@cat-factory/app 0.223.0 → 0.224.1

package/app/composables/useStepApproval.ts

@@ -1,6 +1,9 @@
 import { ref, computed, nextTick } from 'vue'
+import { refuseGateResolution, UNATTRIBUTED_GATE_ACTOR } from '@cat-factory/contracts'
+import type { GateActor, GateApprovalRefusal } from '@cat-factory/contracts'
 import type { PipelineStep } from '~/types/execution'
 import { useProseComments } from '~/composables/useProseComments'
+import { useWorkspaceAccess } from '~/composables/useWorkspaceAccess'
 
 /**
  * The GitHub-style approval/review state machine for a pending gate step. When the
@@ -23,6 +26,8 @@ export function useStepApproval(opts: {
   close: () => void
 }) {
   const execution = useExecutionStore()
+  const auth = useAuthStore()
+  const access = useWorkspaceAccess()
 
   const feedback = ref('')
   const submitting = ref(false)
@@ -60,12 +65,71 @@ export function useStepApproval(opts: {
     () => !!feedback.value.trim() || reviewComments.value.length > 0,
   )
 
+  // ---- The gate's own POLICY, as the pipeline step configured it -------------------------
+  //
+  // Read from the SAME `@cat-factory/contracts` rules the engine enforces, never a local
+  // reimplementation: a button enabled by a second copy of the rule is a request the server
+  // refuses, and the person pressing it has no way to tell which of the two is right.
+
+  const approval = computed(() => opts.step()?.approval ?? null)
+
+  /**
+   * The gate's quorum, or null when it needs the usual single approval. Non-null is what makes
+   * the rail say "1 of 2 approvals" — otherwise an approve that correctly leaves the run parked
+   * looks exactly like one that failed.
+   */
+  const quorum = computed(() => {
+    const required = approval.value?.requiredApprovals ?? 1
+    if (required <= 1) return null
+    return { required, recorded: approval.value?.approvals?.length ?? 0 }
+  })
+
+  /** Whether the viewer's own approval is already counted (so the rail can say so). */
+  const viewerHasApproved = computed(() => {
+    const userId = auth.user?.id
+    return !!userId && !!approval.value?.approvals?.some((a) => a.actorId === userId)
+  })
+
+  /**
+   * Whether the viewer's approval would be the one that CLEARS the gate. Always true without a
+   * quorum; under one it folds the viewer in the way the server does, so a re-approval by someone
+   * already counted does not read as a new vote.
+   *
+   * This is what decides whether "approve with corrections" is offered: a quorum votes on ONE
+   * artifact, so an edit that does not clear the gate would rewrite the proposal under the people
+   * already counted toward it and the ones still to come. The server refuses that
+   * (`proposal_not_editable_until_quorum`); hiding the affordance is what stops a reviewer typing
+   * a correction into a dead end, the same disposition as `outputIsRendered`.
+   */
+  const approvalWouldClearGate = computed(() => {
+    const q = quorum.value
+    if (!q) return true
+    return (viewerHasApproved.value ? q.recorded : q.recorded + 1) >= q.required
+  })
+
+  /**
+   * Why the viewer may not resolve this gate, or null when they may. Drives the disabled state of
+   * all three verbs, since the policy governs every resolution and not just approve.
+   *
+   * With auth off there is no signed-in user, and the actor is `unattributed` — exactly what the
+   * server will decide with, so the rail refuses ahead of it rather than offering a button whose
+   * request comes back 403.
+   */
+  const refusal = computed<GateApprovalRefusal | null>(() => {
+    if (!approval.value) return null
+    const user = auth.user
+    const actor: GateActor = user
+      ? { id: user.id, kind: 'user', role: access.role.value }
+      : { id: UNATTRIBUTED_GATE_ACTOR, kind: 'unattributed', role: access.role.value }
+    return refuseGateResolution(approval.value.approverPolicy, actor)
+  })
+
   // Plain approve: accept the agent's proposal verbatim and advance. Every action below
   // closes the overlay ONLY when the command actually ran — a server refusal (surfaced as
   // a toast by the store) or a cancelled credential prompt keeps the review open.
   async function approve() {
     const id = opts.approvalId()
-    if (!opts.instanceId() || !id || submitting.value) return
+    if (!opts.instanceId() || !id || submitting.value || refusal.value) return
     submitting.value = true
     try {
       if (await execution.approveStep(opts.instanceId()!, id)) opts.close()
@@ -88,7 +152,9 @@ export function useStepApproval(opts: {
   }
   async function approveWithEdits() {
     const id = opts.approvalId()
-    if (!opts.instanceId() || !id || submitting.value) return
+    if (!opts.instanceId() || !id || submitting.value || refusal.value) return
+    // The server refuses an edit that does not clear the gate; never send one.
+    if (!approvalWouldClearGate.value) return
     submitting.value = true
     try {
       if (await execution.approveStep(opts.instanceId()!, id, draftProposal.value)) opts.close()
@@ -99,6 +165,7 @@ export function useStepApproval(opts: {
   async function requestChanges() {
     const id = opts.approvalId()
     if (!opts.instanceId() || !id || submitting.value || !canRequestChanges.value) return
+    if (refusal.value) return
     submitting.value = true
     try {
       const ok = await execution.requestStepChanges(opts.instanceId()!, id, {
@@ -118,7 +185,7 @@ export function useStepApproval(opts: {
   }
   async function reject() {
     const id = opts.approvalId()
-    if (!opts.instanceId() || !id || submitting.value) return
+    if (!opts.instanceId() || !id || submitting.value || refusal.value) return
     submitting.value = true
     try {
       if (await execution.rejectStep(opts.instanceId()!, id, feedback.value.trim() || undefined)) {
@@ -159,6 +226,10 @@ export function useStepApproval(opts: {
     draftProposal,
     rejectArmed,
     canRequestChanges,
+    quorum,
+    viewerHasApproved,
+    approvalWouldClearGate,
+    refusal,
     syncHighlights,
     onProseClick,
     addDraftComment,

