fraim-framework 2.0.194 → 2.0.196

package/dist/src/ai-hub/server.js

@@ -1971,59 +1971,41 @@ class AiHubServer {
         }));
         try {
             // Issue #701: persona state comes from the hosted server (GET /api/personas/me)
-            // via the user's API key — never a local MongoDB connection. A null result means
-            // no/expired key or the feature is off; render the locked fallback (not-signed-in).
+            // via the user's API key — never a local MongoDB connection.
             const state = await this.remoteGateway.getPersonaState(apiKey);
+            // A null result means we could not reach the authority (no/expired key or a
+            // transport error). That is the ONLY access decision the Hub makes on its own —
+            // render the locked "not-signed-in" fallback. When a state IS returned, its
+            // per-persona `status` is authoritative and rendered verbatim: the hired/locked
+            // decision (feature-off, legacy bypass, per-entitlement gating) lives solely in
+            // persona-entitlement-service.resolvePersonaAccessStatuses — the Hub does not
+            // re-derive it.
             if (!state) {
                 return { personas: fallbackPersonas, subscriptionActive: false, workspaceId: null, userKey: null };
             }
-            // Legacy bypass: persona gating is not active for this workspace, so all personas are accessible.
-            // Mirrors the evaluatePersonaAccess legacy bypass in persona-entitlement-service.ts.
-            // Seats are not assignable on legacy workspaces (the hosted server is always DB-backed).
-            if (!state.subscriptionActive) {
-                const allPersonas = allBundles.map((bundle) => ({
-                    key: bundle.personaKey,
-                    displayName: bundle.catalogMetadata.displayName,
-                    role: bundle.catalogMetadata.role,
-                    avatarUrl: buildHubPersonaAvatarUrl(bundle.personaKey),
-                    pricingLabel: '',
-                    status: 'hired',
-                    hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
-                    seatCount: 0,
-                    seatsInUse: 0,
-                }));
-                return { personas: allPersonas, subscriptionActive: false, workspaceId: state.workspaceId, userKey: state.userId ?? null };
-            }
-            const hiredKeys = new Set(state.entitlements
-                .filter((e) => e.status === 'active')
-                .map((e) => e.personaKey));
-            // Build per-persona seat counts from entitlement records.
-            // jobCreditsRemaining represents the number of job-credits (seats) purchased.
-            const seatCountByKey = {};
-            for (const e of state.entitlements) {
-                if (e.status === 'active') {
-                    seatCountByKey[e.personaKey] = (seatCountByKey[e.personaKey] ?? 0) + (e.jobCreditsRemaining ?? 1);
-                }
-            }
-            // seatsInUse for display: derived from the hosted manager team. Authoritative
-            // out-of-stock enforcement lives on the hosted assign endpoint (server-side),
-            // so this display count does not need to be workspace-wide.
+            const verdictByKey = new Map((state.personas || []).map((p) => [p.personaKey, p]));
+            // seatsInUse (manager-team assignments) is display-only accounting fetched
+            // separately; it is not part of the access verdict.
             const seatsInUseByKey = {};
             const team = await this.remoteGateway.listManagerTeam(apiKey);
             for (const entry of team) {
                 seatsInUseByKey[entry.personaKey] = (seatsInUseByKey[entry.personaKey] ?? 0) + 1;
             }
-            const personas = allBundles.map((bundle) => ({
-                key: bundle.personaKey,
-                displayName: bundle.catalogMetadata.displayName,
-                role: bundle.catalogMetadata.role,
-                avatarUrl: buildHubPersonaAvatarUrl(bundle.personaKey),
-                pricingLabel: hiredKeys.has(bundle.personaKey) ? '' : bundle.catalogMetadata.pricingLabel,
-                status: (hiredKeys.has(bundle.personaKey) ? 'hired' : 'locked'),
-                hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
-                seatCount: seatCountByKey[bundle.personaKey] ?? 0,
-                seatsInUse: seatsInUseByKey[bundle.personaKey] ?? 0,
-            }));
+            const personas = allBundles.map((bundle) => {
+                const verdict = verdictByKey.get(bundle.personaKey);
+                const status = (verdict?.status ?? 'locked');
+                return {
+                    key: bundle.personaKey,
+                    displayName: bundle.catalogMetadata.displayName,
+                    role: bundle.catalogMetadata.role,
+                    avatarUrl: buildHubPersonaAvatarUrl(bundle.personaKey),
+                    pricingLabel: status === 'hired' ? '' : bundle.catalogMetadata.pricingLabel,
+                    status,
+                    hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+                    seatCount: verdict?.seatCount ?? 0,
+                    seatsInUse: seatsInUseByKey[bundle.personaKey] ?? 0,
+                };
+            });
             return { personas, subscriptionActive: state.subscriptionActive, workspaceId: state.workspaceId, userKey: state.userId ?? null };
         }
         catch (err) {
@@ -2252,9 +2234,20 @@ class AiHubServer {
                 if (!Array.isArray(body.conversations)) {
                     return res.status(400).json({ error: 'conversations array required' });
                 }
+                // The client strips server-owned heavy fields (messages/events/artifacts/run/
+                // delegation) from its PUT payload to stay under the body-size limit. Merge them
+                // back from the stored record so a client-owned change (e.g. reviewApproved) never
+                // erases run history. List membership still comes from the incoming array, so
+                // deletes are honored (a conversation absent here is dropped).
+                const prior = this.conversationStore.loadProject(key);
+                const priorById = new Map(prior.conversations.map((entry) => [entry.id, entry]));
+                const conversations = body.conversations.map((incoming) => {
+                    const existing = incoming && incoming.id ? priorById.get(incoming.id) : undefined;
+                    return existing ? { ...existing, ...incoming } : incoming;
+                });
                 const saved = this.conversationStore.replaceProject(key, {
                     activeId: body.activeId ?? null,
-                    conversations: body.conversations,
+                    conversations,
                 });
                 return res.json({ projectPath: key, scope: scope ?? 'project', ...saved, source: 'disk' });
             }

