-else class="text-[10px] text-slate-500" data-testid="step-rendered-output-note">
+            <p
+              v-else-if="!proposalEditable"
+              class="text-[10px] text-slate-500"
+              data-testid="step-rendered-output-note"
+            >
               {{ t('panels.stepDetail.renderedOutputNote') }}
             </p>
+            <!-- Withheld only until the quorum is one approval away, so it says so rather than
+               leaving a reviewer to wonder where the affordance went. -->
+            <p v-else class="text-[10px] text-slate-500" data-testid="step-quorum-edit-locked">
+              {{ t('panels.stepDetail.quorumEditLocked') }}
+            </p>
 
             <!-- destructive: a two-step inline confirm instead of a native dialog -->
             <div
@@ -881,7 +938,7 @@ async function copyOutput() {
                 icon="i-lucide-rotate-ccw"
                 class="flex-1"
                 data-testid="step-request-changes"
-                :disabled="!canRequestChanges"
+                :disabled="!canRequestChanges || !!gateRefusal"
                 :loading="submitting"
                 @click="requestChanges"
               >
@@ -893,7 +950,7 @@ async function copyOutput() {
                 size="sm"
                 icon="i-lucide-ban"
                 class="flex-1"
-                :disabled="submitting"
+                :disabled="submitting || !!gateRefusal"
                 @click="armReject"
               >
                 {{ t('panels.stepDetail.reject') }}

package/app/components/panels/inspector/TaskTypeFields.vue

@@ -0,0 +1,115 @@
+<script setup lang="ts">
+// The answers to a CUSTOM task type's own declared fields, editable after creation.
+//
+// Why it exists: the create form is not the only door a task arrives through (the public API, an
+// initiative spawn, a tracker import), and a type's declaration can get STRICTER after a task
+// already exists. The pre-dispatch input gate judges the declaration as it stands now, so it
+// parks runs whose task predates the requirement. Without this panel that park had exactly one
+// exit, a human waiving the gate: `recheck` would re-read the same unanswered bag forever, and
+// the remedy the notice names ("fill it in on the task") would be one nothing offered.
+//
+// Renders through the SAME `DescriptorFields` component the create form uses, against the SAME
+// declaration, validated by the SAME shared rule. A field the form would have hidden by its
+// `showWhen` is hidden here too, so the two doors cannot show a person different questions.
+import { computed, ref, watch } from 'vue'
+import type { DescriptorFieldValues } from '@cat-factory/contracts'
+import { sanitizeDescriptorFields, validateDescriptorFields } from '@cat-factory/contracts'
+import type { Block } from '~/types/domain'
+import DescriptorFields from '~/components/common/DescriptorFields.vue'
+import InspectorSection from '~/components/panels/inspector/InspectorSection.vue'
+
+const props = defineProps<{ block: Block }>()
+
+const board = useBoardStore()
+const taskTypes = useTaskTypesStore()
+const { t } = useI18n()
+
+/** The registered type this task is, or undefined for a built-in / unregistered one. */
+const descriptor = computed(() =>
+  props.block.taskType
+    ? taskTypes.customTaskTypes.find((tt) => tt.taskType === props.block.taskType)
+    : undefined,
+)
+
+/**
+ * The fields to render. A type carrying a bespoke `formPanel` owns its whole bag, so its
+ * descriptor fields are not what was collected and editing them here would write values its own
+ * form never offered. That is the same stand-down the create door and the input gate take, and
+ * all three have to agree or "the declaration" would mean three different things.
+ */
+const fields = computed(() => (descriptor.value?.formPanel ? [] : (descriptor.value?.fields ?? [])))
+
+const stored = computed<DescriptorFieldValues>(() => props.block.taskTypeFields?.custom ?? {})
+
+// Local edit buffer, re-seeded whenever the stored bag changes underneath (a live board push, or
+// switching blocks). Editing writes on commit rather than per keystroke, so a half-typed answer
+// never reaches the row the gate reads.
+const draft = ref<DescriptorFieldValues>({ ...stored.value })
+watch(stored, (next) => {
+  draft.value = { ...next }
+})
+
+/**
+ * The same check the server runs, so the button reflects an invalid form rather than the save
+ * failing with a 422. Shared from contracts precisely so the two cannot drift.
+ */
+const problems = computed(() => validateDescriptorFields(fields.value, draft.value))
+
+const dirty = computed(
+  () =>
+    JSON.stringify(sanitizeDescriptorFields(fields.value, draft.value)) !==
+    JSON.stringify(stored.value),
+)
+
+const saving = ref(false)
+
+async function save() {
+  if (problems.value.length || !dirty.value) return
+  saving.value = true
+  try {
+    await board.updateBlock(props.block.id, {
+      customTaskTypeFields: sanitizeDescriptorFields(fields.value, draft.value),
+    })
+  } finally {
+    saving.value = false
+  }
+}
+
+function revert() {
+  draft.value = { ...stored.value }
+}
+</script>
+
+<template>
+  <InspectorSection
+    v-if="fields.length"
+    :title="t('inspector.taskTypeFields.title')"
+    :hint="t('inspector.taskTypeFields.hint')"
+    icon="i-lucide-clipboard-list"
+    :count="fields.length"
+  >
+    <DescriptorFields v-model="draft" :fields="fields" testid-prefix="task-type-field" />
+    <div v-if="dirty" class="mt-2 flex items-center gap-2">
+      <UButton
+        size="xs"
+        color="primary"
+        variant="soft"
+        :loading="saving"
+        :disabled="problems.length > 0"
+        data-testid="task-type-fields-save"
+        @click="save"
+      >
+        {{ t('inspector.taskTypeFields.save') }}
+      </UButton>
+      <UButton
+        size="xs"
+        color="neutral"
+        variant="ghost"
+        data-testid="task-type-fields-revert"
+        @click="revert"
+      >
+        {{ t('inspector.taskTypeFields.revert') }}
+      </UButton>
+    </div>
+  </InspectorSection>
+</template>

