@cat-factory/app 0.225.0 → 0.227.0

package/app/components/settings/MergeRolePolicyEditor.vue

@@ -1,11 +1,12 @@
 <script setup lang="ts">
 // The ROLE layer of one merge preset: what happens to a run depending on WHO started it.
 //
-// Two settings, edited together because they answer the same question at two strengths. A role can
-// be held to stricter per-class rules than the preset's base map (`classRulesByRole`), or held to
-// dry runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing
-// merges. The second outranks the first, which is why a sandboxed role says so on its row rather
-// than leaving the class rules below reading as the policy.
+// Three settings, edited together because they answer the same question at three strengths. A role
+// can be held to stricter per-class rules than the preset's base map (`classRulesByRole`), held to
+// an allowlist of the change classes it may LAND at all (`submissionClassesByRole`), or held to dry
+// runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing merges.
+// The strongest of the three that applies is what governs, which is why a sandboxed role says so on
+// its row rather than leaving the two below it reading as the policy.
 //
 // Composition is NARROW-ONLY, so this editor only offers a role rules STRICTER than the base one
 // (see MergeRolePolicyEditor.logic.ts). A looser rule is discarded by the engine, and an editor
@@ -18,14 +19,19 @@ import type {
   MergeClassRule,
   MergeClassRules,
   RuleableChangeClass,
+  SubmissionClassesByRole,
   WorkspaceRole,
 } from '~/types/merge'
 import {
   INHERIT_RULE,
   roleClassRuleRows,
   roleNarrowedCount,
+  roleSubmissionRows,
+  roleSubmissionScoped,
   setRoleClassRule,
+  setRoleSubmissionScoped,
   toggleDryRunRole,
+  toggleSubmissionClass,
   type RoleRuleSelection,
 } from '~/components/settings/MergeRolePolicyEditor.logic'
 
@@ -34,6 +40,12 @@ const props = defineProps<{
   classRulesByRole: ClassRulesByRole
   /** The roles whose runs this preset sandboxes. */
   dryRunRoles: DryRunRoles
+  /**
+   * Which change classes each role may LAND. A role with no entry is unrestricted; an entry with
+   * no classes lands nothing. The editor keeps those two apart (a switch, then tick boxes),
+   * because tick boxes alone would render them identically.
+   */
+  submissionClassesByRole: SubmissionClassesByRole
   /** The base rules the role layer narrows, so each row can show what it inherits. */
   classRules: MergeClassRules
   /**
@@ -50,6 +62,7 @@ const props = defineProps<{
 const emit = defineEmits<{
   'update:classRulesByRole': [ClassRulesByRole]
   'update:dryRunRoles': [DryRunRoles]
+  'update:submissionClassesByRole': [SubmissionClassesByRole]
 }>()
 
 const { t } = useI18n()
@@ -92,6 +105,14 @@ const roles = computed(() =>
       sandboxed: props.dryRunRoles.includes(role),
       narrowed,
       open: !!expanded.value[role],
+      // Scoped-ness is read off the MAP rather than off the entry being truthy, so an empty
+      // allowlist (a real policy: this role lands nothing) stays scoped instead of reading as
+      // the unrestricted default.
+      submissionScoped: roleSubmissionScoped(props.submissionClassesByRole, role),
+      submissionRows: roleSubmissionRows(props.submissionClassesByRole[role] ?? []).map((row) => ({
+        ...row,
+        label: t(CLASS_LABEL_KEYS[row.changeClass]),
+      })),
       rows: roleClassRuleRows(props.classRules, entry).map((row) => ({
         ...row,
         label: t(CLASS_LABEL_KEYS[row.changeClass]),
@@ -118,6 +139,24 @@ function setSandboxed(role: WorkspaceRole, sandboxed: boolean) {
 function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: RoleRuleSelection) {
   emit('update:classRulesByRole', setRoleClassRule(props.classRulesByRole, role, changeClass, rule))
 }
+
+function setSubmissionScoped(role: WorkspaceRole, scoped: boolean) {
+  emit(
+    'update:submissionClassesByRole',
+    setRoleSubmissionScoped(props.submissionClassesByRole, role, scoped),
+  )
+}
+
+function setSubmissionClass(
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  allowed: boolean,
+) {
+  emit(
+    'update:submissionClassesByRole',
+    toggleSubmissionClass(props.submissionClassesByRole, role, changeClass, allowed),
+  )
+}
 </script>
 
