@cat-factory/orchestration 0.264.1 → 0.265.0

package/dist/modules/merge/WorkspaceRiskPolicyLibrary.js

@@ -0,0 +1,156 @@
+import { describeRiskPolicySuppressions, mergeRiskPolicyTiers, resolveRiskPolicyTier, } from '@cat-factory/kernel';
+/**
+ * A board's risk-policy library: its OWN policies merged with the account policies it inherits
+ * (ADR 0055), behind the same three reads every consumer already made of the workspace tier.
+ *
+ * It is the {@link WorkspaceRiskPolicyReader} the engine's `resolveRiskPolicy`, the board's two
+ * selection guards, the settings editor and the snapshot all hold, and that is the point: a
+ * resolution that admitted an id the editor calls hidden — or refused one a picker offered — would
+ * decide how much oversight a task's merge takes by a rule nobody can see. The PRECEDENCE itself
+ * lives in kernel (`mergeRiskPolicyTiers` / `resolveRiskPolicyTier`), so this class is only the I/O
+ * around it and the two cannot drift.
+ */
+/**
+ * Build the library from a container's dependency bag, or `undefined` when no board tier is wired.
+ *
+ * Every consumer composes it through THIS factory rather than reaching for the repositories itself:
+ * the board guards, the engine's wiring and the risk-policy module each need the same three-store
+ * composition, and the one that assembled it by hand would be the one that forgot the suppression
+ * store and quietly resolved a policy the editor calls hidden. Instances hold no state, so building
+ * one per consumer costs nothing.
+ */
+export function createWorkspaceRiskPolicyLibrary(deps) {
+    if (!deps.riskPolicyRepository)
+        return undefined;
+    return new WorkspaceRiskPolicyLibrary({
+        riskPolicyRepository: deps.riskPolicyRepository,
+        accountRiskPolicyRepository: deps.accountRiskPolicyRepository,
+        riskPolicySuppressionRepository: deps.riskPolicySuppressionRepository,
+        workspaceRepository: deps.workspaceRepository,
+    });
+}
+export class WorkspaceRiskPolicyLibrary {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The merged library, account tier first, each entry tagged with the tier that owns it. */
+    async list(workspaceId) {
+        const [workspacePolicies, inherited] = await Promise.all([
+            this.deps.riskPolicyRepository.list(workspaceId),
+            this.inheritedTier(workspaceId),
+        ]);
+        return mergeRiskPolicyTiers({ ...inherited, workspacePolicies });
+    }
+    /**
+     * One policy by id, under the same precedence {@link list} applies.
+     *
+     * The board's own tier is read FIRST and answers alone when it hits, which is both the correct
+     * precedence and the common case: a task usually pins a policy its own board holds, and paying
+     * for the account reads only on a miss keeps the engine's per-gate resolution at one query where
+     * it already was.
+     */
+    async get(workspaceId, id) {
+        const own = await this.deps.riskPolicyRepository.get(workspaceId, id);
+        if (own)
+            return resolveRiskPolicyTier({ workspacePolicy: own, accountPolicy: null, suppressed: false });
+        const accountId = await this.accountOf(workspaceId);
+        if (!accountId)
+            return null;
+        const [accountPolicy, suppressedIds] = await Promise.all([
+            this.deps.accountRiskPolicyRepository?.get(accountId, id) ?? Promise.resolve(null),
+            this.suppressedIds(workspaceId),
+        ]);
+        return resolveRiskPolicyTier({
+            workspacePolicy: null,
+            accountPolicy,
+            suppressed: suppressedIds.includes(id),
+        });
+    }
+    /**
+     * The board's default for one scope — the WORKSPACE tier's own answer, unchanged by inheritance.
+     *
+     * A delegate rather than a merge, and deliberately so: an account row carries no default claim
+     * (see `AccountRiskPolicy`), because which policy governs a task that pinned nothing is a
+     * per-board question that no single account row could answer correctly for every board under it.
+     * A board that wants an inherited posture as its default clones it and promotes the copy.
+     */
+    getDefault(workspaceId, scope) {
+        return this.deps.riskPolicyRepository.getDefault(workspaceId, scope);
+    }
+    /**
+     * What this board hides, joined against the account tier for identity — including the entries
+     * that now hide nothing because the account withdrew the policy (see
+     * `describeRiskPolicySuppressions`).
+     */
+    async listSuppressions(workspaceId) {
+        const suppressedIds = await this.suppressedIds(workspaceId);
+        if (suppressedIds.length === 0)
+            return [];
+        const accountId = await this.accountOf(workspaceId);
+        // Only the suppressed ids, in ONE batched read: a board hides a handful of policies out of a
+        // tier that an account is free to grow, so listing the whole tier to name a few rows would
+        // read more the larger the account got.
+        const named = accountId && this.deps.accountRiskPolicyRepository
+            ? await this.deps.accountRiskPolicyRepository.listByIds(accountId, suppressedIds)
+            : [];
+        return describeRiskPolicySuppressions(suppressedIds, named);
+    }
+    /**
+     * The account policy this board actually INHERITS under `id`, or null.
+     *
+     * Suppression-aware, under exactly the precedence {@link list} and {@link get} apply, because that
+     * is what makes this the merged reader rather than a second opinion: a hidden id is absent from the
+     * library, so a guard answering off the raw account row would let a board CLONE a posture it had
+     * just opted out of, and would tell an operator editing that id that the account governs their
+     * board when the board has withdrawn it.
+     */
+    async inheritedPolicy(workspaceId, id) {
+        const [policy, suppressedIds] = await Promise.all([
+            this.accountPolicy(workspaceId, id),
+            this.suppressedIds(workspaceId),
+        ]);
+        return policy && !suppressedIds.includes(id) ? policy : null;
+    }
+    /**
+     * What the ACCOUNT defines under `id`, whether or not this board hides it.
+     *
+     * Deliberately suppression-BLIND, and its own method rather than a flag on the one above, for the
+     * single caller that needs it: hiding is idempotent, so hiding an already-hidden policy has to
+     * settle as the state it already is. Asked through {@link inheritedPolicy} that request would 404
+     * on the second click, which is a refusal reporting a failure for a board that is in exactly the
+     * state the request asked for.
+     */
+    async accountPolicy(workspaceId, id) {
+        const accountId = await this.accountOf(workspaceId);
+        if (!accountId || !this.deps.accountRiskPolicyRepository)
+            return null;
+        return this.deps.accountRiskPolicyRepository.get(accountId, id);
+    }
+    /** The account tier as the merge wants it: its policies plus this board's suppressions. */
+    async inheritedTier(workspaceId) {
+        const accountId = await this.accountOf(workspaceId);
+        // A board with no account inherits nothing, so neither read is worth making.
+        if (!accountId)
+            return { accountPolicies: [], suppressedIds: [] };
+        const [accountPolicies, suppressedIds] = await Promise.all([
+            this.deps.accountRiskPolicyRepository?.list(accountId) ?? Promise.resolve([]),
+            this.suppressedIds(workspaceId),
+        ]);
+        return { accountPolicies, suppressedIds };
+    }
+    suppressedIds(workspaceId) {
+        return this.deps.riskPolicySuppressionRepository?.list(workspaceId) ?? Promise.resolve([]);
+    }
+    async accountOf(workspaceId) {
+        // No account tier wired ⇒ nothing to address, so the lookup itself is skipped rather than
+        // made and discarded. This is the pass-through: every read answers the workspace tier alone.
+        if (!this.deps.accountRiskPolicyRepository)
+            return null;
+        // The port answers `undefined` for a board it cannot place and `null` for one with no account;
+        // both mean "inherits nothing here", and normalising once keeps every caller above from having
+        // to know there are two spellings of it.
+        return (await this.deps.workspaceRepository.accountOf(workspaceId)) ?? null;
+    }
+}
+//# sourceMappingURL=WorkspaceRiskPolicyLibrary.js.map

