@nanobpm/nano-workforce 0.202.0 → 0.203.0

package/operations/listAutoResolutions.ts

@@ -0,0 +1,83 @@
+// GET /app/api/auto-resolutions → operationId `listAutoResolutions` (issue #889). The read door for
+// the Auto-resolutions view + the matching MCP tool: list the escalation steward's durable,
+// reviewable records (every escalation it resolved or abstained from), newest first, filtered by
+// `reviewState` / `subject` / `kind`. Read-only projection over the ONE `escalation_auto_resolutions`
+// table (app/escalationSteward.ts) — no second source of truth. The optional shared-secret guard
+// mirrors `listEscalations`.
+import {
+  type EscalationAutoResolution,
+  listAutoResolutions,
+  pendingAutoResolutionCount,
+} from "../app/escalationSteward.ts";
+import { envVar } from "../app/version.ts";
+import { defineOperation } from "../nano-generated/operations.ts";
+
+const SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
+
+/** Project one stored row into its API/read-tool entry (camelCase, parsed JSON fields). */
+function toView(r: EscalationAutoResolution) {
+  const parseJsonArray = (s: string | null): unknown[] | null => {
+    if (s == null) return null;
+    try {
+      const v: unknown = JSON.parse(s);
+      return Array.isArray(v) ? v : null;
+    } catch {
+      return null;
+    }
+  };
+  const parseJsonObject = (s: string | null): { [key: string]: unknown } | null => {
+    if (s == null) return null;
+    try {
+      const v: unknown = JSON.parse(s);
+      if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+        // biome-ignore lint/plugin: narrowing a parsed JSON object to a string-keyed record (validated object above)
+        return v as { [key: string]: unknown };
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  };
+  return {
+    id: r.id,
+    userTaskKey: r.user_task_key,
+    kind: r.escalation_kind,
+    elementId: r.element_id,
+    subjectType: r.subject_type,
+    subjectKey: r.subject_key,
+    subjectUrl: r.subject_url,
+    processInstanceKey: r.process_instance_key,
+    question: r.question,
+    options: parseJsonArray(r.options),
+    outcome: r.outcome === "resolved" ? ("resolved" as const) : ("abstained" as const),
+    submittedVariables: parseJsonObject(r.submitted_variables),
+    // The first-class "what the steward chose" value (issue #889 review): derived host-side at record
+    // time, so consumers read it directly instead of decoding `submittedVariables`. NULL when abstained.
+    selectedOption: r.selected_option ?? null,
+    rationale: r.rationale,
+    evidence: r.evidence,
+    stewardInstanceKey: r.steward_instance_key,
+    agentJobKey: r.agent_job_key,
+    worker: r.worker,
+    model: r.model,
+    createdAt: r.created_at,
+    reviewState: r.review_state,
+    reviewedBy: r.reviewed_by,
+    reviewedAt: r.reviewed_at,
+    reviewNote: r.review_note,
+  };
+}
+
+export default defineOperation("listAutoResolutions", async ({ query, req }, app) => {
+  if (SECRET && req.headers.get("x-hook-secret") !== SECRET) {
+    app.log.warn("listAutoResolutions rejected: missing/invalid shared secret");
+    return { status: 401, body: { error: "unauthorized" } };
+  }
+  const str = (v: unknown): string | undefined => (typeof v === "string" && v.trim() !== "" ? v.trim() : undefined);
+  const reviewState = str(query.reviewState);
+  const subject = str(query.subject);
+  const kind = str(query.kind);
+  const records = (await listAutoResolutions(app.data, { reviewState, subjectKey: subject, kind })).map(toView);
+  const pendingCount = await pendingAutoResolutionCount(app.data);
+  return { status: 200, body: { count: records.length, pendingCount, records } };
+});

