feat: surface research admission gates in settings

Author: DeliciousBuding

apps/web/src/app/(workspace)/workspace/settings/SettingsClient.test.tsx

@@ -13,6 +13,43 @@ function withToast(ui: React.ReactElement) {
 }
 
 describe("SettingsClient account verification", () => {
+  it("renders Runner admission gates from research boundaries without promoting watch items", () => {
+    const markup = renderToStaticMarkup(withToast(
+      <SettingsClient
+        locale="en-US"
+        oauthEnabled={{ google: true, github: true }}
+        initialResearchBoundaries={{
+          status: "ok",
+          source: "registry",
+          candidate_policy: "not-exposed-as-live-jobs",
+          boundaries: [
+            {
+              key: "h2-output-cloud-geometry-candidate-no-runtime-job",
+              title: "H2 output-cloud geometry candidate",
+              admission_status: "watch",
+            },
+            {
+              key: "rediffuse-stl10-bounded-scout-and-score-norm-completed-weak-results-no-runtime-job",
+              title: "ReDiffuse STL-10 weak scout",
+              admission_status: "watch",
+            },
+          ],
+          source_readiness: { ready: true },
+        }}
+      />,
+    ));
+
+    expect(markup).toContain("data-runner-boundary-panel");
+    expect(markup).toContain("Runner admission gates");
+    expect(markup).toContain("Watch-only");
+    expect(markup).toContain(">2<");
+    expect(markup).toContain("Admitted");
+    expect(markup).toContain(">0<");
+    expect(markup).toContain("Research candidates stay outside live jobs");
+    expect(markup).toContain("H2 output-cloud geometry candidate");
+    expect(markup).toContain("ReDiffuse STL-10 weak scout");
+  });
+
   it("renders a verification entry point for pending email addresses", () => {
     const markup = renderToStaticMarkup(withToast(
       <SettingsClient

apps/web/src/app/(workspace)/workspace/settings/SettingsClient.tsx

@@ -18,6 +18,10 @@ import { useTheme } from "@/hooks/use-theme";
 import type { ThemeMode } from "@/lib/theme";
 import type { CurrentUserProfile } from "@/lib/auth";
 import { setDemoModeClient } from "@/lib/demo-mode-client";
+import {
+  getResearchBoundarySummary,
+  type ResearchBoundariesPayload,
+} from "@/lib/research-boundaries";
 import { WORKSPACE_COPY } from "@/lib/workspace-copy";
 
 const STORAGE_KEYS = {
@@ -58,7 +62,6 @@ type GatewayHealth = {
     date?: string;
   };
 };
-
 function formatProviderName(provider: string) {
   if (provider === "google") return "Google";
   if (provider === "github") return "GitHub";
@@ -167,6 +170,7 @@ interface SettingsClientProps {
   initialProviderLinkStatus?: ProviderLinkStatus | null;
   oauthEnabled: { google: boolean; github: boolean };
   mode?: SettingsMode;
+  initialResearchBoundaries?: ResearchBoundariesPayload | null;
 }
 
 export function SettingsClient({
@@ -178,6 +182,7 @@ export function SettingsClient({
   initialProviderLinkStatus,
   oauthEnabled,
   mode = "settings",
+  initialResearchBoundaries,
 }: SettingsClientProps) {
   const localeCopy = WORKSPACE_COPY[locale];
   const copy = localeCopy.settings;
@@ -226,6 +231,13 @@ export function SettingsClient({
   const [gatewayHealth, setGatewayHealth] = useState<GatewayHealth | null>(null);
   const [gatewayHealthError, setGatewayHealthError] = useState(false);
   const [gatewayHealthLoading, setGatewayHealthLoading] = useState(true);
+  const [researchBoundaries, setResearchBoundaries] = useState<ResearchBoundariesPayload | null>(
+    initialResearchBoundaries ?? null,
+  );
+  const [researchBoundariesError, setResearchBoundariesError] = useState(false);
+  const [researchBoundariesLoading, setResearchBoundariesLoading] = useState(
+    initialResearchBoundaries === undefined,
+  );
 
   // Audit templates
   const [templates, setTemplates] = useState<SavedTemplate[]>([]);
@@ -331,6 +343,42 @@ export function SettingsClient({
     };
   }, []);
 
