@cat-factory/app 0.226.0 → 0.228.0

package/app/components/panels/inspector/TaskExecution.vue

@@ -19,6 +19,7 @@ import type { ChangeClass, ReviewEffort } from '~/types/merge'
 import MergeEffortChips from '~/components/merge/MergeEffortChips.vue'
 import InputGateNotice from '~/components/inputGate/InputGateNotice.vue'
 import { inputGateNoticeFor } from '~/utils/inputGate'
+import { composeRunOutcome, hasOutcomeToShow } from '~/utils/runOutcome'
 
 const props = defineProps<{ block: Block }>()
 
@@ -87,6 +88,22 @@ const failedRun = computed(() => {
 // CURRENT status, so the error trail stays viewable after a restart clears the top banner.
 const failureHistory = computed(() => agentRuns.byBlock[props.block.id]?.failureHistory ?? [])
 
+/**
+ * Whether this task has a result worth reading in product terms: a pull request, or a step that
+ * recorded evidence. Asked of the shared reduction rather than re-derived here, so the panel and
+ * the board card can never disagree about which runs have an outcome to open.
+ *
+ * The spec is deliberately not loaded for this check: it only ever adds TITLES to requirement
+ * rows, never sections, so nothing about whether there is something to show depends on it. The
+ * window loads it on open.
+ */
+const outcomeReadable = computed(() =>
+  hasOutcomeToShow(composeRunOutcome({ block: props.block, instance: instance.value ?? null })),
+)
+function openOutcome() {
+  ui.openOutcome(props.block.id, instance.value?.id ?? null)
+}
+
 const pr = computed(() => props.block.pullRequest)
 /** A PR is merged once the block is `done`; otherwise it is open awaiting merge. */
 const prMerged = computed(() => props.block.status === 'done')
@@ -605,6 +622,22 @@ async function mergePr() {
     <!-- error trail of prior attempts (survives a retry/restart that cleared the banner) -->
     <AgentFailureHistory :failures="failureHistory" />
 
+    <!-- Read the result: the outcome summary is the way in, and the pull request below is the
+         way to the diff. Offered whenever there is evidence or a PR to read, which includes a
+         merged task whose run instance is long gone. -->
+    <UButton
+      v-if="outcomeReadable"
+      color="primary"
+      variant="soft"
+      size="sm"
+      icon="i-lucide-clipboard-check"
+      block
+      data-testid="inspector-open-outcome"
+      @click="openOutcome"
+    >
+      {{ t('inspector.execution.readOutcome') }}
+    </UButton>
+
     <!-- Open PR: link straight to it on GitHub -->
     <div v-if="pr" class="space-y-2">
       <span class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">

package/app/components/riskPolicy/RiskPolicyPreview.vue

@@ -23,11 +23,12 @@ const ROLE_LABEL: Record<WorkspaceRole, () => string> = {
   viewer: () => t('merge.role.viewer'),
 }
 const roleLayer = computed(() => {
-  const { sandboxed, narrowed } = rolePolicySummary(props.policy)
+  const { sandboxed, narrowed, scoped } = rolePolicySummary(props.policy)
   return {
     sandboxed: sandboxed.map((r) => ROLE_LABEL[r]()).join(', '),
     narrowed: narrowed.map((r) => ROLE_LABEL[r]()).join(', '),
-    any: sandboxed.length > 0 || narrowed.length > 0,
+    scoped: scoped.map((r) => ROLE_LABEL[r]()).join(', '),
+    any: sandboxed.length > 0 || narrowed.length > 0 || scoped.length > 0,
   }
 })
 
@@ -94,6 +95,9 @@ const ceilings = computed(() =>
       <p v-if="roleLayer.sandboxed" class="text-[12px] leading-snug text-slate-400">
         {{ t('riskPolicy.preview.roleSandboxed', { roles: roleLayer.sandboxed }) }}
       </p>
+      <p v-if="roleLayer.scoped" class="text-[12px] leading-snug text-slate-400">
+        {{ t('riskPolicy.preview.roleScoped', { roles: roleLayer.scoped }) }}
+      </p>
       <p v-if="roleLayer.narrowed" class="text-[12px] leading-snug text-slate-400">
         {{ t('riskPolicy.preview.roleNarrowed', { roles: roleLayer.narrowed }) }}
       </p>

