From fd8016514208e6d35ff0dcf332880ec2eb2586bc Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:20:37 +0100
Subject: [PATCH 01/13] docs: design guided inbox-first autopilot

---
 CONTEXT.md                                    |  41 +++
 ...026-08-09-guided-autopilot-inbox-design.md | 283 ++++++++++++++++++
 2 files changed, 324 insertions(+)
 create mode 100644 CONTEXT.md
 create mode 100644 docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md

diff --git a/CONTEXT.md b/CONTEXT.md
new file mode 100644
index 000000000000..8d9563531ac5
--- /dev/null
+++ b/CONTEXT.md
@@ -0,0 +1,41 @@
+# GITS Autonomy
+
+GITS autonomy turns operator-reviewed improvement ideas into safely queued work while keeping the operator-visible history distinct from execution state.
+
+## Language
+
+**Proposal**:
+A candidate piece of work presented for operator review. It is not executable work until accepted.
+_Avoid_: Goal, task, notification
+
+**Launch Configuration**:
+The proposal-specific choices that define how accepted work should run, including its model and optional execution constraints.
+_Avoid_: Global policy, settings form
+
+**Acceptance**:
+The operator decision that approves a Proposal with its Launch Configuration and requests exactly one Goal.
+_Avoid_: Dispatch, start, run
+
+**Goal**:
+The durable execution record created from an accepted Proposal. A Goal may wait in the Queue before execution starts.
+_Avoid_: Proposal, notification
+
+**Queue**:
+The ordered collection of Goals eligible for future execution. Entering the Queue does not mean execution has started.
+_Avoid_: Inbox, scheduler
+
+**Inbox Item**:
+The durable operator-facing history of a Proposal and its resulting Goal. It is not execution truth.
+_Avoid_: Goal, push notification
+
+**Notification**:
+An optional delivery signal that points to an Inbox Item. Delivery failure does not remove or alter the Inbox Item.
+_Avoid_: Inbox Item, Proposal
+
+**Pause**:
+An operator state that prevents new proposals and future Goal starts without terminating work already running.
+_Avoid_: Emergency Stop, kill
+
+**Emergency Stop**:
+An operator action that terminates running autonomous work and prevents new Goal starts until autonomy is explicitly enabled again.
+_Avoid_: Pause, reject
diff --git a/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md b/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md
new file mode 100644
index 000000000000..074eb8e9db57
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md
@@ -0,0 +1,283 @@
+# Guided Inbox-First Autopilot Design
+
+**Status:** Draft for operator review
+**Date:** 2026-08-09
+
+## Objective
+
+Redesign Autopilot around one understandable operator journey: receive a durable proposal in the Cockpit Inbox, open it from an Android PWA notification or the Inbox, validate the idea, choose a model from a dropdown, optionally adjust advanced proposal-specific settings, and accept it into the execution queue immediately.
+
+Keep the useful execution choices, but remove the current raw global-policy workflow. The normal cockpit must not require the operator to understand Automode modes, allowlist duplication, scheduler arming, approval flags, verification JSON, or notification-channel internals before accepting a proposal.
+
+Add notification diagnostics that send real Web Push notifications to the current device so Android PWA delivery and routing can be tested without creating production proposals or goals.
+
+## Domain Model
+
+The canonical terms are recorded in the repository `CONTEXT.md`.
+
+- A **Proposal** is a reviewable idea, not executable work.
+- A **Launch Configuration** contains proposal-specific run choices.
+- **Acceptance** validates a Proposal and requests exactly one **Goal**.
+- A Goal enters the **Queue** immediately but may start later when execution gates permit.
+- An **Inbox Item** is the durable operator-facing projection of the Proposal and Goal lifecycle.
+- A **Notification** is an optional delivery signal pointing to that Inbox Item.
+
+These distinctions are load-bearing. The Inbox is not the Queue, accepting is not dispatching, and opening a notification is not acceptance.
+
+## Existing Modules Reused
+
+- `CockpitInbox` remains authoritative for unread state, pinning, retention, and the operator-visible timeline.
+- `HermesProposalCard` remains authoritative for proposal content and editable launch inputs.
+- `decideProposalWithAutomodeBridge` remains the deep module for decision, draft creation, idempotent Goal creation, scheduling, and Inbox projection.
+- `AutomodeSupervisor` and its persisted Goals remain execution truth.
+- `GitsSlotScheduler` remains the sole authority for whether queued work may start.
+- `AutomodeNotifications`, `PushNotificationService`, and the existing service worker remain the Web Push delivery path.
+- The existing server-side safety gates, isolated branches, verification floor, held-PR workflow, and boot disarm remain mandatory.
+
+The redesign deepens the existing proposal-acceptance seam rather than adding a parallel execution path. Inbox, PWA, and cockpit callers all cross the same acceptance interface, giving one place for validation, idempotency, recovery, and tests.
+
+## Chosen Interaction
+
+Use a three-step guided launch sheet opened from either an Inbox Item or its PWA notification.
+
+Two alternatives were rejected:
+
+- Keeping one dense editable card retains the current cognitive load and makes required choices unclear.
+- One-click acceptance with entirely hidden defaults is simple but removes the model choice and operator confidence the redesign must preserve.
+
+The guided sheet keeps the common path short while placing rarely changed choices behind progressive disclosure.
+
+### Step 1: Validate Idea
+
+Show the Proposal's:
+
+- title and plain-language outcome;
+- repository;
+- summary and scope;
+- evidence and verification plan;
+- risk and action kind; and
+- any blocking reason.
+
+The primary action is **Continue**. **Later** and **Reject** remain secondary actions. The operator does not edit execution settings on this step.
+
+### Step 2: Choose Model
+
+Show one prominent model dropdown. It is preselected from the Proposal's model when valid, otherwise from the server's current recommendation or default. Options come from the available, policy-supported model inventory; arbitrary model text is not accepted.
+
+Each option shows a short useful label, such as provider/model and recommendation status. If the selected model becomes unavailable before acceptance, the launch is blocked with a clear message and refreshed choices.
+
+An **Advanced details** disclosure contains the existing proposal-specific fields:
+
+- repository override;
+- start time (`notBefore`);
+- runtime limit;
+- verification commands; and
+- integration branch.
+
+Defaults come from the Proposal and current safe server policy. Advanced fields are validated with the existing proposal decision schemas and policy gates. The interface uses structured controls where the domain is enumerable; raw JSON is not shown in the common path. Verification commands use repeatable command rows, with label, argv, and optional timeout.
+
+### Step 3: Review and Launch
+
+Show a short plain-language summary:
+
+- what will run;
+- where it will run;
+- selected model;
+- when it becomes eligible;
+- runtime limit;
+- verification expectation; and
+- that successful work ends in a held PR rather than an automatic merge.
+
+The single primary action is **Accept & Queue**. The button remains disabled until required values are valid. While pending, it cannot be submitted again. Success shows the created Goal and its queue/schedule state, not a misleading claim that execution has started.
+
+The sheet keeps the current step in its URL-backed focused state so a PWA deep link, refresh, or existing cockpit window resolves to the same Proposal. Unsaved field edits remain local to the sheet and are discarded when it closes.
+
+## Simplified Autopilot Surface
+
+The normal Autopilot surface contains only:
+
+- **On / Paused** status and control;
+- watched repositories;
+- the Cockpit Inbox;
+- a compact queue summary; and
+- **Emergency Stop**.
+
+The following controls leave the normal surface:
+
+- manual/supervised/autonomous mode selection;
+- manual Goal composer;
+- max peer and budget fields;
+- global model allowlist and arbitrary model text;
+- peer-spawn, integrate, and destructive-action approval toggles;
+- Motoko authority modes;
+- scheduler enable, arm, disarm, nightly cap, and quota threshold controls;
+- global verification-command JSON;
+- global integration branch;
+- duplicate GITS/Telegram notification toggles; and
+- the separate goal-status filter toolbar.
+
+This is removal from the operator Interface, not deletion of safety behavior. Legacy persisted policy remains decodable for compatibility. Internal defaults and existing gates continue to constrain every Goal.
+
+### On, Pause, and Emergency Stop
+
+**On** enables proposal discovery for watched repositories and permits queued Goals to start through the existing scheduler and safety gates. Watched repositories are the execution allowlist and proposal-discovery list; the operator does not maintain two lists.
+
+**Pause** stops new proposal discovery and future Goal starts. It does not terminate a running Goal. Pausing also clears approval-based automatic arming so a restart or scheduler tick cannot silently undo the pause.
+
+**Emergency Stop** uses the existing stop-all path: it prevents new starts, disarms scheduling, and terminates currently running autonomous work. Re-enabling Autopilot is always explicit.
+
+One server operation owns each control transition so the web client does not coordinate several policy and scheduler RPCs. Internally, the implementation may reuse the current policy and scheduler stores, but partial failure must return a failed transition and leave future starts fail-closed.
+
+## Inbox and PWA Flow
+
+The normal path is:
+
+1. Proposal creation is durably persisted by Hermes.
+2. `CockpitInbox` records `pending-review`.
+3. Optional PWA delivery is attempted with a deep link to the Proposal launch sheet.
+4. The operator opens the notification or Inbox Item.
+5. The guided sheet loads the Proposal and current model choices.
+6. **Accept & Queue** submits one proposal decision with its Launch Configuration.
+7. The server creates or repairs exactly one Goal for the Proposal episode.
+8. The server records `approved-queued` and schedules the Goal.
+9. The sheet displays the resulting queue state.
+
+PWA delivery remains advisory. Notification failure never loses a Proposal because the Inbox transition is written first. Notification text stays concise and excludes full prompts, evidence, secrets, and repository contents.
+
+The notification itself does not mutate proposal or execution state. Tapping it opens the focused review sheet, and the explicit **Accept & Queue** action performs Acceptance. This avoids accidental launches and works consistently on Android browsers that do not expose notification action buttons uniformly.
+
+## Reliable Acceptance and Recovery
+
+Acceptance is a durable, idempotent operation keyed by Proposal episode ID.
+
+Its observable success condition is all of:
+
+1. the Proposal decision and edited Launch Configuration are persisted;
+2. exactly one live Goal exists for the episode;
+3. the Inbox Item references that Goal and displays `approved-queued`; and
+4. scheduling has processed the Goal's eligibility time.
+
+The existing stores do not provide a cross-file transaction, so recovery uses ordered, replayable steps rather than pretending to be atomic.
+
+- If decision persistence succeeds but Goal creation fails, record `attention-required` when possible. Retry resumes Goal creation.
+- If Goal creation succeeds but Inbox or scheduling fails, retry finds the existing live Goal and repairs the missing projection or schedule. It never creates a second live Goal.
+- If the final response is lost, a repeated tap returns the same effective result.
+- Multiple devices accepting concurrently converge on one live Goal for the episode.
+- Reject and Later never create a Goal.
+
+The sheet remains open on failure, preserves entered choices, and shows one actionable error. An `attention-required` Inbox Item exposes **Retry launch** through the same guided sheet.
+
+## Android PWA Notification Diagnostics
+
+Settings → Notifications gains a compact **PWA diagnostics** section. It reports current-device prerequisites:
+
+- secure context;
+- notification permission;
+- service worker readiness;
+- active Web Push subscription; and
+- server VAPID availability.
+
+It provides two authenticated actions.
+
+### Send Delivery Test
+
+Send a real Web Push payload through the production server and push provider to the current browser subscription only. The request identifies the exact endpoint already registered by that browser. The server refuses an endpoint that is not in the authenticated installation's registered subscription set.
+
+The notification uses a unique tag so repeated tests are visible and do not collide with production notification deduplication. Its deep link opens the diagnostics result view and confirms that the notification click route reached the PWA.
+
+### Send Proposal Test
+
+Send a proposal-shaped notification to the current subscription. Tapping it opens the real guided launch sheet in explicit test mode with deterministic fixture content.
+
+Test mode exercises:
+
+- server dispatch;
+- Android Web Push delivery;
+- service-worker notification display;
+- notification click and PWA focus/open behavior;
+- deep-link routing;
+- all three guided-sheet steps; and
+- model-dropdown rendering.
+
+Its final button is **Complete Test**, not **Accept & Queue**. Test mode never writes a Proposal, Inbox Item, Goal, scheduler state, or notification delivery key used by production. The UI displays a permanent **Test notification** marker so fixture content cannot be mistaken for real work.
+
+The server reports only that the push provider accepted dispatch. The device confirms actual delivery by opening the notification. No false "delivered" claim is shown before that action.
+
+The test endpoint is owner-authenticated, accepts only the current registered endpoint and a fixed test kind, and accepts no caller-controlled title, body, or URL. This prevents it from becoming an arbitrary push or phishing endpoint. The UI disables repeated submission while a request is pending; no new configurable throttling system is introduced.
+
+## Data and Compatibility
+
+No second Proposal, Goal, Queue, or Inbox persistence model is added.
+
+The existing Proposal decision fields carry Launch Configuration. Existing Automode policy state remains readable. A migration normalizes duplicated watched/allowed repository lists into the watched-repository choice without discarding repositories already explicitly allowed.
+
+The normal web client stops sending broad policy edits. Narrow server operations expose Autopilot state transitions and watched-repository updates. Existing broad RPCs may remain temporarily for stored-state compatibility and internal tests, but they are no longer part of the cockpit Interface and receive no new features.
+
+Inbox retention remains unchanged:
+
+- prune unpinned terminal items 90 days after `terminalAt`;
+- never prune pinned items; and
+- never prune active items.
+
+## Error Handling
+
+- Inbox persistence failure prevents external proposal notification delivery and is surfaced to the initiating operation.
+- External push failure is logged and does not alter Proposal, Inbox, or Goal state.
+- Missing or stale Proposal deep links show a recovery state with Inbox refresh, not an empty launch form.
+- Model inventory failure leaves the recommended value unavailable and blocks Acceptance until choices can be loaded.
+- Server policy validation errors are attached to the affected launch field when possible.
+- Acceptance partial failures use `attention-required` and the idempotent retry path.
+- Corrupt existing Inbox or Automode state preserves the current fail-closed behavior; the redesign does not silently reset operator history.
+- Test-push failure identifies the failing stage: prerequisites, subscription registration, server dispatch, or device-open confirmation.
+- Pause or Emergency Stop partial failure must deny future starts. The UI never reports On until the server returns the reconciled state.
+
+## Testing
+
+Use focused checks at the existing seams.
+
+### Contracts and Server
+
+- schemas for narrow Autopilot controls and fixed notification-test input;
+- watched repositories mapping to proposal discovery and execution allowlisting;
+- On, Pause, and Emergency Stop semantics, including fail-closed partial failure;
+- acceptance with edited model and advanced settings;
+- exactly one live Goal for duplicate and concurrent Acceptance;
+- recovery after failure at decision, Goal, Inbox, and scheduling stages;
+- Inbox-first notification ordering and non-fatal push failure;
+- current-subscription-only test delivery;
+- rejection of unregistered endpoints and arbitrary test payloads; and
+- proof that notification tests cannot mutate Proposal, Inbox, Goal, or scheduler state.
+
+### Web and Service Worker
+
+- guided-sheet step order and validation;
+- recommended model selection and unavailable-model recovery;
+- advanced details progressive disclosure and structured verification rows;
+- Accept & Queue pending, success, error, and retry states;
+- Inbox and notification deep links resolving the same Proposal;
+- Android diagnostics prerequisite states;
+- delivery and proposal test requests using the current subscription;
+- unmistakable test-mode rendering and non-production final action; and
+- notification click focusing a matching window or opening the correct URL.
+
+### Verification
+
+Run focused `bun run test` suites. Never use `bun test`. Repository completion additionally requires:
+
+- `bun fmt`;
+- `bun lint`; and
+- `bun typecheck`.
+
+After deployment, verify authenticated push configuration, current-device subscription registration, both notification-test dispatch paths, deep-link routing, and the production proposal → Inbox → guided Acceptance → queued Goal path. Physical Android receipt remains an operator-observed check because the server can prove push-provider acceptance but not notification display by the device.
+
+## Out of Scope
+
+- Direct queue mutation from a notification action button.
+- Guaranteed delivery while Android or the browser suppresses notifications.
+- Automatic merge or bypassing the held-PR review.
+- A new scheduler, queue, or event store.
+- Arbitrary notification payload composition.
+- Persisted notification-test history or analytics.
+- Per-user Inbox state for a multi-user product.
+- Removing expert policy schemas before compatibility data has migrated.
+- Redesigning Motoko chat or unrelated cockpit panels.

