@cat-factory/app 0.226.0 → 0.227.0

package/app/components/panels/MergerResultView.vue

@@ -71,6 +71,7 @@ const REASON_KEYS: Record<MergeDecision['reason'], string> = {
   class_auto_merge: 'panels.mergerResult.reason.class_auto_merge',
   class_requires_review: 'panels.mergerResult.reason.class_requires_review',
   role_requires_review: 'panels.mergerResult.reason.role_requires_review',
+  submission_not_allowed: 'panels.mergerResult.reason.submission_not_allowed',
   dry_run: 'panels.mergerResult.reason.dry_run',
 }
 const OUTCOME_KEYS: Record<MergeDecision['outcome'], string> = {
@@ -152,6 +153,12 @@ const reasonText = computed(() => {
   return t(REASON_KEYS[d.reason], {
     preset: d.thresholds.presetName,
     axes: axisLabels,
+    // The classes the initiator's role MAY land, so the refusal names what the remedy is
+    // measured against. Empty is a real policy (that role lands nothing) and reads as such
+    // through its own translated phrase rather than as a blank in the middle of a sentence.
+    classes: d.thresholds.submissionClasses?.length
+      ? d.thresholds.submissionClasses.map((c) => t(CLASS_KEYS[c])).join(', ')
+      : t('panels.mergerResult.noSubmittableClasses'),
     // Never blank: a role-scoped reason is only ever produced for a run that pinned one, and the
     // fallback keeps the sentence readable rather than leaving a hole if that ever changes.
     role: d.thresholds.initiatorRole

package/app/components/riskPolicy/RiskPolicyPreview.vue

@@ -23,11 +23,12 @@ const ROLE_LABEL: Record<WorkspaceRole, () => string> = {
   viewer: () => t('merge.role.viewer'),
 }
 const roleLayer = computed(() => {
-  const { sandboxed, narrowed } = rolePolicySummary(props.policy)
+  const { sandboxed, narrowed, scoped } = rolePolicySummary(props.policy)
   return {
     sandboxed: sandboxed.map((r) => ROLE_LABEL[r]()).join(', '),
     narrowed: narrowed.map((r) => ROLE_LABEL[r]()).join(', '),
-    any: sandboxed.length > 0 || narrowed.length > 0,
+    scoped: scoped.map((r) => ROLE_LABEL[r]()).join(', '),
+    any: sandboxed.length > 0 || narrowed.length > 0 || scoped.length > 0,
   }
 })
 
@@ -94,6 +95,9 @@ const ceilings = computed(() =>
       <p v-if="roleLayer.sandboxed" class="text-[12px] leading-snug text-slate-400">
         {{ t('riskPolicy.preview.roleSandboxed', { roles: roleLayer.sandboxed }) }}
       </p>
+      <p v-if="roleLayer.scoped" class="text-[12px] leading-snug text-slate-400">
+        {{ t('riskPolicy.preview.roleScoped', { roles: roleLayer.scoped }) }}
+      </p>
       <p v-if="roleLayer.narrowed" class="text-[12px] leading-snug text-slate-400">
         {{ t('riskPolicy.preview.roleNarrowed', { roles: roleLayer.narrowed }) }}
       </p>

package/app/components/settings/MergeRolePolicyEditor.logic.spec.ts

@@ -1,13 +1,17 @@
 import { describe, expect, it } from 'vitest'
-import { MERGE_CLASS_RULES } from '@cat-factory/contracts'
-import type { ClassRulesByRole, MergeClassRules } from '~/types/merge'
+import { MERGE_CLASS_RULES, RULEABLE_CHANGE_CLASSES } from '@cat-factory/contracts'
+import type { ClassRulesByRole, MergeClassRules, SubmissionClassesByRole } from '~/types/merge'
 import {
   INHERIT_RULE,
   narrowingOptionsFor,
   roleClassRuleRows,
   roleNarrowedCount,
+  roleSubmissionRows,
+  roleSubmissionScoped,
   setRoleClassRule,
+  setRoleSubmissionScoped,
   toggleDryRunRole,
+  toggleSubmissionClass,
 } from '~/components/settings/MergeRolePolicyEditor.logic'
 