+  useEffect(() => {
+    if (initialResearchBoundaries !== undefined) return;
+
+    const controller = new AbortController();
+    const timeoutId = window.setTimeout(() => controller.abort(), 3000);
+
+    async function loadResearchBoundaries() {
+      try {
+        const response = await fetch("/api/v1/research-boundaries", {
+          cache: "no-store",
+          signal: controller.signal,
+        });
+        if (!response.ok) {
+          setResearchBoundariesError(true);
+          return;
+        }
+        const payload = (await response.json().catch(() => null)) as ResearchBoundariesPayload | null;
+        setResearchBoundaries(payload);
+        setResearchBoundariesError(false);
+      } catch {
+        setResearchBoundaries(null);
+        setResearchBoundariesError(true);
+      } finally {
+        window.clearTimeout(timeoutId);
+        setResearchBoundariesLoading(false);
+      }
+    }
+
+    void loadResearchBoundaries();
+
+    return () => {
+      window.clearTimeout(timeoutId);
+      controller.abort();
+    };
+  }, [initialResearchBoundaries]);
+
   useEffect(() => {
     setThemeMounted(true);
   }, []);
@@ -653,6 +701,10 @@ export function SettingsClient({
     { key: "google", label: profile ? copy.account.connectGoogle : copy.account.signInGoogle },
   ] as const).filter((provider) => oauthEnabled[provider.key] && (profile ? !connectedProviders.includes(provider.key) : true));
   const accessSummary = getAccessSummary(profile, copy.account);
+  const researchBoundarySummary = getResearchBoundarySummary(
+    researchBoundaries,
+    copy.systemStatus.runnerBoundaryUnknown,
+  );
   const accountStateItems = [
     {
       key: "email",
@@ -791,6 +843,59 @@ export function SettingsClient({
               </div>
             ) : null}
 
+            <div className="rounded-2xl border border-border bg-muted/10 p-4" data-runner-boundary-panel>
+              {researchBoundariesLoading ? (
+                <div className="space-y-3">
+                  <div className="animate-pulse rounded-xl bg-muted/30 h-4 w-2/3" />
+                  <div className="animate-pulse rounded-xl bg-muted/30 h-4 w-1/2" />
+                </div>
+              ) : (
+                <>
+                  <div className="flex items-center justify-between gap-3">
+                    <span className="text-xs text-muted-foreground">{copy.systemStatus.runnerBoundary}</span>
+                    <StatusBadge tone={researchBoundarySummary.ready ? "info" : "neutral"} compact>
+                      {researchBoundarySummary.ready ? copy.systemStatus.runnerBoundaryReady : copy.systemStatus.runnerBoundaryUnavailable}
+                    </StatusBadge>
+                  </div>
+                  <div className="mt-3 grid grid-cols-2 gap-2">
+                    <div className="rounded-xl border border-border bg-background/40 px-2.5 py-2">
+                      <div className="text-[10px] uppercase tracking-[0.16em] text-muted-foreground">
+                        {copy.systemStatus.runnerBoundaryWatch}
+                      </div>
+                      <div className="mt-1 text-sm font-semibold text-foreground">
+                        {researchBoundarySummary.watchOnlyBoundaryCount}
+                      </div>
+                    </div>
+                    <div className="rounded-xl border border-border bg-background/40 px-2.5 py-2">
+                      <div className="text-[10px] uppercase tracking-[0.16em] text-muted-foreground">
+                        {copy.systemStatus.runnerBoundaryAdmitted}
+                      </div>
+                      <div className="mt-1 text-sm font-semibold text-foreground">
+                        {researchBoundarySummary.admittedBoundaryCount}
+                      </div>
+                    </div>
+                  </div>
+                  <p className="mt-3 text-[11px] leading-5 text-muted-foreground">
+                    {copy.systemStatus.runnerBoundaryPolicy}
+                  </p>
+                  {researchBoundarySummary.previewLabels.length > 0 ? (
+                    <div className="mt-3 space-y-1.5">
+                      {researchBoundarySummary.previewLabels.map((label) => (
+                        <div key={label} className="truncate rounded-lg bg-muted/20 px-2 py-1 font-mono text-[10px] text-muted-foreground">
+                          {label}
+                        </div>
+                      ))}
+                    </div>
+                  ) : null}
+                </>
+              )}
+            </div>
+            {researchBoundariesError ? (
+              <div className="rounded-2xl border border-[var(--warning)]/30 bg-[var(--warning)]/10 px-3 py-2 text-[11px] leading-5 text-[var(--warning)]">
+                {copy.systemStatus.runnerBoundaryError}
+              </div>
+            ) : null}
+
             <div className="rounded-2xl border border-border bg-muted/10 p-3">
               <div className="flex items-center justify-between gap-3">
                 <div className="flex min-w-0 items-center gap-3">