From b9a3a461461dbe9ef74e2ba2a320999400de4568 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:31:52 +0100
Subject: [PATCH 02/13] docs: plan guided inbox-first autopilot

---
 .../2026-08-09-guided-autopilot-inbox.md      | 665 ++++++++++++++++++
 1 file changed, 665 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md

diff --git a/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md b/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md
new file mode 100644
index 000000000000..097c10207d09
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md
@@ -0,0 +1,665 @@
+# Guided Inbox-First Autopilot Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Replace the configuration-heavy Autopilot cockpit with a guided Inbox-first proposal launch flow and add current-device Android PWA notification diagnostics.
+
+**Architecture:** Keep the existing proposal bridge, durable Inbox, Automode Goal store, scheduler, and push sender as the deep execution module. Add one narrow Autopilot control operation, a three-step proposal launch sheet that submits the existing proposal decision contract, and a fixed authenticated push-test route that can target only an already registered subscription.
+
+**Tech Stack:** TypeScript, React 19, TanStack Query, Effect 4, Effect Schema/RPC, Vitest, `@effect/vitest`, Web Push, service workers, Base UI controls, Bun workspaces.
+
+## Global Constraints
+
+- Keep proposal choices, especially model selection, but make Model the only prominent run choice.
+- Put repository override, start time, runtime, verification commands, and integration branch under Advanced details.
+- A PWA notification opens review; it never mutates proposal or queue state itself.
+- Acceptance creates exactly one live Goal and reports queued state, not started state.
+- Test notifications target only the requesting browser's registered endpoint and cannot create Proposals, Inbox Items, Goals, scheduler state, or production delivery keys.
+- Pause blocks new proposals and future starts without killing running work; Emergency Stop also kills running autonomous work.
+- Preserve isolated branches, verification, held-PR review, quota/runtime gates, boot disarm, and Inbox retention.
+- Terminal Inbox items are pruned after 90 days; pinned items and active items are never pruned.
+- Add no dependencies and no new persistence store.
+- Never run `bun test`; use `bun run test`.
+- Before completion, `bun fmt`, `bun lint`, and `bun typecheck` must pass.
+
+---
+
+## File Map
+
+- `packages/contracts/src/gits.ts`: narrow Autopilot configure input/result schemas.
+- `packages/contracts/src/push.ts`: fixed push-test request/result schemas.
+- `packages/contracts/src/rpc.ts`: Autopilot configure RPC registration.
+- `packages/contracts/src/gits.test.ts`, `packages/contracts/src/push.test.ts`: schema coverage.
+- `packages/client-runtime/src/wsRpcClient.ts`: typed `automode.configure` client method.
+- `apps/server/src/gits/Layers/AutopilotControl.ts`: fail-closed On/Pause/Emergency Stop orchestration.
+- `apps/server/src/gits/Layers/AutopilotControl.test.ts`: control semantics.
+- `apps/server/src/gits/Layers/HermesAutomodeBridge.ts`: acceptance recovery projection.
+- `apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts`: partial-failure and retry coverage.
+- `apps/server/src/push/Services/PushNotificationService.ts`: targeted delivery interface.
+- `apps/server/src/push/Layers/PushNotificationService.ts`: registered-endpoint delivery.
+- `apps/server/src/push/Layers/PushNotificationService.test.ts`: targeting and failure results.
+- `apps/server/src/push/http.ts`: authenticated fixed test route.
+- `apps/server/src/push/http.test.ts`: route security and payload coverage.
+- `apps/server/src/server.ts`: push-test route registration.
+- `apps/server/src/ws.ts`: Autopilot configure and stop handler wiring.
+- `apps/server/src/server.test.ts`: RPC/route registration smoke coverage.
+- `apps/web/src/lib/webPush.ts`: current-subscription diagnostics and test request helpers.
+- `apps/web/src/lib/webPush.test.ts`: prerequisite and request behavior.
+- `apps/web/src/service-worker.ts`: keep notification click routing generic and test it.
+- `apps/web/src/components/settings/SettingsPanels.tsx`: PWA diagnostics UI.
+- `apps/web/src/components/settings/SettingsPanels.browser.tsx`: diagnostics interaction coverage.
+- `apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts`: launch defaults, model options, validation, edits.
+- `apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`: pure launch logic.
+- `apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx`: three-step real/test launch sheet.
+- `apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx`: guided interaction coverage.
+- `apps/web/src/components/gits/cockpit/AutopilotPanel.tsx`: simplified status/Inbox/queue surface.
+- `apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx`: reduced-surface coverage.
+- `apps/web/src/components/gits/GitsCockpit.tsx`: remove obsolete form state/mutations and refresh all acceptance projections.
+- `apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.ts`: delete obsolete global policy-form logic.
+- `apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts`: delete obsolete tests.
+
+---
+
+### Task 1: Add Narrow Contracts and Client Method
+
+**Files:**
+- Modify: `packages/contracts/src/gits.ts`
+- Modify: `packages/contracts/src/push.ts`
+- Modify: `packages/contracts/src/rpc.ts`
+- Modify: `packages/contracts/src/gits.test.ts`
+- Create: `packages/contracts/src/push.test.ts`
+- Modify: `packages/client-runtime/src/wsRpcClient.ts`
+
+**Interfaces:**
+- Produces: `AutopilotConfigureInput`, `AutopilotControlSnapshot`, `WebPushTestKind`, `WebPushTestInput`, `WebPushTestResult`, and `WsGitsAutomodeConfigureRpc`.
+- Produces client call: `client.gits.automode.configure(input)`.
+
+- [ ] **Step 1: Write failing contract tests**
+
+Add schema assertions equivalent to:
+
+```ts
+const configure = Schema.decodeUnknownSync(AutopilotConfigureInput);
+expect(configure({ enabled: true, repositories: ["/srv/repo"] })).toEqual({
+  enabled: true,
+  repositories: ["/srv/repo"],
+});
+expect(() => configure({ enabled: true, repositories: [] })).not.toThrow();
+
+const pushTest = Schema.decodeUnknownSync(WebPushTestInput);
+expect(pushTest({ endpoint: "https://push.example/device", kind: "proposal" })).toEqual({
+  endpoint: "https://push.example/device",
+  kind: "proposal",
+});
+expect(() => pushTest({ endpoint: "https://push.example/device", kind: "custom" })).toThrow();
+```
+
+- [ ] **Step 2: Run the tests and verify they fail on missing exports**
+
+Run: `bun run test packages/contracts/src/gits.test.ts packages/contracts/src/push.test.ts`
+
+Expected: FAIL because the new schemas do not exist.
+
+- [ ] **Step 3: Add the schemas and RPC**
+
+Use these exact public shapes:
+
+```ts
+export const AutopilotConfigureInput = Schema.Struct({
+  enabled: Schema.Boolean,
+  repositories: Schema.Array(PathString),
+});
+
+export const AutopilotControlSnapshot = Schema.Struct({
+  automode: AutomodeSnapshot,
+  scheduler: GitsSchedulerSnapshot,
+});
+
+export const WebPushTestKind = Schema.Literals(["delivery", "proposal"]);
+export const WebPushTestInput = Schema.Struct({
+  endpoint: PushEndpoint,
+  kind: WebPushTestKind,
+});
+export const WebPushTestResult = Schema.Struct({
+  accepted: Schema.Literal(true),
+  url: TrimmedNonEmptyString,
+});
+```
+
+Register `gits.automode.configure` with `AutopilotConfigureInput`, `AutopilotControlSnapshot`, and `AutomodeSupervisorError`; export it in `WsRpcSchema`. Add the corresponding client type and implementation beside `updatePolicy`.
+
+- [ ] **Step 4: Run focused tests and typecheck the touched packages**
+
+Run: `bun run test packages/contracts/src/gits.test.ts packages/contracts/src/push.test.ts && bun run build:contracts`
+
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add packages/contracts/src/gits.ts packages/contracts/src/push.ts packages/contracts/src/rpc.ts packages/contracts/src/gits.test.ts packages/contracts/src/push.test.ts packages/client-runtime/src/wsRpcClient.ts
+git commit -m "feat: add guided autopilot contracts"
+```
+
+### Task 2: Add Fail-Closed Autopilot Controls
+
+**Files:**
+- Create: `apps/server/src/gits/Layers/AutopilotControl.ts`
+- Create: `apps/server/src/gits/Layers/AutopilotControl.test.ts`
+- Modify: `apps/server/src/ws.ts`
+- Modify: `apps/server/src/server.test.ts`
+
+**Interfaces:**
+- Consumes: `AutopilotConfigureInput`, `AutopilotControlSnapshot`.
+- Produces: `configureAutopilot(dependencies, input)` and `emergencyStopAutopilot(dependencies)`.
+
+- [ ] **Step 1: Write failing control tests**
+
+Cover these observable calls:
+
+```ts
+expect(onCalls).toEqual([
+  ["scheduler.setConfig", { enabled: true }],
+  ["supervisor.updatePolicy", {
+    mode: "autonomous",
+    killSwitchEnabled: false,
+    maxActivePeers: 1,
+    allowedRepos: [repo],
+    proposalRepos: [repo],
+    nightlyProposalSweep: true,
+    sweepRequiresConfirmation: true,
+    autoEnqueueApprovedProposals: true,
+    gitsNotificationsEnabled: true,
+  }],
+]);
+
+expect(pauseCalls).toEqual([
+  ["scheduler.disarm", { reason: "Autopilot paused." }],
+  ["supervisor.updatePolicy", {
+    mode: "manual",
+    allowedRepos: [repo],
+    proposalRepos: [repo],
+    nightlyProposalSweep: false,
+  }],
+]);
+```
+
+Also assert empty repositories reject enabling, a scheduler-enable failure never switches policy to autonomous, Pause disarms before updating policy, and Emergency Stop disarms before calling `stopAll`. These orderings ensure a later failure still denies future starts.
+
+- [ ] **Step 2: Run the test and verify it fails**
+
+Run: `bun run test apps/server/src/gits/Layers/AutopilotControl.test.ts`
+
+Expected: FAIL because `AutopilotControl.ts` does not exist.
+
+- [ ] **Step 3: Implement the two orchestration functions**
+
+Keep the seam dependency-based and small:
+
+```ts
+export function configureAutopilot(
+  dependencies: {
+    supervisor: Pick<AutomodeSupervisorShape, "updatePolicy">;
+    scheduler: Pick<GitsSlotSchedulerShape, "setConfig" | "disarm">;
+  },
+  input: AutopilotConfigureInput,
+): Effect.Effect<AutopilotControlSnapshot, AutomodeSupervisorError>;
+
+export function emergencyStopAutopilot(
+  dependencies: {
+    supervisor: Pick<AutomodeSupervisorShape, "stopAll">;
+    scheduler: Pick<GitsSlotSchedulerShape, "disarm">;
+  },
+): Effect.Effect<AutomodeStopAllResult, AutomodeSupervisorError>;
+```
+
+Map scheduler errors into `AutomodeSupervisorError`. Do not arm on On; accepted work remains the authorization point through `scheduleApprovedGoal`.
+
+- [ ] **Step 4: Wire RPC handlers**
+
+Add `WS_METHODS.gitsAutomodeConfigure` to `ws.ts` using `configureAutopilot`. Replace the current stop-all handler effect with `emergencyStopAutopilot` so the existing UI and Telegram-compatible result remain unchanged.
+
+- [ ] **Step 5: Run focused tests**
+
+Run: `bun run test apps/server/src/gits/Layers/AutopilotControl.test.ts apps/server/src/server.test.ts`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add apps/server/src/gits/Layers/AutopilotControl.ts apps/server/src/gits/Layers/AutopilotControl.test.ts apps/server/src/ws.ts apps/server/src/server.test.ts
+git commit -m "feat: add simple autopilot controls"
+```
+
+### Task 3: Make Acceptance Recovery Visible and Idempotent
+
+**Files:**
+- Modify: `apps/server/src/gits/Layers/HermesAutomodeBridge.ts`
+- Modify: `apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts`
+
+**Interfaces:**
+- Consumes: existing `decideProposalWithAutomodeBridge` dependencies.
+- Produces: the same external result with a new recovery invariant: approval failure records `attention-required` when the Proposal is known.
+
+- [ ] **Step 1: Add failing partial-failure tests**
+
+Add scenarios for enqueue failure and scheduler failure. Assert the Inbox record includes:
+
+```ts
+expect(events.at(-1)).toMatchObject({
+  proposalId: proposal.id,
+  episodeId: proposal.episodeId,
+  goalId: null,
+  eventKey: `proposal:${proposal.id}:acceptance-failed`,
+  state: "attention-required",
+  reason: expect.stringContaining("Retry"),
+});
+```
+
+For scheduler failure after Goal creation, expect `goalId` to be populated. Retry the same approval and assert only one live Goal exists and the final Inbox state is `approved-queued` or `scheduled-tonight`.
+
+- [ ] **Step 2: Run the bridge test and verify failure**
+
+Run: `bun run test apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts`
+
+Expected: FAIL because failure is not projected to the Inbox.
+
+- [ ] **Step 3: Implement one best-effort recovery projection**
+
+Track the known Proposal and current Goal inside the existing bridge operation. On an approval-path error, call `dependencies.inbox.record` with stable key `proposal:<id>:acceptance-failed`, state `attention-required`, the Goal ID when known, and the existing proposal deep link. Ignore only failure of this compensating Inbox write, then rethrow the original `HermesAdapterError`.
+
+Do not alter the successful ordering, episode deduplication, or decision contract.
+
+- [ ] **Step 4: Run the bridge and Inbox suites**
+
+Run: `bun run test apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts apps/server/src/gits/Layers/CockpitInbox.test.ts`
+
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add apps/server/src/gits/Layers/HermesAutomodeBridge.ts apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
+git commit -m "fix: make proposal launch retries visible"
+```
+
+### Task 4: Add Current-Device Push Tests
+
+**Files:**
+- Modify: `apps/server/src/push/Services/PushNotificationService.ts`
+- Modify: `apps/server/src/push/Layers/PushNotificationService.ts`
+- Modify: `apps/server/src/push/Layers/PushNotificationService.test.ts`
+- Modify: `apps/server/src/push/http.ts`
+- Create: `apps/server/src/push/http.test.ts`
+- Modify: `apps/server/src/server.ts`
+
+**Interfaces:**
+- Produces: `sendToEndpoint(endpoint, payload): Effect<"sent" | "disabled" | "not-found" | "failed">`.
+- Produces: authenticated `POST /api/push/test` accepting only `WebPushTestInput`.
+
+- [ ] **Step 1: Write failing targeted-send tests**
+
+Create two registered subscriptions, call `sendToEndpoint` for one, and assert only that endpoint is sent. Cover disabled VAPID, missing endpoint, sender failure, and expired-subscription deletion.
+
+```ts
+const result = yield* service.sendToEndpoint(active.endpoint, payload);
+assert.strictEqual(result, "sent");
+assert.deepStrictEqual(sentEndpoints, [active.endpoint]);
+```
+
+- [ ] **Step 2: Run the push service test and verify failure**
+
+Run: `bun run test apps/server/src/push/Layers/PushNotificationService.test.ts`
+
+Expected: FAIL because `sendToEndpoint` is absent.
+
+- [ ] **Step 3: Implement targeted delivery by reusing the existing sender**
+
+List registered subscriptions, find an exact endpoint match, serialize the provided typed payload, and call `WebPushSender.send` once. Delete 404/410 endpoints. Return a closed result union instead of accepting caller-provided fallback behavior.
+
+- [ ] **Step 4: Write and implement route tests**
+