package/app/components/settings/MergeRolePolicyEditor.logic.spec.ts

@@ -1,13 +1,17 @@
 import { describe, expect, it } from 'vitest'
-import { MERGE_CLASS_RULES } from '@cat-factory/contracts'
-import type { ClassRulesByRole, MergeClassRules } from '~/types/merge'
+import { MERGE_CLASS_RULES, RULEABLE_CHANGE_CLASSES } from '@cat-factory/contracts'
+import type { ClassRulesByRole, MergeClassRules, SubmissionClassesByRole } from '~/types/merge'
 import {
   INHERIT_RULE,
   narrowingOptionsFor,
   roleClassRuleRows,
   roleNarrowedCount,
+  roleSubmissionRows,
+  roleSubmissionScoped,
   setRoleClassRule,
+  setRoleSubmissionScoped,
   toggleDryRunRole,
+  toggleSubmissionClass,
 } from '~/components/settings/MergeRolePolicyEditor.logic'
 
 describe('narrowingOptionsFor', () => {
@@ -144,3 +148,62 @@ describe('roleNarrowedCount', () => {
     expect(roleNarrowedCount({ docs: 'never', source: 'never' })).toBe(2)
   })
 })
+
+// The submission allowlist's editing shape turns on one distinction the wire contract makes and a
+// tick-box grid cannot render on its own: an ABSENT entry (unrestricted) and an EMPTY list (lands
+// nothing) are different policies. Every case below is about keeping those two apart.
+describe('roleSubmissionScoped', () => {
+  it('reads an EMPTY allowlist as scoped, not as the unrestricted default', () => {
+    expect(roleSubmissionScoped({ member: [] }, 'member')).toBe(true)
+    expect(roleSubmissionScoped({ member: ['docs'] }, 'member')).toBe(true)
+  })
+
+  it('reads a role with no entry as unrestricted', () => {
+    expect(roleSubmissionScoped({ member: ['docs'] }, 'admin')).toBe(false)
+    expect(roleSubmissionScoped({}, 'member')).toBe(false)
+  })
+})
+
+describe('roleSubmissionRows', () => {
+  it('renders one row per ruleable class, in the shared order, ticked by membership', () => {
+    const rows = roleSubmissionRows(['source', 'docs'])
+    expect(rows.map((r) => r.changeClass)).toEqual([...RULEABLE_CHANGE_CLASSES])
+    expect(rows.filter((r) => r.allowed).map((r) => r.changeClass)).toEqual(['docs', 'source'])
+  })
+})
+
+describe('setRoleSubmissionScoped', () => {
+  // Turning the switch ON must not silently impose a policy nobody clicked: seeding today's
+  // landable classes leaves the role exactly where it was, and the operator subtracts from there.
+  it('seeds every class when scoping is turned on', () => {
+    expect(setRoleSubmissionScoped({}, 'member', true).member).toEqual([...RULEABLE_CHANGE_CLASSES])
+  })
+
+  it('removes the entry entirely when scoping is turned off', () => {
+    const byRole: SubmissionClassesByRole = { member: [], admin: ['docs'] }
+    const next = setRoleSubmissionScoped(byRole, 'member', false)
+    expect('member' in next).toBe(false)
+    expect(next.admin).toEqual(['docs'])
+  })
+})
+
+describe('toggleSubmissionClass', () => {
+  it('adds and removes one class, keeping the shared class order', () => {
+    const ticked = toggleSubmissionClass({ member: ['source'] }, 'member', 'docs', true)
+    expect(ticked.member).toEqual(['docs', 'source'])
+    expect(toggleSubmissionClass(ticked, 'member', 'source', false).member).toEqual(['docs'])
+  })
+
+  // Unticking the last class is the policy "this role lands nothing", so it must NOT prune back
+  // to an absent entry, which would silently invert the click into "unrestricted".
+  it('leaves an EMPTY list rather than un-scoping the role', () => {
+    const next = toggleSubmissionClass({ member: ['docs'] }, 'member', 'docs', false)
+    expect(next.member).toEqual([])
+    expect(roleSubmissionScoped(next, 'member')).toBe(true)
+  })
+
+  it('leaves other roles untouched', () => {
+    const next = toggleSubmissionClass({ admin: ['docs'] }, 'member', 'docs', true)
+    expect(next.admin).toEqual(['docs'])
+  })
+})

package/app/components/settings/MergeRolePolicyEditor.logic.ts

@@ -23,6 +23,7 @@ import type {
   MergeClassRule,
   MergeClassRules,
   RuleableChangeClass,
+  SubmissionClassesByRole,
   WorkspaceRole,
 } from '~/types/merge'
 