package/app/modular/panels/inspector.logic.spec.ts

@@ -97,6 +97,11 @@ describe('inspector panel group', () => {
       'task-dependencies',
       'task-run-settings',
       'task-agent-config',
+      // The custom type's own declared fields sit with the other task INPUTS (what the task is),
+      // not under run settings (how it runs). It is gated on being a task alone: the panel hides
+      // itself unless the type is one this deployment registered with descriptor fields, which
+      // the spec here cannot see and should not try to.
+      'task-type-fields',
       'task-structure',
     ])
   })

package/app/modular/panels/inspector.logic.ts

@@ -45,6 +45,7 @@ export const INSPECTOR_PANEL_IDS = [
   'task-dependencies',
   'task-run-settings',
   'task-agent-config',
+  'task-type-fields',
   'task-structure',
   // service / module body
   'container-summary',
@@ -134,6 +135,11 @@ export const INSPECTOR_PANEL_SPECS: readonly InspectorPanelSpec[] = [
   { id: 'task-dependencies', order: 60, when: isTask },
   { id: 'task-run-settings', order: 70, when: isTask },
   { id: 'task-agent-config', order: 80, when: isTask },
+  // The answers to a CUSTOM task type's declared fields. Gated on being a task alone; the panel
+  // itself hides unless the task's type is one this deployment registered WITH descriptor fields,
+  // which is the only case there is anything to edit. It sits beside the other task inputs rather
+  // than under Run settings: these are what the task IS, not how it runs.
+  { id: 'task-type-fields', order: 85, when: isTask },
   { id: 'task-structure', order: 90, when: isTask },
   { id: 'container-summary', order: 110, when: isContainer },
   { id: 'frontend-config', order: 120, when: (b) => isFrame(b) && b.type === 'frontend' },

package/app/modular/panels/inspector.ts

@@ -21,6 +21,7 @@ import TaskEstimateBadge from '~/components/panels/inspector/TaskEstimateBadge.v
 import TaskDependencies from '~/components/panels/inspector/TaskDependencies.vue'
 import TaskRunSettings from '~/components/panels/inspector/TaskRunSettings.vue'
 import TaskAgentConfig from '~/components/panels/inspector/TaskAgentConfig.vue'
+import TaskTypeFields from '~/components/panels/inspector/TaskTypeFields.vue'
 import TaskStructure from '~/components/panels/inspector/TaskStructure.vue'
 import ContainerSummary from '~/components/panels/inspector/ContainerSummary.vue'
 import FrontendConfig from '~/components/panels/inspector/FrontendConfig.vue'
@@ -75,6 +76,7 @@ const COMPONENTS: Record<InspectorPanelId, Component> = {
   'task-dependencies': TaskDependencies,
   'task-run-settings': TaskRunSettings,
   'task-agent-config': TaskAgentConfig,
+  'task-type-fields': TaskTypeFields,
   'task-structure': TaskStructure,
   'container-summary': ContainerSummary,
   'frontend-config': FrontendConfig,