+The route builds fixed payload content only. It creates the tag server-side with `crypto.randomUUID()` so repeated Android tests remain visible without accepting caller text:
+
+```ts
+const TEST_PAYLOADS = {
+  delivery: {
+    title: "GITS notification test",
+    body: "Android PWA delivery is working. Tap to confirm.",
+    url: "/gits?panel=autopilot&notificationTest=delivery",
+  },
+  proposal: {
+    title: "Test proposal ready",
+    body: "Tap to test the guided proposal launch.",
+    url: "/gits?panel=autopilot&notificationTest=proposal",
+  },
+} satisfies Record<WebPushTestKind, Omit<PushNotificationPayload, "tag">>;
+
+const payload = {
+  ...TEST_PAYLOADS[input.kind],
+  tag: `gits:test:${input.kind}:${crypto.randomUUID()}`,
+};
+```
+
+Require owner authentication with the same helper as subscription routes. Return 200 plus `{ accepted: true, url }` only for `sent`; map disabled to 503, not-found to 404, and failed to 502. Tests must prove thread-scoped auth is rejected and request bodies cannot provide title/body/url.
+
+- [ ] **Step 5: Register the route and run tests**
+
+Run: `bun run test apps/server/src/push/Layers/PushNotificationService.test.ts apps/server/src/push/http.test.ts apps/server/src/server.test.ts`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add apps/server/src/push apps/server/src/server.ts
+git commit -m "feat: add targeted PWA notification tests"
+```
+
+### Task 5: Build Guided Launch Logic Test-First
+
+**Files:**
+- Create: `apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts`
+- Create: `apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`
+
+**Interfaces:**
+- Produces: `LaunchStep`, `ProposalLaunchForm`, `launchModelOptions`, `initialProposalLaunchForm`, `validateProposalLaunchForm`, `proposalLaunchEdits`, and `TEST_PROPOSAL`.
+
+- [ ] **Step 1: Write failing pure tests**
+
+Cover proposal/default model precedence, allowed-model filtering, fallback to the three `CODEX_MODEL_TIERS`, invalid runtime, missing repository, ISO conversion for `notBefore`, structured verification rows, and deterministic test fixture behavior.
+
+```ts
+expect(initialProposalLaunchForm(proposal, policy).model).toBe(proposal.model);
+expect(launchModelOptions({ ...policy, allowedModels: [] }).map((item) => item.value)).toEqual([
+  CODEX_MODEL_TIERS.light,
+  CODEX_MODEL_TIERS.medium,
+  CODEX_MODEL_TIERS.high,
+]);
+expect(validateProposalLaunchForm({ ...form, runtime: "-1" })).toMatchObject({
+  ok: false,
+  field: "runtime",
+});
+```
+
+- [ ] **Step 2: Run and verify failure**
+
+Run: `bun run test apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`
+
+Expected: FAIL because the module is absent.
+
+- [ ] **Step 3: Implement minimal pure logic**
+
+Use the existing `CODEX_MODEL_TIERS`, `HermesProposalCard`, `AutomodePolicy`, `GitsVerifyCommand`, and `MotokoProposalEdits` types. Model options are policy `allowedModels` when non-empty; otherwise use the three tier slugs. Include the Proposal model when valid and not duplicated. Do not add free-text custom models.
+
+Represent verification commands as `ReadonlyArray<GitsVerifyCommand>` and edit them with rows in the UI; never serialize them to editable JSON.
+
+- [ ] **Step 4: Run tests**
+
+Run: `bun run test apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`
+
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add apps/web/src/components/gits/cockpit/proposal-launch
+git commit -m "feat: add guided proposal launch logic"
+```
+
+### Task 6: Build the Three-Step Launch Sheet
+
+**Files:**
+- Create: `apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx`
+- Create: `apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx`
+- Modify: `apps/web/src/components/gits/GitsCockpit.tsx`
+
+**Interfaces:**
+- Consumes: Task 5 launch logic and existing `onDecision(proposal, decision, edits)` callback.
+- Produces: `ProposalLaunchSheet` supporting real Proposal IDs and `testMode="proposal"`.
+- Produces callback: `onDecision(...): Promise<AutomodeGoal | null>` so the sheet can render the actual queued Goal.
+
+- [ ] **Step 1: Write failing browser interactions**
+
+Render the sheet with a proposed card and assert:
+
+1. Step 1 shows outcome/scope/evidence and Continue.
+2. Step 2 shows a model `<Select>` with the recommendation selected.
+3. Advanced details are initially closed and reveal structured controls.
+4. Step 3 summarizes model/repo/runtime, calls approval exactly once, and displays the returned Goal as queued.
+5. Later and Reject call their existing decisions without creating a Goal client call.
+6. Test mode is visibly marked, ends with **Complete Test**, and never invokes `onDecision`.
+
+- [ ] **Step 2: Run browser test and verify failure**
+
+Run: `cd apps/web && bun run test:browser -- src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx`
+
+Expected: FAIL because the sheet is absent.
+
+- [ ] **Step 3: Implement the focused sheet**
+
+Use existing `Sheet`, `Select`, `Input`, `Button`, and status primitives. Keep one local form seeded when Proposal ID changes. Render explicit progress text `1 of 3`, `2 of 3`, `3 of 3`. Use **Accept & Queue**, never “dispatch,” for the real final action. Await `onDecision`; on success show the returned Goal title and status before allowing the sheet to close.
+
+For `testMode="proposal"`, use `TEST_PROPOSAL`, show a persistent **Test notification** pill, and make completion local-only.
+
+- [ ] **Step 4: Refresh all projections after decisions**
+
+In `GitsCockpit.tsx`, remove the redundant client-side `draftFromProposal` call after approval: the server bridge already drafts and queues. After `decideProposal`, fetch the Automode snapshot, match its live Goal by `decided.episodeId`, and return that Goal from `mutateAsync`. The mutation success must also refetch proposals, Hermes status, scheduler snapshot, and invalidate the Cockpit Inbox query prefix. This makes queue success visible without a second decision/draft call.
+
+- [ ] **Step 5: Run browser and relevant pure tests**
+
+Run: `cd apps/web && bun run test:browser -- src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx`
+
+Run: `bun run test apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx apps/web/src/components/gits/GitsCockpit.tsx
+git commit -m "feat: add guided proposal launch sheet"
+```
+
+### Task 7: Replace the Autopilot Policy Dashboard
+
+**Files:**
+- Rewrite: `apps/web/src/components/gits/cockpit/AutopilotPanel.tsx`
+- Create: `apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx`
+- Modify: `apps/web/src/components/gits/GitsCockpit.tsx`
+- Delete: `apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.ts`
+- Delete: `apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts`
+
+**Interfaces:**
+- Consumes: `automode.configure`, `ProposalLaunchSheet`, `InboxSection`, existing `stopAll`.
+- Produces: compact Autopilot operator surface.
+
+- [ ] **Step 1: Write failing reduced-surface browser tests**
+
+Assert the panel contains On/Paused, watched repositories, Inbox, queue summary, and Emergency Stop. Assert it does not contain “Automation switchboard,” “Policy,” “Max budget,” “Verification commands JSON,” “Scheduler arm,” “Manual goal,” or raw mode choices.
+
+Assert enabling with zero watched repositories shows a validation message. Assert Pause calls:
+
+```ts
+client.automode.configure({
+  enabled: false,
+  repositories: snapshot.policy.proposalRepos,
+});
+```
+
+- [ ] **Step 2: Run browser test and verify failure**
+
+Run: `cd apps/web && bun run test:browser -- src/components/gits/cockpit/AutopilotPanel.browser.tsx`
+
+Expected: FAIL against the old dashboard.
+
+- [ ] **Step 3: Rewrite the panel around the narrow interface**
+
+Keep the existing environment-client helper, repository chip picker, Inbox, stop confirmation, and status primitives. Delete policy form state, quick-switchboard mutations, manual Goal composer, scheduler controls, goal filters, budget display, and overnight result table.
+
+Derive On as `policy.mode === "autonomous" && !policy.killSwitchEnabled`. Show at most five non-terminal Goals in creation order with title, repository basename, and status. The queue display is read-only; Emergency Stop remains the only destructive panel action.
+
+- [ ] **Step 4: Remove obsolete shell props and state**
+
+Delete manual Goal title/repo/model/prompt state and enqueue/approve/reject/dispatch/scheduler arm mutations from `GitsCockpit.tsx`. Pass only snapshot, proposals, projects, focused Proposal ID, decision callback, and refresh callback.
+
+- [ ] **Step 5: Run web tests**
+
+Run: `cd apps/web && bun run test:browser -- src/components/gits/cockpit/AutopilotPanel.browser.tsx src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx`
+
+Run: `bun run test apps/web/src/components/gits/cockpit/inbox/inbox.logic.test.ts apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`
+
+Expected: PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A apps/web/src/components/gits
+git commit -m "feat: simplify autopilot around the inbox"
+```
+
+### Task 8: Add PWA Diagnostics UI and Test Routing
+
+**Files:**
+- Modify: `apps/web/src/lib/webPush.ts`
+- Create: `apps/web/src/lib/webPush.test.ts`
+- Modify: `apps/web/src/components/settings/SettingsPanels.tsx`
+- Modify: `apps/web/src/components/settings/SettingsPanels.browser.tsx`
+- Modify: `apps/web/src/components/gits/cockpit/AutopilotPanel.tsx`
+- Modify: `apps/web/src/service-worker.ts`
+
+**Interfaces:**
+- Produces: `readWebPushDiagnostics()` and `sendWebPushTest(kind)`.
+- Consumes: `POST /api/push/test` and `notificationTest` query values.
+
+- [ ] **Step 1: Write failing helper tests**
+
+Mock secure context, Notification permission, service worker readiness, PushManager subscription, and fetch. Assert diagnostics distinguish unsupported, permission denied, missing subscription, and ready. Assert the test request uses the normalized current endpoint and only the fixed kind.
+
+```ts
+await sendWebPushTest("proposal");
+expect(fetch).toHaveBeenCalledWith(
+  "/api/push/test",
+  expect.objectContaining({
+    method: "POST",
+    credentials: "include",
+    body: JSON.stringify({ endpoint, kind: "proposal" }),
+  }),
+);
+```
+
+- [ ] **Step 2: Run helper tests and verify failure**
+
+Run: `bun run test apps/web/src/lib/webPush.test.ts`
+
+Expected: FAIL because helpers do not exist.
+
+- [ ] **Step 3: Export current-subscription normalization and diagnostics**
+
+Reuse `canUseWebPush`, `navigator.serviceWorker.ready`, and `normalizeSubscription`. Do not register implicitly from a test button; diagnostics must tell the operator to enable Push to phone first.
+
+- [ ] **Step 4: Add Settings diagnostics browser coverage and UI**
+
+Add one compact section below **Push to phone** with five status rows and buttons **Send delivery test** and **Send proposal test**. Disable them unless permission, server VAPID, service worker, and subscription are ready. Show server acceptance as “Sent — tap the notification to confirm Android delivery,” not “Delivered.”
+
+Run: `cd apps/web && bun run test:browser -- src/components/settings/SettingsPanels.browser.tsx`
+
+Expected after implementation: PASS.
+
+- [ ] **Step 5: Render test routes safely**
+
+When `notificationTest=delivery`, the Autopilot panel shows a success banner stating the notification click reached the PWA. When `notificationTest=proposal`, render `ProposalLaunchSheet` in test mode. Keep the service worker's generic same-origin focus/open logic; add a test or extracted pure URL assertion only if current browser coverage lacks it.
+
+- [ ] **Step 6: Run all focused notification tests**
+
+Run: `bun run test apps/web/src/lib/webPush.test.ts apps/server/src/push/Layers/PushNotificationService.test.ts apps/server/src/push/http.test.ts`
+
+Run: `cd apps/web && bun run test:browser -- src/components/settings/SettingsPanels.browser.tsx src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx src/components/gits/cockpit/AutopilotPanel.browser.tsx`
+
+Expected: PASS.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add apps/web/src/lib/webPush.ts apps/web/src/lib/webPush.test.ts apps/web/src/components/settings/SettingsPanels.tsx apps/web/src/components/settings/SettingsPanels.browser.tsx apps/web/src/components/gits/cockpit/AutopilotPanel.tsx apps/web/src/service-worker.ts
+git commit -m "feat: add Android PWA notification diagnostics"
+```
+
+### Task 9: Integration Audit, Verification, and Documentation
+
+**Files:**
+- Modify as failures require: files already listed above
+- Modify: `docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md`
+
+**Interfaces:**
+- Verifies the complete Proposal → Inbox → PWA → guided Acceptance → Queue path and notification-test isolation.
+
+- [ ] **Step 1: Run focused integration suites**
+
+```bash
+bun run test \
+  packages/contracts/src/gits.test.ts \
+  packages/contracts/src/push.test.ts \
+  apps/server/src/gits/Layers/AutopilotControl.test.ts \
+  apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts \
+  apps/server/src/gits/Layers/CockpitInbox.test.ts \
+  apps/server/src/push/Layers/PushNotificationService.test.ts \
+  apps/server/src/push/http.test.ts \
+  apps/server/src/server.test.ts \
+  apps/web/src/components/gits/cockpit/inbox/inbox.logic.test.ts \
+  apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts \
+  apps/web/src/lib/webPush.test.ts
+```
+
+Expected: PASS.
+
+- [ ] **Step 2: Run browser suites**
+
+```bash
+cd apps/web && bun run test:browser -- \
+  src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx \
+  src/components/gits/cockpit/AutopilotPanel.browser.tsx \
+  src/components/settings/SettingsPanels.browser.tsx
+```
+
+Expected: PASS.
+
+- [ ] **Step 3: Run mandatory repository gates**
+
+From the repository root:
+
+```bash
+bun fmt
+bun lint
+bun typecheck
+```
+
+Expected: all exit 0. Review `git status` after `bun fmt` and include only task-related formatting changes.
+
+- [ ] **Step 4: Audit spec requirements against current evidence**
+
+Confirm with code and tests that:
+
+- the old policy dashboard and manual Goal composer are absent;
+- Model is a dropdown in step 2;
+- advanced settings are optional and structured;
+- Inbox and PWA deep links open the same sheet;
+- successful Acceptance creates one queued Goal and refreshes queue/Inbox/scheduler state;
+- retry is idempotent and failure is visible;
+- Pause and Emergency Stop match the spec;
+- both test notifications target one registered endpoint; and
+- proposal test completion cannot call a production mutation.
+
+- [ ] **Step 5: Mark the design implemented and commit final cleanup**
+
+Change the design status to `Implemented` only after every check passes.
+
+```bash
+git add -A
+git commit -m "docs: mark guided autopilot implemented"
+```
+
+- [ ] **Step 6: Push, open PR, merge, deploy, and smoke test**
+
+Push `feat/guided-autopilot-inbox`, open a PR into `gits`, wait for required checks, merge it, redeploy the hosted `gits` service, and verify the deployed build reports the merge commit. Smoke-test `/gits`, authenticated push configuration, the diagnostics request validation, and the guided Autopilot route. The operator performs the final physical Android receipt/tap check.