 <template>
@@ -129,8 +168,9 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
       <p class="mt-0.5 text-[11px] leading-snug text-slate-500">
         {{ t('settings.riskPolicy.roleRules.help') }}
       </p>
-      <!-- Auto-merge off already sends every pull request to a human, so only the sandbox half of
-           this editor still changes anything (it refuses the manual merge as well). -->
+      <!-- Auto-merge off already sends every pull request to a human, so the per-class narrowing
+           has nothing left to subtract. The other two settings still bite, because both refuse the
+           MANUAL merge as well, which is the one thing the master switch leaves open. -->
       <p
         v-if="!autoMergeEnabled"
         class="mt-1 text-[11px] leading-snug text-amber-400/90"
@@ -174,11 +214,20 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
                 )
           }}
         </UButton>
+        <!-- A collapsed group must not hide an active policy: the tally above counts class rules
+             only, and a role can land nothing at all while showing "No class limits". -->
+        <span
+          v-if="group.submissionScoped"
+          class="text-[11px] text-amber-400/90"
+          :data-testid="`merge-role-submission-badge-${group.role}`"
+        >
+          {{ t('settings.riskPolicy.roleRules.submissionBadge') }}
+        </span>
       </div>
 
-      <!-- A sandboxed role merges nothing at all, so the class rules below cannot make its runs
-           any stricter. They stay editable (removing the sandbox brings them straight back) and
-           the row says which of the two is actually governing. -->
+      <!-- A sandboxed role merges nothing at all, so neither limit below can make its runs any
+           stricter. Both stay editable (removing the sandbox brings them straight back) and the
+           row says which of the three is actually governing. -->
       <p
         v-if="group.sandboxed"
         class="mt-1 text-[11px] leading-snug text-amber-400/90"
@@ -187,38 +236,83 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
         {{ t('settings.riskPolicy.roleRules.sandboxNote') }}
       </p>
 
-      <div v-if="group.open" class="mt-2 space-y-1.5 border-t border-slate-800 pt-2">
-        <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
-          {{ t('settings.riskPolicy.roleRules.baseHint') }}
-        </p>
-        <div
-          v-for="row in group.rows"
-          :key="row.changeClass"
-          class="flex flex-wrap items-center gap-2"
-          :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
-        >
-          <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
-          <USelect
-            :model-value="row.selected"
-            :items="row.items"
-            value-key="value"
+      <div v-if="group.open" class="mt-2 space-y-2 border-t border-slate-800 pt-2">
+        <!-- What this role may LAND at all. Above the class rules because it outranks them: a
+             class can be auto-mergeable under the rules and still outside this list, and then
+             nothing merges, through the review card's own button included. -->
+        <div class="space-y-1.5">
+          <USwitch
+            :model-value="group.submissionScoped"
             size="sm"
-            class="w-52"
-            :disabled="disabled || row.items.length === 1"
-            :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
-            @update:model-value="setRule(group.role, row.changeClass, $event as RoleRuleSelection)"
+            :disabled="disabled"
+            :label="t('settings.riskPolicy.roleRules.submissionLabel')"
+            :data-testid="`merge-role-submission-${group.role}`"
+            @update:model-value="setSubmissionScoped(group.role, $event)"
           />
-          <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
-          <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
-            {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
-          </span>
-          <span
-            v-else-if="row.redundant"
-            class="text-[11px] text-amber-400/90"
-            :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+          <p class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.submissionHelp') }}
+          </p>
+          <div v-if="group.submissionScoped" class="flex flex-wrap gap-x-4 gap-y-1">
+            <UCheckbox
+              v-for="row in group.submissionRows"
+              :key="row.changeClass"
+              :model-value="row.allowed"
+              size="sm"
+              :disabled="disabled"
+              :label="row.label"
+              :data-testid="`merge-role-submission-class-${group.role}-${row.changeClass}`"
+              @update:model-value="setSubmissionClass(group.role, row.changeClass, $event === true)"
+            />
+          </div>
+          <!-- An empty allowlist is a real policy, not an unfinished edit, so it says what it
+               does rather than reading as a switch somebody forgot to fill in. -->
+          <p
+            v-if="group.submissionScoped && !group.submissionRows.some((r) => r.allowed)"
+            class="text-[11px] leading-snug text-amber-400/90"
+            :data-testid="`merge-role-submission-none-${group.role}`"
+          >
+            {{ t('settings.riskPolicy.roleRules.submissionNone') }}
+          </p>
+        </div>
+
+        <div class="space-y-1.5 border-t border-slate-800/70 pt-2">
+          <p class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.classHeading') }}
+          </p>
+          <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.baseHint') }}
+          </p>
+          <div
+            v-for="row in group.rows"
+            :key="row.changeClass"
+            class="flex flex-wrap items-center gap-2"
+            :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
           >
-            {{ t('settings.riskPolicy.roleRules.redundant') }}
-          </span>
+            <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
+            <USelect
+              :model-value="row.selected"
+              :items="row.items"
+              value-key="value"
+              size="sm"
+              class="w-52"
+              :disabled="disabled || row.items.length === 1"
+              :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
+              @update:model-value="
+                setRule(group.role, row.changeClass, $event as RoleRuleSelection)
+              "
+            />
+            <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
+            <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
+              {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
+            </span>
+            <span
+              v-else-if="row.redundant"
+              class="text-[11px] text-amber-400/90"
+              :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+            >
+              {{ t('settings.riskPolicy.roleRules.redundant') }}
+            </span>
+          </div>
         </div>
       </div>
     </div>