package/app/stores/agents.ts

@@ -7,6 +7,7 @@ import {
   AGENT_ARCHETYPES,
   AGENT_BY_KIND,
   setCustomAgentKindMeta,
+  setCustomCompanionTargets,
   SYSTEM_AGENT_META,
   uid,
 } from '~/utils/catalog'
@@ -105,6 +106,28 @@ export const useAgentsStore = defineStore('agents', () => {
   // no tick gap. The watch lives in the store's effect scope (disposed with it).
   watch(customByKind, (map) => setCustomAgentKindMeta(map), { immediate: true, flush: 'sync' })
 
+  /**
+   * The custom COMPANION pairings (companion kind → the producer kinds it reviews), read off the
+   * same custom-kind sources the palette is built from. Kept apart from `customByKind` because a
+   * pairing is not display metadata: the builder uses it to decide a kind is a TOGGLE on its
+   * producer rather than a placeable block, and `AgentArchetype` has no business carrying it.
+   */
+  const customCompanions = computed<Record<string, readonly AgentKind[]>>(() => {
+    const out: Record<string, readonly AgentKind[]> = {}
+    const add = (k: CustomAgentKind) => {
+      // A pairing with no targets is not a pairing. Recording it would make the kind vanish from
+      // the palette (an `isProducerCompanion` hit) with no producer to hang the toggle on.
+      if (k.companionTargets?.length) out[k.kind] = k.companionTargets
+    }
+    for (const k of consumerKinds.value) add(k)
+    for (const k of capabilitiesManifest.value?.slots?.agentKinds ?? []) add(k)
+    return out
+  })
+  watch(customCompanions, (map) => setCustomCompanionTargets(map), {
+    immediate: true,
+    flush: 'sync',
+  })
+
   /** Display metadata for a KNOWN kind (built-in / system / custom), else undefined. */
   function get(kind: AgentKind): AgentArchetype | undefined {
     return AGENT_BY_KIND[kind] ?? SYSTEM_AGENT_META[kind] ?? customByKind.value[kind]

package/app/stores/pipelines/draftActions.ts

@@ -2,6 +2,7 @@ import { computed } from 'vue'
 import type { AgentKind, Pipeline } from '~/types/domain'
 import { companionForProducer } from '~/utils/catalog'
 import type { PipelinesContext } from './context'
+import { createPipelineGateConfigActions } from './draftGateConfig'
 import { createPipelineStepConfigActions } from './draftStepConfig'
 
 /**
@@ -192,6 +193,7 @@ export function createPipelineDraftActions(ctx: PipelinesContext) {
 
   return {
     ...createPipelineStepConfigActions(ctx),
+    ...createPipelineGateConfigActions(ctx),
     addToDraft,
     removeFromDraft,
     moveInDraft,