package/dist/src/api/personas/me.js

@@ -10,13 +10,13 @@ async function getMyPersonas(req, res, dbService) {
             res.status(401).json({ error: 'Authentication required' });
             return;
         }
+        // Feature OFF => the persona system isn't gating anything, so report the
+        // ungated state (every persona accessible) rather than a 404. This makes the
+        // authenticated persona view a single source of truth the Hub renders
+        // verbatim, and matches the execution gate (maybeBuildPersonaLockResponse),
+        // which also treats "flag off" as "allowed". No DB lookup needed.
         if (!(0, feature_flags_1.isPersonaEntitlementsEnabled)()) {
-            res.status(404).json({
-                error: 'Not found',
-                featureFlags: {
-                    personaEntitlements: false
-                }
-            });
+            res.json((0, persona_entitlement_service_1.buildUngatedPersonaWorkspaceState)(apiKeyData.userId, apiKeyData.key));
             return;
         }
         const state = await (0, persona_entitlement_service_1.getWorkspacePersonaState)(dbService, apiKeyData.userId, apiKeyData.key);

package/dist/src/services/persona-entitlement-service.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSubscriptionActive = computeSubscriptionActive;
+exports.resolvePersonaAccessStatuses = resolvePersonaAccessStatuses;
+exports.buildUngatedPersonaWorkspaceState = buildUngatedPersonaWorkspaceState;
 exports.buildPersonaHireUrl = buildPersonaHireUrl;
 exports.syncPersonaEntitlementPurchase = syncPersonaEntitlementPurchase;
 exports.syncPersonaEntitlementFromCheckoutSession = syncPersonaEntitlementFromCheckoutSession;
@@ -9,6 +12,66 @@ const persona_hiring_1 = require("../config/persona-hiring");
 const persona_capability_bundles_1 = require("../config/persona-capability-bundles");
 const workspace_identity_1 = require("./workspace-identity");
 const DEFAULT_JOB_CREDITS = 1;
+// The one place the "is the persona system gating this workspace?" question is
+// answered. A workspace is subscribed if it explicitly opted in (personaSystemActive)
+// or has ever held an active entitlement. Shared by getWorkspacePersonaState and
+// evaluatePersonaAccess so display and enforcement can never diverge.
+function computeSubscriptionActive(apiKeyData, entitlements) {
+    return apiKeyData?.personaSystemActive === true || entitlements.some((e) => e.status === 'active');
+}
+// Single source of truth for per-persona access, mirroring evaluatePersonaAccess's
+// gating rules exactly:
+//   - `ungated` (feature flag OFF, or legacy/never-subscribed workspace) => every
+//     persona is accessible ('hired').
+//   - otherwise => 'hired' iff the workspace holds an active entitlement for it.
+// Pure and DB-free so it is trivially testable and callable from either code path.
+function resolvePersonaAccessStatuses(ungated, entitlements) {
+    const activeByKey = new Map();
+    for (const entitlement of entitlements) {
+        if (entitlement.status !== 'active')
+            continue;
+        const list = activeByKey.get(entitlement.personaKey) || [];
+        list.push(entitlement);
+        activeByKey.set(entitlement.personaKey, list);
+    }
+    return (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => {
+        const active = activeByKey.get(bundle.personaKey) || [];
+        const seatCount = active.reduce((sum, e) => sum + (e.jobCreditsRemaining ?? 1), 0);