package/operations/reviewAutoResolution.test.ts

@@ -0,0 +1,137 @@
+// Integration coverage for the POST /app/api/auto-resolutions/review operation `reviewAutoResolution`
+// (issue #889) — the Auto-resolutions view's Dismiss/Intervene affordance. These tests drive the REAL
+// door through `bootTestApp`'s api driver and assert the OPERATOR-PAGE authorization pattern (issue
+// #889 review): like every other UI-driven operator door (`acknowledgePr`/`acknowledgeDone`/
+// `dismissProposal`), it carries NO `x-hook-secret` guard — declarative page actions structurally
+// cannot attach that header, so guarding on it would 401 the very UI it exists to serve on a secured
+// deployment. The guard is the read-model's derived `pending_review` flag, enforced host-side by
+// `reviewResolution` (only a FINAL, still-`pending` record transitions).
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { after, describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { bootTestApp, type TestApp } from "@nanobpm/urban-testkit";
+import { claimEscalations, escalationAutoResolutions, recordResolution } from "../app/escalationSteward.ts";
+import type { UserTaskRow } from "../app/userTasks.ts";
+
+const APP_ROOT = resolve(import.meta.dirname, "..");
+
+function taskRow(over: Partial<UserTaskRow>): UserTaskRow {
+  return {
+    user_task_key: "UT-1",
+    element_id: "wait-answer",
+    kind_label: "PR review",
+    subject_type: "pr",
+    subject_key: "o/r#1",
+    subject_title: "o/r#1",
+    subject_url: "https://github.com/o/r/pull/1",
+    question: "Which approach?",
+    process_key: "PI-1",
+    form_key: "pr-escalation",
+    created_at: new Date(Date.now() - 10 * 60 * 1000).toISOString(),
+    updated_at: new Date().toISOString(),
+    ...over,
+  };
+}
+
+describe("reviewAutoResolution — operator-page authorization (no x-hook-secret)", () => {
+  const dirs: string[] = [];
+  const apps: TestApp[] = [];
+  after(async () => {
+    for (const app of apps) await app.stop?.();
+    for (const d of dirs) rmSync(d, { recursive: true, force: true });
+  });
+  // Boot with the webhook secret SET — the deployment the finding cited. A declarative page action
+  // cannot attach `x-hook-secret`, so the door must NOT require it (the operator-page pattern).
+  const boot = async (): Promise<TestApp> => {
+    const d = mkdtempSync(join(tmpdir(), "nwf-review-auto-"));
+    dirs.push(d);
+    const app = await bootTestApp(APP_ROOT, {
+      env: { NANO_APP_DB_URL: `file:${join(d, "app.db")}`, NANO_PR_WEBHOOK_SECRET: "s3cr3t" },
+    });
+    apps.push(app);
+    return app;
+  };
+
+  const seedPending = async (app: TestApp): Promise<number> => {
+    await claimEscalations(app.db, [taskRow({})], "steward-A");
+    await recordResolution(app.db, "UT-1", { outcome: "resolved", submittedVariables: { answer: "x" }, rationale: "ok" });
+    return (await escalationAutoResolutions(app.db).find({ user_task_key: "UT-1" }))[0].id;
+  };
+
+  test("a secured deployment still serves the UI: dismiss succeeds WITHOUT an x-hook-secret header", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const id = await seedPending(app);
+    // No `x-hook-secret` header — exactly what a declarative page action sends. Must NOT 401.
+    const res = await app.api.call<{ ok: boolean; reviewState?: string }>("reviewAutoResolution", { body: { id, action: "dismiss" } });
+    assert.equal(res.status, 200, "the operator-page door is reachable from the UI on a secured deployment");
+    assert.equal(res.body.ok, true);
+    assert.equal(res.body.reviewState, "dismissed");
+    const row = (await escalationAutoResolutions(app.db).find({ user_task_key: "UT-1" }))[0];
+    assert.equal(row.review_state, "dismissed");
+    assert.equal(row.reviewed_by, "operator");
+  });
+
