@cat-factory/app 0.267.0 → 0.268.1

package/app/composables/api/presets.ts

@@ -1,5 +1,9 @@
 import {
+  cloneRiskPolicyContract,
   createRiskPolicyContract,
+  listRiskPolicySuppressionsContract,
+  restoreRiskPolicyContract,
+  suppressRiskPolicyContract,
   listMergeClassRollupsContract,
   tagMergeReviewEffortContract,
   createConsensusGroupContract,
@@ -16,7 +20,7 @@ import {
   updateRiskPolicyContract,
   updateModelPresetContract,
 } from '@cat-factory/contracts'
-import type { ReviewEffort, UpdateRiskPolicyInput } from '~/types/merge'
+import type { ReviewEffort, RiskPolicyTier, UpdateRiskPolicyInput } from '~/types/merge'
 import type { CreateModelPresetInput, UpdateModelPresetInput } from '~/types/model-presets'
 import type { CreateConsensusGroupInput, UpdateConsensusGroupInput } from '~/types/consensus'
 import type { SendParams } from './client'
@@ -28,30 +32,63 @@ import type { ApiContext } from './context'
 type CreateRiskPolicyBody = NonNullable<SendParams<typeof createRiskPolicyContract>['body']>
 
 /** The per-workspace preset libraries: merge-threshold policy + model->agent mapping. */
-export function presetsApi({ send, ws }: ApiContext) {
+export function presetsApi({ send, ws, scope }: ApiContext) {
   return {
-    // ---- merge threshold presets (per-task auto-merge policy library) -----
-    listRiskPolicies: (workspaceId: string) =>
-      send(listRiskPoliciesContract, { pathPrefix: ws(workspaceId) }),
-
-    createRiskPolicy: (workspaceId: string, body: CreateRiskPolicyBody) =>
-      send(createRiskPolicyContract, { pathPrefix: ws(workspaceId), body }),
-
-    updateRiskPolicy: (workspaceId: string, presetId: string, body: UpdateRiskPolicyInput) =>
+    // ---- risk policies (per-task auto-merge policy library) ---------------
+    // The four CRUD calls are TIER-scoped (`account` or `workspace`, ADR 0055): the same routes are
+    // mounted under both prefixes, so one method serves either library and the caller states which
+    // one it is managing. The workspace read answers the MERGED library (its own rows plus the
+    // account policies it inherits, each tagged with its tier).
+    listRiskPolicies: (kind: RiskPolicyTier, id: string) =>
+      send(listRiskPoliciesContract, { pathPrefix: scope(kind, id) }),
+
+    createRiskPolicy: (kind: RiskPolicyTier, id: string, body: CreateRiskPolicyBody) =>
+      send(createRiskPolicyContract, { pathPrefix: scope(kind, id), body }),
+
+    updateRiskPolicy: (
+      kind: RiskPolicyTier,
+      id: string,
+      presetId: string,
+      body: UpdateRiskPolicyInput,
+    ) =>
       send(updateRiskPolicyContract, {
-        pathPrefix: ws(workspaceId),
+        pathPrefix: scope(kind, id),
         pathParams: { presetId },
         body,
       }),
 
-    deleteRiskPolicy: (workspaceId: string, presetId: string) =>
-      send(deleteRiskPolicyContract, { pathPrefix: ws(workspaceId), pathParams: { presetId } }),
+    deleteRiskPolicy: (kind: RiskPolicyTier, id: string, presetId: string) =>
+      send(deleteRiskPolicyContract, { pathPrefix: scope(kind, id), pathParams: { presetId } }),
 
     // Restore a built-in preset to its current catalog definition (adopt an update, repair a
     // drifted one, or materialise a new built-in that appeared). Custom presets reject this.
+    // Workspace-only: the built-in catalog is copied into BOARDS, so only a board has one to restore.
     reseedRiskPolicy: (workspaceId: string, presetId: string) =>
       send(reseedRiskPolicyContract, { pathPrefix: ws(workspaceId), pathParams: { presetId } }),
 