+        return {
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            status: (ungated || active.length > 0) ? 'hired' : 'locked',
+            seatCount,
+        };
+    });
+}
+// The persona-entitlements feature is OFF: there is no gating, so every persona is
+// accessible. Returned by /api/personas/me instead of a 404 so downstream consumers
+// (the Hub especially) inherit "flag off => all employees available" rather than
+// inventing their own fallback. Matches maybeBuildPersonaLockResponse, which also
+// short-circuits to "allowed" when the flag is off. No DB lookup is required.
+function buildUngatedPersonaWorkspaceState(userId, apiKey) {
+    return {
+        featureFlagEnabled: false,
+        featureFlags: { personaEntitlementsEnabled: false },
+        subscriptionActive: false,
+        workspaceId: normalizeEmail(userId),
+        userId: normalizeEmail(userId),
+        apiKey: apiKey || null,
+        entitlements: [],
+        catalog: (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => ({
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            protectedJobs: bundle.protectedJobs,
+        })),
+        lockedPersonas: [],
+        personas: resolvePersonaAccessStatuses(true, []),
+    };
+}
 function normalizeEmail(email) {
     return email.trim().toLowerCase();
 }
@@ -154,9 +217,7 @@ async function getWorkspacePersonaState(dbService, userId, apiKey) {
         protectedJobs: bundle.protectedJobs
     }));
     const knownPersonaKeys = new Set(entitlements.map((entitlement) => entitlement.personaKey));
-    // Subscribed = explicitly opted in via flag, OR has ever had an active entitlement.
-    const subscriptionActive = apiKeyData?.personaSystemActive === true ||
-        entitlements.some((e) => e.status === 'active');
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, entitlements);
     return {
         featureFlagEnabled: true,
         featureFlags: {
@@ -185,7 +246,10 @@ async function getWorkspacePersonaState(dbService, userId, apiKey) {
             .map((persona) => ({
             ...persona,
             status: 'locked'
-        }))
+        })),
+        // Authoritative per-persona verdict: a non-subscribed (legacy) workspace is
+        // ungated, so all personas are accessible; a subscribed one gates to owned.
+        personas: resolvePersonaAccessStatuses(!subscriptionActive, entitlements),
     };
 }
 async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnTo) {
@@ -205,9 +269,9 @@ async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnT
     });
     const workspaceEntitlements = await dbService.getPersonaEntitlementsByWorkspaceId(workspace.workspaceId, false);
     // Legacy bypass: if the workspace has never subscribed to the persona system,
-    // all jobs are freely accessible — no lock enforcement.
-    const subscriptionActive = apiKeyData?.personaSystemActive === true ||
-        workspaceEntitlements.some((e) => e.status === 'active');
+    // all jobs are freely accessible — no lock enforcement. Same rule the Hub
+    // display inherits via resolvePersonaAccessStatuses(!subscriptionActive, ...).
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, workspaceEntitlements);
     if (!subscriptionActive) {
         return {
             allowed: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.194",
+  "version": "2.0.196",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {

package/public/ai-hub/index.html

@@ -33,18 +33,18 @@
             <div class="am-email" id="am-email"></div>
           </div>
         </div>
-        <button class="am-item" id="am-account" type="button">
+        <button class="am-item" id="am-account" type="button">
           <span class="am-ico">👤</span>
           <div><div class="am-label">Account</div><div class="am-sub">API key, sessions, billing</div></div>
-        </button>
+        </button>
         <button class="am-item" id="am-brain" type="button">
           <span class="am-ico">🧠</span>
           <div><div class="am-label">Brain</div><div class="am-sub">Everything your team knows</div></div>
         </button>
-        <button class="am-item" id="am-analytics" type="button">
+        <button class="am-item" id="am-analytics" type="button">
           <span class="am-ico">📊</span>
           <div><div class="am-label">Analytics</div><div class="am-sub">Usage, cost, and ROI</div></div>
-        </button>
+        </button>
         <button class="am-item am-theme" id="am-theme-toggle" type="button" role="switch" aria-checked="false">
           <span class="am-ico" id="am-theme-ico">🌙</span>
           <div><div class="am-label">Dark mode</div><div class="am-sub" id="am-theme-sub">Off</div></div>
@@ -141,21 +141,21 @@
     </div>
   </section>
 
-  <section class="hub-area" id="area-connected" hidden>
-    <div class="connected-shell">
-      <div class="connected-toolbar">
-        <div class="connected-title-block">
-          <div class="connected-kicker" id="connected-kicker">Connected FRAIM</div>
-          <div class="connected-title" id="connected-title">Account</div>
-        </div>
-        <div class="connected-origin" id="connected-origin"></div>
-        <button class="connected-close" id="connected-close" type="button">Back</button>
-      </div>
-      <iframe id="connected-frame" class="connected-frame" title="FRAIM connected surface" allow="clipboard-read; clipboard-write"></iframe>
-    </div>
-  </section>
-
-  <!-- Issue #512: Projects area wraps the existing single-surface Hub. -->
+  <section class="hub-area" id="area-connected" hidden>
+    <div class="connected-shell">
+      <div class="connected-toolbar">
+        <div class="connected-title-block">
+          <div class="connected-kicker" id="connected-kicker">Connected FRAIM</div>
+          <div class="connected-title" id="connected-title">Account</div>
+        </div>
+        <div class="connected-origin" id="connected-origin"></div>
+        <button class="connected-close" id="connected-close" type="button">Back</button>
+      </div>
+      <iframe id="connected-frame" class="connected-frame" title="FRAIM connected surface" allow="clipboard-read; clipboard-write"></iframe>
+    </div>
+  </section>
+
+  <!-- Issue #512: Projects area wraps the existing single-surface Hub. -->
   <section class="hub-area on" id="area-projects">
     <div class="proj-tabs" id="proj-tabs">
       <button class="ptab on" id="ptab-overview" type="button" data-view="overview">Overview</button>
@@ -868,6 +868,6 @@
     </div>
   </div>
 
-  <script src="./script.js"></script>
+  <script src="./script.js?v=conv-persist-20260705"></script>
 </body>
 </html>

package/public/ai-hub/script.js

@@ -507,11 +507,29 @@ function normalizeGeminiConversationMessages(conv) {
   return changed;
 }
 
+// Server-owned conversation fields. The server re-derives these from the run
+// registry and writes them to the conversation store on every run update
+// (persistRunConversation), so the client must NOT re-upload them: a large run's
+// messages/events/artifacts push the PUT body past the server's size limit, the
+// request 413s, the error is swallowed, and the client-owned flags in the SAME
+// payload (e.g. reviewApproved from "Mark complete") never persist. Strip them
+// here; the server's PUT handler merges them back from the stored record.
+const SERVER_OWNED_CONV_FIELDS = ['messages', 'events', 'artifacts', 'run', 'delegation'];
+function slimConversationForPersist(conv) {
+  if (!conv || typeof conv !== 'object') return conv;
+  const slim = { ...conv };
+  for (const field of SERVER_OWNED_CONV_FIELDS) delete slim[field];
+  return slim;
+}
+function slimConversationsForPersist(list) {
+  return Array.isArray(list) ? list.map(slimConversationForPersist) : list;
+}
+
 function projectConversationPayload() {
   return {
     projectPath: state.projectPath || '',
     activeId: state.activeId || null,
-    conversations: projectConversations(),
+    conversations: slimConversationsForPersist(projectConversations()),
   };
 }
 