@@ -131,3 +132,74 @@ export function toggleDryRunRole(
 export function roleNarrowedCount(entry: MergeClassRules | undefined): number {
   return entry ? Object.keys(entry).length : 0
 }
+
+// ---------------------------------------------------------------------------
+// The per-role SUBMISSION ALLOWLIST: which change classes a role may LAND at all. A third
+// setting rather than a fourth rule value, because it answers a different question: a class rule
+// decides how much review landing takes, where this decides whether the platform lands it at all,
+// and it is refused at BOTH exits, the manual merge included.
+//
+// The editing shape follows the wire shape's own distinction: an ABSENT entry is unrestricted
+// and an EMPTY list is "this role lands nothing", which are different policies. So the row is a
+// switch (scoped / not) plus a set of tick boxes, never a set of tick boxes alone. With tick
+// boxes alone, "unrestricted" and "lands nothing" would be the same rendered state.
+// ---------------------------------------------------------------------------
+
+/** One class's tick box inside one role's allowlist. */
+export interface RoleSubmissionRow {
+  changeClass: RuleableChangeClass
+  allowed: boolean
+}
+
+/** Whether this role carries an allowlist at all (as opposed to being unrestricted). */
+export function roleSubmissionScoped(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+): boolean {
+  return byRole[role] !== undefined
+}
+
+/** One role's tick boxes, in the shared class order. Empty rows for an unscoped role. */
+export function roleSubmissionRows(entry: readonly RuleableChangeClass[]): RoleSubmissionRow[] {
+  return RULEABLE_CHANGE_CLASSES.map((changeClass) => ({
+    changeClass,
+    allowed: entry.includes(changeClass),
+  }))
+}
+
+/**
+ * Turn the allowlist on or off for a role. Turning it ON seeds the classes that are landable
+ * TODAY, which is behaviourally where the role already was, so the operator subtracts from a
+ * known state rather than starting from a policy ("lands nothing") they did not ask for.
+ *
+ * That seeded list is NOT the identity, and deliberately: from here on the role is scoped, so a
+ * class the vocabulary gains in a later release falls outside it. Opting in is what earns that.
+ */
+export function setRoleSubmissionScoped(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+  scoped: boolean,
+): SubmissionClassesByRole {
+  const next: SubmissionClassesByRole = { ...byRole }
+  if (scoped) next[role] = [...RULEABLE_CHANGE_CLASSES]
+  else delete next[role]
+  return next
+}
+
+/**
+ * Tick or untick one class for a role that is already scoped, keeping the shared class order so
+ * two presets carrying the same policy carry the same array. Unticking the last class leaves an
+ * EMPTY list rather than removing the entry: that is the real policy "this role lands nothing",
+ * and silently promoting it to unrestricted would be the exact inversion of what was clicked.
+ */
+export function toggleSubmissionClass(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  allowed: boolean,
+): SubmissionClassesByRole {
+  const current = new Set(byRole[role] ?? [])
+  if (allowed) current.add(changeClass)
+  else current.delete(changeClass)
+  return { ...byRole, [role]: RULEABLE_CHANGE_CLASSES.filter((c) => current.has(c)) }
+}