package/app/components/settings/RiskPolicyPanel.vue

@@ -11,6 +11,7 @@ import type {
   MergeClassRules,
   RiskPolicy,
   RequirementConcernLevel,
+  SubmissionClassesByRole,
 } from '~/types/merge'
 import type { StepGating } from '@cat-factory/contracts'
 import {
@@ -90,6 +91,9 @@ interface Draft {
   // which is why clearing one in the editor is a plain omission.
   classRulesByRole: ClassRulesByRole
   dryRunRoles: DryRunRoles
+  // Which classes each role may LAND at all. A role with no entry is unrestricted, so `{}` is the
+  // identity; an entry with no classes is the different policy that the role lands nothing.
+  submissionClassesByRole: SubmissionClassesByRole
   // Implementation-fork decision gating (edited 0..100, stored 0..1); disabled ⇒ off in `auto`.
   forkEnabled: boolean
   forkMinComplexity: number
@@ -129,6 +133,7 @@ function toDraft(p: RiskPolicy): Draft {
     classRules: { ...p.classRules },
     classRulesByRole: { ...p.classRulesByRole },
     dryRunRoles: [...p.dryRunRoles],
+    submissionClassesByRole: { ...p.submissionClassesByRole },
     forkEnabled: p.forkDecision?.enabled ?? false,
     forkMinComplexity: Math.round((p.forkDecision?.minComplexity ?? 0.5) * 100),
     forkMinRisk: Math.round((p.forkDecision?.minRisk ?? 0.4) * 100),
@@ -174,6 +179,7 @@ async function save(p: RiskPolicy) {
       classRules: d.classRules,
       classRulesByRole: d.classRulesByRole,
       dryRunRoles: d.dryRunRoles,
+      submissionClassesByRole: d.submissionClassesByRole,
       forkDecision: forkGating(d),
     })
     toast.add({
@@ -235,6 +241,7 @@ const draft = reactive<Draft>({
   classRules: {},
   classRulesByRole: {},
   dryRunRoles: [],
+  submissionClassesByRole: {},
   forkEnabled: false,
   forkMinComplexity: 50,
   forkMinRisk: 40,
@@ -395,6 +402,7 @@ async function create() {
         <MergeRolePolicyEditor
           v-model:class-rules-by-role="drafts[p.id]!.classRulesByRole"
           v-model:dry-run-roles="drafts[p.id]!.dryRunRoles"
+          v-model:submission-classes-by-role="drafts[p.id]!.submissionClassesByRole"
           :class-rules="drafts[p.id]!.classRules"
           :auto-merge-enabled="drafts[p.id]!.autoMergeEnabled"
           :disabled="busy === p.id"