+  test("intervene records the operator note; a re-review is an idempotent 404 no-op", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    const id = await seedPending(app);
+    const res = await app.api.call<{ ok: boolean; reviewState?: string }>("reviewAutoResolution", {
+      body: { id, action: "intervene", operator: "alice", note: "stepping in" },
+    });
+    assert.equal(res.status, 200);
+    assert.equal(res.body.reviewState, "intervened");
+    let row = (await escalationAutoResolutions(app.db).find({ user_task_key: "UT-1" }))[0];
+    assert.equal(row.review_state, "intervened");
+    assert.equal(row.reviewed_by, "alice");
+    assert.equal(row.review_note, "stepping in");
+    // Already off `pending` → the guard folds it to a clean 404 no-op (not a double-stamp).
+    const again = await app.api.call<{ ok: boolean; error?: string }>("reviewAutoResolution", { body: { id, action: "dismiss" } });
+    assert.equal(again.status, 404);
+    assert.equal(again.body.ok, false);
+    row = (await escalationAutoResolutions(app.db).find({ user_task_key: "UT-1" }))[0];
+    assert.equal(row.review_state, "intervened", "the first review is preserved");
+  });
+
+  test("a missing/invalid id or action → 400 (schema + handler validation)", async () => {
+    const app = await boot();
+    assert.ok(app.api);
+    // Missing id → the handler's own 400.
+    const noId = await app.api.call<{ ok: boolean; error?: string }>("reviewAutoResolution", { body: { action: "dismiss" } });
+    assert.equal(noId.status, 400);
+    // An out-of-enum action → the OpenAPI schema rejects it before the handler runs.
+    const badAction = await app.api.call<{ error?: string }>("reviewAutoResolution", { body: { id: 1, action: "nuke" } });
+    assert.equal(badAction.status, 400);
+    assert.ok(typeof badAction.body.error === "string" && badAction.body.error.length > 0, "a human-readable error is returned");
+  });
+
+  // Red-first regression for the removed secret guard (issue #889 review): even with
+  // NANO_PR_WEBHOOK_SECRET set, the operator door must NOT 401 a request carrying no/wrong
+  // `x-hook-secret` — declarative page actions cannot attach one. Drive the handler DIRECTLY with a
+  // cache-busted import so the module reads the secret env (the full-app boot imports it once, before
+  // the per-test env applies — the same module-load timing `cancelInstance.test.ts` works around).
+  test("the handler never 401s a secret-less request, even with NANO_PR_WEBHOOK_SECRET set", async () => {
+    const prev = process.env["NANO_PR_WEBHOOK_SECRET"];
+    process.env["NANO_PR_WEBHOOK_SECRET"] = "s3cr3t";
+    try {
+      const mod = await import(`./reviewAutoResolution.ts?guard=${Date.now()}`);
+      const handler = mod.default as (input: unknown, app: unknown) => Promise<{ status: number; body: { ok: boolean } }>;
+      const d = mkdtempSync(join(tmpdir(), "nwf-review-direct-"));
+      dirs.push(d);
+      const app = await bootTestApp(APP_ROOT, { env: { NANO_APP_DB_URL: `file:${join(d, "app.db")}` } });
+      apps.push(app);
+      await claimEscalations(app.db, [taskRow({})], "steward-A");
+      await recordResolution(app.db, "UT-1", { outcome: "resolved", submittedVariables: { answer: "x" }, rationale: "ok" });
+      const id = (await escalationAutoResolutions(app.db).find({ user_task_key: "UT-1" }))[0].id;
+      const mkReq = (headers: Record<string, string>) => ({ req: { headers: new Headers(headers) }, params: {}, query: {}, body: { id, action: "dismiss" } });
+      const noSecret = await handler(mkReq({}), { data: app.db, log: { info() {}, warn() {}, error() {} } });
+      assert.notEqual(noSecret.status, 401, "no secret header is NOT a 401 — the UI cannot attach one");
+      assert.equal(noSecret.status, 200);
+    } finally {
+      if (prev === undefined) delete process.env["NANO_PR_WEBHOOK_SECRET"];
+      else process.env["NANO_PR_WEBHOOK_SECRET"] = prev;
+    }
+  });
+});