+    // ---- inheritance (workspace only) -------------------------------------
+    // Copy an inherited account policy into the board's own tier, under a fresh id, so the board can
+    // edit its numbers. `name` is optional; the SPA sends the localized "copy" label.
+    cloneRiskPolicy: (workspaceId: string, presetId: string, body: { name?: string }) =>
+      send(cloneRiskPolicyContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { presetId },
+        body,
+      }),
+
+    // Hide an inherited account policy from this board, and the inverse. Deliberately NOT the delete
+    // above: that removes a row the board owns, this withholds one it does not and is reversible.
+    suppressRiskPolicy: (workspaceId: string, presetId: string) =>
+      send(suppressRiskPolicyContract, { pathPrefix: ws(workspaceId), pathParams: { presetId } }),
+
+    restoreRiskPolicy: (workspaceId: string, presetId: string) =>
+      send(restoreRiskPolicyContract, { pathPrefix: ws(workspaceId), pathParams: { presetId } }),
+
+    // What the board is hiding. Its own read because a hidden policy is by construction absent from
+    // the list above, so without it the editor could offer no way back.
+    listRiskPolicySuppressions: (workspaceId: string) =>
+      send(listRiskPolicySuppressionsContract, { pathPrefix: ws(workspaceId) }),
+
     // ---- merge track record (the per-class evidence behind the policy) -----
     // Every class in ONE request (a single SQL aggregate server-side), so the preset editor can
     // show each class's rule next to the numbers that justify widening it without fanning out.

package/app/composables/usePipelineErrorToast.ts

@@ -91,6 +91,17 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
     titleKey: 'errors.conflict.title.input_gate_parked',
     descriptionKey: 'errors.conflict.description.input_gate_parked',
   },
+  // The two halves of "this policy is not yours to change" (ADR 0055). They get opposite copy on
+  // purpose: the first sends the reader to the clone action, the second to the delete, and one
+  // shared string could only describe whichever case the reader was not in.
+  risk_policy_inherited: {
+    titleKey: 'errors.conflict.title.risk_policy_inherited',
+    descriptionKey: 'errors.conflict.description.risk_policy_inherited',
+  },
+  risk_policy_not_inherited: {
+    titleKey: 'errors.conflict.title.risk_policy_not_inherited',
+    descriptionKey: 'errors.conflict.description.risk_policy_not_inherited',
+  },
   task_limit_reached: {
     titleKey: 'errors.conflict.title.task_limit_reached',
     descriptionKey: 'errors.conflict.description.task_limit_reached',

package/app/composables/useRiskPolicyHealth.ts

@@ -31,16 +31,29 @@ function builtinName(id: string, stored: RiskPolicy | undefined): string {
  * versions the snapshot ships ARE the set of built-in ids, so detection is entirely client-side:
  * a stored preset is a built-in iff its id is a catalog key, and a catalog key with no stored
  * preset is a new built-in.
+ *
+ * Asked of the WORKSPACE tier alone. Reseeding writes a board-owned row, so only a board-owned row
+ * can be out of date, and only an id no tier resolves is genuinely missing (ADR 0055).
  */
 export function useRiskPolicyHealth() {
   const store = useRiskPoliciesStore()
 