 describe('narrowingOptionsFor', () => {
@@ -144,3 +148,62 @@ describe('roleNarrowedCount', () => {
     expect(roleNarrowedCount({ docs: 'never', source: 'never' })).toBe(2)
   })
 })
+
+// The submission allowlist's editing shape turns on one distinction the wire contract makes and a
+// tick-box grid cannot render on its own: an ABSENT entry (unrestricted) and an EMPTY list (lands
+// nothing) are different policies. Every case below is about keeping those two apart.
+describe('roleSubmissionScoped', () => {
+  it('reads an EMPTY allowlist as scoped, not as the unrestricted default', () => {
+    expect(roleSubmissionScoped({ member: [] }, 'member')).toBe(true)
+    expect(roleSubmissionScoped({ member: ['docs'] }, 'member')).toBe(true)
+  })
+
+  it('reads a role with no entry as unrestricted', () => {
+    expect(roleSubmissionScoped({ member: ['docs'] }, 'admin')).toBe(false)
+    expect(roleSubmissionScoped({}, 'member')).toBe(false)
+  })
+})
+
+describe('roleSubmissionRows', () => {
+  it('renders one row per ruleable class, in the shared order, ticked by membership', () => {
+    const rows = roleSubmissionRows(['source', 'docs'])
+    expect(rows.map((r) => r.changeClass)).toEqual([...RULEABLE_CHANGE_CLASSES])
+    expect(rows.filter((r) => r.allowed).map((r) => r.changeClass)).toEqual(['docs', 'source'])
+  })
+})
+
+describe('setRoleSubmissionScoped', () => {
+  // Turning the switch ON must not silently impose a policy nobody clicked: seeding today's
+  // landable classes leaves the role exactly where it was, and the operator subtracts from there.
+  it('seeds every class when scoping is turned on', () => {
+    expect(setRoleSubmissionScoped({}, 'member', true).member).toEqual([...RULEABLE_CHANGE_CLASSES])
+  })
+
+  it('removes the entry entirely when scoping is turned off', () => {
+    const byRole: SubmissionClassesByRole = { member: [], admin: ['docs'] }
+    const next = setRoleSubmissionScoped(byRole, 'member', false)
+    expect('member' in next).toBe(false)
+    expect(next.admin).toEqual(['docs'])
+  })
+})
+
+describe('toggleSubmissionClass', () => {
+  it('adds and removes one class, keeping the shared class order', () => {
+    const ticked = toggleSubmissionClass({ member: ['source'] }, 'member', 'docs', true)
+    expect(ticked.member).toEqual(['docs', 'source'])
+    expect(toggleSubmissionClass(ticked, 'member', 'source', false).member).toEqual(['docs'])
+  })
+
+  // Unticking the last class is the policy "this role lands nothing", so it must NOT prune back
+  // to an absent entry, which would silently invert the click into "unrestricted".
+  it('leaves an EMPTY list rather than un-scoping the role', () => {
+    const next = toggleSubmissionClass({ member: ['docs'] }, 'member', 'docs', false)
+    expect(next.member).toEqual([])
+    expect(roleSubmissionScoped(next, 'member')).toBe(true)
+  })
+
+  it('leaves other roles untouched', () => {
+    const next = toggleSubmissionClass({ admin: ['docs'] }, 'member', 'docs', true)
+    expect(next.admin).toEqual(['docs'])
+  })
+})

package/app/components/settings/MergeRolePolicyEditor.logic.ts

@@ -23,6 +23,7 @@ import type {
   MergeClassRule,
   MergeClassRules,
   RuleableChangeClass,
+  SubmissionClassesByRole,
   WorkspaceRole,
 } from '~/types/merge'
 