package/app/components/pipeline/GateConfigFields.vue

@@ -0,0 +1,187 @@
+<script setup lang="ts">
+// One step's GATE configuration in the pipeline builder: who may clear its human approval gate,
+// how many of them must, and the parameters of the registered gate the step's kind runs.
+//
+// Two halves with deliberately different sources, rendered together because they are one question
+// to the author ("how does this checkpoint behave?"):
+//
+//   - the approval policy is PLATFORM-typed (`StepGateConfig.approvers` / `minApprovals`), so it
+//     gets purpose-built controls and the shared rules from `@cat-factory/contracts` decide what
+//     counts as configured;
+//   - the gate's own parameters are DECLARED BY THE GATE (`gateConfigForms` on the snapshot) and
+//     rendered through the shared `DescriptorFields`, so a deployment's gate gets an authoring
+//     form from its registration alone and this component learns nothing about it.
+//
+// Extracted rather than inlined into `PipelineBuilder.vue` for the size rule (split along a seam,
+// never grow the ratchet) and because the approver controls need a roster load this component can
+// own on its own terms.
+import { computed, ref, watch } from 'vue'
+import { MAX_GATE_APPROVALS, requiredGateApprovals } from '@cat-factory/contracts'
+import type { DescriptorFieldValues, StepGateConfig, WorkspaceRole } from '~/types/domain'
+import DescriptorFields from '~/components/common/DescriptorFields.vue'
+
+const props = defineProps<{
+  /** The step's index in the draft, for the store patch. */
+  index: number
+  /** Whether the step carries a human approval gate (the approval half renders only then). */
+  gated: boolean
+  /** The step's agent kind, for looking up its registered gate's declared parameters. */
+  kind: string
+}>()
+
+const { t } = useI18n()
+const pipelines = usePipelinesStore()
+const workspace = useWorkspaceStore()
+const members = useWorkspaceMembersStore()
+
+const config = computed<StepGateConfig>(() => pipelines.draftGateConfig(props.index) ?? {})
+
+/**
+ * The roles a gate may name. `viewer` is deliberately absent: the workspace RBAC write floor
+ * refuses a viewer's resolution before the policy is ever consulted, so offering it would let an
+ * author configure an approver who can never approve.
+ */
+const APPROVER_ROLES: readonly WorkspaceRole[] = ['admin', 'member']
+
+const ROLE_LABEL_KEYS: Record<'admin' | 'member', string> = {
+  admin: 'pipeline.gateConfig.roleAdmin',
+  member: 'pipeline.gateConfig.roleMember',
+}
+
+const requiredApprovals = computed(() => requiredGateApprovals(config.value))
+
+// The roster backs the named-approver picker. Loaded lazily the first time this panel renders (it
+// is not on the board snapshot) and only when the caller has a workspace — every resolved role may
+// read it, so this is not an admin-only affordance.
+const rosterLoaded = ref(false)
+watch(
+  () => [props.gated, workspace.workspaceId] as const,
+  async ([gated, workspaceId]) => {
+    if (!gated || !workspaceId || rosterLoaded.value) return
+    rosterLoaded.value = true
+    await members.load(workspaceId)
+  },
+  { immediate: true },
+)
+
+const memberOptions = computed(() =>
+  members.members.map((m) => ({ value: m.userId, label: m.name || m.email || m.userId })),
+)
+
+function toggleRole(role: WorkspaceRole, on: boolean) {
+  const roles = new Set<WorkspaceRole>(config.value.approvers?.roles ?? [])
+  if (on) roles.add(role)
+  else roles.delete(role)
+  patchApprovers({ roles: [...roles] })
+}
+
+function setNamedApprovers(userIds: string[]) {
+  patchApprovers({ userIds })
+}
+
+/**
+ * Write one axis of the approver policy back, keeping the other. Empty arrays are dropped rather
+ * than stored: `{ roles: [] }` names nobody, and a policy that names nobody would refuse every
+ * approver and park the run forever — so "no rule" has to persist as an ABSENT rule.
+ */
+function patchApprovers(patch: { roles?: WorkspaceRole[]; userIds?: string[] }) {
+  const merged = { ...config.value.approvers, ...patch }
+  const approvers: NonNullable<StepGateConfig['approvers']> = {}
