Approval queue

The queue card on Today sorts remediation cases into bands from their own records. Empty bands say they are empty; an unreadable store renders nothing rather than a guess.

• Built, awaiting your approval. Newest first, and nothing here failed a check. A card expands into the full record: the causal chain with its confidence band, the brief the build ran against, the five verification checks, the changed files with the PR link, the out-of-repo step named as yours, and the lesson that ships on approval.
• Being built now. Each item shows the record's own live step (scoping, building, verifying) and its metered spend so far. Measured dollars, never estimates.
• Below the build floor. Medium and low findings wait for you, on purpose. Each offers Scope only (always cents) and, when a hold was recorded, Build it against today's budget. The scope-cost figure on the button is a measurement from prior scoping or it is absent; it is never invented.

Above the bands, the stat strip: built, being built, shipped since yesterday, and today's measured build spend against the cap. The headline reads "N fixes are built and waiting on you" only when N is a real positive count.

Approve is not a click that trusts a screenshot. The server re-runs the file leash and all five checks before anything merges; only a recorded pass squash-merges the pull request. The same act writes the lesson from the brief's done-means and arms the guard that blocks the introducing mistake, so approving a fix is also approving what the system learns from it.

• The merge is last. A re-verification miss shows you the honest error instead of merging.
• Pending CI defers. Nothing is recorded and nothing merges until the PR's checks finish.
• Watch-only wins. If your first-run answer was watch only, the merge is refused with the reason shown, at this gate and every earlier one.

Rejection discards the diff, the guard, and the lesson together, and closes the pull request. The reason is required because a rejection is information: it is the cheapest possible correction to a loop that scoped or built the wrong thing. Discarding the trio together is deliberate, so the lesson store never fills with cures nobody wanted.

The gate sits after the build, which makes build spend speculative. Two bounds keep it honest, both editable on the Settings tab and shown on the Today rail's Build policy card:

• The auto-build severity floor (default: high). High and critical findings may build unattended; medium and low wait for your explicit click, so a cost tip never spends build budget ahead of an incident.
• The daily build cap (default: $10.00 per UTC day). The meter sums the real per-case build costs the builder recorded, failed runs included. A Build-it click at or over the cap is refused up front, quoting the measured spend and the cap, before a cent of new spend.
• Merges without you: never. The floor and cap bound what gets built. The approve gate does not move for any setting.

• Shipped since yesterday. Merges from the last 24 hours with their PR numbers, and a guard-catch sentence that renders only when the prevention ledger holds a catch dated after the merge.
• OWASP LLM Top 10 coverage. Covered, partial, and not covered at this machine's capture tier, with what fired this week per category, from the one Session Signals coverage matrix. Not covered is named, never implied clean. The first-run handoff carries the same statement.

• Auto-remediation: the nine-stage loop that fills this queue.
• Today: the tab the queue and rail live on.
• First run: where the autonomy answer that watch-only enforces comes from.
• Settings: the editable Build policy card and the Sentry connection.