@@ -131,3 +132,74 @@ export function toggleDryRunRole(
 export function roleNarrowedCount(entry: MergeClassRules | undefined): number {
   return entry ? Object.keys(entry).length : 0
 }
+
+// ---------------------------------------------------------------------------
+// The per-role SUBMISSION ALLOWLIST: which change classes a role may LAND at all. A third
+// setting rather than a fourth rule value, because it answers a different question: a class rule
+// decides how much review landing takes, where this decides whether the platform lands it at all,
+// and it is refused at BOTH exits, the manual merge included.
+//
+// The editing shape follows the wire shape's own distinction: an ABSENT entry is unrestricted
+// and an EMPTY list is "this role lands nothing", which are different policies. So the row is a
+// switch (scoped / not) plus a set of tick boxes, never a set of tick boxes alone. With tick
+// boxes alone, "unrestricted" and "lands nothing" would be the same rendered state.
+// ---------------------------------------------------------------------------
+
+/** One class's tick box inside one role's allowlist. */
+export interface RoleSubmissionRow {
+  changeClass: RuleableChangeClass
+  allowed: boolean
+}
+
+/** Whether this role carries an allowlist at all (as opposed to being unrestricted). */
+export function roleSubmissionScoped(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+): boolean {
+  return byRole[role] !== undefined
+}
+
+/** One role's tick boxes, in the shared class order. Empty rows for an unscoped role. */
+export function roleSubmissionRows(entry: readonly RuleableChangeClass[]): RoleSubmissionRow[] {
+  return RULEABLE_CHANGE_CLASSES.map((changeClass) => ({
+    changeClass,
+    allowed: entry.includes(changeClass),
+  }))
+}
+
+/**
+ * Turn the allowlist on or off for a role. Turning it ON seeds the classes that are landable
+ * TODAY, which is behaviourally where the role already was, so the operator subtracts from a
+ * known state rather than starting from a policy ("lands nothing") they did not ask for.
+ *
+ * That seeded list is NOT the identity, and deliberately: from here on the role is scoped, so a
+ * class the vocabulary gains in a later release falls outside it. Opting in is what earns that.
+ */
+export function setRoleSubmissionScoped(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+  scoped: boolean,
+): SubmissionClassesByRole {
+  const next: SubmissionClassesByRole = { ...byRole }
+  if (scoped) next[role] = [...RULEABLE_CHANGE_CLASSES]
+  else delete next[role]
+  return next
+}
+
+/**
+ * Tick or untick one class for a role that is already scoped, keeping the shared class order so
+ * two presets carrying the same policy carry the same array. Unticking the last class leaves an
+ * EMPTY list rather than removing the entry: that is the real policy "this role lands nothing",
+ * and silently promoting it to unrestricted would be the exact inversion of what was clicked.
+ */
+export function toggleSubmissionClass(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  allowed: boolean,
+): SubmissionClassesByRole {
+  const current = new Set(byRole[role] ?? [])
+  if (allowed) current.add(changeClass)
+  else current.delete(changeClass)
+  return { ...byRole, [role]: RULEABLE_CHANGE_CLASSES.filter((c) => current.has(c)) }
+}

package/app/components/settings/MergeRolePolicyEditor.vue

@@ -1,11 +1,12 @@
 <script setup lang="ts">
 // The ROLE layer of one merge preset: what happens to a run depending on WHO started it.
 //
-// Two settings, edited together because they answer the same question at two strengths. A role can
-// be held to stricter per-class rules than the preset's base map (`classRulesByRole`), or held to
-// dry runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing
-// merges. The second outranks the first, which is why a sandboxed role says so on its row rather
-// than leaving the class rules below reading as the policy.
+// Three settings, edited together because they answer the same question at three strengths. A role
+// can be held to stricter per-class rules than the preset's base map (`classRulesByRole`), held to
+// an allowlist of the change classes it may LAND at all (`submissionClassesByRole`), or held to dry
+// runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing merges.
+// The strongest of the three that applies is what governs, which is why a sandboxed role says so on
+// its row rather than leaving the two below it reading as the policy.
 //
 // Composition is NARROW-ONLY, so this editor only offers a role rules STRICTER than the base one
 // (see MergeRolePolicyEditor.logic.ts). A looser rule is discarded by the engine, and an editor
@@ -18,14 +19,19 @@ import type {
   MergeClassRule,
   MergeClassRules,
   RuleableChangeClass,
+  SubmissionClassesByRole,
   WorkspaceRole,
 } from '~/types/merge'
 import {
   INHERIT_RULE,
   roleClassRuleRows,
   roleNarrowedCount,
+  roleSubmissionRows,
+  roleSubmissionScoped,
   setRoleClassRule,
+  setRoleSubmissionScoped,
   toggleDryRunRole,
+  toggleSubmissionClass,
   type RoleRuleSelection,
 } from '~/components/settings/MergeRolePolicyEditor.logic'
 