package/app/components/settings/MergeRolePolicyEditor.vue

@@ -1,11 +1,12 @@
 <script setup lang="ts">
 // The ROLE layer of one merge preset: what happens to a run depending on WHO started it.
 //
-// Two settings, edited together because they answer the same question at two strengths. A role can
-// be held to stricter per-class rules than the preset's base map (`classRulesByRole`), or held to
-// dry runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing
-// merges. The second outranks the first, which is why a sandboxed role says so on its row rather
-// than leaving the class rules below reading as the policy.
+// Three settings, edited together because they answer the same question at three strengths. A role
+// can be held to stricter per-class rules than the preset's base map (`classRulesByRole`), held to
+// an allowlist of the change classes it may LAND at all (`submissionClassesByRole`), or held to dry
+// runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing merges.
+// The strongest of the three that applies is what governs, which is why a sandboxed role says so on
+// its row rather than leaving the two below it reading as the policy.
 //
 // Composition is NARROW-ONLY, so this editor only offers a role rules STRICTER than the base one
 // (see MergeRolePolicyEditor.logic.ts). A looser rule is discarded by the engine, and an editor
@@ -18,14 +19,19 @@ import type {
   MergeClassRule,
   MergeClassRules,
   RuleableChangeClass,
+  SubmissionClassesByRole,
   WorkspaceRole,
 } from '~/types/merge'
 import {
   INHERIT_RULE,
   roleClassRuleRows,
   roleNarrowedCount,
+  roleSubmissionRows,
+  roleSubmissionScoped,
   setRoleClassRule,
+  setRoleSubmissionScoped,
   toggleDryRunRole,
+  toggleSubmissionClass,
   type RoleRuleSelection,
 } from '~/components/settings/MergeRolePolicyEditor.logic'
 
@@ -34,6 +40,12 @@ const props = defineProps<{
   classRulesByRole: ClassRulesByRole
   /** The roles whose runs this preset sandboxes. */
   dryRunRoles: DryRunRoles
+  /**
+   * Which change classes each role may LAND. A role with no entry is unrestricted; an entry with
+   * no classes lands nothing. The editor keeps those two apart (a switch, then tick boxes),
+   * because tick boxes alone would render them identically.
+   */
+  submissionClassesByRole: SubmissionClassesByRole
   /** The base rules the role layer narrows, so each row can show what it inherits. */
   classRules: MergeClassRules
   /**
@@ -50,6 +62,7 @@ const props = defineProps<{
 const emit = defineEmits<{
   'update:classRulesByRole': [ClassRulesByRole]
   'update:dryRunRoles': [DryRunRoles]
+  'update:submissionClassesByRole': [SubmissionClassesByRole]
 }>()
 
 const { t } = useI18n()
@@ -92,6 +105,14 @@ const roles = computed(() =>
       sandboxed: props.dryRunRoles.includes(role),
       narrowed,
       open: !!expanded.value[role],
+      // Scoped-ness is read off the MAP rather than off the entry being truthy, so an empty
+      // allowlist (a real policy: this role lands nothing) stays scoped instead of reading as
+      // the unrestricted default.
+      submissionScoped: roleSubmissionScoped(props.submissionClassesByRole, role),
+      submissionRows: roleSubmissionRows(props.submissionClassesByRole[role] ?? []).map((row) => ({
+        ...row,
+        label: t(CLASS_LABEL_KEYS[row.changeClass]),
+      })),
       rows: roleClassRuleRows(props.classRules, entry).map((row) => ({
         ...row,
         label: t(CLASS_LABEL_KEYS[row.changeClass]),
@@ -118,6 +139,24 @@ function setSandboxed(role: WorkspaceRole, sandboxed: boolean) {
 function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: RoleRuleSelection) {
   emit('update:classRulesByRole', setRoleClassRule(props.classRulesByRole, role, changeClass, rule))
 }
+
+function setSubmissionScoped(role: WorkspaceRole, scoped: boolean) {
+  emit(
+    'update:submissionClassesByRole',
+    setRoleSubmissionScoped(props.submissionClassesByRole, role, scoped),
+  )
+}
+
+function setSubmissionClass(
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  allowed: boolean,
+) {
+  emit(
+    'update:submissionClassesByRole',
+    toggleSubmissionClass(props.submissionClassesByRole, role, changeClass, allowed),
+  )
+}
 </script>
 
 <template>
@@ -129,8 +168,9 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
       <p class="mt-0.5 text-[11px] leading-snug text-slate-500">
         {{ t('settings.riskPolicy.roleRules.help') }}
       </p>
-      <!-- Auto-merge off already sends every pull request to a human, so only the sandbox half of
-           this editor still changes anything (it refuses the manual merge as well). -->
+      <!-- Auto-merge off already sends every pull request to a human, so the per-class narrowing
+           has nothing left to subtract. The other two settings still bite, because both refuse the
+           MANUAL merge as well, which is the one thing the master switch leaves open. -->
       <p
         v-if="!autoMergeEnabled"
         class="mt-1 text-[11px] leading-snug text-amber-400/90"
@@ -174,11 +214,20 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
                 )
           }}
         </UButton>
+        <!-- A collapsed group must not hide an active policy: the tally above counts class rules
+             only, and a role can land nothing at all while showing "No class limits". -->
+        <span
+          v-if="group.submissionScoped"
+          class="text-[11px] text-amber-400/90"
+          :data-testid="`merge-role-submission-badge-${group.role}`"
+        >
+          {{ t('settings.riskPolicy.roleRules.submissionBadge') }}
+        </span>
       </div>
 