package/dist/modules/merge/WorkspaceRiskPolicyLibrary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceRiskPolicyLibrary.js","sourceRoot":"","sources":["../../../src/modules/merge/WorkspaceRiskPolicyLibrary.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAqB5B;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAKhD;IACC,IAAI,CAAC,IAAI,CAAC,oBAAoB;QAAE,OAAO,SAAS,CAAA;IAChD,OAAO,IAAI,0BAA0B,CAAC;QACpC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,+BAA+B,EAAE,IAAI,CAAC,+BAA+B;QACrE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAAoC;oBAApC,IAAI;IAAmC,CAAC;IAErE,4FAA4F;IAC5F,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;SAChC,CAAC,CAAA;QACF,OAAO,oBAAoB,CAAC,EAAE,GAAG,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAClE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACrE,IAAI,GAAG;YACL,OAAO,qBAAqB,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QAChG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAC3B,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAClF,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;SAChC,CAAC,CAAA;QACF,OAAO,qBAAqB,CAAC;YAC3B,eAAe,EAAE,IAAI;YACrB,aAAa;YACb,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;SACvC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,WAAmB,EAAE,KAAsB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACnD,6FAA6F;QAC7F,2FAA2F;QAC3F,wCAAwC;QACxC,MAAM,KAAK,GACT,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,2BAA2B;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;YACjF,CAAC,CAAC,EAAE,CAAA;QACR,OAAO,8BAA8B,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,EAAU;QACnD,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;SAChC,CAAC,CAAA;QACF,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,EAAU;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;YAAE,OAAO,IAAI,CAAA;QACrE,OAAO,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,aAAa,CACzB,WAAmB;QAEnB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACnD,6EAA6E;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;QACjE,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;SAChC,CAAC,CAAA;QACF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAA;IAC3C,CAAC;IAEO,aAAa,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,WAAmB;QACzC,0FAA0F;QAC1F,6FAA6F;QAC7F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;YAAE,OAAO,IAAI,CAAA;QACvD,+FAA+F;QAC/F,+FAA+F;QAC/F,yCAAyC;QACzC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAA;IAC7E,CAAC;CACF"}

