Approval queue

The queue card on Today sorts remediation cases into bands from their own records. Empty bands say they are empty; an unreadable store renders nothing rather than a guess.

• Built, awaiting your approval. Newest first, and nothing here failed a recorded check. A card expands into the full record: the causal chain with its confidence band, the brief the build ran against, the five verification checks, the changed files with the PR link, the out-of-repo step named as yours, and the lesson that ships on approval.
• Being built now. Each item shows the record's own live step (scoping, building, verifying) and its metered spend so far. Measured dollars, never estimates.
• Below the build floor. Medium and low findings wait for you, on purpose. Each offers Scope only (always cents) and, when a hold was recorded, Build it against today's budget. The scope-cost figure on the button is a measurement from prior scoping or it is absent; it is never invented.

Above the bands, Today's figures include the fixes waiting on you and today's measured build spend against the cap; the Remediation tab reads the same model and shows Waiting for you, Being built, Below the floor and Shipped as four figures. The headline reads "N fixes are built and waiting on you" only when N is a real positive count.

Approve is not a click that trusts a screenshot. The server runs the brief's file leash and all five checks before anything merges; only a recorded pass squash-merges the pull request. The same act writes the lesson from the brief's done-means and arms the guard that blocks the introducing mistake, so approving a fix is also approving what the system learns from it.

• The merge is last. A failed check shows you the honest error instead of merging.
• Pending CI defers. Nothing is recorded and nothing merges until the PR's checks finish.
• Watch-only wins. If your first-run answer was watch only, the merge is refused with the reason shown, at this gate and every earlier one.
• The branch must not move. A push after verification stops the merge with one sentence, the branch moved after verification, and the case waits for a fresh verify.

Rejection discards the diff, the guard, and the lesson together, and closes the pull request. The reason is required because a rejection is information: it is the cheapest possible correction to a loop that scoped or built the wrong thing. Discarding the trio together is deliberate, so the lesson store never fills with cures nobody wanted.

The gate sits after the build, which makes build spend speculative. Two bounds keep it honest, both editable on the Remediation tab under Build policy, beside its spend meter:

• The auto-build severity floor (default: high). High and critical findings may build unattended; medium and low wait for your explicit click, so a cost tip never spends build budget ahead of an incident.
• The daily build cap (default: $10.00 per UTC day). The meter sums the real per-case build costs the builder recorded, failed runs included. A Build-it click at or over the cap is refused up front, quoting the measured spend and the cap, before a cent of new spend.
• The classes table (on the Remediation tab, and on /team/remediation for a team owner or admin) sets a level per kind of problem: build, ask or never. A credential in source, a tracked .env file, an undeclared environment variable and a GitHub code scanning or secret scanning alert default to build; a risky command, a production error, a failed deployment and a performance finding default to ask; a prompt injection marker, an exfiltration shape, live egress and an agent incident default to never. The stricter of the floor and the level wins, and the queue names the hold as class-ask or class-never. An ask case shows its brief and a Build button; a never case reads "held by policy: class never".
• The auto-remediation switch (one button on the Remediation tab per repo, and on /team/remediation per team for an owner or admin). Auto-remediation is off until you turn it on. With it off, nothing merges without you. With it on, a fourth level, auto, becomes available: the classes you set to auto merge when all five checks pass, and every merge carries the receipt. Pressing it records who, when and on which scope; turning it off records that too and returns every auto row to build. The team switch is the ceiling over every bound desktop. The merge runs inside the unattended build tick on the machine that built the fix, is bound to the verified digest, and counts against a daily merge cap (default five, the stricter of the team's and the desktop's), separate from the build cap. A built fix the loop looked at and did not merge carries the reason on its row: switch-off, team-ceiling, merge-cap-reached, watch-only, class-not-auto, brief-not-grounded, cap-reached, hard-to-reverse, or the branch moved after verification. Hard-to-reverse means the diff deletes a file, touches a migration or a schema, or changes a watched or critical path, and no setting lets the loop merge such a fix: a person does.

• Shipped. The Remediation tab's Shipped figure counts the fixes that merged with their lesson recorded, and Today's aside names what the loop built overnight.
• OWASP LLM Top 10 coverage. The first-run handoff states coverage at this machine's capture tier: how many categories are covered, partial, and not covered, with the not-covered ones named rather than implied clean. It reads the one Session Signals coverage matrix; the full matrix, per capture tier, is on the Security tab.

• Auto-remediation: the loop that fills this queue.
• Today: the tab the queue lives on.
• First run: where the autonomy answer that watch-only enforces comes from.
• Settings: the editable build policy and the Sentry connection.