package/operations/reviewAutoResolution.ts

@@ -0,0 +1,42 @@
+// POST /app/api/auto-resolutions/review → operationId `reviewAutoResolution` (issue #889). The
+// Auto-resolutions view's review affordance: mark a steward auto-resolution `dismissed` (reviewed,
+// no action) or `intervened` (the operator stepped in), with an optional note. Both fold the
+// record's `review_state` off `pending` — idempotently, so an already-reviewed record is a 404-style
+// no-op — and record who reviewed it and when. Reopening the completed user task is NOT required.
+//
+// AUTHORIZATION (issue #889 review): this is an OPERATOR-PAGE mutation, driven by the declarative
+// Dismiss/Intervene row actions + the guidance form on `pages/auto-resolutions.page.json`. Like every
+// other UI-driven operator door (`acknowledgePr`/`acknowledgeDone`/`acknowledgeEpic`/`dismissProposal`)
+// it carries NO `x-hook-secret` guard — declarative page actions structurally cannot attach that header
+// (see `pages/mcp.page.json`), so guarding on it would 401 the very UI it exists to serve on any
+// secured deployment. The guard is instead the read-model's derived `pending_review` flag the button
+// reads via `showWhenField`, enforced host-side by `reviewResolution` (which only transitions a FINAL,
+// still-`pending` record) — the same "affordance and guard read one oracle" pattern as `acknowledgeVia`.
+import { reviewResolution } from "../app/escalationSteward.ts";
+import { defineOperation } from "../nano-generated/operations.ts";
+
+const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
+
+export default defineOperation("reviewAutoResolution", async ({ body }, app) => {
+  if (!body || typeof body !== "object") {
+    app.log.warn("reviewAutoResolution rejected: missing request body");
+    return { status: 400, body: { ok: false, error: "id and action are required" } };
+  }
+  const id = typeof body.id === "number" && Number.isInteger(body.id) ? body.id : NaN;
+  if (!Number.isFinite(id)) return { status: 400, body: { ok: false, error: "id must be an integer" } };
+  const actionRaw = str(body.action);
+  if (actionRaw !== "dismiss" && actionRaw !== "intervene") {
+    return { status: 400, body: { ok: false, error: "action must be `dismiss` or `intervene`" } };
+  }
+  const operator = str(body.operator) || "operator";
+  const note = str(body.note) || null;
+  // `dismiss` → review_state `dismissed`; `intervene` → `intervened`.
+  const reviewState = actionRaw === "dismiss" ? "dismissed" : "intervened";
+  const changed = await reviewResolution(app.data, id, reviewState, operator, note);
+  if (!changed) {
+    app.log.warn("reviewAutoResolution: no pending record", { id });
+    return { status: 404, body: { ok: false, error: "no pending auto-resolution record with that id (already reviewed, or unknown)" } };
+  }
+  app.log.info("auto-resolution reviewed", { id, action: actionRaw, operator });
+  return { status: 200, body: { ok: true, id, reviewState } };
+});

package/operations/startConvergenceLoop.ts

@@ -35,13 +35,17 @@ export default defineOperation("startConvergenceLoop", async ({ body }, app) =>
   // callers that omit autoMerge retain the existing convergeOnly/global-default behavior.
   const hasAutoMerge = typeof body.autoMerge === "boolean";
   const convergeOnly = hasAutoMerge ? body.autoMerge !== true : body.convergeOnly === true;
-  const result = await submitPr(app.data, app.engine, parsed, dependsOn, maxRounds, convergeOnly);
+  // Opt-in escalation steward (issue #889): only when explicitly requested do this loop's
+  // escalations become eligible for steward auto-resolution. Default off.
+  const autoResolveEscalations = "autoResolveEscalations" in body && body.autoResolveEscalations === true;
+  const result = await submitPr(app.data, app.engine, parsed, dependsOn, maxRounds, convergeOnly, null, false, autoResolveEscalations);
   app.log.info("convergence loop started", {
     prKey: parsed.prKey,
     alreadyRunning: "alreadyRunning" in result && result.alreadyRunning === true,
     dependsOn: dependsOn.length,
     maxRounds,
     convergeOnly,
+    autoResolveEscalations,
   });
   return { status: 202, body: result };
 });

package/operations/startEpicSet.admission.integration.test.ts

@@ -498,13 +498,13 @@ function makeSqliteApp(
   db.exec(
     "CREATE TABLE plans (plan_key TEXT PRIMARY KEY, repo TEXT, issue_number INTEGER, issue_url TEXT, " +
       "title TEXT, base_branch TEXT, status TEXT, task_count INTEGER, epic_phase TEXT, " +
-      "blackboard_token TEXT, list_bucket TEXT, ack_open INTEGER, created_at TEXT, updated_at TEXT);",
+      "blackboard_token TEXT, list_bucket TEXT, ack_open INTEGER, auto_resolve_escalations INTEGER, created_at TEXT, updated_at TEXT);",
   );
   for (const p of seedPlans) {
     db.prepare("INSERT INTO plans (plan_key, repo, base_branch, status) VALUES (?, ?, ?, ?)")
       .run(p.plan_key, p.repo, p.base_branch, p.status);
   }
-  for (const f of ["041_inter_epic_plan_deps.sql", "045_epic_set_admission_staging.sql"]) {
+  for (const f of ["041_inter_epic_plan_deps.sql", "045_epic_set_admission_staging.sql", "124_admitted_epics_auto_resolve.sql"]) {
     db.exec(readFileSync(fileURLToPath(new URL(`../db/migrations/${f}`, import.meta.url)), "utf8"));
   }
   const q = (id: string) => `"${id.replace(/"/g, '""')}"`;