-      <!-- A sandboxed role merges nothing at all, so the class rules below cannot make its runs
-           any stricter. They stay editable (removing the sandbox brings them straight back) and
-           the row says which of the two is actually governing. -->
+      <!-- A sandboxed role merges nothing at all, so neither limit below can make its runs any
+           stricter. Both stay editable (removing the sandbox brings them straight back) and the
+           row says which of the three is actually governing. -->
       <p
         v-if="group.sandboxed"
         class="mt-1 text-[11px] leading-snug text-amber-400/90"
@@ -187,38 +236,83 @@ function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: Ro
         {{ t('settings.riskPolicy.roleRules.sandboxNote') }}
       </p>
 
-      <div v-if="group.open" class="mt-2 space-y-1.5 border-t border-slate-800 pt-2">
-        <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
-          {{ t('settings.riskPolicy.roleRules.baseHint') }}
-        </p>
-        <div
-          v-for="row in group.rows"
-          :key="row.changeClass"
-          class="flex flex-wrap items-center gap-2"
-          :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
-        >
-          <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
-          <USelect
-            :model-value="row.selected"
-            :items="row.items"
-            value-key="value"
+      <div v-if="group.open" class="mt-2 space-y-2 border-t border-slate-800 pt-2">
+        <!-- What this role may LAND at all. Above the class rules because it outranks them: a
+             class can be auto-mergeable under the rules and still outside this list, and then
+             nothing merges, through the review card's own button included. -->
+        <div class="space-y-1.5">
+          <USwitch
+            :model-value="group.submissionScoped"
             size="sm"
-            class="w-52"
-            :disabled="disabled || row.items.length === 1"
-            :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
-            @update:model-value="setRule(group.role, row.changeClass, $event as RoleRuleSelection)"
+            :disabled="disabled"
+            :label="t('settings.riskPolicy.roleRules.submissionLabel')"
+            :data-testid="`merge-role-submission-${group.role}`"
+            @update:model-value="setSubmissionScoped(group.role, $event)"
           />
-          <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
-          <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
-            {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
-          </span>
-          <span
-            v-else-if="row.redundant"
-            class="text-[11px] text-amber-400/90"
-            :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+          <p class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.submissionHelp') }}
+          </p>
+          <div v-if="group.submissionScoped" class="flex flex-wrap gap-x-4 gap-y-1">
+            <UCheckbox
+              v-for="row in group.submissionRows"
+              :key="row.changeClass"
+              :model-value="row.allowed"
+              size="sm"
+              :disabled="disabled"
+              :label="row.label"
+              :data-testid="`merge-role-submission-class-${group.role}-${row.changeClass}`"
+              @update:model-value="setSubmissionClass(group.role, row.changeClass, $event === true)"
+            />
+          </div>
+          <!-- An empty allowlist is a real policy, not an unfinished edit, so it says what it
+               does rather than reading as a switch somebody forgot to fill in. -->
+          <p
+            v-if="group.submissionScoped && !group.submissionRows.some((r) => r.allowed)"
+            class="text-[11px] leading-snug text-amber-400/90"
+            :data-testid="`merge-role-submission-none-${group.role}`"
+          >
+            {{ t('settings.riskPolicy.roleRules.submissionNone') }}
+          </p>
+        </div>
+
+        <div class="space-y-1.5 border-t border-slate-800/70 pt-2">
+          <p class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.classHeading') }}
+          </p>
+          <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.baseHint') }}
+          </p>
+          <div
+            v-for="row in group.rows"
+            :key="row.changeClass"
+            class="flex flex-wrap items-center gap-2"
+            :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
           >
-            {{ t('settings.riskPolicy.roleRules.redundant') }}
-          </span>
+            <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
+            <USelect
+              :model-value="row.selected"
+              :items="row.items"
+              value-key="value"
+              size="sm"
+              class="w-52"
+              :disabled="disabled || row.items.length === 1"
+              :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
+              @update:model-value="
+                setRule(group.role, row.changeClass, $event as RoleRuleSelection)
+              "
+            />
+            <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
+            <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
+              {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
+            </span>
+            <span
+              v-else-if="row.redundant"
+              class="text-[11px] text-amber-400/90"
+              :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+            >
+              {{ t('settings.riskPolicy.roleRules.redundant') }}
+            </span>
+          </div>
         </div>
       </div>
     </div>