   const issues = computed<RiskPolicyIssue[]>(() => {
     const out: RiskPolicyIssue[] = []
-    const byId = new Map(store.presets.map((p) => [p.id, p]))
+    // The BOARD'S OWN rows only. Since ADR 0055 `presets` is the merged two-tier library, and an
+    // account entry carries no `version`, so indexing the merge read an account policy that happens
+    // to use a catalog id as a stored built-in stuck at version 0 — an advisory whose reseed would
+    // have written a board-owned row shadowing the account's deliberate posture.
+    const own = store.presets.filter((p) => p.tier === 'workspace')
+    const byId = new Map(own.map((p) => [p.id, p]))
+    const inheritedIds = new Set(store.presets.filter((p) => p.tier === 'account').map((p) => p.id))
     for (const [id, catalogVersion] of Object.entries(store.catalogVersions)) {
       const stored = byId.get(id)
       if (!stored) {
+        // A built-in the board does not hold, that its ACCOUNT defines, is not missing: the board
+        // already resolves a policy under that id. Adding the catalog copy would shadow it, so the
+        // advisory stays silent rather than offering a one-click override of the org's choice.
+        if (inheritedIds.has(id)) continue
         out.push({ type: 'new', id, name: builtinName(id, undefined) })
         continue
       }

package/app/composables/useRunStart.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { nextTick, ref, type Ref } from 'vue'
 import type { Block, Pipeline } from '~/types/domain'
-import type { RiskPolicy, WorkspaceRole } from '~/types/merge'
+import type { RiskPolicyLibraryEntry, WorkspaceRole } from '~/types/merge'
 import { useBoardStore } from '~/stores/board'
 import { useExecutionStore } from '~/stores/execution'
 import { useRiskPoliciesStore } from '~/stores/riskPolicies'
@@ -14,7 +14,7 @@ import { useDryRunPolicy, useRunStart } from '~/composables/useRunStart'
 // stubbed, since neither an HTTP call nor an auth gate is what these assertions are about.
 const pipeline = { id: 'pl_build', name: 'Build' } as Pipeline
 
-const preset = (over: Partial<RiskPolicy> = {}): RiskPolicy =>
+const preset = (over: Partial<RiskPolicyLibraryEntry> = {}): RiskPolicyLibraryEntry =>
   ({
     id: 'mp_balanced',
     name: 'Balanced',
@@ -35,9 +35,13 @@ const preset = (over: Partial<RiskPolicy> = {}): RiskPolicy =>
     classRulesByRole: {},
     dryRunRoles: [],
     isDefault: true,
+    // The board's OWN tier: what these assertions are about is the policy the board resolves, and an
+    // inherited one resolves identically (that is the point of the merge), so the fixture states the
+    // ordinary case rather than parameterising a tier nothing here branches on.
+    tier: 'workspace',
     createdAt: 0,
     ...over,
-  }) as RiskPolicy
+  }) as RiskPolicyLibraryEntry
 
 /**
  * Seed a board governed by `policy`, signed in as `role`, and hand back the composable.
@@ -48,8 +52,8 @@ const preset = (over: Partial<RiskPolicy> = {}): RiskPolicy =>
  */
 function setup(options: {
   role: WorkspaceRole | null
-  policy?: RiskPolicy
-  otherPolicy?: RiskPolicy
+  policy?: RiskPolicyLibraryEntry
+  otherPolicy?: RiskPolicyLibraryEntry
   advanced?: boolean
 }) {
   const start = vi.fn().mockResolvedValue(true)

package/app/stores/riskPolicies.ts

@@ -1,18 +1,27 @@
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
-import type { RiskPolicy, UpdateRiskPolicyInput } from '~/types/domain'
+import type {
+  RiskPolicyLibraryEntry,
+  RiskPolicySuppression,
+  UpdateRiskPolicyInput,
+} from '~/types/merge'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
- * The workspace's merge threshold presets — the library a task picks its
- * auto-merge policy from (the `merger` step compares the PR assessment against the
- * resolved preset). Hydrated from the workspace snapshot; managed via a small
- * settings UI. The backend always keeps at least one default preset.
+ * The board's risk policy library — what a task picks its auto-merge policy from (the `merger` step
+ * compares the PR assessment against the resolved policy).
+ *
+ * Since ADR 0055 the list is the MERGE of two tiers: the board's own policies and the ones it
+ * inherits from its account, each entry carrying the `tier` that owns it. An inherited entry is
+ * read-only here and offers two actions instead of an edit — clone it into the board, or hide it —
+ * and the backend refuses the writes as well, so the affordances and the rules agree.
+ *
+ * Hydrated from the workspace snapshot, which carries the same merged list.
  */
 export const useRiskPoliciesStore = defineStore('riskPolicies', () => {
   const api = useApi()
 