package/operations/startEpicSet.ts

@@ -51,6 +51,8 @@ interface EpicMember {
   baseBranch: string;
   allowSharedBase: boolean;
   confirmDefaultBase: boolean;
+  /** Escalation-steward opt-in for this epic (issue #889) — carried through staging to `startPlan`. */
+  autoResolveEscalations: boolean;
 }
 
 export default defineOperation("startEpicSet", async ({ body }, app) => {
@@ -104,6 +106,7 @@ export default defineOperation("startEpicSet", async ({ body }, app) => {
       baseBranch: typeof m.baseBranch === "string" ? m.baseBranch : "",
       allowSharedBase: m.allowSharedBase === true,
       confirmDefaultBase: m.confirmDefaultBase === true,
+      autoResolveEscalations: m.autoResolveEscalations === true,
     });
     planKeys.push(parsed.planKey);
   }
@@ -125,7 +128,7 @@ export default defineOperation("startEpicSet", async ({ body }, app) => {
   // persisted. `selfPlanKey` excludes the epic's own active row so an idempotent re-submit does not
   // 409 against itself.
   const token = process.env.GITHUB_TOKEN ?? "";
-  const admitted: { parsed: ParsedIssue; baseBranch: string }[] = [];
+  const admitted: { parsed: ParsedIssue; baseBranch: string; autoResolveEscalations: boolean }[] = [];
   // Intra-set shared-base guard: admitPlan's rule 4 only inspects DURABLE `plans` rows, and S2
   // materializes none, so two members of THIS set reaching for the same custom integration branch
   // would both slip past it and silently defeat ADR 0003 rule 4. Track each admitted member's
@@ -151,7 +154,7 @@ export default defineOperation("startEpicSet", async ({ body }, app) => {
         if (claimed) claimed.add(normalizedBase);
         else claimedBases.set(member.parsed.repo, new Set([normalizedBase]));
       }
-      admitted.push({ parsed: member.parsed, baseBranch: normalizedBase });
+      admitted.push({ parsed: member.parsed, baseBranch: normalizedBase, autoResolveEscalations: member.autoResolveEscalations });
     } catch (err) {
       const mapped = admitPlanErrorResponse(err);
       if (mapped) {
@@ -183,6 +186,9 @@ export default defineOperation("startEpicSet", async ({ body }, app) => {
       issue_number: a.parsed.number,
       issue_url: a.parsed.url,
       base_branch: a.baseBranch,
+      // Carry the per-epic steward opt-in (issue #889) into staging so the lowering forwards it to
+      // `startPlan` — without it a batch-admitted epic stayed opted out despite the caller's choice.
+      auto_resolve_escalations: a.autoResolveEscalations ? 1 : 0,
     });
   }
   for (const edge of edges) {

package/operations/startFeature.ts

@@ -118,6 +118,9 @@ export default defineOperation("startFeature", async ({ body }, app) => {
   const autoMerge = converge && "autoMerge" in body && body.autoMerge === true;
   // Human approval gates the merge-loop, so it is moot (pinned off) without auto-merge (issue #826).
   const humanApproval = autoMerge && "humanApproval" in body && body.humanApproval === true;
+  // Opt-in escalation steward (issue #889): only when explicitly requested does this run's
+  // escalations become eligible for steward auto-resolution. Default off.
+  const autoResolveEscalations = "autoResolveEscalations" in body && body.autoResolveEscalations === true;
   // Optional operator steering threaded to the implementation agent's prompt. Empty/whitespace is
   // normalized to null downstream (startFeature) so it never appends an empty instruction block.
   const customInstructions = "customInstructions" in body && typeof body.customInstructions === "string"
@@ -179,6 +182,7 @@ export default defineOperation("startFeature", async ({ body }, app) => {
     customInstructions,
     { probes: readiness.probes, probeTimeout: readiness.probeTimeout, probePollEvery: readiness.probePollEvery },
     humanApproval,
+    autoResolveEscalations,
   );
   app.log.info("feature run intake", {
     featureKey: parsed.planKey,
@@ -186,6 +190,7 @@ export default defineOperation("startFeature", async ({ body }, app) => {
     converge,
     autoMerge,
     humanApproval,
+    autoResolveEscalations,
     hasCustomInstructions: typeof customInstructions === "string" && customInstructions.trim() !== "",
     readinessProbes: readiness.probes.length,
     outcome: result.outcome,