package/app/stores/pipelines/draftGateConfig.ts

@@ -0,0 +1,55 @@
+import type { StepGateConfig, StepOptions } from '@cat-factory/contracts'
+import { hasApproverPolicy } from '@cat-factory/contracts'
+import type { PipelinesContext } from './context'
+
+/**
+ * The pipeline-builder draft's per-step GATE configuration: who may clear a step's human approval
+ * gate, how many of them must, and the parameters the step's registered gate declares.
+ *
+ * Its own module rather than another pair of accessors on `./draftStepConfig`, which owns the flat
+ * per-step options (a skill id, a variant id, a token ceiling — each one field, read and written
+ * whole). Gate config is the one nested value there: it MERGES a patch across two independently
+ * edited halves and normalizes at three levels on the way out, which is a different enough shape to
+ * be worth reading on its own. (It also put that file over the per-function line budget, which is
+ * the ratchet doing its job rather than a number to raise.)
+ */
+export function createPipelineGateConfigActions(ctx: PipelinesContext) {
+  const { draftStepOptions } = ctx
+
+  /**
+   * The gate configuration on the draft step at `index`, or undefined when the step takes every
+   * default (one approval from anyone entitled to write, and the gate's shipped knobs).
+   */
+  function draftGateConfig(index: number): StepGateConfig | undefined {
+    return draftStepOptions.value[index]?.gateConfig
+  }
+
+  /**
+   * Merge a PATCH into the draft step's gate configuration. A patch rather than a whole-value set
+   * because the builder edits the two halves through different controls: a whole-value write from
+   * the approver fields would drop the gate's own parameters, and vice versa.
+   *
+   * Normalizes downward at every level: a field set back to its default is deleted, an emptied
+   * `gateConfig` is dropped, and an emptied options bag becomes `null`. So a step returned to the
+   * defaults persists nothing at all — the same rule the other per-step options follow, and what
+   * keeps an all-default pipeline from growing a `step_options` array it does not need.
+   *
+   * An empty approver policy is dropped rather than stored, and that one is not just tidiness:
+   * `{ roles: [] }` names nobody, and a policy naming nobody would refuse every approver and park
+   * the run forever. "No rule" has to persist as an ABSENT rule.
+   */
+  function patchDraftGateConfig(index: number, patch: Partial<StepGateConfig>) {
+    const gateConfig: StepGateConfig = { ...draftGateConfig(index), ...patch }
+    if (!hasApproverPolicy(gateConfig.approvers)) delete gateConfig.approvers
+    if (gateConfig.minApprovals !== undefined && gateConfig.minApprovals <= 1) {
+      delete gateConfig.minApprovals
+    }
+    if (gateConfig.fields && Object.keys(gateConfig.fields).length === 0) delete gateConfig.fields
+    const next: StepOptions = { ...draftStepOptions.value[index] }
+    if (Object.keys(gateConfig).length) next.gateConfig = gateConfig
+    else delete next.gateConfig
+    draftStepOptions.value[index] = Object.keys(next).length ? next : null
+  }
+
+  return { draftGateConfig, patchDraftGateConfig }
+}

package/app/stores/pipelines/draftStepConfig.ts

@@ -7,7 +7,8 @@ import { defaultConsensusConfig, type PipelinesContext } from './context'
  * consensus-GROUP tier set), the human approval gate, the estimate gate on a companion step, the
  * follow-up and test-QC companions, the per-step enable flag, and the `StepOptions` bag
  * (requirements auto-recommendation, the picked skill, the picked agent-kind variant, the
- * per-step output-token ceiling, the binary-output storage/context selection).
+ * per-step output-token ceiling, the binary-output storage/context selection). The step's GATE
+ * configuration is the sibling `./draftGateConfig`, which explains why it is not here.
  *
  * Split out of `./draftActions`, which owns the draft's STRUCTURE (insert / remove / reorder /
  * units). Every function here reads and writes one of the parallel per-step arrays at an index and

package/app/stores/pipelines.ts

@@ -1,7 +1,7 @@
 import { defineStore } from 'pinia'
 import { ref } from 'vue'
 import type { Pipeline } from '~/types/domain'
-import type { PipelinePurpose, RetiredPipelineWire } from '@cat-factory/contracts'
+import type { GateConfigForm, PipelinePurpose, RetiredPipelineWire } from '@cat-factory/contracts'
 import { useUpsertList } from '~/composables/useUpsertList'
 import { createDraftStepState, type PipelinesContext } from '~/stores/pipelines/context'
 import { createPipelineDraftActions } from '~/stores/pipelines/draftActions'
@@ -39,6 +39,13 @@ export const usePipelinesStore = defineStore('pipelines', () => {
    * `usePipelineHealth`). Disjoint from {@link catalogVersions} by construction.
    */
   const retiredPipelines = ref<RetiredPipelineWire[]>([])
+  /**
+   * The per-step parameters each registered GATE declares, projected from the deployment's gate
+   * registry onto the board snapshot. The builder renders a gated step's own config form from
+   * these, so what it can save is exactly what run admission validates. Empty on a deployment
+   * whose gates declare nothing.
+   */
+  const gateConfigForms = ref<GateConfigForm[]>([])
 
   // The per-step, index-aligned draft arrays (kept in lockstep — see `createDraftStepState`).
   const {
@@ -83,6 +90,16 @@ export const usePipelinesStore = defineStore('pipelines', () => {
     retiredPipelines.value = retired ?? []
   }
 