From 367ab55f9660bc26023afecf2f7f824a6b07ed2d Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:39:01 +0100
Subject: [PATCH 03/13] feat: add guided autopilot contracts

---
 packages/client-runtime/src/wsRpcClient.ts |  3 +++
 packages/contracts/src/gits.test.ts        | 14 ++++++++++++++
 packages/contracts/src/gits.ts             | 12 ++++++++++++
 packages/contracts/src/push.test.ts        | 17 +++++++++++++++++
 packages/contracts/src/push.ts             | 15 +++++++++++++++
 packages/contracts/src/rpc.ts              | 10 ++++++++++
 6 files changed, 71 insertions(+)
 create mode 100644 packages/contracts/src/push.test.ts

diff --git a/packages/client-runtime/src/wsRpcClient.ts b/packages/client-runtime/src/wsRpcClient.ts
index 0e485721f41b..c3e53fde21ba 100644
--- a/packages/client-runtime/src/wsRpcClient.ts
+++ b/packages/client-runtime/src/wsRpcClient.ts
@@ -230,6 +230,7 @@ export interface WsRpcClient {
     };
     readonly automode: {
       readonly getSnapshot: RpcUnaryNoArgMethod<typeof WS_METHODS.gitsAutomodeGetSnapshot>;
+      readonly configure: RpcUnaryMethod<typeof WS_METHODS.gitsAutomodeConfigure>;
       readonly updatePolicy: RpcUnaryMethod<typeof WS_METHODS.gitsAutomodeUpdatePolicy>;
       readonly enqueueGoal: RpcUnaryMethod<typeof WS_METHODS.gitsAutomodeEnqueueGoal>;
       readonly approveGoal: RpcUnaryMethod<typeof WS_METHODS.gitsAutomodeApproveGoal>;
@@ -535,6 +536,8 @@ export function createWsRpcClient(
       automode: {
         getSnapshot: () =>
           transport.request((client) => client[WS_METHODS.gitsAutomodeGetSnapshot]({})),
+        configure: (input) =>
+          transport.request((client) => client[WS_METHODS.gitsAutomodeConfigure](input)),
         updatePolicy: (input) =>
           transport.request((client) => client[WS_METHODS.gitsAutomodeUpdatePolicy](input)),
         enqueueGoal: (input) =>
diff --git a/packages/contracts/src/gits.test.ts b/packages/contracts/src/gits.test.ts
index 815d50d7a159..32b31f803a49 100644
--- a/packages/contracts/src/gits.test.ts
+++ b/packages/contracts/src/gits.test.ts
@@ -2,6 +2,7 @@ import * as Schema from "effect/Schema";
 import { describe, expect, it } from "vitest";
 
 import {
+  AutopilotConfigureInput,
   AutomodeGoal,
   CockpitInboxFilter,
   CockpitInboxItem,
@@ -24,6 +25,7 @@ import {
 } from "./gits.ts";
 
 const decodeGitsBuildInfo = Schema.decodeUnknownSync(GitsBuildInfo);
+const decodeAutopilotConfigureInput = Schema.decodeUnknownSync(AutopilotConfigureInput);
 const decodeGitsNoteSummary = Schema.decodeUnknownSync(GitsNoteSummary);
 const decodeGitsNote = Schema.decodeUnknownSync(GitsNote);
 const decodeGitsNoteWriteInput = Schema.decodeUnknownSync(GitsNoteWriteInput);
@@ -41,6 +43,18 @@ const decodeHermesProposal = Schema.decodeUnknownSync(HermesProposalCard);
 const decodeHermesDraft = Schema.decodeUnknownSync(HermesExecutionDraft);
 const decodeHermesScheduleRun = Schema.decodeUnknownSync(HermesScheduleRunResult);
 
+describe("AutopilotConfigureInput", () => {
+  it("accepts enabled state with zero or more repositories", () => {
+    expect(decodeAutopilotConfigureInput({ enabled: true, repositories: ["/srv/repo"] })).toEqual({
+      enabled: true,
+      repositories: ["/srv/repo"],
+    });
+    expect(() =>
+      decodeAutopilotConfigureInput({ enabled: true, repositories: [] }),
+    ).not.toThrow();
+  });
+});
+
 describe("GitsBuildInfo", () => {
   it("accepts nullable build provenance fields", () => {
     const parsed = decodeGitsBuildInfo({
diff --git a/packages/contracts/src/gits.ts b/packages/contracts/src/gits.ts
index 7fa931f001f0..c08c6e4423a1 100644
--- a/packages/contracts/src/gits.ts
+++ b/packages/contracts/src/gits.ts
@@ -1101,6 +1101,12 @@ export const AutomodeSnapshot = Schema.Struct({
 });
 export type AutomodeSnapshot = typeof AutomodeSnapshot.Type;
 
+export const AutopilotConfigureInput = Schema.Struct({
+  enabled: Schema.Boolean,
+  repositories: Schema.Array(PathString),
+});
+export type AutopilotConfigureInput = typeof AutopilotConfigureInput.Type;
+
 export const AutomodePolicyUpdateInput = Schema.Struct({
   mode: Schema.optional(AutomodeMode),
   killSwitchEnabled: Schema.optional(Schema.Boolean),
@@ -1235,6 +1241,12 @@ export const GitsSchedulerSnapshot = Schema.Struct({
 });
 export type GitsSchedulerSnapshot = typeof GitsSchedulerSnapshot.Type;
 
+export const AutopilotControlSnapshot = Schema.Struct({
+  automode: AutomodeSnapshot,
+  scheduler: GitsSchedulerSnapshot,
+});
+export type AutopilotControlSnapshot = typeof AutopilotControlSnapshot.Type;
+
 export const GitsSchedulerSetConfigInput = Schema.Struct({
   enabled: Schema.optional(Schema.Boolean),
   maxGoalsPerNight: Schema.optional(PositiveInt),
diff --git a/packages/contracts/src/push.test.ts b/packages/contracts/src/push.test.ts
new file mode 100644
index 000000000000..f625efb74ae1
--- /dev/null
+++ b/packages/contracts/src/push.test.ts
@@ -0,0 +1,17 @@
+import * as Schema from "effect/Schema";
+import { describe, expect, it } from "vitest";
+
+import { WebPushTestInput } from "./push.ts";
+
+const decodeWebPushTestInput = Schema.decodeUnknownSync(WebPushTestInput);
+
+describe("WebPushTestInput", () => {
+  it("accepts only fixed notification test kinds", () => {
+    expect(
+      decodeWebPushTestInput({ endpoint: "https://push.example/device", kind: "proposal" }),
+    ).toEqual({ endpoint: "https://push.example/device", kind: "proposal" });
+    expect(() =>
+      decodeWebPushTestInput({ endpoint: "https://push.example/device", kind: "custom" }),
+    ).toThrow();
+  });
+});
diff --git a/packages/contracts/src/push.ts b/packages/contracts/src/push.ts
index 2fb6a688a106..3f6e45217cd4 100644
--- a/packages/contracts/src/push.ts
+++ b/packages/contracts/src/push.ts
@@ -32,3 +32,18 @@ export const WebPushPublicConfig = Schema.Struct({
   publicKey: Schema.NullOr(PushKey),
 });
 export type WebPushPublicConfig = typeof WebPushPublicConfig.Type;
+
+export const WebPushTestKind = Schema.Literals(["delivery", "proposal"]);
+export type WebPushTestKind = typeof WebPushTestKind.Type;
+
+export const WebPushTestInput = Schema.Struct({
+  endpoint: PushEndpoint,
+  kind: WebPushTestKind,
+});
+export type WebPushTestInput = typeof WebPushTestInput.Type;
+
+export const WebPushTestResult = Schema.Struct({
+  accepted: Schema.Literal(true),
+  url: TrimmedNonEmptyString,
+});
+export type WebPushTestResult = typeof WebPushTestResult.Type;
diff --git a/packages/contracts/src/rpc.ts b/packages/contracts/src/rpc.ts
index 46397c2ee47a..dd872c02218b 100644
--- a/packages/contracts/src/rpc.ts
+++ b/packages/contracts/src/rpc.ts
@@ -16,6 +16,8 @@ import {
   FilesystemBrowseError,
 } from "./filesystem.ts";
 import {
+  AutopilotConfigureInput,
+  AutopilotControlSnapshot,
   AutomodeDispatchResult,
   AutomodeEnqueueGoalInput,
   AutomodeEpisode,
@@ -319,6 +321,7 @@ export const WS_METHODS = {
   gitsOpenGsdInitProject: "gits.openGsd.init",
   gitsOpenGsdRunAuto: "gits.openGsd.auto",
   gitsAutomodeGetSnapshot: "gits.automode.snapshot",
+  gitsAutomodeConfigure: "gits.automode.configure",
   gitsAutomodeUpdatePolicy: "gits.automode.policy.update",
   gitsAutomodeEnqueueGoal: "gits.automode.goals.enqueue",
   gitsAutomodeApproveGoal: "gits.automode.goals.approve",
@@ -945,6 +948,12 @@ export const WsGitsAutomodeGetSnapshotRpc = Rpc.make(WS_METHODS.gitsAutomodeGetS
   error: AutomodeSupervisorError,
 });
 
+export const WsGitsAutomodeConfigureRpc = Rpc.make(WS_METHODS.gitsAutomodeConfigure, {
+  payload: AutopilotConfigureInput,
+  success: AutopilotControlSnapshot,
+  error: AutomodeSupervisorError,
+});
+
 export const WsGitsAutomodeUpdatePolicyRpc = Rpc.make(WS_METHODS.gitsAutomodeUpdatePolicy, {
   payload: AutomodePolicyUpdateInput,
   success: AutomodeSnapshot,
@@ -1359,6 +1368,7 @@ export const WsRpcGroup = RpcGroup.make(
   WsGitsOpenGsdInitProjectRpc,
   WsGitsOpenGsdRunAutoRpc,
   WsGitsAutomodeGetSnapshotRpc,
+  WsGitsAutomodeConfigureRpc,
   WsGitsAutomodeUpdatePolicyRpc,
   WsGitsAutomodeEnqueueGoalRpc,
   WsGitsAutomodeApproveGoalRpc,

From ab6139fbcb2121f114edab947e3f4663151291ac Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:42:37 +0100
Subject: [PATCH 04/13] feat: add simple autopilot controls