package/dist/modules/merge/riskPolicyResolution.d.ts

@@ -1,5 +1,5 @@
 import type { GroupCacheHandle, RiskPolicy, RiskPolicyCacheValue, RunDefaultScope } from '@cat-factory/kernel';
-import type { RiskPolicyRepository } from '@cat-factory/kernel';
+import type { WorkspaceRiskPolicyReader } from '@cat-factory/kernel';
 import type { ResolvedRunRiskPolicy } from '../execution/policy-types.js';
 /**
  * WHICH row a resolution wants: the id the task pinned, or the workspace's default.
@@ -44,16 +44,20 @@ export declare function preloadedRiskPolicyRead(library: readonly RiskPolicy[]):
 /**
  * Resolve the preset governing `riskPolicyId` in a workspace.
  *
- * An ABSENT repository is not a hole to guard: with no preset library there is nothing for a task
+ * An ABSENT reader is not a hole to guard: with no preset library there is nothing for a task
  * to point at, so every task in the deployment is governed by {@link FALLBACK_RISK_POLICY}, whose
  * role layer is empty and therefore holds nobody to anything, and which auto-merges nothing, so
  * the deployment that configured no policy lands no PR without a human.
  *
- * A wired repository answers from a library the board was seeded with at CREATION, so reaching
+ * A wired reader answers from a library the board was seeded with at CREATION, so reaching
  * the fallback is a deployment-level fact rather than a question of who had read what first.
+ *
+ * It is a `WorkspaceRiskPolicyReader` and not the workspace-tier repository, because a board's
+ * library includes the account policies it INHERITS (ADR 0055): a task may pin one, and the same
+ * merged view the picker offered has to be the one that governs the run.
  */
 export declare function resolveRiskPolicy(input: {
-    repository: RiskPolicyRepository | undefined;
+    repository: WorkspaceRiskPolicyReader | undefined;
     workspaceId: string;
     riskPolicyId: string | null | undefined;
     /**

package/dist/modules/merge/riskPolicyResolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"riskPolicyResolution.d.ts","sourceRoot":"","sources":["../../../src/modules/merge/riskPolicyResolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAkBzE;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAA;AAE/C,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KACnC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;AAE/B,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,EAAE,cAA0C,CAAA;AAa7E;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,SAAS,EACzD,WAAW,EAAE,MAAM,GAClB,cAAc,CAKhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,cAAc,CAUtF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,UAAU,EAAE,oBAAoB,GAAG,SAAS,CAAA;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACvC;;;;OAIG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB,IAAI,CAAC,EAAE,cAAc,CAAA;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAcjC"}
+{"version":3,"file":"riskPolicyResolution.d.ts","sourceRoot":"","sources":["../../../src/modules/merge/riskPolicyResolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAkBzE;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAA;AAE/C,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KACnC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;AAE/B,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,EAAE,cAA0C,CAAA;AAa7E;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,SAAS,EACzD,WAAW,EAAE,MAAM,GAClB,cAAc,CAKhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,cAAc,CAUtF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,UAAU,EAAE,yBAAyB,GAAG,SAAS,CAAA;IACjD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACvC;;;;OAIG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB,IAAI,CAAC,EAAE,cAAc,CAAA;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAcjC"}