+  /**
+   * Replace the registered gates' declared config forms from a snapshot. Applied even when EMPTY,
+   * for the reason `retired` is: carrying the previous board's forward would offer a form for a
+   * parameter this deployment's gates do not declare, and a value saved through it would then be
+   * refused at save by the very registry that never declared it.
+   */
+  function hydrateGateConfigForms(forms: GateConfigForm[]) {
+    gateConfigForms.value = forms
+  }
+
   function getPipeline(id: string) {
     return pipelines.value.find((p) => p.id === id)
   }
@@ -117,6 +134,7 @@ export const usePipelinesStore = defineStore('pipelines', () => {
     pipelines,
     catalogVersions,
     retiredPipelines,
+    gateConfigForms,
     draft,
     draftGates,
     draftEnabled,
@@ -132,6 +150,7 @@ export const usePipelinesStore = defineStore('pipelines', () => {
     draftDescription,
     editingId,
     hydrate,
+    hydrateGateConfigForms,
     getPipeline,
     ...draftActions,
     ...persistence,

package/app/stores/workspace/hydrate.ts

@@ -114,6 +114,9 @@ export function applySnapshotToStores(snapshot: WorkspaceSnapshot, boardSince?:
     snapshot.binaryGeneratorsUnavailable === true,
   )
   useTaskTypesStore().hydrateCapabilities(capabilities)
+  // The per-step parameters each registered gate declares, so a gated step's config form in the
+  // builder comes from the gate's own registration rather than a form hard-coded per gate.
+  usePipelinesStore().hydrateGateConfigForms(snapshot.gateConfigForms ?? [])
   // The account's repo-sourced Claude Skills catalog (shared across its workspaces), so the
   // pipeline builder's per-step skill picker has its options. A straight replace.
   useSkillsStore().hydrate(snapshot.skills ?? [])

package/app/types/domain.ts

@@ -73,6 +73,11 @@ export type {
   DescriptorField,
   DescriptorFieldValue,
   DescriptorFieldValues,
+  // Per-step GATE configuration: who may resolve a human approval gate, how many of them, and
+  // the parameters the step's registered gate declares (`contracts/src/gate-config.ts`).
+  GateApproverPolicy,
+  GateConfigForm,
+  StepGateConfig,
   Pipeline,
   PipelinePurpose,
   SpendStatus,