package/app/composables/usePipelineErrorToast.ts

@@ -117,6 +117,10 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
     titleKey: 'errors.conflict.title.dry_run_not_mergeable',
     descriptionKey: 'errors.conflict.description.dry_run_not_mergeable',
   },
+  submission_not_allowed: {
+    titleKey: 'errors.conflict.title.submission_not_allowed',
+    descriptionKey: 'errors.conflict.description.submission_not_allowed',
+  },
   github_not_connected: {
     titleKey: 'errors.conflict.title.github_not_connected',
     descriptionKey: 'errors.conflict.description.github_not_connected',

package/app/types/merge.ts

@@ -16,6 +16,8 @@ export type {
   // runs are sandboxed (they open a pull request and merge nothing).
   ClassRulesByRole,
   DryRunRoles,
+  // Which change classes a role may LAND at all (absent ⇒ unrestricted, empty ⇒ nothing).
+  SubmissionClassesByRole,
   WorkspaceRole,
   MergeTrackRecord,
   ReviewEffort,

package/app/utils/riskPolicy.spec.ts

@@ -27,6 +27,7 @@ const policy = (over: Partial<RiskPolicy> = {}): RiskPolicy =>
     classRules: {},
     classRulesByRole: {},
     dryRunRoles: [],
+    submissionClassesByRole: {},
     isDefault: true,
     version: 1,
     createdAt: 0,
@@ -61,7 +62,7 @@ describe('riskPolicyCeilings', () => {
 
 describe('rolePolicySummary', () => {
   it('is empty on a policy that treats every initiator alike', () => {
-    expect(rolePolicySummary(policy())).toEqual({ sandboxed: [], narrowed: [] })
+    expect(rolePolicySummary(policy())).toEqual({ sandboxed: [], narrowed: [], scoped: [] })
   })
 
   it('lists both layers in the shared role order', () => {
@@ -72,6 +73,7 @@ describe('rolePolicySummary', () => {
     expect(rolePolicySummary(p)).toEqual({
       sandboxed: ['member', 'viewer'],
       narrowed: ['admin'],
+      scoped: [],
     })
   })
 
@@ -79,6 +81,23 @@ describe('rolePolicySummary', () => {
   // limit that changes nothing about what that role's runs can do.
   it('does not also report class rules for a role the policy sandboxes', () => {
     const p = policy({ dryRunRoles: ['member'], classRulesByRole: { member: { docs: 'never' } } })
-    expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [] })
+    expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [], scoped: [] })
+  })
+
+  it('lists a role allowlisted to a subset of change classes', () => {
+    const p = policy({ submissionClassesByRole: { member: ['docs'] } })
+    expect(rolePolicySummary(p)).toEqual({ sandboxed: [], narrowed: [], scoped: ['member'] })
+  })
+
+  // The most restrictive policy this setting can express, and the one a summary must not drop:
+  // an EMPTY allowlist is scoped, where an absent entry is unrestricted.
+  it('lists a role allowlisted to NOTHING', () => {
+    const p = policy({ submissionClassesByRole: { viewer: [] } })
+    expect(rolePolicySummary(p).scoped).toEqual(['viewer'])
+  })
+
+  it('does not also report an allowlist for a role the policy sandboxes', () => {
+    const p = policy({ dryRunRoles: ['member'], submissionClassesByRole: { member: ['docs'] } })
+    expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [], scoped: [] })
   })
 })

package/app/utils/riskPolicy.ts

@@ -52,6 +52,12 @@ export interface RolePolicySummary {
    * both would read as two limits where the second changes nothing.
    */
   narrowed: WorkspaceRole[]
+  /**
+   * Roles allowlisted to a subset of change classes they may LAND. Same suppression rule as
+   * `narrowed` and for the same reason, and listed SEPARATELY from it because the two are not
+   * degrees of one setting: this one bars landing outright, including through the manual merge.
+   */
+  scoped: WorkspaceRole[]
 }
 