---
 .../src/gits/Layers/AutopilotControl.test.ts  | 176 ++++++++++++++++++
 .../src/gits/Layers/AutopilotControl.ts       |  71 +++++++
 apps/server/src/server.test.ts                |  23 +++
 apps/server/src/ws.ts                         |  24 ++-
 4 files changed, 291 insertions(+), 3 deletions(-)
 create mode 100644 apps/server/src/gits/Layers/AutopilotControl.test.ts
 create mode 100644 apps/server/src/gits/Layers/AutopilotControl.ts

diff --git a/apps/server/src/gits/Layers/AutopilotControl.test.ts b/apps/server/src/gits/Layers/AutopilotControl.test.ts
new file mode 100644
index 000000000000..1df028a2b4f0
--- /dev/null
+++ b/apps/server/src/gits/Layers/AutopilotControl.test.ts
@@ -0,0 +1,176 @@
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { describe, expect, it } from "vitest";
+
+import {
+  AutomodeSupervisorError,
+  GitsSlotSchedulerError,
+  type AutomodeSnapshot,
+  type GitsSchedulerSnapshot,
+} from "@t3tools/contracts";
+
+import { configureAutopilot, emergencyStopAutopilot } from "./AutopilotControl.ts";
+
+const automode = { policy: { mode: "manual" } } as AutomodeSnapshot;
+const scheduler = { config: { enabled: false } } as GitsSchedulerSnapshot;
+
+describe("AutopilotControl", () => {
+  it("enables the scheduler before switching to the safe autonomous policy", async () => {
+    const calls: Array<readonly [string, unknown]> = [];
+    const result = await Effect.runPromise(
+      configureAutopilot(
+        {
+          scheduler: {
+            setConfig: (input) =>
+              Effect.sync(() => {
+                calls.push(["scheduler.setConfig", input]);
+                return scheduler;
+              }),
+            disarm: () => Effect.succeed(scheduler),
+          },
+          supervisor: {
+            updatePolicy: (input) =>
+              Effect.sync(() => {
+                calls.push(["supervisor.updatePolicy", input]);
+                return automode;
+              }),
+          },
+        },
+        { enabled: true, repositories: ["/srv/repo"] },
+      ),
+    );
+
+    expect(calls).toEqual([
+      ["scheduler.setConfig", { enabled: true }],
+      [
+        "supervisor.updatePolicy",
+        {
+          mode: "autonomous",
+          killSwitchEnabled: false,
+          maxActivePeers: 1,
+          allowedRepos: ["/srv/repo"],
+          proposalRepos: ["/srv/repo"],
+          nightlyProposalSweep: true,
+          sweepRequiresConfirmation: true,
+          autoEnqueueApprovedProposals: true,
+          gitsNotificationsEnabled: true,
+        },
+      ],
+    ]);
+    expect(result).toEqual({ automode, scheduler });
+  });
+
+  it("rejects enabling without a repository", async () => {
+    const exit = await Effect.runPromiseExit(
+      configureAutopilot(
+        {
+          scheduler: { setConfig: () => Effect.succeed(scheduler), disarm: () => Effect.succeed(scheduler) },
+          supervisor: { updatePolicy: () => Effect.succeed(automode) },
+        },
+        { enabled: true, repositories: [] },
+      ),
+    );
+
+    expect(Exit.isFailure(exit)).toBe(true);
+  });
+
+  it("does not switch policy when scheduler enable fails", async () => {
+    let policyCalls = 0;
+    const exit = await Effect.runPromiseExit(
+      configureAutopilot(
+        {
+          scheduler: {
+            setConfig: () =>
+              Effect.fail(new GitsSlotSchedulerError({ message: "scheduler unavailable" })),
+            disarm: () => Effect.succeed(scheduler),
+          },
+          supervisor: {
+            updatePolicy: () =>
+              Effect.sync(() => {
+                policyCalls += 1;
+                return automode;
+              }),
+          },
+        },
+        { enabled: true, repositories: ["/srv/repo"] },
+      ),
+    );
+
+    expect(Exit.isFailure(exit)).toBe(true);
+    expect(policyCalls).toBe(0);
+  });
+
+  it("disarms before pausing and before emergency stop", async () => {
+    const pauseCalls: Array<readonly [string, unknown]> = [];
+    await Effect.runPromise(
+      configureAutopilot(
+        {
+          scheduler: {
+            setConfig: () => Effect.succeed(scheduler),
+            disarm: (input) =>
+              Effect.sync(() => {
+                pauseCalls.push(["scheduler.disarm", input]);
+                return scheduler;
+              }),
+          },
+          supervisor: {
+            updatePolicy: (input) =>
+              Effect.sync(() => {
+                pauseCalls.push(["supervisor.updatePolicy", input]);
+                return automode;
+              }),
+          },
+        },
+        { enabled: false, repositories: ["/srv/repo"] },
+      ),
+    );
+    expect(pauseCalls).toEqual([
+      ["scheduler.disarm", { reason: "Autopilot paused." }],
+      [
+        "supervisor.updatePolicy",
+        {
+          mode: "manual",
+          allowedRepos: ["/srv/repo"],
+          proposalRepos: ["/srv/repo"],
+          nightlyProposalSweep: false,
+        },
+      ],
+    ]);
+
+    const stopCalls: Array<string> = [];
+    await Effect.runPromise(
+      emergencyStopAutopilot({
+        scheduler: {
+          disarm: () =>
+            Effect.sync(() => {
+              stopCalls.push("scheduler.disarm");
+              return scheduler;
+            }),
+        },
+        supervisor: {
+          stopAll: () =>
+            Effect.sync(() => {
+              stopCalls.push("supervisor.stopAll");
+              return { stoppedPeers: 1, failures: 0 };
+            }),
+        },
+      }),
+    );
+    expect(stopCalls).toEqual(["scheduler.disarm", "supervisor.stopAll"]);
+  });
+
+  it("maps scheduler errors into the supervisor error contract", async () => {
+    const exit = await Effect.runPromiseExit(
+      emergencyStopAutopilot({
+        scheduler: {
+          disarm: () => Effect.fail(new GitsSlotSchedulerError({ message: "cannot disarm" })),
+        },
+        supervisor: {
+          stopAll: () => Effect.fail(new AutomodeSupervisorError({ message: "not reached" })),
+        },
+      }),
+    );
+
+    expect(Exit.isFailure(exit)).toBe(true);
+  });
+});
diff --git a/apps/server/src/gits/Layers/AutopilotControl.ts b/apps/server/src/gits/Layers/AutopilotControl.ts
new file mode 100644
index 000000000000..ccca895bd956
--- /dev/null
+++ b/apps/server/src/gits/Layers/AutopilotControl.ts
@@ -0,0 +1,71 @@
+import * as Effect from "effect/Effect";
+
+import {
+  AutomodeSupervisorError,
+  type AutopilotConfigureInput,
+  type AutopilotControlSnapshot,
+  type AutomodeStopAllResult,
+} from "@t3tools/contracts";
+
+import type { AutomodeSupervisorShape } from "../Services/AutomodeSupervisor.ts";
+import type { GitsSlotSchedulerShape } from "../Services/GitsSlotScheduler.ts";
+
+const schedulerError = (message: string) => (cause: unknown) =>
+  new AutomodeSupervisorError({ message, cause });
+
+export function configureAutopilot(
+  dependencies: {
+    readonly supervisor: Pick<AutomodeSupervisorShape, "updatePolicy">;
+    readonly scheduler: Pick<GitsSlotSchedulerShape, "setConfig" | "disarm">;
+  },
+  input: AutopilotConfigureInput,
+): Effect.Effect<AutopilotControlSnapshot, AutomodeSupervisorError> {
+  if (input.enabled && input.repositories.length === 0) {
+    return Effect.fail(
+      new AutomodeSupervisorError({ message: "Choose at least one repository for Autopilot." }),
+    );
+  }
+
+  return Effect.gen(function* () {
+    const scheduler = input.enabled
+      ? yield* dependencies.scheduler
+          .setConfig({ enabled: true })
+          .pipe(Effect.mapError(schedulerError("Failed to enable the Autopilot scheduler.")))
+      : yield* dependencies.scheduler
+          .disarm({ reason: "Autopilot paused." })
+          .pipe(Effect.mapError(schedulerError("Failed to pause the Autopilot scheduler.")));
+    const automode = yield* dependencies.supervisor.updatePolicy(
+      input.enabled
+        ? {
+            mode: "autonomous",
+            killSwitchEnabled: false,
+            maxActivePeers: 1,
+            allowedRepos: input.repositories,
+            proposalRepos: input.repositories,
+            nightlyProposalSweep: true,
+            sweepRequiresConfirmation: true,
+            autoEnqueueApprovedProposals: true,
+            gitsNotificationsEnabled: true,
+          }
+        : {
+            mode: "manual",
+            allowedRepos: input.repositories,
+            proposalRepos: input.repositories,
+            nightlyProposalSweep: false,
+          },
+    );
+    return { automode, scheduler };
+  });
+}
+
+export function emergencyStopAutopilot(dependencies: {
+  readonly supervisor: Pick<AutomodeSupervisorShape, "stopAll">;
+  readonly scheduler: Pick<GitsSlotSchedulerShape, "disarm">;
+}): Effect.Effect<AutomodeStopAllResult, AutomodeSupervisorError> {
+  return dependencies.scheduler
+    .disarm({ reason: "Autopilot emergency stop." })
+    .pipe(
+      Effect.mapError(schedulerError("Failed to disarm the Autopilot scheduler.")),
+      Effect.flatMap(() => dependencies.supervisor.stopAll()),
+    );
+}
diff --git a/apps/server/src/server.test.ts b/apps/server/src/server.test.ts
index bc0ff55755e4..4fd31becdf55 100644
--- a/apps/server/src/server.test.ts
+++ b/apps/server/src/server.test.ts
@@ -5039,6 +5039,16 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       const calls: string[] = [];
       yield* buildAppUnderTest({
         layers: {
+          gitsSlotScheduler: {
+            setConfig: (input) =>
+              Effect.sync(() => {
+                calls.push(`scheduler:${input.enabled}`);
+                return {
+                  ...defaultGitsSchedulerSnapshot,
+                  config: { ...defaultGitsSchedulerSnapshot.config, enabled: input.enabled ?? false },
+                };
+              }),
+          },
           automodeSupervisor: {
             getSnapshot: () =>
               Effect.sync(() => {
@@ -5114,6 +5124,17 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       );
       assert.equal(snapshot.policy.mode, "manual");
 
+      const configured = yield* Effect.scoped(
+        withWsRpcClient(wsUrl, (client) =>
+          client[WS_METHODS.gitsAutomodeConfigure]({
+            enabled: true,
+            repositories: ["/tmp/source-repo"],
+          }),
+        ),
+      );
+      assert.equal(configured.automode.policy.mode, "autonomous");
+      assert.equal(configured.scheduler.config.enabled, true);
+
       const policy = yield* Effect.scoped(
         withWsRpcClient(wsUrl, (client) =>
           client[WS_METHODS.gitsAutomodeUpdatePolicy]({
@@ -5162,6 +5183,8 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       assert.equal(dispatched.peer?.id, defaultDelamainPeer.id);
       assert.deepEqual(calls, [
         "snapshot",
+        "scheduler:true",
+        "policy:autonomous",
         "policy:supervised",
         "enqueue:/tmp/source-repo",
         "approve:goal-test",
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index ffff6c1d8f1b..df26716d8ce4 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -113,6 +113,10 @@ import {
   hasLiveGoalForEpisode,
 } from "./gits/Layers/HermesAutomodeBridge.ts";
 import { AutomodeNotifications } from "./gits/Layers/AutomodeNotifications.ts";
+import {
+  configureAutopilot,
+  emergencyStopAutopilot,
+} from "./gits/Layers/AutopilotControl.ts";
 import { ServerEnvironment } from "./environment/Services/ServerEnvironment.ts";
 import {
   denyThreadAccess,
@@ -2293,6 +2297,15 @@ const makeWsRpcLayer = (
             ),
             { "rpc.aggregate": "gits" },
           ),
+        [WS_METHODS.gitsAutomodeConfigure]: (input) =>
+          observeRpcEffect(
+            WS_METHODS.gitsAutomodeConfigure,
+            configureAutopilot(
+              { supervisor: automodeSupervisor, scheduler: gitsSlotScheduler },
+              input,
+            ),
+            { "rpc.aggregate": "gits" },
+          ),
         [WS_METHODS.gitsAutomodeUpdatePolicy]: (input) =>
           observeRpcEffect(
             WS_METHODS.gitsAutomodeUpdatePolicy,
@@ -2366,9 +2379,14 @@ const makeWsRpcLayer = (
             { "rpc.aggregate": "gits" },
           ),
         [WS_METHODS.gitsAutomodeStopAll]: (_input) =>
-          observeRpcEffect(WS_METHODS.gitsAutomodeStopAll, automodeSupervisor.stopAll(), {
-            "rpc.aggregate": "gits",
-          }),
+          observeRpcEffect(
+            WS_METHODS.gitsAutomodeStopAll,
+            emergencyStopAutopilot({
+              supervisor: automodeSupervisor,
+              scheduler: gitsSlotScheduler,
+            }),
+            { "rpc.aggregate": "gits" },
+          ),
         [WS_METHODS.gitsAutomodeGoalsKill]: (input) =>
           observeRpcEffect(WS_METHODS.gitsAutomodeGoalsKill, automodeSupervisor.killGoal(input), {
             "rpc.aggregate": "gits",

From 6d1398a89bff6998b1aff4845a9c91f83e2f310b Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:42:59 +0100
Subject: [PATCH 05/13] fix: surface proposal acceptance recovery

---
 .../gits/Layers/HermesAutomodeBridge.test.ts  | 105 ++++++++
 .../src/gits/Layers/HermesAutomodeBridge.ts   | 239 ++++++++++--------
 2 files changed, 242 insertions(+), 102 deletions(-)

diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
index bf3794595db4..a70a343fe0ea 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
@@ -12,6 +12,7 @@ import type {
   HermesProposalDecisionInput,
   HermesProposalStatus,
 } from "@t3tools/contracts";
+import { AutomodeSupervisorError, GitsSlotSchedulerError } from "@t3tools/contracts";
 