+  if (merged.roles?.length) approvers.roles = merged.roles
+  if (merged.userIds?.length) approvers.userIds = merged.userIds
+  pipelines.patchDraftGateConfig(props.index, {
+    approvers: Object.keys(approvers).length ? approvers : undefined,
+  })
+}
+
+function setRequiredApprovals(raw: string) {
+  const parsed = Number.parseInt(raw, 10)
+  const bounded = Number.isFinite(parsed) ? Math.min(Math.max(parsed, 1), MAX_GATE_APPROVALS) : 1
+  // The store drops a value of 1 (the default), so an author who types the default back persists
+  // nothing — the same normalization every other per-step option follows.
+  pipelines.patchDraftGateConfig(props.index, { minApprovals: bounded })
+}
+
+/** The parameters the registered gate for this step's kind declares, if any. */
+const gateFields = computed(
+  () => pipelines.gateConfigForms.find((form) => form.kind === props.kind)?.fields,
+)
+
+const gateFieldValues = computed<DescriptorFieldValues>({
+  get: () => config.value.fields ?? {},
+  set: (fields) => pipelines.patchDraftGateConfig(props.index, { fields }),
+})
+</script>
+
+<template>
+  <div v-if="gated || gateFields?.length" class="ms-6 space-y-2" data-testid="gate-config">
+    <div v-if="gated" class="space-y-2 rounded-md border border-amber-800/40 bg-amber-950/10 p-2">
+      <div class="flex flex-wrap items-center gap-2 text-[10px]">
+        <span class="text-slate-500">{{ t('pipeline.gateConfig.approversLabel') }}</span>
+        <label
+          v-for="role in APPROVER_ROLES"
+          :key="role"
+          class="flex items-center gap-1 text-slate-400"
+        >
+          <input
+            type="checkbox"
+            :checked="config.approvers?.roles?.includes(role) ?? false"
+            :data-testid="`gate-approver-role-${role}`"
+            @change="toggleRole(role, ($event.target as HTMLInputElement).checked)"
+          />
+          {{ t(ROLE_LABEL_KEYS[role as 'admin' | 'member']) }}
+        </label>
+      </div>
+
+      <div class="flex flex-wrap items-center gap-2 text-[10px]">
+        <span class="text-slate-500">{{ t('pipeline.gateConfig.namedApproversLabel') }}</span>
+        <USelectMenu
+          class="w-64"
+          multiple
+          size="xs"
+          value-key="value"
+          :items="memberOptions"
+          :model-value="config.approvers?.userIds ?? []"
+          :placeholder="t('pipeline.gateConfig.namedApproversPlaceholder')"
+          data-testid="gate-named-approvers"
+          @update:model-value="setNamedApprovers(($event ?? []) as string[])"
+        />
+      </div>
+
+      <div class="flex flex-wrap items-center gap-2 text-[10px]">
+        <label class="text-slate-500" :title="t('pipeline.gateConfig.requiredApprovalsHint')">
+          {{ t('pipeline.gateConfig.requiredApprovalsLabel') }}
+        </label>
+        <input
+          :value="requiredApprovals"
+          type="number"
+          min="1"
+          :max="MAX_GATE_APPROVALS"
+          step="1"
+          class="w-14 rounded border border-slate-700 bg-slate-900 px-1.5 py-0.5 text-slate-100"
+          data-testid="gate-required-approvals"
+          @change="setRequiredApprovals(($event.target as HTMLInputElement).value)"
+        />
+        <span class="text-slate-500">{{ t('pipeline.gateConfig.requiredApprovalsHint') }}</span>
+      </div>
+
+      <p v-if="!config.approvers" class="text-[10px] text-slate-500">
+        {{ t('pipeline.gateConfig.anyoneHint') }}
+      </p>
+    </div>
+
+    <!-- The registered gate's OWN parameters, rendered from what it declared. Labels and help are
+       the gate's own English (the descriptor-form convention); only the heading is i18n. -->
+    <div
+      v-if="gateFields?.length"
+      class="space-y-2 rounded-md border border-slate-800 bg-slate-900/40 p-2"
+    >
+      <p class="text-[10px] text-slate-500">{{ t('pipeline.gateConfig.gateParametersLabel') }}</p>
+      <DescriptorFields
+        v-model="gateFieldValues"
+        :fields="gateFields"
+        testid-prefix="gate-parameter"
+      />
+    </div>
+  </div>
+</template>