 /**
@@ -66,5 +72,11 @@ export function rolePolicySummary(p: RiskPolicy): RolePolicySummary {
     narrowed: WORKSPACE_ROLES.filter(
       (role) => !sandboxed.includes(role) && Object.keys(p.classRulesByRole[role] ?? {}).length > 0,
     ),
+    // Scoped-ness is the PRESENCE of an entry, never its length: a role allowlisted to nothing
+    // is the most restrictive policy this setting can express, and reading it as "no allowlist"
+    // would drop the one summary line a reader most needs to see.
+    scoped: WORKSPACE_ROLES.filter(
+      (role) => !sandboxed.includes(role) && p.submissionClassesByRole[role] !== undefined,
+    ),
   }
 }

package/i18n/locales/de.json

@@ -525,10 +525,15 @@
       },
       "roleRules": {
         "heading": "Grenzen je startender Rolle",
-        "help": "Was ein Lauf darf, hängt auch davon ab, wer ihn gestartet hat. Eine Rolle kann strengeren Regeln als den obigen unterliegen oder nur Probeläufe machen: Die Pipeline arbeitet und öffnet einen Pull Request, zusammengeführt wird nichts. Eine Rolle kann diese Richtlinie nur verschärfen, nie lockern.",
-        "autoMergeOffWarning": "Für diese Vorlage ist das automatische Zusammenführen aus, jeder Pull Request geht also ohnehin an einen Menschen und die Kategoriegrenzen unten ändern nichts mehr. Probeläufe gelten weiterhin: Sie verweigern auch das manuelle Zusammenführen.",
+        "help": "Was ein Lauf darf, hängt auch davon ab, wer ihn gestartet hat. Eine Rolle kann auf bestimmte Änderungsarten beschränkt, an strengere Regeln als die obigen gebunden oder auf Probeläufe begrenzt werden: Die Pipeline arbeitet und öffnet einen Pull Request, zusammengeführt wird nichts. Eine Rolle kann diese Richtlinie nur einschränken, nie erweitern.",
+        "autoMergeOffWarning": "Automatisches Zusammenführen ist für diese Vorlage aus, daher geht ohnehin jeder Pull Request an einen Menschen und die Klassenlimits unten bewirken nichts. Die Merge-Beschränkung und Probeläufe gelten weiterhin: Beide verweigern auch das manuelle Zusammenführen.",
         "sandboxLabel": "Nur Probeläufe",
-        "sandboxNote": "Läufe dieser Rolle öffnen einen Pull Request und führen nichts zusammen, die Kategorieregeln unten können sie also nicht weiter einschränken.",
+        "sandboxNote": "Läufe dieser Rolle öffnen einen Pull Request und führen nichts zusammen, daher kann keine der Beschränkungen unten sie strenger halten.",
+        "submissionLabel": "Einschränken, welche Änderungen diese Rolle zusammenführen darf",
+        "submissionHelp": "Wenn aktiv, werden bei Läufen dieser Rolle nur die angehakten Änderungsarten zusammengeführt. Alles andere bleibt für jemand anderen offen, unabhängig von den Bewertungen. Der Pull Request wird trotzdem geöffnet und kann auf dem Git-Host von Hand zusammengeführt werden.",
+        "submissionNone": "Nichts ist angehakt, also führt dieser Arbeitsbereich keinen Lauf dieser Rolle zusammen.",
+        "submissionBadge": "Zusammenführen beschränkt",
+        "classHeading": "Erforderliche Prüfung je Änderungsart",
         "noRules": "Keine Kategoriegrenzen",
         "ruleCount": "{count} Kategorie eingeschränkt | {count} Kategorien eingeschränkt",
         "inherit": "Wie in dieser Richtlinie",
@@ -1800,6 +1805,7 @@
         "class_auto_merge": "Diese Vorlage führt diese Änderungskategorie immer automatisch zusammen, daher wurden die Bewertungen nicht verglichen.",
         "class_requires_review": "Diese Vorlage gibt diese Änderungskategorie unabhängig von den Bewertungen immer an einen Menschen.",
         "role_requires_review": "Diese Vorgabe lässt Läufe, die ein {role} startet, für diese Art von Änderung unabhängig von den Bewertungen immer von einem Menschen prüfen. Ein Teammitglied mit höherer Berechtigung kann diesen PR unverändert zusammenführen.",
+        "submission_not_allowed": "Diese Vorlage lässt Läufe, die von {role} gestartet wurden, nur diese Änderungsarten zusammenführen: {classes}. Dies ist eine andere Art, daher wartet der Pull Request auf jemanden, dessen Rolle ihn zusammenführen darf.",
         "dry_run": "Dies war ein Probelauf, daher blieb der Pull Request für einen Menschen offen und die Bewertungen wurden nicht verglichen. Starte die Aufgabe erneut als echten Lauf, um einen Pull Request zu erzeugen, den dieser Arbeitsbereich zusammenführt."