@@ -34,6 +40,12 @@ const props = defineProps<{
   classRulesByRole: ClassRulesByRole
   /** The roles whose runs this preset sandboxes. */
   dryRunRoles: DryRunRoles
+  /**
+   * Which change classes each role may LAND. A role with no entry is unrestricted; an entry with
+   * no classes lands nothing. The editor keeps those two apart (a switch, then tick boxes),
+   * because tick boxes alone would render them identically.
+   */
+  submissionClassesByRole: SubmissionClassesByRole
   /** The base rules the role layer narrows, so each row can show what it inherits. */
   classRules: MergeClassRules
   /**
@@ -50,6 +62,7 @@ const props = defineProps<{
 const emit = defineEmits<{
   'update:classRulesByRole': [ClassRulesByRole]
   'update:dryRunRoles': [DryRunRoles]
+  'update:submissionClassesByRole': [SubmissionClassesByRole]
 }>()
 
 const { t } = useI18n()
@@ -92,6 +105,14 @@ const roles = computed(() =>
       sandboxed: props.dryRunRoles.includes(role),
       narrowed,
       open: !!expanded.value[role],
+      // Scoped-ness is read off the MAP rather than off the entry being truthy, so an empty
+      // allowlist (a real policy: this role lands nothing) stays scoped instead of reading as
+      // the unrestricted default.
+      submissionScoped: roleSubmissionScoped(props.submissionClassesByRole, role),
+      submissionRows: roleSubmissionRows(props.submissionClassesByRole[role] ?? []).map((row) => ({
+        ...row,
+        label: t(CLASS_LABEL_KEYS[row.changeClass]),
+      })),
       rows: roleClassRuleRows(props.classRules, entry).map((row) => ({
         ...row,
         label: t(CLASS_LABEL_KEYS[row.changeClass]),
@@ -118,6 +139,24 @@ function setSandboxed(role: WorkspaceRole, sandboxed: boolean) {
 function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: RoleRuleSelection) {
   emit('update:classRulesByRole', setRoleClassRule(props.classRulesByRole, role, changeClass, rule))
 }
+
+function setSubmissionScoped(role: WorkspaceRole, scoped: boolean) {
+  emit(
+    'update:submissionClassesByRole',
+    setRoleSubmissionScoped(props.submissionClassesByRole, role, scoped),
+  )
+}
+
+function setSubmissionClass(
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  allowed: boolean,
+) {
+  emit(
+    'update:submissionClassesByRole',
+    toggleSubmissionClass(props.submissionClassesByRole, role, changeClass, allowed),
+  )
+}
 </script>
 
 <template>
@@ -129,8 +168,9 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
       <p class="mt-0.5 text-[11px] leading-snug text-slate-500">
         {{ t('settings.riskPolicy.roleRules.help') }}
       </p>
-      <!-- Auto-merge off already sends every pull request to a human, so only the sandbox half of
-           this editor still changes anything (it refuses the manual merge as well). -->
+      <!-- Auto-merge off already sends every pull request to a human, so the per-class narrowing
+           has nothing left to subtract. The other two settings still bite, because both refuse the
+           MANUAL merge as well, which is the one thing the master switch leaves open. -->
       <p
         v-if="!autoMergeEnabled"
         class="mt-1 text-[11px] leading-snug text-amber-400/90"
@@ -174,11 +214,20 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
                 )
           }}
         </UButton>
+        <!-- A collapsed group must not hide an active policy: the tally above counts class rules
+             only, and a role can land nothing at all while showing "No class limits". -->
+        <span
+          v-if="group.submissionScoped"
+          class="text-[11px] text-amber-400/90"
+          :data-testid="`merge-role-submission-badge-${group.role}`"
+        >
+          {{ t('settings.riskPolicy.roleRules.submissionBadge') }}
+        </span>
       </div>
 