package/operations/startPlanFanout.ts

@@ -49,7 +49,9 @@ export default defineOperation("startPlanFanout", async ({ body }, app) => {
     }
     throw err;
   }
-  const result = await startPlan(app.data, app.engine, parsed, normalizedBase);
+  // Opt-in escalation steward (issue #889): propagate to every child the epic spawns.
+  const autoResolveEscalations = "autoResolveEscalations" in body && body.autoResolveEscalations === true;
+  const result = await startPlan(app.data, app.engine, parsed, normalizedBase, { autoResolveEscalations });
   const alreadyRunning = "alreadyRunning" in result && result.alreadyRunning === true;
   app.log.info("plan fan-out started", {
     planKey: parsed.planKey,
@@ -58,6 +60,7 @@ export default defineOperation("startPlanFanout", async ({ body }, app) => {
     // request — not the effective base — to keep the log honest.
     requestedBaseBranch: normalizedBase,
     alreadyRunning,
+    autoResolveEscalations,
   });
   return { status: 202, body: result };
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.202.0",
+  "version": "0.203.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/_nav.json

@@ -24,6 +24,18 @@
           "hideWhenZero": true
         }
       },
+      {
+        "label": "Auto-resolutions",
+        "page": "auto-resolutions",
+        "badge": {
+          "source": "app",
+          "table": "escalation_auto_resolutions__read_model",
+          "filter": [{ "field": "review_state", "eq": "pending" }],
+          "tone": "warn",
+          "refreshMs": 5000,
+          "hideWhenZero": true
+        }
+      },
       { "label": "Cockpit", "page": "cockpit" },
       { "label": "Board", "page": "board" },
       { "label": "Velocity", "page": "velocity" }