       },
       "scores": "Bewertungen",
@@ -1811,7 +1817,8 @@
       "ceiling": "Obergrenze {value}",
       "rationale": "Begründung",
       "noAssessment": "Der Merger hat keine bewertete Einschätzung zurückgegeben.",
-      "noResult": "Noch keine Merge-Entscheidung aufgezeichnet."
+      "noResult": "Noch keine Merge-Entscheidung aufgezeichnet.",
+      "noSubmittableClasses": "keine"
     },
     "testReport": {
       "title": "Testbericht",
@@ -5271,7 +5278,8 @@
         "input_gate_parked": "Über die Eingabeprüfung der Aufgabe beantworten",
         "ticket_already_linked": "Dieses Ticket hat bereits eine Aufgabe",
         "document_already_linked": "Dokument bereits angehängt",
-        "dry_run_not_mergeable": "Probelauf kann nicht zusammengeführt werden"
+        "dry_run_not_mergeable": "Probelauf kann nicht zusammengeführt werden",
+        "submission_not_allowed": "Zusammenführen für diesen Lauf nicht erlaubt"
       },
       "description": {
         "dependencies_unmet": "Diese Aufgabe hängt von anderen ab, die noch nicht abgeschlossen sind. Schließe sie ab oder gib sie frei und starte dann erneut.",
@@ -5308,7 +5316,8 @@
         "input_gate_parked": "Dieser Lauf wartet auf seine Eingabeprüfung, die über die Freigabe nicht beantwortet werden kann. Nutzen Sie den Hinweis am Lauf: Aufgabe ergänzen und erneut prüfen, oder trotzdem ausführen.",
         "ticket_already_linked": "Ein Ticket kann nur eine Aufgabe stützen. Es erneut zu verknüpfen würde der bestehenden Aufgabe genau den Kontext entziehen, mit dem sie angelegt wurde. Öffne stattdessen diese Aufgabe oder hebe die Verknüpfung des Tickets zuerst auf.",
         "document_already_linked": "Dieses Dokument ist an eine andere Aufgabe angehängt. Lösen Sie es dort zuerst, oder hängen Sie eine separate Kopie an.",
-        "dry_run_not_mergeable": "Dieser Pull Request stammt aus einem Probelauf und kann hier nicht zusammengeführt werden. Starte die Aufgabe erneut als echten Lauf, um einen Pull Request zu erzeugen, den dieser Arbeitsbereich zusammenführt."
+        "dry_run_not_mergeable": "Dieser Pull Request stammt aus einem Probelauf und kann hier nicht zusammengeführt werden. Starte die Aufgabe erneut als echten Lauf, um einen Pull Request zu erzeugen, den dieser Arbeitsbereich zusammenführt.",
+        "submission_not_allowed": "Die Merge-Richtlinie dieser Aufgabe erlaubt der Rolle, die diesen Lauf gestartet hat, diese Änderungsart nicht zusammenzuführen. Jemand mit einer passenden Rolle kann es tun, oder ein Admin erweitert die Richtlinie in der Merge-Vorlage."
       },
       "action": {
         "connectGitHub": "GitHub verbinden",
@@ -6156,7 +6165,12 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Gilt, weil diese Aufgabe keine eigene Richtlinie wählt.",
-      "noneHint": "Keine Risikorichtlinie konfiguriert. Jeder Pull Request wartet auf eine menschliche Prüfung."
+      "noneHint": "Keine Risikorichtlinie konfiguriert. Jeder Pull Request wartet auf eine menschliche Prüfung.",
+      "refused": {
+        "relaxes_role_sandbox": "Für deine Rolle nicht verfügbar: Läufe dieser Aufgabe laufen in der Sandbox, und diese Richtlinie würde sie mergen lassen. Eine Workspace-Administration kann das ändern.",
+        "relaxes_role_submission_allowlist": "Für deine Rolle nicht verfügbar: Diese Richtlinie würde dich Änderungsarten mergen lassen, die dir bei dieser Aufgabe verwehrt sind. Eine Workspace-Administration kann das ändern.",
+        "relaxes_role_class_rule": "Für deine Rolle nicht verfügbar: Diese Richtlinie merged Änderungen automatisch, die du bei dieser Aufgabe prüfen musst. Eine Workspace-Administration kann das ändern."
+      }
     },
     "preview": {
       "defaultBadge": "Standard",
@@ -6174,6 +6188,7 @@
       "ciAttempts": "Der Lauf darf {count} Mal versuchen, eine rote CI grün zu bekommen, bevor er aufgibt. | Der Lauf darf {count} Mal versuchen, eine rote CI grün zu bekommen, bevor er aufgibt.",
       "roleHeading": "Wer den Lauf gestartet hat",
       "roleSandboxed": "Läufe von {roles} öffnen einen Pull Request und werden nie zusammengeführt.",
+      "roleScoped": "Läufe von {roles} führen nur bestimmte Änderungsarten zusammen.",
       "roleNarrowed": "Für Läufe von {roles} gelten in einigen Änderungskategorien strengere Regeln."
     }
   },