-      <!-- A sandboxed role merges nothing at all, so the class rules below cannot make its runs
-           any stricter. They stay editable (removing the sandbox brings them straight back) and
-           the row says which of the two is actually governing. -->
+      <!-- A sandboxed role merges nothing at all, so neither limit below can make its runs any
+           stricter. Both stay editable (removing the sandbox brings them straight back) and the
+           row says which of the three is actually governing. -->
       <p
         v-if="group.sandboxed"
         class="mt-1 text-[11px] leading-snug text-amber-400/90"
@@ -187,38 +236,83 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
         {{ t('settings.riskPolicy.roleRules.sandboxNote') }}
       </p>
 
-      <div v-if="group.open" class="mt-2 space-y-1.5 border-t border-slate-800 pt-2">
-        <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
-          {{ t('settings.riskPolicy.roleRules.baseHint') }}
-        </p>
-        <div
-          v-for="row in group.rows"
-          :key="row.changeClass"
-          class="flex flex-wrap items-center gap-2"
-          :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
-        >
-          <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
-          <USelect
-            :model-value="row.selected"
-            :items="row.items"
-            value-key="value"
+      <div v-if="group.open" class="mt-2 space-y-2 border-t border-slate-800 pt-2">
+        <!-- What this role may LAND at all. Above the class rules because it outranks them: a
+             class can be auto-mergeable under the rules and still outside this list, and then
+             nothing merges, through the review card's own button included. -->
+        <div class="space-y-1.5">
+          <USwitch
+            :model-value="group.submissionScoped"
             size="sm"
-            class="w-52"
-            :disabled="disabled || row.items.length === 1"
-            :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
-            @update:model-value="setRule(group.role, row.changeClass, $event as RoleRuleSelection)"
+            :disabled="disabled"
+            :label="t('settings.riskPolicy.roleRules.submissionLabel')"
+            :data-testid="`merge-role-submission-${group.role}`"
+            @update:model-value="setSubmissionScoped(group.role, $event)"
           />
-          <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
-          <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
-            {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
-          </span>
-          <span
-            v-else-if="row.redundant"
-            class="text-[11px] text-amber-400/90"
-            :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+          <p class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.submissionHelp') }}
+          </p>
+          <div v-if="group.submissionScoped" class="flex flex-wrap gap-x-4 gap-y-1">
+            <UCheckbox
+              v-for="row in group.submissionRows"
+              :key="row.changeClass"
+              :model-value="row.allowed"
+              size="sm"
+              :disabled="disabled"
+              :label="row.label"
+              :data-testid="`merge-role-submission-class-${group.role}-${row.changeClass}`"
+              @update:model-value="setSubmissionClass(group.role, row.changeClass, $event === true)"
+            />
+          </div>
+          <!-- An empty allowlist is a real policy, not an unfinished edit, so it says what it
+               does rather than reading as a switch somebody forgot to fill in. -->
+          <p
+            v-if="group.submissionScoped && !group.submissionRows.some((r) => r.allowed)"
+            class="text-[11px] leading-snug text-amber-400/90"
+            :data-testid="`merge-role-submission-none-${group.role}`"
+          >
+            {{ t('settings.riskPolicy.roleRules.submissionNone') }}
+          </p>
+        </div>
+
+        <div class="space-y-1.5 border-t border-slate-800/70 pt-2">
+          <p class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.classHeading') }}
+          </p>
+          <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.baseHint') }}
+          </p>
+          <div
+            v-for="row in group.rows"
+            :key="row.changeClass"
+            class="flex flex-wrap items-center gap-2"
+            :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
           >
-            {{ t('settings.riskPolicy.roleRules.redundant') }}
-          </span>
+            <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
+            <USelect
+              :model-value="row.selected"
+              :items="row.items"
+              value-key="value"
+              size="sm"
+              class="w-52"
+              :disabled="disabled || row.items.length === 1"
+              :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
+              @update:model-value="
+                setRule(group.role, row.changeClass, $event as RoleRuleSelection)
+              "
+            />
+            <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
+            <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
+              {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
+            </span>
+            <span
+              v-else-if="row.redundant"
+              class="text-[11px] text-amber-400/90"
+              :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+            >
+              {{ t('settings.riskPolicy.roleRules.redundant') }}
+            </span>
+          </div>
         </div>
       </div>
     </div>