package/pages/auto-resolutions.page.json

@@ -0,0 +1,191 @@
+{
+  "schemaVersion": "1.0",
+  "title": "Auto-resolutions",
+  "nodes": [
+    {
+      "type": "nav",
+      "id": "nav",
+      "props": {
+        "variant": "bar",
+        "title": "Nano Workforce",
+        "items": [
+          {
+            "label": "Overview",
+            "page": "overview"
+          },
+          {
+            "label": "Connect over MCP",
+            "page": "mcp"
+          },
+          {
+            "label": "Lineage",
+            "page": "lineage"
+          },
+          {
+            "label": "Convergence",
+            "page": "home"
+          },
+          {
+            "label": "Epics",
+            "page": "epic"
+          },
+          {
+            "label": "Feature",
+            "page": "feature"
+          },
+          {
+            "label": "Delivery Graphs",
+            "page": "delivery-graphs"
+          },
+          {
+            "label": "Tasks",
+            "page": "tasks",
+            "badge": {
+              "source": "app",
+              "table": "user_tasks",
+              "filter": [],
+              "tone": "danger",
+              "refreshMs": 5000,
+              "hideWhenZero": true
+            }
+          },
+          {
+            "label": "Auto-resolutions",
+            "page": "auto-resolutions",
+            "badge": {
+              "source": "app",
+              "table": "escalation_auto_resolutions__read_model",
+              "filter": [
+                {
+                  "field": "review_state",
+                  "eq": "pending"
+                }
+              ],
+              "tone": "warn",
+              "refreshMs": 5000,
+              "hideWhenZero": true
+            }
+          },
+          {
+            "label": "Cockpit",
+            "page": "cockpit"
+          },
+          {
+            "label": "Board",
+            "page": "board"
+          },
+          {
+            "label": "Velocity",
+            "page": "velocity"
+          }
+        ],
+        "sticky": true
+      }
+    },
+    {
+      "type": "text",
+      "id": "title",
+      "props": { "text": "Auto-resolutions", "variant": "heading" }
+    },
+    {
+      "type": "text",
+      "id": "subtitle",
+      "props": {
+        "text": "Every escalation the opt-in escalation steward (issue #889) resolved or abstained from, as a durable, reviewable record. The default list shows pending records — examine one, then Dismiss it (reviewed, no action) or Intervene (mark it and record guidance for stepping in after the fact). Abstentions carry their own badge. A record is never a hidden machine decision: it is attributed to the steward agent, never to a human.",
+        "variant": "sub"
+      }
+    },
+    {
+      "type": "dataGrid",
+      "id": "auto-resolutions",
+      "props": {
+        "title": "Auto-resolutions",
+        "rowKey": "id",
+        "refreshMs": 5000,
+        "data": {
+          "kind": "datasource",
+          "source": "app",
+          "table": "escalation_auto_resolutions__read_model",
+          "orderBy": { "field": "created_at", "dir": "desc" }
+        },
+        "tabs": [
+          { "label": "Pending", "filter": [{ "field": "review_state", "in": ["pending"] }] },
+          { "label": "Reviewed", "filter": [{ "field": "review_state", "in": ["dismissed", "intervened"] }] },
+          { "label": "All", "filter": [] }
+        ],
+        "columns": [
+          { "field": "id", "header": "ID" },
+          { "field": "outcome", "header": "Outcome", "badge": true },
+          { "field": "selected_option", "header": "Chose" },
+          { "field": "escalation_kind", "header": "Kind" },
+          {
+            "field": "subject_key",
+            "template": "{{subject_key}}",
+            "header": "Subject",
+            "truncate": true,
+            "linkField": "subject_url"
+          },
+          { "field": "rationale", "header": "Rationale", "truncate": true },
+          { "field": "worker", "header": "Worker" },
+          { "field": "process_key", "header": "Agent", "template": "Transcript", "truncate": true, "link": { "kind": "page", "page": "cockpit", "keyField": "process_key" } },
+          { "field": "process_instance_key", "header": "Engine instance", "truncate": true, "link": { "kind": "processExplorer", "keyField": "process_instance_key" } },
+          { "field": "created_at", "header": "When", "format": "datetime" },
+          { "field": "review_state", "header": "Review", "badge": true }
+        ],
+        "rowActions": [
+          {
+            "label": "Dismiss",
+            "confirm": "Dismiss this auto-resolution (reviewed, no action)?",
+            "showWhenField": "pending_review",
+            "action": {
+              "path": "/app/api/auto-resolutions/review",
+              "body": { "id": "{{row.id}}", "action": "dismiss" }
+            }
+          },
+          {
+            "label": "Intervene",
+            "confirm": "Mark this auto-resolution as intervened (you are stepping in after the fact)?",
+            "showWhenField": "pending_review",
+            "action": {
+              "path": "/app/api/auto-resolutions/review",
+              "body": { "id": "{{row.id}}", "action": "intervene" }
+            }
+          }
+        ],
+        "detail": {
+          "linkField": "subject_url",
+          "fields": [
+            { "field": "id", "label": "Record id" },
+            { "field": "question", "label": "Question" },
+            { "field": "selected_option", "label": "Selected option" },
+            { "field": "options", "label": "Options offered" },
+            { "field": "submitted_variables", "label": "Submitted variables" },
+            { "field": "rationale", "label": "Rationale" },
+            { "field": "evidence", "label": "Evidence" },
+            { "field": "subject_key", "label": "Subject" },
+            { "field": "process_instance_key", "label": "Process instance" },
+            { "field": "steward_instance_key", "label": "Steward instance" },
+            { "field": "agent_job_key", "label": "Agent job" },
+            { "field": "review_note", "label": "Review note" }
+          ]
+        }
+      }
+    },
+    {
+      "type": "actionForm",
+      "id": "intervene-with-note",
+      "props": {
+        "title": "Intervene with guidance",
+        "submitLabel": "Record intervention",
+        "fields": [
+          { "key": "id", "label": "Record id (the pending auto-resolution to intervene on)", "type": "number", "required": true },
+          { "key": "note", "label": "Guidance for stepping in (recorded as the review note)", "type": "text" }
+        ],
+        "action": {
+          "path": "/app/api/auto-resolutions/review",
+          "body": { "id": "{{form.id}}", "action": "intervene", "note": "{{form.note}}" }
+        }
+      }
+    }
+  ]
+}

package/pages/board.page.json

@@ -49,6 +49,23 @@
               "hideWhenZero": true
             }
           },
+          {
+            "label": "Auto-resolutions",
+            "page": "auto-resolutions",
+            "badge": {
+              "source": "app",
+              "table": "escalation_auto_resolutions__read_model",
+              "filter": [
+                {
+                  "field": "review_state",
+                  "eq": "pending"
+                }
+              ],
+              "tone": "warn",
+              "refreshMs": 5000,
+              "hideWhenZero": true
+            }
+          },
           {
             "label": "Cockpit",
             "page": "cockpit"