package/app/utils/catalog.companions.spec.ts

@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import type { AgentKind } from '~/types/domain'
+import {
+  COMPANION_FOR_PRODUCER,
+  __resetCustomCompanionTargetsForTest,
+  companionForProducer,
+  isProducerCompanion,
+  setCustomCompanionTargets,
+} from '~/utils/catalog'
+
+// The SPA half of the companion registry. A companion is not a placeable palette block: the
+// builder renders it as an "add companion" toggle ON its producer and inserts it immediately
+// after. These two lookups are what decide that, so a deployment's registered pair is either
+// visible as a toggle or invisible entirely, with nothing in between.
+//
+// The backend half is `extension-registries.companions.test.ts`. Both are needed: the backend
+// enforces the adjacency rule on save, and this decides whether a person can ever express the
+// pairing in the first place.
+
+afterEach(() => {
+  __resetCustomCompanionTargetsForTest()
+})
+
+describe('custom companion pairings in the palette', () => {
+  it('has no opinion about a deployment’s pair until the store projects it', () => {
+    // The pre-registration state is a real one: the snapshot arrives after first paint, and a
+    // custom companion must degrade to an ordinary kind rather than to a broken toggle.
+    expect(isProducerCompanion('acme:migration-auditor')).toBe(false)
+    expect(companionForProducer('acme:migrator')).toBeUndefined()
+  })
+
+  it('renders a registered pair as a toggle on its producer', () => {
+    setCustomCompanionTargets({ 'acme:migration-auditor': ['acme:migrator'] })
+    expect(companionForProducer('acme:migrator')).toBe('acme:migration-auditor')
+    // ...and the companion itself leaves the palette, which is the other half of "it is a
+    // toggle, not a block". Registering only one of these would show the kind twice.
+    expect(isProducerCompanion('acme:migration-auditor')).toBe(true)
+    // The producer is not a companion just for being reviewed by one.
+    expect(isProducerCompanion('acme:migrator')).toBe(false)
+  })
+
+  it('lets one companion review several producers', () => {
+    setCustomCompanionTargets({ 'acme:auditor': ['acme:migrator', 'acme:packager'] })
+    expect(companionForProducer('acme:migrator')).toBe('acme:auditor')
+    expect(companionForProducer('acme:packager')).toBe('acme:auditor')
+  })
+
+  it('never lets a deployment re-point a BUILT-IN producer at its own companion', () => {
+    // Built-ins win, matching `agentKindMeta`'s precedence and the backend registry's refusal to
+    // shadow a built-in kind. The shipped pairing is what every stock pipeline relies on, so a
+    // silent re-point would change what those pipelines do without anyone editing them.
+    setCustomCompanionTargets({ 'acme:reviewer': ['coder'] })
+    expect(companionForProducer('coder')).toBe(COMPANION_FOR_PRODUCER.coder)
+    // The custom kind still leaves the palette: it IS a companion, it just does not get `coder`.
+    expect(isProducerCompanion('acme:reviewer')).toBe(true)
+  })
+
+  it('resolves a contested producer deterministically, first registration winning', () => {
+    // Only one toggle can hang off a producer, so two companions claiming it is a case with an
+    // answer whether or not anyone chose one. Pinning it here is what keeps the answer from
+    // being "whichever the object happened to enumerate first".
+    const contested: Record<string, readonly AgentKind[]> = {
+      'acme:first': ['acme:migrator'],
+      'acme:second': ['acme:migrator'],
+    }
+    setCustomCompanionTargets(contested)
+    expect(companionForProducer('acme:migrator')).toBe('acme:first')
+    expect(isProducerCompanion('acme:second')).toBe(true)
+  })
+
+  it('drops a pairing when the catalog it came from goes away', () => {
+    setCustomCompanionTargets({ 'acme:migration-auditor': ['acme:migrator'] })
+    expect(companionForProducer('acme:migrator')).toBe('acme:migration-auditor')
+    // A workspace switch re-projects an empty catalog. The lookups must follow it rather than
+    // keep answering from the old deployment's registrations.
+    setCustomCompanionTargets({})
+    expect(companionForProducer('acme:migrator')).toBeUndefined()
+    expect(isProducerCompanion('acme:migration-auditor')).toBe(false)
+  })
+})

package/app/utils/catalog.spec.ts

@@ -37,6 +37,7 @@ const AGENT_KINDS: AgentKind[] = [
   'business-reviewer',
   'human-test',
   'visual-confirmation',
+  'disposer',
 ]
 const BLOCK_TYPES: BlockType[] = [
   'frontend',

package/app/utils/catalog.ts

@@ -1,4 +1,4 @@
-import { shallowRef } from 'vue'
+import { computed, shallowRef } from 'vue'
 import type {
   AgentArchetype,
   AgentCategory,
@@ -228,6 +228,21 @@ export const AGENT_ARCHETYPES: AgentArchetype[] = [
     // recreate / destroy) instead of the generic prose step-detail panel.
     resultView: 'human-test',
   },
+  {
+    // The `deployer`'s counterpart at the other end of the environment lifecycle, and a PALETTE
+    // block rather than a system kind precisely because deciding WHEN the environment goes away
+    // is the point of it: after the automated tester, or after a human has finished with the live
+    // URL. Without one, the TTL sweep reclaims environments on a timer long after the run
+    // settled, which is a fine backstop and cannot close the run's own teardown proof.
+    kind: 'disposer',
+    tier: 'intermediate',
+    label: 'Disposer',
+    icon: 'i-lucide-cloud-off',
+    color: '#34d399',
+    category: 'test',
+    description:
+      'Reclaims the ephemeral environments this run provisioned, and confirms they are actually gone. Place it after the last step that needs the environment.',
+  },
   {
     kind: 'visual-confirmation',
     tier: 'advanced',
@@ -322,9 +337,13 @@ export const COMPANION_ARCHETYPES: AgentArchetype[] = [
 ]
 