package/app/components/settings/RiskPolicyPanel.vue

@@ -11,6 +11,7 @@ import type {
   MergeClassRules,
   RiskPolicy,
   RequirementConcernLevel,
+  SubmissionClassesByRole,
 } from '~/types/merge'
 import type { StepGating } from '@cat-factory/contracts'
 import {
@@ -90,6 +91,9 @@ interface Draft {
   // which is why clearing one in the editor is a plain omission.
   classRulesByRole: ClassRulesByRole
   dryRunRoles: DryRunRoles
+  // Which classes each role may LAND at all. A role with no entry is unrestricted, so `{}` is the
+  // identity; an entry with no classes is the different policy that the role lands nothing.
+  submissionClassesByRole: SubmissionClassesByRole
   // Implementation-fork decision gating (edited 0..100, stored 0..1); disabled ⇒ off in `auto`.
   forkEnabled: boolean
   forkMinComplexity: number
@@ -129,6 +133,7 @@ function toDraft(p: RiskPolicy): Draft {
     classRules: { ...p.classRules },
     classRulesByRole: { ...p.classRulesByRole },
     dryRunRoles: [...p.dryRunRoles],
+    submissionClassesByRole: { ...p.submissionClassesByRole },
     forkEnabled: p.forkDecision?.enabled ?? false,
     forkMinComplexity: Math.round((p.forkDecision?.minComplexity ?? 0.5) * 100),
     forkMinRisk: Math.round((p.forkDecision?.minRisk ?? 0.4) * 100),
@@ -174,6 +179,7 @@ async function save(p: RiskPolicy) {
       classRules: d.classRules,
       classRulesByRole: d.classRulesByRole,
       dryRunRoles: d.dryRunRoles,
+      submissionClassesByRole: d.submissionClassesByRole,
       forkDecision: forkGating(d),
     })
     toast.add({
@@ -235,6 +241,7 @@ const draft = reactive<Draft>({
   classRules: {},
   classRulesByRole: {},
   dryRunRoles: [],
+  submissionClassesByRole: {},
   forkEnabled: false,
   forkMinComplexity: 50,
   forkMinRisk: 40,
@@ -395,6 +402,7 @@ async function create() {
         <MergeRolePolicyEditor
           v-model:class-rules-by-role="drafts[p.id]!.classRulesByRole"
           v-model:dry-run-roles="drafts[p.id]!.dryRunRoles"
+          v-model:submission-classes-by-role="drafts[p.id]!.submissionClassesByRole"
           :class-rules="drafts[p.id]!.classRules"
           :auto-merge-enabled="drafts[p.id]!.autoMergeEnabled"
           :disabled="busy === p.id"

package/app/composables/usePipelineErrorToast.ts

@@ -117,6 +117,10 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
     titleKey: 'errors.conflict.title.dry_run_not_mergeable',
     descriptionKey: 'errors.conflict.description.dry_run_not_mergeable',
   },
+  submission_not_allowed: {
+    titleKey: 'errors.conflict.title.submission_not_allowed',
+    descriptionKey: 'errors.conflict.description.submission_not_allowed',
+  },
   github_not_connected: {
     titleKey: 'errors.conflict.title.github_not_connected',
     descriptionKey: 'errors.conflict.description.github_not_connected',