package/i18n/locales/en.json

@@ -644,7 +644,8 @@
         "input_gate_parked": "Answer it in the task's input check",
         "ticket_already_linked": "This issue already has a task",
         "document_already_linked": "Document already attached",
-        "dry_run_not_mergeable": "Dry run cannot be merged"
+        "dry_run_not_mergeable": "Dry run cannot be merged",
+        "submission_not_allowed": "Merge not allowed for this run"
       },
       "description": {
         "dependencies_unmet": "This task depends on others that aren't finished yet. Complete or unblock them, then start it again.",
@@ -684,7 +685,8 @@
         "input_gate_parked": "This run is parked on its input check, which the approval rail cannot answer. Use the notice on the run: fix the task and re-check, or run it anyway.",
         "ticket_already_linked": "An issue can back only one task, so linking it again would strip the existing task of the context it was created with. Open that task instead, or unlink the issue first.",
         "document_already_linked": "That document is attached to another task. Detach it there first, or attach a separate copy.",
-        "dry_run_not_mergeable": "This pull request came from a dry run, so it can't be merged from here. Start the task again as a live run to produce a pull request this workspace will merge."
+        "dry_run_not_mergeable": "This pull request came from a dry run, so it can't be merged from here. Start the task again as a live run to produce a pull request this workspace will merge.",
+        "submission_not_allowed": "This task's merge policy doesn't let the role that started this run merge this kind of change. Somebody whose role may merge it can do so, or an admin can widen the policy in the merge preset."
       },
       "action": {
         "connectGitHub": "Connect GitHub",
@@ -1354,6 +1356,7 @@
         "class_auto_merge": "This preset always auto-merges this class of change, so the scores were not compared.",
         "class_requires_review": "This preset always sends this class of change to a human, whatever the scores.",
         "role_requires_review": "This preset holds runs started by a {role} to human review for this class of change, whatever the scores. A teammate on a higher tier can merge this PR as it stands.",
+        "submission_not_allowed": "This preset lets runs started by a {role} merge only these kinds of change: {classes}. This one is a different kind, so the pull request is waiting for somebody whose role may merge it.",
         "dry_run": "This was a dry run, so the pull request was left open for a human and the scores were not compared. Start the task again as a live run to produce a pull request this workspace will merge."
       },
       "scores": "Scores",
@@ -1365,7 +1368,11 @@
       "ceiling": "ceiling {value}",
       "rationale": "Rationale",
       "noAssessment": "The merger did not return a scored assessment.",
-      "noResult": "No merge decision recorded yet."
+      "noResult": "No merge decision recorded yet.",
+      "noSubmittableClasses": "none",
+      "@noSubmittableClasses": {
+        "description": "Substituted into the {classes} slot of `reason.submission_not_allowed` when the role's allowlist is empty, so it reads as a list with no members ('...only these kinds of change: none'), NOT as a standalone sentence or an absence of policy."
+      }
     },
     "testReport": {
       "title": "Test report",
@@ -3013,10 +3020,15 @@
       },
       "roleRules": {