apps/web/src/lib/research-boundaries.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+
+import { getResearchBoundarySummary } from "./research-boundaries";
+
+describe("getResearchBoundarySummary", () => {
+  it("keeps watch-only research candidates out of admitted counts", () => {
+    const summary = getResearchBoundarySummary({
+      status: "ok",
+      boundaries: [
+        {
+          key: "h2-output-cloud-geometry-candidate-no-runtime-job",
+          title: "H2 output-cloud geometry candidate",
+          admission_status: "watch",
+        },
+        {
+          key: "rediffuse-stl10-bounded-scout-and-score-norm-completed-weak-results-no-runtime-job",
+          title: "ReDiffuse STL-10 weak scout",
+          admission_status: "watch",
+        },
+      ],
+      source_readiness: { ready: true },
+    }, "Unnamed boundary");
+
+    expect(summary).toMatchObject({
+      boundaryCount: 2,
+      watchOnlyBoundaryCount: 2,
+      admittedBoundaryCount: 0,
+      ready: true,
+    });
+    expect(summary.previewLabels).toEqual([
+      "H2 output-cloud geometry candidate",
+      "ReDiffuse STL-10 weak scout",
+    ]);
+  });
+
+  it("sanitizes boundary preview labels before they are rendered", () => {
+    const summary = getResearchBoundarySummary({
+      boundaries: [
+        {
+          title: "Failed at D:\\private\\runtime.log via http://127.0.0.1:8765",
+          admission_status: "watch",
+        },
+      ],
+    }, "Unnamed boundary");
+
+    expect(summary.previewLabels[0]).not.toContain("D:\\private");
+    expect(summary.previewLabels[0]).not.toContain("127.0.0.1");
+    expect(summary.previewLabels[0]).toContain("<local-path>");
+    expect(summary.previewLabels[0]).toContain("<runtime-url>");
+  });
+});

apps/web/src/lib/research-boundaries.ts

@@ -0,0 +1,54 @@
+import { sanitizeRuntimeText } from "@/lib/runtime-text";
+
+export type ResearchBoundary = {
+  key?: string;
+  title?: string;
+  label?: string;
+  status?: string;
+  admission_status?: string;
+};
+
+export type ResearchBoundariesPayload = {
+  status?: string;
+  source?: string;
+  candidate_policy?: string;
+  boundaries?: ResearchBoundary[];
+  runtime_configured?: boolean;
+  demo_mode?: boolean;
+  source_readiness?: {
+    configured?: boolean;
+    ready?: boolean;
+  };
+};
+
+export type ResearchBoundarySummary = {
+  boundaryCount: number;
+  watchOnlyBoundaryCount: number;
+  admittedBoundaryCount: number;
+  ready: boolean;
+  previewLabels: string[];
+};
+
+export function getResearchBoundarySummary(
+  payload: ResearchBoundariesPayload | null | undefined,
+  fallbackLabel: string,
+): ResearchBoundarySummary {
+  const boundaryItems = Array.isArray(payload?.boundaries)
+    ? payload.boundaries
+    : [];
+
+  return {
+    boundaryCount: boundaryItems.length,
+    watchOnlyBoundaryCount: boundaryItems.filter((boundary) => !isAdmittedBoundary(boundary)).length,
+    admittedBoundaryCount: boundaryItems.filter(isAdmittedBoundary).length,
+    ready: payload?.status === "ok" || payload?.source_readiness?.ready === true,
+    previewLabels: boundaryItems.slice(0, 3).map((boundary) => (
+      sanitizeRuntimeText(boundary.title ?? boundary.label ?? boundary.key ?? fallbackLabel)
+        ?? fallbackLabel
+    )),
+  };
+}
+
+function isAdmittedBoundary(boundary: ResearchBoundary) {
+  return (boundary.admission_status ?? boundary.status ?? "").toLowerCase() === "admitted";
+}