@@ -537,7 +555,7 @@ function scheduleConversationDiskPersist() {
         await requestJson('/api/ai-hub/conversations', {
           method: 'PUT',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ scope, activeId: null, conversations: bucket }),
+          body: JSON.stringify({ scope, activeId: null, conversations: slimConversationsForPersist(bucket) }),
         });
       }
       state.conversationDiskAvailable = true;
@@ -3259,6 +3277,10 @@ function convAwaitingReview(conv) {
   // output, not deliverables submitted to the human manager. Other manager jobs (e.g.,
   // stakeholder-status-reporting) may legitimately surface artifacts for human review.
   if (delegationLedgerForConversation(conv)) return false;
+  const runArtifacts = Array.isArray(conv.artifacts) ? conv.artifacts : [];
+  if (conv.status === 'completed' && runArtifacts.some((artifact) => artifactLocalPath(artifact) || artifactExternalUrl(artifact))) {
+    return true;
+  }
   // #521: a plain completed turn is NOT awaiting review — the approve/reject card
   // only belongs when the employee actually submits for review (a review_handoff,
   // emitted by the submit phase). A turn that just finished (a question, a pause
@@ -3465,12 +3487,32 @@ function hasReviewHandoffSignal(text) {
   return !!(text && /reviewRequired|reviewTarget|review_handoff/i.test(text));
 }
 
+function reviewSubmissionClaimText(text) {
+  return String(stripMarkdownForDisplay(text) || '')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function hasExplicitReviewSubmissionClaim(text) {
+  const cleaned = reviewSubmissionClaimText(text);
+  if (!cleaned) return false;
+  if (/\b(?:not\s+ready|not\s+yet\s+ready|will\s+be\s+ready|soon\s+be\s+ready)\b.{0,60}\breview\b/i.test(cleaned)) {
+    return false;
+  }
+  return /\bready\s+for\s+(?:your\s+)?review\b/i.test(cleaned)
+    || /\bplease\s+review\b/i.test(cleaned)
+    || /\bsubmitted\s+(?:the\s+|this\s+|my\s+)?(?:work|deliverable|artifact|bundle|pr|pull request|document|doc|file|files)\s+for\s+(?:your\s+)?review\b/i.test(cleaned)
+    || /\b(?:review|open)\s+(?:the\s+)?(?:pr|pull request|artifact|document|doc|file|files|deliverable|bundle)\b/i.test(cleaned);
+}
+
 function reviewHandoffIssueForConversation(conv) {
   if (!conv) return '';
   if (conv.reviewHandoff && !normalizeReviewHandoff(conv.reviewHandoff)) {
     return 'The review handoff contract is invalid.';
   }
   const messages = conv.messages || [];
+  const hasRunArtifacts = Array.isArray(conv.artifacts) && conv.artifacts.length > 0;
+  const latestEmployee = [...messages].reverse().find((message) => message.role === 'employee');
   for (let i = messages.length - 1; i >= 0; i -= 1) {
     if (messages[i].role !== 'employee') continue;
     if (!hasReviewHandoffSignal(messages[i].text)) continue;
@@ -3478,6 +3520,9 @@ function reviewHandoffIssueForConversation(conv) {
       return 'The review handoff contract is malformed or missing required fields.';
     }
   }
+  if (!conv.reviewHandoff && !hasRunArtifacts && latestEmployee && hasExplicitReviewSubmissionClaim(latestEmployee.text)) {
+    return 'This run says it is ready for review, but did not include a structured review handoff.';
+  }
   return '';
 }
 
@@ -3833,7 +3878,7 @@ function renderReviewExperience(conv) {
   if (handoff) {
     const hasArtifact = !!(fmt.actions && fmt.actions.length);
     handoff.textContent = fmt.key === 'contract_error'
-      ? 'The review handoff contract is invalid. Ask the employee to resend it before review.'
+      ? `${fmt.issue || 'The review handoff contract is invalid.'} Ask the employee to resend it before review.`
       : fmt.key === 'pull_request'
         ? 'Comment on the PR to leave inline notes, or approve / type changes below.'
         : isManagerTemplateJob(conv && conv.jobId)