 /**
- * Producer agent kind → its companion agent kind. Mirrors the backend `COMPANIONS` registry
- * (`@cat-factory/agents`). The builder shows an "add companion" toggle on a producer step
- * found here, and inserts/removes the companion immediately after it.
+ * Producer agent kind → its companion agent kind, for the BUILT-IN pairs. Mirrors the backend
+ * `COMPANIONS` catalog (`@cat-factory/agents`). The builder shows an "add companion" toggle on
+ * a producer step found here, and inserts/removes the companion immediately after it.
+ *
+ * A DEPLOYMENT's own pair does not live here: it arrives on the snapshot as a custom agent
+ * kind carrying `companionTargets`, and is projected into {@link customCompanionTargets} by the
+ * agents store. Both are consulted below, built-ins first.
  */
 export const COMPANION_FOR_PRODUCER: Record<string, AgentKind> = {
   coder: 'reviewer',
@@ -335,18 +354,67 @@ export const COMPANION_FOR_PRODUCER: Record<string, AgentKind> = {
 
 const COMPANION_KINDS: ReadonlySet<string> = new Set(COMPANION_ARCHETYPES.map((a) => a.kind))
 
-/** The companion kind that depends on a producer kind, or undefined if it has none. */
+/**
+ * Reactive read-model of the deployment's CUSTOM companion pairings (companion kind → the
+ * producer kinds it reviews), kept in sync by the agents store from the snapshot's
+ * `customAgentKinds[].companionTargets`.
+ *
+ * A `shallowRef` for the same reason {@link customAgentKindMeta} is one: the pure lookups below
+ * must resolve a registered companion, and re-render when the catalog changes, without importing
+ * the store (circular) or mutating the frozen built-in map. Empty until the store first
+ * populates it, so a custom companion degrades to "not a companion" (an ordinary palette block),
+ * exactly as before registration.
+ */
+const customCompanionTargets = shallowRef<Record<string, readonly AgentKind[]>>({})
+
+/**
+ * The same projection INVERTED: producer kind → the companion that reviews it, the direction
+ * {@link companionForProducer} actually asks in. Derived rather than scanned per call, because
+ * that lookup runs once per step of every pipeline the builder renders.
+ *
+ * Inverting is also where an ambiguity has to be RESOLVED rather than left to iteration order:
+ * two registered companions may both claim a producer, and only one toggle can hang off it.
+ * First registration wins, stated here once, instead of "whichever `Object.entries` reached
+ * first" being the answer at each call site.
+ */
+const customCompanionByProducer = computed<Record<string, AgentKind>>(() => {
+  const out: Record<string, AgentKind> = {}
+  for (const [companion, targets] of Object.entries(customCompanionTargets.value)) {
+    for (const producer of targets) if (!(producer in out)) out[producer] = companion
+  }
+  return out
+})
+
+/** Replace the custom companion projection (called only by the agents store). */
+export function setCustomCompanionTargets(map: Record<string, readonly AgentKind[]>): void {
+  customCompanionTargets.value = map
+}
+
+/** Test-only: clear the custom companion projection so a spec starts from built-ins only. */
+export function __resetCustomCompanionTargetsForTest(): void {
+  customCompanionTargets.value = {}
+}
+
+/**
+ * The companion kind that depends on a producer kind, or undefined if it has none.
+ *
+ * Built-ins win. A deployment cannot re-point `coder` at its own reviewer by registering one,
+ * for the same reason `agentKindMeta`'s precedence puts built-ins first and the backend registry
+ * never shadows a built-in kind: the shipped pairing is the one the engine's own pipelines rely
+ * on, and a silent re-point would change what every stock pipeline does.
+ */
 export function companionForProducer(kind: string): AgentKind | undefined {
-  return COMPANION_FOR_PRODUCER[kind]
+  return COMPANION_FOR_PRODUCER[kind] ?? customCompanionByProducer.value[kind]
 }
 
 /**
  * Whether a kind is a dependent producer-companion (reviewer / architect-companion /
- * spec-companion) — rendered as a toggle on its producer, not a standalone palette block.
- * Distinct from `pipelineRender`'s `isCompanionKind`, which also counts the Tester's `fixer`.
+ * spec-companion, or a deployment's own): rendered as a toggle on its producer, not a
+ * standalone palette block. Distinct from `pipelineRender`'s `isCompanionKind`, which also
+ * counts the Tester's `fixer`.
  */
 export function isProducerCompanion(kind: string): boolean {
-  return COMPANION_KINDS.has(kind)
+  return COMPANION_KINDS.has(kind) || kind in customCompanionTargets.value
 }
 