package/app/components/settings/RiskPolicyPanel.vue

@@ -11,6 +11,7 @@ import type {
   MergeClassRules,
   RiskPolicy,
   RequirementConcernLevel,
+  SubmissionClassesByRole,
 } from '~/types/merge'
 import type { StepGating } from '@cat-factory/contracts'
 import {
@@ -90,6 +91,9 @@ interface Draft {
   // which is why clearing one in the editor is a plain omission.
   classRulesByRole: ClassRulesByRole
   dryRunRoles: DryRunRoles
+  // Which classes each role may LAND at all. A role with no entry is unrestricted, so `{}` is the
+  // identity; an entry with no classes is the different policy that the role lands nothing.
+  submissionClassesByRole: SubmissionClassesByRole
   // Implementation-fork decision gating (edited 0..100, stored 0..1); disabled ⇒ off in `auto`.
   forkEnabled: boolean
   forkMinComplexity: number
@@ -129,6 +133,7 @@ function toDraft(p: RiskPolicy): Draft {
     classRules: { ...p.classRules },
     classRulesByRole: { ...p.classRulesByRole },
     dryRunRoles: [...p.dryRunRoles],
+    submissionClassesByRole: { ...p.submissionClassesByRole },
     forkEnabled: p.forkDecision?.enabled ?? false,
     forkMinComplexity: Math.round((p.forkDecision?.minComplexity ?? 0.5) * 100),
     forkMinRisk: Math.round((p.forkDecision?.minRisk ?? 0.4) * 100),
@@ -174,6 +179,7 @@ async function save(p: RiskPolicy) {
       classRules: d.classRules,
       classRulesByRole: d.classRulesByRole,
       dryRunRoles: d.dryRunRoles,
+      submissionClassesByRole: d.submissionClassesByRole,
       forkDecision: forkGating(d),
     })
     toast.add({
@@ -235,6 +241,7 @@ const draft = reactive<Draft>({
   classRules: {},
   classRulesByRole: {},
   dryRunRoles: [],
+  submissionClassesByRole: {},
   forkEnabled: false,
   forkMinComplexity: 50,
   forkMinRisk: 40,
@@ -395,6 +402,7 @@ async function create() {
         <MergeRolePolicyEditor
           v-model:class-rules-by-role="drafts[p.id]!.classRulesByRole"
           v-model:dry-run-roles="drafts[p.id]!.dryRunRoles"
+          v-model:submission-classes-by-role="drafts[p.id]!.submissionClassesByRole"
           :class-rules="drafts[p.id]!.classRules"
           :auto-merge-enabled="drafts[p.id]!.autoMergeEnabled"
           :disabled="busy === p.id"

package/app/composables/usePipelineErrorToast.ts

@@ -117,6 +117,10 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
     titleKey: 'errors.conflict.title.dry_run_not_mergeable',
     descriptionKey: 'errors.conflict.description.dry_run_not_mergeable',
   },
+  submission_not_allowed: {
+    titleKey: 'errors.conflict.title.submission_not_allowed',
+    descriptionKey: 'errors.conflict.description.submission_not_allowed',
+  },
   github_not_connected: {
     titleKey: 'errors.conflict.title.github_not_connected',
     descriptionKey: 'errors.conflict.description.github_not_connected',