package/app/components/pipeline/PipelineBuilder.vue

@@ -6,6 +6,7 @@ import AgentPalette from '~/components/palettes/AgentPalette.vue'
 import AgentKindIcon from '~/components/pipeline/AgentKindIcon.vue'
 import AgentPromptEditor from '~/components/pipeline/AgentPromptEditor.vue'
 import EstimateThresholdFields from '~/components/pipeline/EstimateThresholdFields.vue'
+import GateConfigFields from '~/components/pipeline/GateConfigFields.vue'
 import OutputBudgetInput from '~/components/pipeline/OutputBudgetInput.vue'
 import BinaryOutputStepPicker from '~/components/pipeline/BinaryOutputStepPicker.vue'
 import { ESTIMATE_AXES, ESTIMATE_AXIS_FIELD, type EstimateAxis } from '~/utils/estimateGating'
@@ -164,6 +165,23 @@ function showVariantPicker(index: number, kind: AgentKind): boolean {
   return showOverrideField(uiMode.isAdvanced, pipelines.draftAgentVariantId(index) ?? null)
 }
 
+/**
+ * Whether to offer this step's GATE configuration (approvers + required approvals, and any
+ * parameters its registered gate declares). There has to be something to configure: either the
+ * step carries a human approval gate, or its kind has a registered gate that declares parameters.
+ *
+ * Then it is an OVERRIDE like the variant picker above — advanced-only until a value is actually
+ * set, and visible in both tiers from then on. That second half is load-bearing here rather than
+ * cosmetic: the builder saves the whole step-options bag, so a configured policy invisible to a
+ * basic-mode editor would be a policy they silently save over.
+ */
+function showGateConfig(index: number, kind: AgentKind): boolean {
+  const gated = pipelines.draftGates[index] === true
+  const declaresFields = pipelines.gateConfigForms.some((form) => form.kind === kind)
+  if (!gated && !declaresFields) return false
+  return showOverrideField(uiMode.isAdvanced, pipelines.draftGateConfig(index) ?? null)
+}
+
 /**
  * The variants registered for a step's kind as USelect items, with an explicit "shipped prompt"
  * entry so clearing the pick is a choice in the same list rather than a separate affordance.
@@ -843,6 +861,19 @@ async function clone(p: Pipeline) {
                 />
               </div>
 
+              <!-- Gate configuration: who may clear this step's approval gate and how many of
+                 them, plus the parameters its registered gate declares. An OVERRIDE of the
+                 defaults (one approval from anyone entitled to write, the gate's shipped knobs),
+                 so it is advanced-only until a step actually configures something — at which point
+                 it must stay visible in both tiers, or a member editing the pipeline would save
+                 over a policy they were never shown. -->
+              <GateConfigFields
+                v-if="showGateConfig(unit.index, unit.kind)"
+                :index="unit.index"
+                :gated="pipelines.draftGates[unit.index] === true"
+                :kind="unit.kind"
+              />
+
               <!-- Binary-output picker: a generator kind's step is parametrized by the
                  foundational STORAGE service its artifacts go through (`stepOptions.binaryOutput`)
                  plus any services consulted for the generation's scope. Required, not an

package/app/components/provisioning/ProvisioningLogsDrawer.vue

@@ -88,6 +88,7 @@ onBeforeUnmount(() => {
 const OPERATION_LABEL = computed<Record<ProvisioningOperation, string>>(() => ({
   provision: t('provisioning.operation.provision'),
   teardown: t('provisioning.operation.teardown'),
+  'teardown-verify': t('provisioning.operation.teardown-verify'),
   status: t('provisioning.operation.status'),
   dispatch: t('provisioning.operation.dispatch'),
   release: t('provisioning.operation.release'),