 /**

package/i18n/locales/de.json

@@ -1533,6 +1533,12 @@
       "inherited": "vom Service geerbt",
       "frozen": "Eingefroren: der Agent hat gestartet"
     },
+    "taskTypeFields": {
+      "title": "Aufgabentyp-Felder",
+      "hint": "Die Antworten, die dieser Aufgabentyp benötigt. Fehlt eine Pflichtangabe, wird ein Lauf vor dem Start angehalten.",
+      "save": "Speichern",
+      "revert": "Zurücksetzen"
+    },
     "dependencies": {
       "title": "Hängt ab von",
       "hint": "Aufgaben, die gemergt sein müssen, bevor diese laufen kann. Das Run-Steuerelement bleibt gesperrt, bis jede Abhängigkeit erledigt ist.",
@@ -1979,7 +1985,12 @@
         "notRun": "nicht ausgeführt",
         "attempts": "Versuch {attempts} von {maxAttempts}",
         "omittedTestPaths": "{count} deklarierte Testdatei wurde vor dem Nachweis verworfen, daher wurde der Stand vor dem Fix aus einer unvollständigen Reproduktion aufgebaut. | {count} deklarierte Testdateien wurden vor dem Nachweis verworfen, daher wurde der Stand vor dem Fix aus einer unvollständigen Reproduktion aufgebaut."
-      }
+      },
+      "quorumProgress": "{recorded} von {required} Freigaben",
+      "quorumYours": "(deine ist gezählt)",
+      "quorumEditLocked": "Korrekturen sind möglich, sobald deine Freigabe dieses Gate auflöst. Bis dahin unverändert freigeben oder Änderungen anfordern.",
+      "notAnApprover": "Dieses Gate benennt, wer es auflösen darf, und du gehörst nicht dazu.",
+      "approverIdentityRequired": "Dieses Gate benennt, wer es auflösen darf; eine dieser Personen muss dafür angemeldet sein."
     },
     "inspector": {
       "frameStatus": {
@@ -4123,6 +4134,17 @@
       "hint": "Der Höchstumfang einer einzelnen Antwort dieses Agenten. Leer lassen heißt vom nächsthöheren Level erben, nicht das Limit aufheben. Der Wert eines Pipeline-Schritts sticht die Vorgabe des Workspace.",
       "inherits": "Übernommen",
       "inheritsValue": "Übernommen ({tokens})"
+    },
+    "gateConfig": {
+      "approversLabel": "Wer freigeben darf",
+      "roleAdmin": "Administratoren",
+      "roleMember": "Mitglieder",
+      "namedApproversLabel": "Benannte Freigebende",
+      "namedApproversPlaceholder": "Alle mit Schreibrecht",
+      "requiredApprovalsLabel": "Erforderliche Freigaben",
+      "requiredApprovalsHint": "Jeweils von einer anderen Person, bevor der Lauf fortgesetzt wird.",
+      "anyoneHint": "Alle, die dieses Board bearbeiten dürfen, können diesen Schritt freigeben.",
+      "gateParametersLabel": "Gate-Einstellungen"
     }
   },
   "agentPrompt": {
@@ -5561,6 +5583,11 @@
         "title": "Keine Erfolgskriterien",
         "hint": "Nenne die Frage, die der Spike beantwortet, oder wie ein gutes Ergebnis aussieht, damit die Zeitbox ein Ziel hat."
       },
+      "required_field_missing": {
+        "title": "Fehlt: {field}",
+        "hint": "Dieser Aufgabentyp verlangt „{field}“, die Aufgabe beantwortet es aber nicht. Trage es an der Aufgabe nach und prüfe erneut.",
+        "unnamedField": "ein Pflichtfeld"
+      },
       "unknown": {
         "title": "Unbekannter Befund",
         "hint": "Dieser Lauf hat eine Prüfung erfasst, die diese Version nicht mehr kennt. Sieh die Aufgabe von Hand durch, bevor du fortfährst."
@@ -5914,6 +5941,7 @@
     "operation": {
       "provision": "Hochfahren",
       "teardown": "Abbauen",
+      "teardown-verify": "Abbau-Prüfung",
       "status": "Statusprüfung",
       "dispatch": "Hochfahren",
       "release": "Abbauen",