fraim-framework 2.0.195 → 2.0.196

package/dist/src/ai-hub/server.js

@@ -1971,59 +1971,41 @@ class AiHubServer {
         }));
         try {
             // Issue #701: persona state comes from the hosted server (GET /api/personas/me)
-            // via the user's API key — never a local MongoDB connection. A null result means
-            // no/expired key or the feature is off; render the locked fallback (not-signed-in).
+            // via the user's API key — never a local MongoDB connection.
             const state = await this.remoteGateway.getPersonaState(apiKey);
+            // A null result means we could not reach the authority (no/expired key or a
+            // transport error). That is the ONLY access decision the Hub makes on its own —
+            // render the locked "not-signed-in" fallback. When a state IS returned, its
+            // per-persona `status` is authoritative and rendered verbatim: the hired/locked
+            // decision (feature-off, legacy bypass, per-entitlement gating) lives solely in
+            // persona-entitlement-service.resolvePersonaAccessStatuses — the Hub does not
+            // re-derive it.
             if (!state) {
                 return { personas: fallbackPersonas, subscriptionActive: false, workspaceId: null, userKey: null };
             }
-            // Legacy bypass: persona gating is not active for this workspace, so all personas are accessible.
-            // Mirrors the evaluatePersonaAccess legacy bypass in persona-entitlement-service.ts.
-            // Seats are not assignable on legacy workspaces (the hosted server is always DB-backed).
-            if (!state.subscriptionActive) {
-                const allPersonas = allBundles.map((bundle) => ({
-                    key: bundle.personaKey,
-                    displayName: bundle.catalogMetadata.displayName,
-                    role: bundle.catalogMetadata.role,
-                    avatarUrl: buildHubPersonaAvatarUrl(bundle.personaKey),
-                    pricingLabel: '',
-                    status: 'hired',
-                    hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
-                    seatCount: 0,
-                    seatsInUse: 0,
-                }));
-                return { personas: allPersonas, subscriptionActive: false, workspaceId: state.workspaceId, userKey: state.userId ?? null };
-            }
-            const hiredKeys = new Set(state.entitlements
-                .filter((e) => e.status === 'active')
-                .map((e) => e.personaKey));
-            // Build per-persona seat counts from entitlement records.
-            // jobCreditsRemaining represents the number of job-credits (seats) purchased.
-            const seatCountByKey = {};
-            for (const e of state.entitlements) {
-                if (e.status === 'active') {
-                    seatCountByKey[e.personaKey] = (seatCountByKey[e.personaKey] ?? 0) + (e.jobCreditsRemaining ?? 1);
-                }
-            }
-            // seatsInUse for display: derived from the hosted manager team. Authoritative
-            // out-of-stock enforcement lives on the hosted assign endpoint (server-side),
-            // so this display count does not need to be workspace-wide.
+            const verdictByKey = new Map((state.personas || []).map((p) => [p.personaKey, p]));
+            // seatsInUse (manager-team assignments) is display-only accounting fetched
+            // separately; it is not part of the access verdict.
             const seatsInUseByKey = {};
             const team = await this.remoteGateway.listManagerTeam(apiKey);
             for (const entry of team) {
                 seatsInUseByKey[entry.personaKey] = (seatsInUseByKey[entry.personaKey] ?? 0) + 1;
             }
-            const personas = allBundles.map((bundle) => ({
-                key: bundle.personaKey,
-                displayName: bundle.catalogMetadata.displayName,
-                role: bundle.catalogMetadata.role,
-                avatarUrl: buildHubPersonaAvatarUrl(bundle.personaKey),
-                pricingLabel: hiredKeys.has(bundle.personaKey) ? '' : bundle.catalogMetadata.pricingLabel,
-                status: (hiredKeys.has(bundle.personaKey) ? 'hired' : 'locked'),
-                hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
-                seatCount: seatCountByKey[bundle.personaKey] ?? 0,
-                seatsInUse: seatsInUseByKey[bundle.personaKey] ?? 0,
-            }));
+            const personas = allBundles.map((bundle) => {
+                const verdict = verdictByKey.get(bundle.personaKey);
+                const status = (verdict?.status ?? 'locked');
+                return {
+                    key: bundle.personaKey,
+                    displayName: bundle.catalogMetadata.displayName,
+                    role: bundle.catalogMetadata.role,
+                    avatarUrl: buildHubPersonaAvatarUrl(bundle.personaKey),
+                    pricingLabel: status === 'hired' ? '' : bundle.catalogMetadata.pricingLabel,
+                    status,
+                    hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+                    seatCount: verdict?.seatCount ?? 0,
+                    seatsInUse: seatsInUseByKey[bundle.personaKey] ?? 0,
+                };
+            });
             return { personas, subscriptionActive: state.subscriptionActive, workspaceId: state.workspaceId, userKey: state.userId ?? null };
         }
         catch (err) {