package/dist/modules/merge/riskPolicyResolution.js

@@ -47,13 +47,17 @@ export function preloadedRiskPolicyRead(library) {
 /**
  * Resolve the preset governing `riskPolicyId` in a workspace.
  *
- * An ABSENT repository is not a hole to guard: with no preset library there is nothing for a task
+ * An ABSENT reader is not a hole to guard: with no preset library there is nothing for a task
  * to point at, so every task in the deployment is governed by {@link FALLBACK_RISK_POLICY}, whose
  * role layer is empty and therefore holds nobody to anything, and which auto-merges nothing, so
  * the deployment that configured no policy lands no PR without a human.
  *
- * A wired repository answers from a library the board was seeded with at CREATION, so reaching
+ * A wired reader answers from a library the board was seeded with at CREATION, so reaching
  * the fallback is a deployment-level fact rather than a question of who had read what first.
+ *
+ * It is a `WorkspaceRiskPolicyReader` and not the workspace-tier repository, because a board's
+ * library includes the account policies it INHERITS (ADR 0055): a task may pin one, and the same
+ * merged view the picker offered has to be the one that governs the run.
  */
 export async function resolveRiskPolicy(input) {
     const { repository, workspaceId, riskPolicyId, scope } = input;

package/dist/modules/merge/riskPolicyResolution.js.map

@@ -1 +1 @@
-{"version":3,"file":"riskPolicyResolution.js","sourceRoot":"","sources":["../../../src/modules/merge/riskPolicyResolution.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAqC1D,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;AAE7E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,EAAE,CAAA;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAyD,EACzD,WAAmB;IAEnB,IAAI,CAAC,KAAK;QAAE,OAAO,oBAAoB,CAAA;IACvC,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5B,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;SACvF,MAAM,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA8B;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAClE,MAAM,QAAQ,GAA+C;QAC3D,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/D,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,IAAI;KACzE,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,OAAO,CAAC,OAAO,CACb,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAClF,CAAA;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAWvC;IACC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,oBAAoB,CAAA;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,oBAAoB,CAAA;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CACnE,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAC1C,CAAA;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;IAC3B,CAAC;IACD,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QACzF,oBAAoB,CACrB,CAAA;AACH,CAAC"}
+{"version":3,"file":"riskPolicyResolution.js","sourceRoot":"","sources":["../../../src/modules/merge/riskPolicyResolution.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAqC1D,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;AAE7E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,EAAE,CAAA;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAyD,EACzD,WAAmB;IAEnB,IAAI,CAAC,KAAK;QAAE,OAAO,oBAAoB,CAAA;IACvC,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5B,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;SACvF,MAAM,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA8B;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAClE,MAAM,QAAQ,GAA+C;QAC3D,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI;QAC/D,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,IAAI;KACzE,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,OAAO,CAAC,OAAO,CACb,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAClF,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAWvC;IACC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,oBAAoB,CAAA;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,oBAAoB,CAAA;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CACnE,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAC1C,CAAA;QACD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;IAC3B,CAAC;IACD,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QACzF,oBAAoB,CACrB,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/orchestration",
-  "version": "0.264.1",
+  "version": "0.265.0",
   "description": "Delivery-workflow engine for the Agent Architecture Board (execution, bootstrap, pipelines, board, boardScan, requirements, and composition root).",
   "repository": {
     "type": "git",
@@ -25,20 +25,20 @@
   },
   "dependencies": {
     "ai": "^7.0.58",
-    "@cat-factory/agents": "0.127.0",
-    "@cat-factory/caching": "0.20.9",
-    "@cat-factory/contracts": "0.302.0",
-    "@cat-factory/integrations": "0.160.7",
-    "@cat-factory/kernel": "0.293.0",
-    "@cat-factory/prompt-fragments": "1.0.64",
-    "@cat-factory/sandbox": "0.11.141",
-    "@cat-factory/spend": "0.15.82",
-    "@cat-factory/workspaces": "0.27.26"
+    "@cat-factory/agents": "0.127.1",
+    "@cat-factory/caching": "0.20.10",
+    "@cat-factory/contracts": "0.303.0",
+    "@cat-factory/kernel": "0.294.0",
+    "@cat-factory/integrations": "0.160.8",
+    "@cat-factory/spend": "0.15.83",
+    "@cat-factory/sandbox": "0.11.142",
+    "@cat-factory/workspaces": "0.27.27",
+    "@cat-factory/prompt-fragments": "1.0.65"
   },
   "devDependencies": {
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
-    "@cat-factory/sandbox-fixtures": "0.7.343"
+    "@cat-factory/sandbox-fixtures": "0.7.344"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",