 import { ServerConfig } from "../../config.ts";
 import { AutomodeLanding } from "../Services/AutomodeLanding.ts";
@@ -555,4 +556,108 @@ describe("decideProposalWithAutomodeBridge", () => {
       assert.equal((yield* supervisor.getSnapshot()).goals.length, 0);
     }).pipe(Effect.provide(makeSupervisorLayer())),
   );
+
+  it.effect("records enqueue failure for retry and remains idempotent", () =>
+    Effect.gen(function* () {
+      const supervisor = yield* armAutonomous;
+      const { hermes } = makeFakeHermes();
+      const events: CockpitInboxRecordInput[] = [];
+      let enqueueCalls = 0;
+      const automode = {
+        getSnapshot: supervisor.getSnapshot,
+        updateQueuedGoal: supervisor.updateQueuedGoal,
+        enqueueGoal: (input: Parameters<typeof supervisor.enqueueGoal>[0]) => {
+          enqueueCalls += 1;
+          return enqueueCalls === 1
+            ? Effect.fail(new AutomodeSupervisorError({ message: "queue unavailable" }))
+            : supervisor.enqueueGoal(input);
+        },
+      };
+      const dependencies = {
+        scheduler: {
+          scheduleApprovedGoal: () =>
+            Effect.succeed({ snapshot: {} as never, targetsCurrentNight: false }),
+        },
+        inbox: {
+          record: (input: CockpitInboxRecordInput) =>
+            Effect.sync(() => {
+              events.push(input);
+              return {} as never;
+            }),
+        },
+      };
+
+      yield* decideProposalWithAutomodeBridge(
+        hermes,
+        automode,
+        { proposalId: "proposal-1", decision: "approve" },
+        dependencies,
+      ).pipe(Effect.flip);
+      assert.deepInclude(events.at(-1)!, {
+        proposalId: "proposal-1",
+        episodeId: "epi-proposal-1",
+        goalId: null,
+        eventKey: "proposal:proposal-1:acceptance-failed",
+        state: "attention-required",
+      });
+      assert.include(events.at(-1)!.reason, "Retry");
+
+      yield* decideProposalWithAutomodeBridge(
+        hermes,
+        automode,
+        { proposalId: "proposal-1", decision: "approve" },
+        dependencies,
+      );
+      assert.equal((yield* supervisor.getSnapshot()).goals.length, 1);
+      assert.equal(events.at(-1)!.state, "approved-queued");
+    }).pipe(Effect.provide(makeSupervisorLayer())),
+  );
+
+  it.effect("records the existing goal when scheduling fails and retry does not duplicate it", () =>
+    Effect.gen(function* () {
+      const supervisor = yield* armAutonomous;
+      const { hermes } = makeFakeHermes();
+      const events: CockpitInboxRecordInput[] = [];
+      let scheduleCalls = 0;
+      const dependencies = {
+        scheduler: {
+          scheduleApprovedGoal: () => {
+            scheduleCalls += 1;
+            return scheduleCalls === 1
+              ? Effect.fail(new GitsSlotSchedulerError({ message: "schedule unavailable" }))
+              : Effect.succeed({ snapshot: {} as never, targetsCurrentNight: false });
+          },
+        },
+        inbox: {
+          record: (input: CockpitInboxRecordInput) =>
+            Effect.sync(() => {
+              events.push(input);
+              return {} as never;
+            }),
+        },
+      };
+
+      yield* decideProposalWithAutomodeBridge(
+        hermes,
+        supervisor,
+        { proposalId: "proposal-1", decision: "approve" },
+        dependencies,
+      ).pipe(Effect.flip);
+      const goalId = (yield* supervisor.getSnapshot()).goals[0]!.id;
+      assert.deepInclude(events.at(-1)!, {
+        goalId,
+        eventKey: "proposal:proposal-1:acceptance-failed",
+        state: "attention-required",
+      });
+
+      yield* decideProposalWithAutomodeBridge(
+        hermes,
+        supervisor,
+        { proposalId: "proposal-1", decision: "approve" },
+        dependencies,
+      );
+      assert.equal((yield* supervisor.getSnapshot()).goals.length, 1);
+      assert.equal(events.at(-1)!.state, "approved-queued");
+    }).pipe(Effect.provide(makeSupervisorLayer())),
+  );
 });
diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
index 74240de6b9c2..7923303f106a 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
@@ -128,119 +128,154 @@ export const decideProposalWithAutomodeBridge = (
       }
     }
     const decided = yield* hermes.decideProposal(input);
-    if (snapshot !== null && priorProposal !== null) {
-      const draft = yield* hermes.draftFromProposal({
-        proposalId: input.proposalId,
-      });
-      if (draft.kind === "delamain-peer" && draft.status === "draft" && draft.repo !== null) {
-        const existing = snapshot.goals.find(
-          (goal) =>
-            goal.episodeId === priorProposal.episodeId && !TERMINAL_GOAL_STATUSES.has(goal.status),
-        );
-        const editable =
-          existing !== undefined && ["queued", "waiting-approval"].includes(existing.status);
-        const update = {
-          title: draft.title,
-          prompt: draft.prompt,
-          repo: draft.repo,
-          notBefore: decided.notBefore,
-          maxRuntimeMinutes: decided.maxRuntimeMinutes,
-          verificationCommands: decided.verificationCommands,
-          integrationBranch: decided.integrationBranch,
-        };
-        if (existing === undefined) {
-          yield* automode
-            .enqueueGoal({
-              ...update,
-              ...(decided.model === null ? {} : { model: decided.model }),
-              origin: "proposal",
-              episodeId: priorProposal.episodeId,
-            })
-            .pipe(
-              Effect.mapError(
-                (cause) =>
-                  new HermesAdapterError({
-                    message: "Failed to queue approved proposal.",
-                    cause,
-                  }),
-              ),
-            );
-        } else if (editable) {
-          yield* automode
-            .updateQueuedGoal({
-              ...update,
-              goalId: existing.id,
-              model: decided.model,
-            })
-            .pipe(
-              Effect.mapError(
-                (cause) =>
-                  new HermesAdapterError({
-                    message: "Failed to queue approved proposal.",
-                    cause,
-                  }),
-              ),
-            );
+    yield* Effect.gen(function* () {
+      if (snapshot !== null && priorProposal !== null) {
+        const draft = yield* hermes.draftFromProposal({
+          proposalId: input.proposalId,
+        });
+        if (draft.kind === "delamain-peer" && draft.status === "draft" && draft.repo !== null) {
+          const existing = snapshot.goals.find(
+            (goal) =>
+              goal.episodeId === priorProposal.episodeId &&
+              !TERMINAL_GOAL_STATUSES.has(goal.status),
+          );
+          const editable =
+            existing !== undefined && ["queued", "waiting-approval"].includes(existing.status);
+          const update = {
+            title: draft.title,
+            prompt: draft.prompt,
+            repo: draft.repo,
+            notBefore: decided.notBefore,
+            maxRuntimeMinutes: decided.maxRuntimeMinutes,
+            verificationCommands: decided.verificationCommands,
+            integrationBranch: decided.integrationBranch,
+          };
+          if (existing === undefined) {
+            yield* automode
+              .enqueueGoal({
+                ...update,
+                ...(decided.model === null ? {} : { model: decided.model }),
+                origin: "proposal",
+                episodeId: priorProposal.episodeId,
+              })
+              .pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new HermesAdapterError({
+                      message: "Failed to queue approved proposal.",
+                      cause,
+                    }),
+                ),
+              );
+          } else if (editable) {
+            yield* automode
+              .updateQueuedGoal({
+                ...update,
+                goalId: existing.id,
+                model: decided.model,
+              })
+              .pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new HermesAdapterError({
+                      message: "Failed to queue approved proposal.",
+                      cause,
+                    }),
+                ),
+              );
+          }
         }
       }
-    }
-    if (dependencies !== undefined) {
-      const current =
-        input.decision === "approve"
-          ? (yield* automode.getSnapshot()).goals.find(
-              (goal) =>
-                goal.episodeId === decided.episodeId && !TERMINAL_GOAL_STATUSES.has(goal.status),
-            )
-          : undefined;
-      if (input.decision !== "approve" || current !== undefined) {
-        let targetsCurrentNight = false;
-        if (input.decision === "approve") {
-          const scheduled = yield* dependencies.scheduler.scheduleApprovedGoal({
-            eligibleAt: decided.notBefore,
-          });
-          targetsCurrentNight = scheduled.targetsCurrentNight;
-        }
-        const eventKey = `proposal:${decided.id}:${input.decision}`;
-        const deepLink =
-          current === undefined
-            ? `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`
-            : `/gits?panel=autopilot&goal=${encodeURIComponent(current.id)}`;
-        yield* dependencies.inbox.record({
-          episodeId: decided.episodeId,
-          proposalId: decided.id,
-          goalId: current?.id ?? null,
-          title: decided.title,
-          repository: decided.projectDir,
-          eventKey,
-          state:
-            input.decision === "approve"
-              ? "approved-queued"
-              : input.decision === "reject"
-                ? "rejected"
-                : "deferred",
-          reason:
-            input.decision === "approve"
-              ? "Approved and queued for autonomous work."
-              : input.decision === "reject"
-                ? "Proposal rejected."
-                : "Proposal deferred.",
-          deepLink,
-        });
-        if (targetsCurrentNight) {
+      if (dependencies !== undefined) {
+        const current =
+          input.decision === "approve"
+            ? (yield* automode.getSnapshot()).goals.find(
+                (goal) =>
+                  goal.episodeId === decided.episodeId && !TERMINAL_GOAL_STATUSES.has(goal.status),
+              )
+            : undefined;
+        if (input.decision !== "approve" || current !== undefined) {
+          let targetsCurrentNight = false;
+          if (input.decision === "approve") {
+            const scheduled = yield* dependencies.scheduler.scheduleApprovedGoal({
+              eligibleAt: decided.notBefore,
+            });
+            targetsCurrentNight = scheduled.targetsCurrentNight;
+          }
+          const eventKey = `proposal:${decided.id}:${input.decision}`;
+          const deepLink =
+            current === undefined
+              ? `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`
+              : `/gits?panel=autopilot&goal=${encodeURIComponent(current.id)}`;
           yield* dependencies.inbox.record({
             episodeId: decided.episodeId,
             proposalId: decided.id,
-            goalId: current!.id,
+            goalId: current?.id ?? null,
             title: decided.title,
             repository: decided.projectDir,
-            eventKey: `goal:${current!.id}:scheduled`,
-            state: "scheduled-tonight",
-            reason: "Scheduled for the current autonomy night.",
+            eventKey,
+            state:
+              input.decision === "approve"
+                ? "approved-queued"
+                : input.decision === "reject"
+                  ? "rejected"
+                  : "deferred",
+            reason:
+              input.decision === "approve"
+                ? "Approved and queued for autonomous work."
+                : input.decision === "reject"
+                  ? "Proposal rejected."
+                  : "Proposal deferred.",
             deepLink,
           });
+          if (targetsCurrentNight) {
+            yield* dependencies.inbox.record({
+              episodeId: decided.episodeId,
+              proposalId: decided.id,
+              goalId: current!.id,
+              title: decided.title,
+              repository: decided.projectDir,
+              eventKey: `goal:${current!.id}:scheduled`,
+              state: "scheduled-tonight",
+              reason: "Scheduled for the current autonomy night.",
+              deepLink,
+            });
+          }
         }
       }
-    }
+    }).pipe(
+      Effect.tapError(() => {
+        if (input.decision !== "approve" || dependencies === undefined || priorProposal === null) {
+          return Effect.void;
+        }
+        return automode.getSnapshot().pipe(
+          Effect.map((currentSnapshot) =>
+            currentSnapshot.goals.find(
+              (goal) =>
+                goal.episodeId === decided.episodeId && !TERMINAL_GOAL_STATUSES.has(goal.status),
+            ),
+          ),
+          Effect.catch(() => Effect.succeed(undefined)),
+          Effect.flatMap((goal) =>
+            dependencies.inbox.record({
+              episodeId: decided.episodeId,
+              proposalId: decided.id,
+              goalId: goal?.id ?? null,
+              title: decided.title,
+              repository: decided.projectDir,
+              eventKey: `proposal:${decided.id}:acceptance-failed`,
+              state: "attention-required",
+              reason: "Acceptance did not finish. Retry Accept & Queue; any existing Goal will be reused.",
+              deepLink:
+                goal === undefined
+                  ? `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`
+                  : `/gits?panel=autopilot&goal=${encodeURIComponent(goal.id)}`,
+            }),
+          ),
+          Effect.catch(() => Effect.void),
+        );
+      }),
+    );
     return decided;
   }).pipe(
     Effect.mapError((cause) =>

From 49436a8e0356e431d891b6610a41ec874d25f3b2 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:50:55 +0100
Subject: [PATCH 06/13] feat: add targeted PWA notification tests

---
 .../Layers/PushNotificationService.test.ts    | 102 +++++++++++++++
 .../push/Layers/PushNotificationService.ts    |  46 +++++++
 .../push/Services/PushNotificationService.ts  |   6 +
 apps/server/src/push/http.test.ts             | 118 ++++++++++++++++++
 apps/server/src/push/http.ts                  |  67 ++++++++++
 apps/server/src/server.ts                     |  12 +-
 6 files changed, 347 insertions(+), 4 deletions(-)
 create mode 100644 apps/server/src/push/http.test.ts

diff --git a/apps/server/src/push/Layers/PushNotificationService.test.ts b/apps/server/src/push/Layers/PushNotificationService.test.ts
index f80c6482da64..a0d0cc9b037f 100644
--- a/apps/server/src/push/Layers/PushNotificationService.test.ts
+++ b/apps/server/src/push/Layers/PushNotificationService.test.ts
@@ -174,3 +174,105 @@ it.effect("sends configured push notifications and removes expired subscriptions
     assert.deepStrictEqual(deletedEndpoints, [expired.endpoint]);
   }).pipe(Effect.provide(layer));
 });
+
+it.effect("sends a test only to the exact registered endpoint", () => {
+  const active = makeSubscription("https://push.example.test/active");
+  const other = makeSubscription("https://push.example.test/other");
+  const sentEndpoints: Array<string> = [];
+  const layer = PushNotificationServiceLive.pipe(
+    Layer.provide(configLayer),
+    Layer.provide(environmentLayer),
+    Layer.provide(
+      Layer.succeed(WebPushSubscriptionRepository, {
+        upsert: () => Effect.void,
+        deleteByEndpoint: () => Effect.void,
+        list: () => Effect.succeed([persisted(active), persisted(other)]),
+      }),
+    ),
+    Layer.provide(
+      Layer.succeed(WebPushSender, {
+        send: (subscription) =>
+          Effect.sync(() => {
+            sentEndpoints.push(subscription.endpoint);
+          }),
+      }),
+    ),
+  );
+
+  return Effect.gen(function* () {
+    const service = yield* PushNotificationService;
+    const payload = { title: "Test", body: "Body", tag: "test-1", url: "/gits" };
+    assert.strictEqual(yield* service.sendToEndpoint(active.endpoint, payload), "sent");
+    assert.strictEqual(yield* service.sendToEndpoint("https://push.example.test/missing", payload), "not-found");
+    assert.deepStrictEqual(sentEndpoints, [active.endpoint]);
+  }).pipe(Effect.provide(layer));
+});
+
+it.effect("reports disabled and failed targeted delivery and deletes expired endpoints", () => {
+  const expired = makeSubscription("https://push.example.test/expired");
+  const deletedEndpoints: Array<string> = [];
+  const repositoryLayer = Layer.succeed(WebPushSubscriptionRepository, {
+    upsert: () => Effect.void,
+    deleteByEndpoint: (endpoint: string) =>
+      Effect.sync(() => {
+        deletedEndpoints.push(endpoint);
+      }),
+    list: () => Effect.succeed([persisted(expired)]),
+  });
+  const senderLayer = Layer.succeed(WebPushSender, {
+    send: () =>
+      Effect.fail(new WebPushSendError({ endpoint: expired.endpoint, statusCode: 410 })),
+  });
+  const payload = { title: "Test", body: "Body", tag: "test-2", url: "/gits" };
+
+  return Effect.gen(function* () {
+    const configuredService = yield* PushNotificationService;
+    assert.strictEqual(yield* configuredService.sendToEndpoint(expired.endpoint, payload), "failed");
+    assert.deepStrictEqual(deletedEndpoints, [expired.endpoint]);
+
+  }).pipe(
+    Effect.provide(
+      PushNotificationServiceLive.pipe(
+        Layer.provide(configLayer),
+        Layer.provide(environmentLayer),
+        Layer.provide(repositoryLayer),
+        Layer.provide(senderLayer),
+      ),
+    ),
+  );
+});
+
+it.effect("reports targeted delivery as disabled without VAPID configuration", () => {
+  const subscription = makeSubscription("https://push.example.test/device");
+  const layer = PushNotificationServiceLive.pipe(
+    Layer.provide(
+      Layer.succeed(ServerConfig, {
+        vapidPublicKey: undefined,
+        vapidPrivateKey: undefined,
+        vapidSubject: undefined,
+      } as ServerConfigShape),
+    ),
+    Layer.provide(environmentLayer),
+    Layer.provide(
+      Layer.succeed(WebPushSubscriptionRepository, {
+        upsert: () => Effect.void,
+        deleteByEndpoint: () => Effect.void,
+        list: () => Effect.succeed([persisted(subscription)]),
+      }),
+    ),
+    Layer.provide(Layer.succeed(WebPushSender, { send: () => Effect.void })),
+  );
+
+  return Effect.gen(function* () {
+    const service = yield* PushNotificationService;
+    assert.strictEqual(
+      yield* service.sendToEndpoint(subscription.endpoint, {
+        title: "Test",
+        body: "Body",
+        tag: "test-3",
+        url: "/gits",
+      }),
+      "disabled",
+    );
+  }).pipe(Effect.provide(layer));
+});
diff --git a/apps/server/src/push/Layers/PushNotificationService.ts b/apps/server/src/push/Layers/PushNotificationService.ts
index 149a3036b3aa..7ee124cdcf1d 100644
--- a/apps/server/src/push/Layers/PushNotificationService.ts
+++ b/apps/server/src/push/Layers/PushNotificationService.ts
@@ -12,6 +12,7 @@ import {
   type PushNotificationPayload,
   PushNotificationService,
   type PushNotificationServiceShape,
+  type TargetedPushResult,
 } from "../Services/PushNotificationService.ts";
 