-  const presets = ref<RiskPolicy[]>([])
+  const presets = ref<RiskPolicyLibraryEntry[]>([])
   /**
    * Current built-in catalog versions (`seedRiskPolicies()`), keyed by preset id, from the
    * workspace snapshot. The keys ARE the set of built-in ids: a stored preset whose id is a
@@ -21,9 +30,24 @@ export const useRiskPoliciesStore = defineStore('riskPolicies', () => {
    * `useRiskPolicyHealth`.
    */
   const catalogVersions = ref<Record<string, number>>({})
+  /**
+   * The account policies this board is HIDING. Loaded on demand rather than from the snapshot: a
+   * hidden policy is by construction absent from `presets`, so this is the only way back, and it is
+   * read when the settings panel opens rather than on every board load.
+   */
+  const suppressions = ref<RiskPolicySuppression[]>([])
 
-  function hydrate(list: RiskPolicy[], versions?: Record<string, number>) {
-    presets.value = [...list].sort((a, b) => a.createdAt - b.createdAt)
+  /**
+   * Adopt the server's list AS SENT, never re-sorted.
+   *
+   * `mergeRiskPolicyTiers` answers oldest-first within each tier with the ACCOUNT tier first, and
+   * both repositories order by `created_at`, so the order already carries the tier grouping every
+   * reader wants. Re-sorting the merged list by timestamp interleaved the two, which the settings
+   * panel hid by re-splitting per tier and the task picker showed as inherited and own policies
+   * shuffled together.
+   */
+  function hydrate(list: RiskPolicyLibraryEntry[], versions?: Record<string, number>) {
+    presets.value = [...list]
     if (versions) catalogVersions.value = versions
   }
 
@@ -31,7 +55,7 @@ export const useRiskPoliciesStore = defineStore('riskPolicies', () => {
   const defaultPreset = computed(() => presets.value.find((p) => p.isDefault) ?? null)
 
   /** Resolve a task's effective preset by id, falling back to the default. */
-  function resolve(presetId: string | undefined): RiskPolicy | null {
+  function resolve(presetId: string | undefined): RiskPolicyLibraryEntry | null {
     if (presetId) {
       const picked = presets.value.find((p) => p.id === presetId)
       if (picked) return picked
@@ -39,23 +63,23 @@ export const useRiskPoliciesStore = defineStore('riskPolicies', () => {
     return defaultPreset.value
   }
 
-  async function create(input: Parameters<typeof api.createRiskPolicy>[1]) {
+  async function create(input: Parameters<typeof api.createRiskPolicy>[2]) {
     const ws = useWorkspaceStore()
-    const created = await api.createRiskPolicy(ws.requireId(), input)
+    const created = await api.createRiskPolicy('workspace', ws.requireId(), input)
     await ws.refresh()
     return created
   }
 
   async function update(presetId: string, patch: UpdateRiskPolicyInput) {
     const ws = useWorkspaceStore()
-    const updated = await api.updateRiskPolicy(ws.requireId(), presetId, patch)
+    const updated = await api.updateRiskPolicy('workspace', ws.requireId(), presetId, patch)
     await ws.refresh()
     return updated
   }
 
   async function remove(presetId: string) {
     const ws = useWorkspaceStore()
-    await api.deleteRiskPolicy(ws.requireId(), presetId)
+    await api.deleteRiskPolicy('workspace', ws.requireId(), presetId)
     await ws.refresh()
   }
 
@@ -71,9 +95,41 @@ export const useRiskPoliciesStore = defineStore('riskPolicies', () => {
     return updated
   }
 