package/app/composables/useRunDeepLink.ts

@@ -82,10 +82,18 @@ export function useRunDeepLink(): void {
       if (!ready || applied) return
       applied = true
       if (link.blockId) ui.select(link.blockId)
-      // Two views are served: the observability panel and the Tester's result window (where the
-      // screenshots the report's environment-lifecycle section lists are rendered). An unknown
-      // view still lands the user on the right board and task rather than failing the navigation.
-      if (link.view === 'observability') ui.openObservability(link.runId)
+      // Three views are served: the run's outcome summary (the non-code answer to "what did this
+      // change"), the observability panel, and the Tester's result window (where the screenshots
+      // the report's environment-lifecycle section lists are rendered). An unknown view still
+      // lands the user on the right board and task rather than failing the navigation.
+      //
+      // `outcome` is passed the block as well as the run: it is the one of the three that stays
+      // readable on a task whose run the snapshot no longer carries, and a link followed weeks
+      // after the work merged is exactly that case. The engine emits no `view=outcome` link
+      // today (its report links a REVIEWER to the two run-scoped panels); this is the entry
+      // point for one, and for a URL a person shares.
+      if (link.view === 'outcome') ui.openRunOutcome(link.runId, link.blockId)
+      else if (link.view === 'observability') ui.openObservability(link.runId)
       else if (link.view === 'test-evidence') ui.openTestEvidence(link.runId)
       stop?.()
     },

package/app/modular/result-views.ts

@@ -1,6 +1,7 @@
 import type { Component } from 'vue'
 import { defineModule } from '@modular-vue/core'
 import { RESULT_VIEW_IDS, type ResultViewId } from '@cat-factory/contracts'
+import OutcomeSummaryWindow from '~/components/outcome/OutcomeSummaryWindow.vue'
 import RequirementsReviewWindow from '~/components/requirements/RequirementsReviewWindow.vue'
 import ClarityReviewWindow from '~/components/clarity/ClarityReviewWindow.vue'
 import BrainstormWindow from '~/components/brainstorm/BrainstormWindow.vue'
@@ -51,6 +52,9 @@ import type { ResultViewContribution } from './slots'
  * that could ship. Consumer namespaced ids are validated separately by `pairById`.
  */
 const BUILT_IN_RESULT_VIEWS: Record<ResultViewId, Component> = {
+  // The run's non-code outcome summary: what changed in product terms, with the captured
+  // evidence, and the diff one click away. RUN-keyed (no step), opened by `ui.openOutcome`.
+  outcome: OutcomeSummaryWindow,
   'requirements-review': RequirementsReviewWindow,
   'clarity-review': ClarityReviewWindow,
   // Shared by both brainstorm stages (requirements + architecture); the window reads the stage.

package/app/stores/ui/resultViews.ts

@@ -113,6 +113,32 @@ export function createUiResultViews() {
     stepDetail.value = { instanceId, stepIndex }
   }
 
+  /**
+   * Open a task's NON-CODE OUTCOME summary — what the run changed in product terms, with the
+   * evidence behind it, and the diff one click away. BLOCK-keyed rather than run-keyed because a
+   * merged task keeps its pull request long after its run instance is gone, and that task is
+   * exactly the one somebody comes back to read. The run rides along when there is one, which is
+   * where every piece of evidence comes from; `stepIndex` stays null because the summary is
+   * composed from the WHOLE run and there is no step for it to be about.
+   */
+  function openOutcome(blockId: string, instanceId: string | null = null) {
+    resultView.value = { view: 'outcome', blockId, instanceId, stepIndex: null }
+  }
+
+  /**
+   * Open the outcome summary from a caller that knows the RUN: the `outcome` deep link.
+   *
+   * The run id is a LOOKUP here, not the key — the window is block-keyed (above) — so a link
+   * naming its block opens on it even when the store never hydrated that run, which is the
+   * normal state of following a link into a task that finished long ago. Falling back to the
+   * run's own `blockId` keeps a link that carries only `run=` working. Only a link that
+   * resolves neither is a silent no-op, matching the run-step openers.
+   */
+  function openRunOutcome(instanceId: string, blockId: string | null = null) {
+    const resolved = blockId ?? useExecutionStore().getInstance(instanceId)?.blockId ?? null
+    if (resolved) openOutcome(resolved, instanceId)
+  }
+
   function openRequirementReview(blockId: string) {
     resultView.value = { view: 'requirements-review', blockId, instanceId: null, stepIndex: null }
   }
@@ -185,6 +211,8 @@ export function createUiResultViews() {
     openForkDecision,
     openPrReview,
     openTestEvidence,
+    openOutcome,
+    openRunOutcome,
     closeResultView,
     closeRequirementReview,
     openStepDetail,