 function activityRequestId(payload: unknown): string | null {
@@ -163,9 +164,54 @@ const makePushNotificationService = Effect.gen(function* () {
     });
   };
 
+  const sendToEndpoint: PushNotificationServiceShape["sendToEndpoint"] = (endpoint, payload) => {
+    if (!configured) {
+      return Effect.succeed("disabled");
+    }
+
+    return Effect.gen(function* () {
+      const subscriptions = yield* repository.list().pipe(
+        Effect.map((entries) => entries as ReadonlyArray<(typeof entries)[number]> | null),
+        Effect.catch((cause) =>
+          Effect.logWarning("failed to list web push subscriptions for test", { cause }).pipe(
+            Effect.as(null),
+          ),
+        ),
+      );
+      if (subscriptions === null) {
+        return "failed" as TargetedPushResult;
+      }
+      const entry = subscriptions.find((candidate) => candidate.subscription.endpoint === endpoint);
+      if (entry === undefined) {
+        return "not-found" as TargetedPushResult;
+      }
+
+      // @effect-diagnostics-next-line preferSchemaOverJson:off
+      const body = JSON.stringify(payload);
+      return yield* sender.send(entry.subscription, body).pipe(
+        Effect.as<TargetedPushResult>("sent"),
+        Effect.catchTag("WebPushSendError", (error) =>
+          Effect.gen(function* () {
+            if (isExpiredSubscriptionError(error)) {
+              yield* repository.deleteByEndpoint(endpoint).pipe(Effect.ignore);
+            } else {
+              yield* Effect.logWarning("failed to send targeted web push notification", {
+                endpoint,
+                statusCode: error.statusCode,
+                cause: error.cause,
+              });
+            }
+            return "failed" as const;
+          }),
+        ),
+      );
+    });
+  };
+
   return {
     getPublicConfig,
     sendToAll,
+    sendToEndpoint,
     sendForOrchestrationEvent,
   };
 });
diff --git a/apps/server/src/push/Services/PushNotificationService.ts b/apps/server/src/push/Services/PushNotificationService.ts
index 6b8845d2dd99..bc39c4641cc1 100644
--- a/apps/server/src/push/Services/PushNotificationService.ts
+++ b/apps/server/src/push/Services/PushNotificationService.ts
@@ -11,12 +11,18 @@ export interface PushNotificationPayload {
   readonly url: string;
 }
 
+export type TargetedPushResult = "sent" | "disabled" | "not-found" | "failed";
+
 export interface PushNotificationServiceShape {
   readonly getPublicConfig: () => {
     readonly enabled: boolean;
     readonly publicKey: string | null;
   };
   readonly sendToAll: (payload: PushNotificationPayload) => Effect.Effect<void>;
+  readonly sendToEndpoint: (
+    endpoint: string,
+    payload: PushNotificationPayload,
+  ) => Effect.Effect<TargetedPushResult>;
   readonly sendForOrchestrationEvent: (event: OrchestrationEvent) => Effect.Effect<void>;
 }
 
diff --git a/apps/server/src/push/http.test.ts b/apps/server/src/push/http.test.ts
new file mode 100644
index 000000000000..aa682fe3fcd0
--- /dev/null
+++ b/apps/server/src/push/http.test.ts
@@ -0,0 +1,118 @@
+import { AuthSessionId } from "@t3tools/contracts";
+import { assert, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpRouter, HttpServerRequest } from "effect/unstable/http";
+
+import { ServerAuth, type AuthenticatedSession } from "../auth/Services/ServerAuth.ts";
+import {
+  type PushNotificationPayload,
+  PushNotificationService,
+  type TargetedPushResult,
+} from "./Services/PushNotificationService.ts";
+import { pushTestRouteLayer } from "./http.ts";
+
+const session = (role: AuthenticatedSession["role"]): AuthenticatedSession => ({
+  sessionId: AuthSessionId.make(`session-${role}`),
+  subject: role,
+  method: "bearer-session-token",
+  role,
+});
+
+const execute = (
+  role: AuthenticatedSession["role"],
+  body: unknown,
+  result: TargetedPushResult,
+  sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }>,
+) => {
+  const request = HttpServerRequest.fromWeb(
+    new Request("http://localhost/api/push/test", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    }),
+  );
+  const dependencies = Layer.mergeAll(
+    Layer.mock(ServerAuth)({
+      authenticateHttpRequest: () => Effect.succeed(session(role)),
+    }),
+    Layer.mock(PushNotificationService)({
+      getPublicConfig: () => ({ enabled: true, publicKey: "test" }),
+      sendToAll: () => Effect.void,
+      sendToEndpoint: (endpoint, payload) =>
+        Effect.sync(() => {
+          sent.push({ endpoint, payload });
+          return result;
+        }),
+      sendForOrchestrationEvent: () => Effect.void,
+    }),
+  );
+  return Effect.scoped(
+    HttpRouter.toHttpEffect(pushTestRouteLayer).pipe(
+      Effect.flatMap((handler) => handler),
+      Effect.provideService(HttpServerRequest.HttpServerRequest, request),
+      Effect.provide(dependencies),
+    ),
+  );
+};
+
+it.effect("push test route uses fixed server payload and a unique test tag", () =>
+  Effect.gen(function* () {
+    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> = [];
+    const response = yield* execute(
+      "owner",
+      {
+        endpoint: "https://push.example/device",
+        kind: "proposal",
+        title: "Caller title",
+        body: "Caller body",
+        url: "https://evil.example",
+      },
+      "sent",
+      sent,
+    );
+
+    assert.equal(response.status, 200);
+    assert.equal(sent.length, 1);
+    assert.equal(sent[0]!.endpoint, "https://push.example/device");
+    assert.equal(sent[0]!.payload.title, "Test proposal ready");
+    assert.equal(sent[0]!.payload.body, "Tap to test the guided proposal launch.");
+    assert.equal(
+      sent[0]!.payload.url,
+      "/gits?panel=autopilot&notificationTest=proposal",
+    );
+    assert.match(sent[0]!.payload.tag, /^gits:test:proposal:/);
+  }),
+);
+
+it.effect("push test route rejects thread-scoped sessions before sending", () =>
+  Effect.gen(function* () {
+    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> = [];
+    const response = yield* execute(
+      "thread-scoped",
+      { endpoint: "https://push.example/device", kind: "delivery" },
+      "sent",
+      sent,
+    );
+    assert.equal(response.status, 403);
+    assert.equal(sent.length, 0);
+  }),
+);
+
+it.effect("push test route maps closed delivery results", () =>
+  Effect.gen(function* () {
+    for (const [result, status] of [
+      ["disabled", 503],
+      ["not-found", 404],
+      ["failed", 502],
+    ] as const) {
+      const response = yield* execute(
+        "owner",
+        { endpoint: "https://push.example/device", kind: "delivery" },
+        result,
+        [],
+      );
+      assert.equal(response.status, status);
+    }
+  }),
+);
diff --git a/apps/server/src/push/http.ts b/apps/server/src/push/http.ts
index 8820350db7a0..50975705fa62 100644
--- a/apps/server/src/push/http.ts
+++ b/apps/server/src/push/http.ts
@@ -1,10 +1,16 @@
+import { randomUUID } from "node:crypto";
+
 import {
   WebPushPublicConfig,
   WebPushRegisterInput,
+  WebPushTestInput,
+  type WebPushTestKind,
+  type WebPushTestResult,
   WebPushUnregisterInput,
 } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 
 import { AuthError, ServerAuth } from "../auth/Services/ServerAuth.ts";
@@ -12,6 +18,23 @@ import { respondToAuthError } from "../auth/http.ts";
 import { ServerConfig } from "../config.ts";
 import { browserApiCorsHeaders } from "../httpCors.ts";
 import { WebPushSubscriptionRepository } from "../persistence/Services/WebPushSubscriptions.ts";
+import {
+  type PushNotificationPayload,
+  PushNotificationService,
+} from "./Services/PushNotificationService.ts";
+
+export const TEST_PUSH_PAYLOADS = {
+  delivery: {
+    title: "GITS notification test",
+    body: "Android PWA delivery is working. Tap to confirm.",
+    url: "/gits?panel=autopilot&notificationTest=delivery",
+  },
+  proposal: {
+    title: "Test proposal ready",
+    body: "Tap to test the guided proposal launch.",
+    url: "/gits?panel=autopilot&notificationTest=proposal",
+  },
+} satisfies Record<WebPushTestKind, Omit<PushNotificationPayload, "tag">>;
 
 const authenticatePushSession = Effect.gen(function* () {
   const request = yield* HttpServerRequest.HttpServerRequest;
@@ -139,3 +162,47 @@ export const pushUnregisterRouteLayer = HttpRouter.add(
     }),
   ),
 );
+
+export const pushTestRouteLayer = HttpRouter.add(
+  "POST",
+  "/api/push/test",
+  Effect.gen(function* () {
+    yield* authenticatePushSession;
+    const input = yield* HttpServerRequest.schemaBodyJson(WebPushTestInput).pipe(
+      Effect.mapError(
+        (cause) =>
+          new AuthError({
+            message: "Invalid web push test payload.",
+            status: 400,
+            cause,
+          }),
+      ),
+    );
+    const service = yield* Effect.serviceOption(PushNotificationService);
+    const fixed = TEST_PUSH_PAYLOADS[input.kind];
+    const result = yield* Option.match(service, {
+      onNone: () => Effect.succeed("disabled" as const),
+      onSome: (available) =>
+        available.sendToEndpoint(input.endpoint, {
+          ...fixed,
+          tag: `gits:test:${input.kind}:${randomUUID()}`,
+        }),
+    });
+    if (result === "sent") {
+      return HttpServerResponse.jsonUnsafe(
+        { accepted: true, url: fixed.url } satisfies WebPushTestResult,
+        { status: 200, headers: browserApiCorsHeaders },
+      );
+    }
+    const [status, error] =
+      result === "disabled"
+        ? [503, "Web push is not configured."]
+        : result === "not-found"
+          ? [404, "This device subscription is not registered."]
+          : [502, "The push provider rejected the test notification."];
+    return HttpServerResponse.jsonUnsafe(
+      { error },
+      { status, headers: browserApiCorsHeaders },
+    );
+  }).pipe(Effect.catchTag("AuthError", respondToAuthError)),
+);
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index 8e2bb49664c9..d89feb18a087 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -156,6 +156,7 @@ import { PushNotificationReactorLive } from "./push/Layers/PushNotificationReact
 import {
   pushPublicConfigRouteLayer,
   pushRegisterRouteLayer,
+  pushTestRouteLayer,
   pushUnregisterRouteLayer,
 } from "./push/http.ts";
 
@@ -268,6 +269,10 @@ const WebPushSubscriptionRepositoryLayerLive = WebPushSubscriptionRepositoryLive
   Layer.provide(PersistenceLayerLive),
 );
 
+const RegisteredPushNotificationLayerLive = PushNotificationLayerLive.pipe(
+  Layer.provide(WebPushSubscriptionRepositoryLayerLive),
+);
+
 const VcsDriverRegistryLayerLive = VcsDriverRegistry.layer.pipe(
   Layer.provide(VcsProjectConfig.layer),
 );
@@ -346,9 +351,7 @@ const GitsSlotSchedulerLayerLive = GitsSlotSchedulerLive.pipe(
 
 const AutomodeNotificationsLayerLive = AutomodeNotificationsLive.pipe(
   Layer.provide(HermesTelegramNotifierLive),
-  Layer.provide(
-    PushNotificationLayerLive.pipe(Layer.provide(WebPushSubscriptionRepositoryLayerLive)),
-  ),
+  Layer.provide(RegisteredPushNotificationLayerLive),
 );
 
 const CockpitInboxLayerLive = CockpitInboxLive;
@@ -610,6 +613,7 @@ const GitsRoutesLayer = Layer.mergeAll(
 const PushRoutesLayer = Layer.mergeAll(
   pushPublicConfigRouteLayer,
   pushRegisterRouteLayer,
+  pushTestRouteLayer,
   pushUnregisterRouteLayer,
 );
 
@@ -737,7 +741,7 @@ export const makeServerLayer = Layer.unwrap(
       runtimeStateLayer,
       tailscaleServeLayer,
       browserPreviewCleanupLayer,
-    );
+    ).pipe(Layer.provideMerge(RegisteredPushNotificationLayerLive));
 
     return serverApplicationLayer.pipe(
       Layer.provideMerge(RuntimeServicesLive),

From fabd2b934476587829d036128b517f81220deeb4 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 22:52:40 +0100
Subject: [PATCH 07/13] feat: add guided proposal launch logic