+  /**
+   * Copy an inherited account policy into the board, under a fresh id, so the board can edit it.
+   * `name` is supplied by the caller because the label is localized copy and the backend does not
+   * localize prose.
+   */
+  async function clone(presetId: string, name?: string) {
+    const ws = useWorkspaceStore()
+    const created = await api.cloneRiskPolicy(ws.requireId(), presetId, name ? { name } : {})
+    await ws.refresh()
+    return created
+  }
+
+  /** Hide an inherited account policy from this board, then re-read what is hidden. */
+  async function hide(presetId: string) {
+    const ws = useWorkspaceStore()
+    await api.suppressRiskPolicy(ws.requireId(), presetId)
+    await Promise.all([ws.refresh(), loadSuppressions()])
+  }
+
+  /** Stop hiding one, so the board offers it again. */
+  async function unhide(presetId: string) {
+    const ws = useWorkspaceStore()
+    await api.restoreRiskPolicy(ws.requireId(), presetId)
+    await Promise.all([ws.refresh(), loadSuppressions()])
+  }
+
+  async function loadSuppressions() {
+    const ws = useWorkspaceStore()
+    suppressions.value = await api.listRiskPolicySuppressions(ws.requireId())
+  }
+
   return {
     presets,
     catalogVersions,
+    suppressions,
     defaultPreset,
     resolve,
     hydrate,
@@ -81,5 +137,59 @@ export const useRiskPoliciesStore = defineStore('riskPolicies', () => {
     update,
     remove,
     reseed,
+    clone,
+    hide,
+    unhide,
+    loadSuppressions,
   }
 })
+
+/**
+ * The ACCOUNT tier of the same library: the postures an org authors once, which every board under
+ * it inherits (ADR 0055).
+ *
+ * Its own store rather than a scope flag on the one above, because the two have different lifetimes
+ * and different sources of truth: the board library rides the workspace snapshot and refreshes with
+ * it, while the account library is loaded on demand by the account settings panel and has no
+ * snapshot to fold into. Keyed by account id so switching accounts cannot show the previous one's
+ * policies.
+ */
+export const useAccountRiskPoliciesStore = defineStore('accountRiskPolicies', () => {
+  const api = useApi()
+
+  const byAccount = ref<Record<string, RiskPolicyLibraryEntry[]>>({})
+  const loading = ref(false)
+
+  const policies = (accountId: string) => byAccount.value[accountId] ?? []
+
+  async function load(accountId: string) {
+    loading.value = true
+    try {
+      byAccount.value = {
+        ...byAccount.value,
+        [accountId]: await api.listRiskPolicies('account', accountId),
+      }
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function create(accountId: string, input: Parameters<typeof api.createRiskPolicy>[2]) {
+    const created = await api.createRiskPolicy('account', accountId, input)
+    await load(accountId)
+    return created
+  }
+
+  async function update(accountId: string, presetId: string, patch: UpdateRiskPolicyInput) {
+    const updated = await api.updateRiskPolicy('account', accountId, presetId, patch)
+    await load(accountId)
+    return updated
+  }
+
+  async function remove(accountId: string, presetId: string) {
+    await api.deleteRiskPolicy('account', accountId, presetId)
+    await load(accountId)
+  }
+
+  return { policies, loading, load, create, update, remove }
+})

package/app/types/merge.ts

@@ -25,4 +25,9 @@ export type {
   RiskPolicy,
   CreateRiskPolicyInput,
   UpdateRiskPolicyInput,
+  // The two tiers a policy can be stored at, the merged library entry a board picks from, and one
+  // account policy a board is hiding (ADR 0055).
+  RiskPolicyTier,
+  RiskPolicyLibraryEntry,
+  RiskPolicySuppression,
 } from '@cat-factory/contracts'

package/app/utils/riskPolicy.spec.ts

@@ -1,9 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import type { RiskPolicy } from '~/types/merge'
+import { RISK_POLICY_NAME_MAX_LENGTH } from '@cat-factory/contracts'
 import {
   RISK_POLICY_AXES,
   RISK_POLICY_CEILING_FIELD,
   riskPolicyCeilings,
+  riskPolicyCopyName,
   rolePolicySummary,
 } from '~/utils/riskPolicy'
 