package/app/types/merge.ts

@@ -16,6 +16,8 @@ export type {
   // runs are sandboxed (they open a pull request and merge nothing).
   ClassRulesByRole,
   DryRunRoles,
+  // Which change classes a role may LAND at all (absent ⇒ unrestricted, empty ⇒ nothing).
+  SubmissionClassesByRole,
   WorkspaceRole,
   MergeTrackRecord,
   ReviewEffort,

package/app/utils/riskPolicy.spec.ts

@@ -27,6 +27,7 @@ const policy = (over: Partial<RiskPolicy> = {}): RiskPolicy =>
     classRules: {},
     classRulesByRole: {},
     dryRunRoles: [],
+    submissionClassesByRole: {},
     isDefault: true,
     version: 1,
     createdAt: 0,
@@ -61,7 +62,7 @@ describe('riskPolicyCeilings', () => {
 
 describe('rolePolicySummary', () => {
   it('is empty on a policy that treats every initiator alike', () => {
-    expect(rolePolicySummary(policy())).toEqual({ sandboxed: [], narrowed: [] })
+    expect(rolePolicySummary(policy())).toEqual({ sandboxed: [], narrowed: [], scoped: [] })
   })
 
   it('lists both layers in the shared role order', () => {
@@ -72,6 +73,7 @@ describe('rolePolicySummary', () => {
     expect(rolePolicySummary(p)).toEqual({
       sandboxed: ['member', 'viewer'],
       narrowed: ['admin'],
+      scoped: [],
     })
   })
 
@@ -79,6 +81,23 @@ describe('rolePolicySummary', () => {
   // limit that changes nothing about what that role's runs can do.
   it('does not also report class rules for a role the policy sandboxes', () => {
     const p = policy({ dryRunRoles: ['member'], classRulesByRole: { member: { docs: 'never' } } })
-    expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [] })
+    expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [], scoped: [] })
+  })
+
+  it('lists a role allowlisted to a subset of change classes', () => {
+    const p = policy({ submissionClassesByRole: { member: ['docs'] } })
+    expect(rolePolicySummary(p)).toEqual({ sandboxed: [], narrowed: [], scoped: ['member'] })
+  })
+
+  // The most restrictive policy this setting can express, and the one a summary must not drop:
+  // an EMPTY allowlist is scoped, where an absent entry is unrestricted.
+  it('lists a role allowlisted to NOTHING', () => {
+    const p = policy({ submissionClassesByRole: { viewer: [] } })
+    expect(rolePolicySummary(p).scoped).toEqual(['viewer'])
+  })
+
+  it('does not also report an allowlist for a role the policy sandboxes', () => {
+    const p = policy({ dryRunRoles: ['member'], submissionClassesByRole: { member: ['docs'] } })
+    expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [], scoped: [] })
   })
 })

package/app/utils/riskPolicy.ts

@@ -52,6 +52,12 @@ export interface RolePolicySummary {
    * both would read as two limits where the second changes nothing.
    */
   narrowed: WorkspaceRole[]
+  /**
+   * Roles allowlisted to a subset of change classes they may LAND. Same suppression rule as
+   * `narrowed` and for the same reason, and listed SEPARATELY from it because the two are not
+   * degrees of one setting: this one bars landing outright, including through the manual merge.
+   */
+  scoped: WorkspaceRole[]
 }
 
 /**
@@ -66,5 +72,11 @@ export function rolePolicySummary(p: RiskPolicy): RolePolicySummary {
     narrowed: WORKSPACE_ROLES.filter(
       (role) => !sandboxed.includes(role) && Object.keys(p.classRulesByRole[role] ?? {}).length > 0,
     ),
+    // Scoped-ness is the PRESENCE of an entry, never its length: a role allowlisted to nothing
+    // is the most restrictive policy this setting can express, and reading it as "no allowlist"
+    // would drop the one summary line a reader most needs to see.
+    scoped: WORKSPACE_ROLES.filter(
+      (role) => !sandboxed.includes(role) && p.submissionClassesByRole[role] !== undefined,
+    ),
   }
 }