package/dist/src/api/personas/me.js

@@ -10,13 +10,13 @@ async function getMyPersonas(req, res, dbService) {
             res.status(401).json({ error: 'Authentication required' });
             return;
         }
+        // Feature OFF => the persona system isn't gating anything, so report the
+        // ungated state (every persona accessible) rather than a 404. This makes the
+        // authenticated persona view a single source of truth the Hub renders
+        // verbatim, and matches the execution gate (maybeBuildPersonaLockResponse),
+        // which also treats "flag off" as "allowed". No DB lookup needed.
         if (!(0, feature_flags_1.isPersonaEntitlementsEnabled)()) {
-            res.status(404).json({
-                error: 'Not found',
-                featureFlags: {
-                    personaEntitlements: false
-                }
-            });
+            res.json((0, persona_entitlement_service_1.buildUngatedPersonaWorkspaceState)(apiKeyData.userId, apiKeyData.key));
             return;
         }
         const state = await (0, persona_entitlement_service_1.getWorkspacePersonaState)(dbService, apiKeyData.userId, apiKeyData.key);

package/dist/src/services/persona-entitlement-service.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSubscriptionActive = computeSubscriptionActive;
+exports.resolvePersonaAccessStatuses = resolvePersonaAccessStatuses;
+exports.buildUngatedPersonaWorkspaceState = buildUngatedPersonaWorkspaceState;
 exports.buildPersonaHireUrl = buildPersonaHireUrl;
 exports.syncPersonaEntitlementPurchase = syncPersonaEntitlementPurchase;
 exports.syncPersonaEntitlementFromCheckoutSession = syncPersonaEntitlementFromCheckoutSession;
@@ -9,6 +12,66 @@ const persona_hiring_1 = require("../config/persona-hiring");
 const persona_capability_bundles_1 = require("../config/persona-capability-bundles");
 const workspace_identity_1 = require("./workspace-identity");
 const DEFAULT_JOB_CREDITS = 1;
+// The one place the "is the persona system gating this workspace?" question is
+// answered. A workspace is subscribed if it explicitly opted in (personaSystemActive)
+// or has ever held an active entitlement. Shared by getWorkspacePersonaState and
+// evaluatePersonaAccess so display and enforcement can never diverge.
+function computeSubscriptionActive(apiKeyData, entitlements) {
+    return apiKeyData?.personaSystemActive === true || entitlements.some((e) => e.status === 'active');
+}
+// Single source of truth for per-persona access, mirroring evaluatePersonaAccess's
+// gating rules exactly:
+//   - `ungated` (feature flag OFF, or legacy/never-subscribed workspace) => every
+//     persona is accessible ('hired').
+//   - otherwise => 'hired' iff the workspace holds an active entitlement for it.
+// Pure and DB-free so it is trivially testable and callable from either code path.
+function resolvePersonaAccessStatuses(ungated, entitlements) {
+    const activeByKey = new Map();
+    for (const entitlement of entitlements) {
+        if (entitlement.status !== 'active')
+            continue;
+        const list = activeByKey.get(entitlement.personaKey) || [];
+        list.push(entitlement);
+        activeByKey.set(entitlement.personaKey, list);
+    }
+    return (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => {
+        const active = activeByKey.get(bundle.personaKey) || [];
+        const seatCount = active.reduce((sum, e) => sum + (e.jobCreditsRemaining ?? 1), 0);
+        return {
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            status: (ungated || active.length > 0) ? 'hired' : 'locked',