         "heading": "Limits per initiator role",
-        "help": "What a run may do also depends on who started it. A role can be held to stricter rules than the ones above, or to dry runs only: the pipeline works and opens a pull request, and nothing merges. A role can only narrow this policy, never widen it.",
-        "autoMergeOffWarning": "Auto-merge is off for this preset, so every pull request already goes to a human and the class limits below add nothing. Dry runs still apply: they refuse a manual merge too.",
+        "help": "What a run may do also depends on who started it. A role can be limited to merging only certain kinds of change, held to stricter rules than the ones above, or held to dry runs only: the pipeline works and opens a pull request, and nothing merges. A role can only narrow this policy, never widen it.",
+        "autoMergeOffWarning": "Auto-merge is off for this preset, so every pull request already goes to a human and the per-class limits below add nothing. The merge limit and dry runs still apply: both refuse a manual merge too.",
         "sandboxLabel": "Dry runs only",
-        "sandboxNote": "Runs started by this role open a pull request and merge nothing, so the class rules below cannot hold them to anything stricter.",
+        "sandboxNote": "Runs started by this role open a pull request and merge nothing, so neither limit below can hold them to anything stricter.",
+        "submissionLabel": "Limit which changes this role may merge",
+        "submissionHelp": "When on, only the ticked kinds of change are merged for runs this role starts. Anything else stays open for somebody else, whatever the scores say. The pull request is still opened, and it can still be merged by hand on the git host.",
+        "submissionNone": "Nothing is ticked, so this workspace will not merge any run this role starts.",
+        "submissionBadge": "Merge limited",
+        "classHeading": "Review required per class",
         "noRules": "No class limits",
         "ruleCount": "{count} class limited | {count} classes limited",
         "@ruleCount": {
@@ -4744,7 +4756,12 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Applied because this task picks no policy of its own.",
-      "noneHint": "No risk policy configured. Every pull request waits for a human review."
+      "noneHint": "No risk policy configured. Every pull request waits for a human review.",
+      "refused": {
+        "relaxes_role_sandbox": "Not available for your role: this task’s runs are sandboxed, and this policy would let them merge. A workspace admin can change it.",
+        "relaxes_role_submission_allowlist": "Not available for your role: this policy would let you land kinds of change this task holds you back from. A workspace admin can change it.",
+        "relaxes_role_class_rule": "Not available for your role: this policy auto-merges changes you are held to review on this task. A workspace admin can change it."
+      }
     },
     "preview": {
       "defaultBadge": "Default",
@@ -4762,6 +4779,7 @@
       "ciAttempts": "The run may try {count} time to turn a red CI green before it gives up. | The run may try {count} times to turn a red CI green before it gives up.",
       "roleHeading": "Who started the run",
       "roleSandboxed": "Runs started by {roles} open a pull request and never merge.",
+      "roleScoped": "Runs started by {roles} merge only some kinds of change.",
       "roleNarrowed": "Runs started by {roles} follow stricter rules for some change classes."
     }
   },