apps/web/src/lib/workspace-copy.ts

@@ -753,7 +753,7 @@ export const WORKSPACE_COPY: Record<
       eyebrow: string;
       title: string;
       description: string;
-      systemStatus: { title: string; runtime: string; snapshot: string; snapshotReady: string; snapshotMissing: string; build: string; unknown: string; demoMode: string; demoOn: string; demoOff: string; demoHintOn: string; demoHintOff: string; gatewayError: string };
+      systemStatus: { title: string; runtime: string; snapshot: string; snapshotReady: string; snapshotMissing: string; build: string; unknown: string; demoMode: string; demoOn: string; demoOff: string; demoHintOn: string; demoHintOff: string; gatewayError: string; runnerBoundary: string; runnerBoundaryReady: string; runnerBoundaryUnavailable: string; runnerBoundaryWatch: string; runnerBoundaryAdmitted: string; runnerBoundaryPolicy: string; runnerBoundaryError: string; runnerBoundaryUnknown: string };
       auditConfig: { title: string; defaultRounds: string; defaultBatchSize: string; saved: string; roundsClamped: string; batchClamped: string };
       account: { title: string; username: string; email: string; pendingEmail: string; pendingEmailNote: string; addEmail: string; changeEmail: string; emailPlaceholder: string; saveEmail: string; savingEmail: string; cancelEmailEdit: string; emailSaved: string; emailInvalid: string; emailInUse: string; generateVerificationLink: string; generatingVerificationLink: string; verificationWorkspaceMode: string; verificationLinkReady: string; openVerificationLink: string; copyVerificationLink: string; showVerificationDetails: string; hideVerificationDetails: string; verificationLinkCopied: string; verificationRequestFailed: string; passwordSaveFailed: string; verificationSuccess: string; verificationMissing: string; verificationInvalid: string; verificationExpired: string; verificationMissingPending: string; providers: string; connectGoogle: string; connectGithub: string; signInGoogle: string; signInGithub: string; providerLinkedGoogle: string; providerLinkedGithub: string; providerAlreadyLinkedGoogle: string; providerAlreadyLinkedGithub: string; providerInUseGoogle: string; providerInUseGithub: string; accessSummary: string; accessSummaryPrefix: string; accessSummaryPasswordOn: string; accessSummaryPasswordOff: string; accessSummaryPendingEmail: string; accessSummaryNoProvider: string; connectAnotherProvider: string; password: string; passwordManage: string; passwordSet: string; passwordUnset: string; loginId: string; loginIdPending: string; verified: string; unverified: string; noEmail: string; securityNote: string; privacy: string; terms: string; currentPassword: string; currentPasswordPlaceholder: string; currentPasswordRequired: string; currentPasswordIncorrect: string; newPassword: string; newPasswordPlaceholder: string; confirmPassword: string; confirmPasswordPlaceholder: string; passwordHintNew: string; passwordHintExisting: string; openPasswordCreate: string; openPasswordChange: string; closePasswordEditor: string; createLocalAccount: string; savePassword: string; savingPassword: string; passwordSaved: string; passwordMismatch: string; passwordTooShort: string; passwordRequired: string; passwordUnauthorized: string; twoFactor: string; twoFactorHint: string; twoFactorEnabled: string; twoFactorDisabled: string; twoFactorEnable: string; twoFactorDisable: string; twoFactorSaving: string; twoFactorSavedOn: string; twoFactorSavedOff: string; twoFactorSaveFailed: string; twoFactorNetworkFailed: string; notSignedIn: string; chooseSignInMethod: string; githubAvatarPriority: string; logout: string };
       preferences: { title: string; language: string; languageNote: string; theme: string; themeLight: string; themeDark: string; themeSystem: string };
@@ -1749,6 +1749,14 @@ export const WORKSPACE_COPY: Record<
         demoHintOn: "Using snapshot contracts, jobs, and reports across the workspace.",
         demoHintOff: "Using live Runtime and API responses instead of snapshot data.",
         gatewayError: "Gateway health check failed. Some status information may be unavailable.",
+        runnerBoundary: "Runner admission gates",
+        runnerBoundaryReady: "Synced",
+        runnerBoundaryUnavailable: "Unavailable",
+        runnerBoundaryWatch: "Watch-only",
+        runnerBoundaryAdmitted: "Admitted",
+        runnerBoundaryPolicy: "Research candidates stay outside live jobs until Runtime exposes an admitted contract.",
+        runnerBoundaryError: "Research boundary status is unavailable. Live job admission remains conservative.",
+        runnerBoundaryUnknown: "Unnamed boundary",
       },
       auditConfig: {
         title: "Audit defaults",
@@ -2915,6 +2923,14 @@ export const WORKSPACE_COPY: Record<
         demoHintOn: "当前工作台统一使用演示快照：合约、任务、报告都会显示模拟数据",
         demoHintOff: "当前使用实时 Runtime / API 数据，不再显示演示快照。",
         gatewayError: "网关健康检查失败，部分状态信息可能不可用。",
+        runnerBoundary: "Runner 准入边界",
+        runnerBoundaryReady: "已同步",
+        runnerBoundaryUnavailable: "不可用",
+        runnerBoundaryWatch: "观察中",
+        runnerBoundaryAdmitted: "已准入",
+        runnerBoundaryPolicy: "Research 候选结果在 Runtime 暴露已准入合约前，不会进入实时任务。",
+        runnerBoundaryError: "Research 边界状态不可用。实时任务准入仍保持保守策略。",
+        runnerBoundaryUnknown: "未命名边界",
       },
       auditConfig: {
         title: "审计默认值",