+            seatCount,
+        };
+    });
+}
+// The persona-entitlements feature is OFF: there is no gating, so every persona is
+// accessible. Returned by /api/personas/me instead of a 404 so downstream consumers
+// (the Hub especially) inherit "flag off => all employees available" rather than
+// inventing their own fallback. Matches maybeBuildPersonaLockResponse, which also
+// short-circuits to "allowed" when the flag is off. No DB lookup is required.
+function buildUngatedPersonaWorkspaceState(userId, apiKey) {
+    return {
+        featureFlagEnabled: false,
+        featureFlags: { personaEntitlementsEnabled: false },
+        subscriptionActive: false,
+        workspaceId: normalizeEmail(userId),
+        userId: normalizeEmail(userId),
+        apiKey: apiKey || null,
+        entitlements: [],
+        catalog: (0, persona_capability_bundles_1.listPersonaCapabilityBundles)().map((bundle) => ({
+            personaKey: bundle.personaKey,
+            personaName: bundle.catalogMetadata.displayName,
+            personaRole: bundle.catalogMetadata.role,
+            hireUrl: buildPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
+            protectedJobs: bundle.protectedJobs,
+        })),
+        lockedPersonas: [],
+        personas: resolvePersonaAccessStatuses(true, []),
+    };
+}
 function normalizeEmail(email) {
     return email.trim().toLowerCase();
 }
@@ -154,9 +217,7 @@ async function getWorkspacePersonaState(dbService, userId, apiKey) {
         protectedJobs: bundle.protectedJobs
     }));
     const knownPersonaKeys = new Set(entitlements.map((entitlement) => entitlement.personaKey));
-    // Subscribed = explicitly opted in via flag, OR has ever had an active entitlement.
-    const subscriptionActive = apiKeyData?.personaSystemActive === true ||
-        entitlements.some((e) => e.status === 'active');
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, entitlements);
     return {
         featureFlagEnabled: true,
         featureFlags: {
@@ -185,7 +246,10 @@ async function getWorkspacePersonaState(dbService, userId, apiKey) {
             .map((persona) => ({
             ...persona,
             status: 'locked'
-        }))
+        })),
+        // Authoritative per-persona verdict: a non-subscribed (legacy) workspace is
+        // ungated, so all personas are accessible; a subscribed one gates to owned.
+        personas: resolvePersonaAccessStatuses(!subscriptionActive, entitlements),
     };
 }
 async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnTo) {
@@ -205,9 +269,9 @@ async function evaluatePersonaAccess(dbService, userId, jobName, apiKey, returnT
     });
     const workspaceEntitlements = await dbService.getPersonaEntitlementsByWorkspaceId(workspace.workspaceId, false);
     // Legacy bypass: if the workspace has never subscribed to the persona system,
-    // all jobs are freely accessible — no lock enforcement.
-    const subscriptionActive = apiKeyData?.personaSystemActive === true ||
-        workspaceEntitlements.some((e) => e.status === 'active');
+    // all jobs are freely accessible — no lock enforcement. Same rule the Hub
+    // display inherits via resolvePersonaAccessStatuses(!subscriptionActive, ...).
+    const subscriptionActive = computeSubscriptionActive(apiKeyData, workspaceEntitlements);
     if (!subscriptionActive) {
         return {
             allowed: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.195",
+  "version": "2.0.196",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {

package/public/ai-hub/script.js

@@ -3277,6 +3277,10 @@ function convAwaitingReview(conv) {
   // output, not deliverables submitted to the human manager. Other manager jobs (e.g.,
   // stakeholder-status-reporting) may legitimately surface artifacts for human review.
   if (delegationLedgerForConversation(conv)) return false;
+  const runArtifacts = Array.isArray(conv.artifacts) ? conv.artifacts : [];
+  if (conv.status === 'completed' && runArtifacts.some((artifact) => artifactLocalPath(artifact) || artifactExternalUrl(artifact))) {
+    return true;
+  }
   // #521: a plain completed turn is NOT awaiting review — the approve/reject card
   // only belongs when the employee actually submits for review (a review_handoff,
   // emitted by the submit phase). A turn that just finished (a question, a pause
@@ -3483,12 +3487,32 @@ function hasReviewHandoffSignal(text) {
   return !!(text && /reviewRequired|reviewTarget|review_handoff/i.test(text));
 }
 
+function reviewSubmissionClaimText(text) {
+  return String(stripMarkdownForDisplay(text) || '')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function hasExplicitReviewSubmissionClaim(text) {
+  const cleaned = reviewSubmissionClaimText(text);
+  if (!cleaned) return false;
+  if (/\b(?:not\s+ready|not\s+yet\s+ready|will\s+be\s+ready|soon\s+be\s+ready)\b.{0,60}\breview\b/i.test(cleaned)) {
+    return false;
+  }
+  return /\bready\s+for\s+(?:your\s+)?review\b/i.test(cleaned)
+    || /\bplease\s+review\b/i.test(cleaned)
+    || /\bsubmitted\s+(?:the\s+|this\s+|my\s+)?(?:work|deliverable|artifact|bundle|pr|pull request|document|doc|file|files)\s+for\s+(?:your\s+)?review\b/i.test(cleaned)
+    || /\b(?:review|open)\s+(?:the\s+)?(?:pr|pull request|artifact|document|doc|file|files|deliverable|bundle)\b/i.test(cleaned);
+}
+
 function reviewHandoffIssueForConversation(conv) {
   if (!conv) return '';
   if (conv.reviewHandoff && !normalizeReviewHandoff(conv.reviewHandoff)) {
     return 'The review handoff contract is invalid.';
   }
   const messages = conv.messages || [];
+  const hasRunArtifacts = Array.isArray(conv.artifacts) && conv.artifacts.length > 0;
+  const latestEmployee = [...messages].reverse().find((message) => message.role === 'employee');
   for (let i = messages.length - 1; i >= 0; i -= 1) {
     if (messages[i].role !== 'employee') continue;
     if (!hasReviewHandoffSignal(messages[i].text)) continue;
@@ -3496,6 +3520,9 @@ function reviewHandoffIssueForConversation(conv) {
       return 'The review handoff contract is malformed or missing required fields.';
     }
   }
+  if (!conv.reviewHandoff && !hasRunArtifacts && latestEmployee && hasExplicitReviewSubmissionClaim(latestEmployee.text)) {
+    return 'This run says it is ready for review, but did not include a structured review handoff.';
+  }
   return '';
 }
 
@@ -3851,7 +3878,7 @@ function renderReviewExperience(conv) {
   if (handoff) {
     const hasArtifact = !!(fmt.actions && fmt.actions.length);
     handoff.textContent = fmt.key === 'contract_error'
-      ? 'The review handoff contract is invalid. Ask the employee to resend it before review.'
+      ? `${fmt.issue || 'The review handoff contract is invalid.'} Ask the employee to resend it before review.`
       : fmt.key === 'pull_request'
         ? 'Comment on the PR to leave inline notes, or approve / type changes below.'
         : isManagerTemplateJob(conv && conv.jobId)