@@ -101,3 +103,29 @@ describe('rolePolicySummary', () => {
     expect(rolePolicySummary(p)).toEqual({ sandboxed: ['member'], narrowed: [], scoped: [] })
   })
 })
+
+describe('riskPolicyCopyName', () => {
+  // The template the SPA actually uses for the clone action.
+  const copy = (name: string) => `${name} (copy)`
+
+  it('leaves a name with room to spare alone', () => {
+    expect(riskPolicyCopyName('Balanced', copy)).toBe('Balanced (copy)')
+  })
+
+  it('keeps the copy marker by trimming the SOURCE name, not the result', () => {
+    // 58 chars, so ' (copy)' would put the composed name 5 over the 60-char contract limit. The
+    // clone action was simply unavailable for such a policy: a 422 against a name with no field to
+    // edit. The marker is the informative half, so the source name is what gives way.
+    const long = 'Balanced posture for revenue services with schema review!!'
+    expect(long.length).toBe(58)
+    const composed = riskPolicyCopyName(long, copy)
+    expect(composed.length).toBeLessThanOrEqual(RISK_POLICY_NAME_MAX_LENGTH)
+    expect(composed.endsWith('(copy)')).toBe(true)
+    expect(long.startsWith(composed.slice(0, composed.indexOf(' (copy)')))).toBe(true)
+  })
+
+  it('still answers within the limit when the template alone would blow the budget', () => {
+    const verbose = (name: string) => `${name} ${'x'.repeat(RISK_POLICY_NAME_MAX_LENGTH)}`
+    expect(riskPolicyCopyName('Balanced', verbose).length).toBe(RISK_POLICY_NAME_MAX_LENGTH)
+  })
+})

package/app/utils/riskPolicy.ts

@@ -1,6 +1,29 @@
-import { WORKSPACE_ROLES } from '@cat-factory/contracts'
+import { RISK_POLICY_NAME_MAX_LENGTH, WORKSPACE_ROLES } from '@cat-factory/contracts'
 import type { RiskPolicy, WorkspaceRole } from '~/types/merge'
 
+/**
+ * The name a CLONE of an inherited policy is created under, guaranteed to satisfy the contract's
+ * length limit.
+ *
+ * The label is composed here because the backend does not localize prose, which puts the contract's
+ * ceiling on this side of the wire too: a source name near the limit plus whatever the locale's
+ * template adds is over it, and the clone action then failed with a 422 against a name the operator
+ * had no field to shorten. The SOURCE name is what gets trimmed rather than the composed string, so
+ * the copy marker (the informative half) always survives.
+ *
+ * `compose` is passed in rather than `t` so this stays a pure function with no i18n dependency.
+ */
+export function riskPolicyCopyName(sourceName: string, compose: (name: string) => string): string {
+  const full = compose(sourceName)
+  if (full.length <= RISK_POLICY_NAME_MAX_LENGTH) return full
+  // What the template itself costs, so the trim leaves room for it rather than guessing.
+  const overhead = full.length - sourceName.length
+  const room = Math.max(1, RISK_POLICY_NAME_MAX_LENGTH - overhead)
+  // The final slice is the backstop for a template long enough to blow the budget on its own,
+  // where no source name would fit: better a truncated label than an action that cannot be used.
+  return compose(sourceName.slice(0, room).trimEnd()).slice(0, RISK_POLICY_NAME_MAX_LENGTH)
+}
+
 /**
  * The three axes a `merger` agent scores a pull request on. Presentation order is
  * risk → impact → complexity: what the PR could break first, then how far it reaches, then