---
 .../proposalLaunch.logic.test.ts              |  97 ++++++++++++
 .../proposal-launch/proposalLaunch.logic.ts   | 145 ++++++++++++++++++
 .../service.threadSubscriptions.test.ts       |   1 +
 3 files changed, 243 insertions(+)
 create mode 100644 apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
 create mode 100644 apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts

diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
new file mode 100644
index 000000000000..754806c90f94
--- /dev/null
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
@@ -0,0 +1,97 @@
+import { CODEX_MODEL_TIERS, type AutomodePolicy, type HermesProposalCard } from "@t3tools/contracts";
+import { describe, expect, it } from "vitest";
+
+import {
+  TEST_PROPOSAL,
+  initialProposalLaunchForm,
+  launchModelOptions,
+  proposalLaunchEdits,
+  validateProposalLaunchForm,
+} from "./proposalLaunch.logic.ts";
+
+const policy = {
+  allowedRepos: ["/srv/repo"],
+  allowedModels: ["model-a", "model-b"],
+  defaultModel: "model-b",
+  maxRuntimeMinutes: 60,
+  verificationCommands: [{ label: "typecheck", cmd: ["bun", "typecheck"] }],
+  integrationBranch: "autopilot/main",
+} as unknown as AutomodePolicy;
+
+const proposal = {
+  ...TEST_PROPOSAL,
+  projectDir: "/srv/repo",
+  model: "model-a",
+  notBefore: "2026-08-10T20:30:00.000Z",
+  maxRuntimeMinutes: 45,
+  verificationCommands: [{ label: "lint", cmd: ["bun", "lint"] }],
+  integrationBranch: "autopilot/proposal",
+} satisfies HermesProposalCard;
+
+describe("guided proposal launch logic", () => {
+  it("uses proposal choices before policy defaults", () => {
+    expect(initialProposalLaunchForm(proposal, policy)).toMatchObject({
+      repository: "/srv/repo",
+      model: "model-a",
+      notBefore: "2026-08-10T20:30",
+      runtime: "45",
+      integrationBranch: "autopilot/proposal",
+      verificationCommands: [{ label: "lint", cmd: ["bun", "lint"] }],
+    });
+
+    expect(
+      initialProposalLaunchForm({ ...proposal, model: null, maxRuntimeMinutes: null }, policy),
+    ).toMatchObject({ model: "model-b", runtime: "60" });
+  });
+
+  it("uses allowed models or the three built-in tiers without duplicates", () => {
+    expect(launchModelOptions(policy).map((item) => item.value)).toEqual(["model-a", "model-b"]);
+    expect(
+      launchModelOptions({ ...policy, allowedModels: [] }).map((item) => item.value),
+    ).toEqual([CODEX_MODEL_TIERS.light, CODEX_MODEL_TIERS.medium, CODEX_MODEL_TIERS.high]);
+  });
+
+  it("validates repository, model, runtime, and start time", () => {
+    const form = initialProposalLaunchForm(proposal, policy);
+    expect(validateProposalLaunchForm(form)).toEqual({ ok: true });
+    expect(validateProposalLaunchForm({ ...form, repository: "" })).toMatchObject({
+      ok: false,
+      field: "repository",
+    });
+    expect(validateProposalLaunchForm({ ...form, model: "" })).toMatchObject({
+      ok: false,
+      field: "model",
+    });
+    expect(validateProposalLaunchForm({ ...form, runtime: "-1" })).toMatchObject({
+      ok: false,
+      field: "runtime",
+    });
+    expect(validateProposalLaunchForm({ ...form, notBefore: "invalid" })).toMatchObject({
+      ok: false,
+      field: "notBefore",
+    });
+  });
+
+  it("builds typed edits and converts local time to ISO", () => {
+    const form = initialProposalLaunchForm(proposal, policy);
+    expect(proposalLaunchEdits(form)).toEqual({
+      title: proposal.title,
+      prompt: proposal.nextCommandOrPrompt,
+      projectDir: "/srv/repo",
+      model: "model-a",
+      notBefore: new Date("2026-08-10T20:30").toISOString(),
+      maxRuntimeMinutes: 45,
+      verificationCommands: [{ label: "lint", cmd: ["bun", "lint"] }],
+      integrationBranch: "autopilot/proposal",
+    });
+  });
+
+  it("exports a deterministic proposal-only test fixture", () => {
+    expect(TEST_PROPOSAL).toMatchObject({
+      id: "notification-test-proposal",
+      episodeId: "notification-test-episode",
+      status: "proposed",
+      projectDir: "/srv/example-project",
+    });
+  });
+});
diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
new file mode 100644
index 000000000000..00e32829324b
--- /dev/null
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
@@ -0,0 +1,145 @@
+import {
+  CODEX_MODEL_TIERS,
+  type AutomodePolicy,
+  type GitsVerifyCommand,
+  type HermesProposalCard,
+  type HermesProposalDecisionInput,
+} from "@t3tools/contracts";
+
+export type LaunchStep = "idea" | "model" | "review";
+
+export interface ProposalLaunchForm {
+  readonly title: string;
+  readonly prompt: string;
+  readonly repository: string;
+  readonly model: string;
+  readonly notBefore: string;
+  readonly runtime: string;
+  readonly verificationCommands: ReadonlyArray<GitsVerifyCommand>;
+  readonly integrationBranch: string;
+}
+
+export interface LaunchModelOption {
+  readonly value: string;
+  readonly label: string;
+}
+
+export type ProposalLaunchEdits = Omit<
+  HermesProposalDecisionInput,
+  "proposalId" | "decision" | "reason"
+>;
+
+export type ProposalLaunchValidation =
+  | { readonly ok: true }
+  | {
+      readonly ok: false;
+      readonly field: "repository" | "model" | "runtime" | "notBefore";
+      readonly message: string;
+    };
+
+const tierLabels = new Map<string, string>([
+  [CODEX_MODEL_TIERS.light, "Luna · Light"],
+  [CODEX_MODEL_TIERS.medium, "Terra · Balanced"],
+  [CODEX_MODEL_TIERS.high, "Sol · Deep"],
+]);
+
+export function launchModelOptions(policy: AutomodePolicy): ReadonlyArray<LaunchModelOption> {
+  const models =
+    policy.allowedModels.length > 0
+      ? policy.allowedModels
+      : [CODEX_MODEL_TIERS.light, CODEX_MODEL_TIERS.medium, CODEX_MODEL_TIERS.high];
+  return [...new Set(models)].map((value) => ({ value, label: tierLabels.get(value) ?? value }));
+}
+
+export function initialProposalLaunchForm(
+  proposal: HermesProposalCard,
+  policy: AutomodePolicy,
+): ProposalLaunchForm {
+  const models = launchModelOptions(policy).map((option) => option.value);
+  const model =
+    proposal.model !== null && models.includes(proposal.model)
+      ? proposal.model
+      : policy.defaultModel !== null && models.includes(policy.defaultModel)
+        ? policy.defaultModel
+        : (models[0] ?? "");
+  return {
+    title: proposal.title,
+    prompt: proposal.nextCommandOrPrompt ?? proposal.detail,
+    repository: proposal.projectDir ?? policy.allowedRepos[0] ?? "",
+    model,
+    notBefore: proposal.notBefore?.slice(0, 16) ?? "",
+    runtime:
+      proposal.maxRuntimeMinutes !== null
+        ? String(proposal.maxRuntimeMinutes)
+        : policy.maxRuntimeMinutes !== null
+          ? String(policy.maxRuntimeMinutes)
+          : "",
+    verificationCommands:
+      proposal.verificationCommands.length > 0
+        ? proposal.verificationCommands
+        : policy.verificationCommands,
+    integrationBranch: proposal.integrationBranch ?? policy.integrationBranch ?? "",
+  };
+}
+
+export function validateProposalLaunchForm(form: ProposalLaunchForm): ProposalLaunchValidation {
+  if (form.repository.trim().length === 0) {
+    return { ok: false, field: "repository", message: "Choose a repository." };
+  }
+  if (form.model.trim().length === 0) {
+    return { ok: false, field: "model", message: "Choose a model." };
+  }
+  if (form.runtime.length > 0) {
+    const runtime = Number(form.runtime);
+    if (!Number.isInteger(runtime) || runtime < 0) {
+      return { ok: false, field: "runtime", message: "Runtime must be zero or more minutes." };
+    }
+  }
+  if (form.notBefore.length > 0 && Number.isNaN(new Date(form.notBefore).getTime())) {
+    return { ok: false, field: "notBefore", message: "Choose a valid start time." };
+  }
+  return { ok: true };
+}
+
+export function proposalLaunchEdits(form: ProposalLaunchForm): ProposalLaunchEdits {
+  return {
+    title: form.title.trim(),
+    prompt: form.prompt.trim(),
+    projectDir: form.repository.trim(),
+    model: form.model.trim(),
+    notBefore: form.notBefore.length > 0 ? new Date(form.notBefore).toISOString() : null,
+    maxRuntimeMinutes: form.runtime.length > 0 ? Number(form.runtime) : null,
+    verificationCommands: form.verificationCommands,
+    integrationBranch: form.integrationBranch.trim() || null,
+  };
+}
+
+export const TEST_PROPOSAL: HermesProposalCard = {
+  id: "notification-test-proposal",
+  episodeId: "notification-test-episode",
+  title: "Improve the Android notification flow",
+  summary: "Validate a proposal notification and guided launch without queueing real work.",
+  detail: "Review the idea, choose a model, and confirm the queue summary.",
+  evidence: ["Opened from a test PWA notification."],
+  scope: ["Notification delivery", "Guided proposal review"],
+  risk: "low",
+  actionKind: "repo-write",
+  status: "proposed",
+  requiresApproval: true,
+  recommendedExecutor: "delamain",
+  verificationPlan: ["Complete the local test flow."],
+  nextCommandOrPrompt: "Exercise the guided notification proposal flow.",
+  blockedReason: null,
+  source: "notification-test",
+  projectDir: "/srv/example-project",
+  model: CODEX_MODEL_TIERS.medium,
+  notBefore: null,
+  maxRuntimeMinutes: 45,
+  verificationCommands: [],
+  integrationBranch: null,
+  sourceThreadId: null,
+  decisionReason: null,
+  decidedAt: null,
+  createdAt: "2026-08-09T00:00:00.000Z",
+  updatedAt: "2026-08-09T00:00:00.000Z",
+};
diff --git a/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts b/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts
index af5d3e456e94..17b33e0987df 100644
--- a/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts
+++ b/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts
@@ -209,6 +209,7 @@ vi.mock("@t3tools/client-runtime", async (importOriginal) => {
       },
       automode: {
         getSnapshot: vi.fn(),
+        configure: vi.fn(),
         updatePolicy: vi.fn(),
         enqueueGoal: vi.fn(),
         approveGoal: vi.fn(),

From 4dacf3af559a8834933cd2bd0b1462e908d7cae1 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 23:04:54 +0100
Subject: [PATCH 08/13] feat: simplify autopilot around the inbox

---
 apps/web/src/components/gits/GitsCockpit.tsx  |  163 +--
 .../gits/cockpit/AutopilotPanel.browser.tsx   |  117 ++
 .../gits/cockpit/AutopilotPanel.tsx           | 1261 ++++-------------
 .../cockpit/ProposalLaunchSheet.browser.tsx   |  129 ++
 .../gits/cockpit/ProposalLaunchSheet.tsx      |  491 +++++++
 .../cockpit/autopilot/autopilot.logic.test.ts |  175 +--
 .../gits/cockpit/autopilot/autopilot.logic.ts |  201 +--
 7 files changed, 1005 insertions(+), 1532 deletions(-)
 create mode 100644 apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx
 create mode 100644 apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
 create mode 100644 apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx

diff --git a/apps/web/src/components/gits/GitsCockpit.tsx b/apps/web/src/components/gits/GitsCockpit.tsx
index ca8d8701a5b3..102146c174ad 100644
--- a/apps/web/src/components/gits/GitsCockpit.tsx
+++ b/apps/web/src/components/gits/GitsCockpit.tsx
@@ -9,7 +9,7 @@ import type {
 } from "@t3tools/contracts";
 import { DEFAULT_SERVER_SETTINGS } from "@t3tools/contracts";
 import { resolveRepositoryProfile } from "@t3tools/shared/repositoryProfiles";
-import { useMutation } from "@tanstack/react-query";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { RefreshCwIcon } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
 import { useShallow } from "zustand/react/shallow";
@@ -72,6 +72,7 @@ import { useDevCommandSessions } from "./cockpit/useDevCommandSessions";
 import { readCockpitDeepLink } from "./cockpit/motoko/motoko.logic";
 
 export function GitsCockpit() {
+  const queryClient = useQueryClient();
   const deepLink = readCockpitDeepLink(typeof window === "undefined" ? "" : window.location.search);
   const [activeTab, setActiveTab] = useState<GitsCockpitTab>(deepLink.panel);
   const [focusedProposalId] = useState(deepLink.proposalId);
@@ -115,10 +116,6 @@ export function GitsCockpit() {
   const [gsdMaxBudget, setGsdMaxBudget] = useState("");
   const [skillReviews, setSkillReviews] = useState<SkillReviewState>(() => loadSkillReviewState());
   const [mcpOverrides, setMcpOverrides] = useState<McpOverrideState>(() => loadMcpOverrideState());
-  const [automodeGoalTitle, setAutomodeGoalTitle] = useState("");
-  const [automodeGoalRepo, setAutomodeGoalRepo] = useState("");
-  const [automodeGoalModel, setAutomodeGoalModel] = useState("");
-  const [automodeGoalPrompt, setAutomodeGoalPrompt] = useState("");
   const [openGsdCommandResult, setOpenGsdCommandResult] = useState<
     OpenGsdCommandResult | undefined
   >(undefined);
@@ -413,14 +410,16 @@ export function GitsCockpit() {
         ...input.edits,
       });
       if (input.decision !== "approve" || decided.status !== "approved") {
-        return { decided, draft: null };
+        return { decided, draft: null, goal: null };
       }
-      // Approval means "go" through the automode rails: the server-side approve bridge
-      // enqueues delamain-peer drafts as automode goals (own branch, verify floor, held
-      // PR). Never spawn a raw peer here — an unpinned spawn would let delamain merge
-      // unreviewed work straight into the origin default branch.
-      const draft = await client.hermes.draftFromProposal({ proposalId: input.proposalId });
-      return { decided, draft };
+      const automode = await client.automode.getSnapshot();
+      const goal = automode.goals.find(
+        (candidate) =>
+          candidate.episodeId === decided.episodeId &&
+          !["completed", "failed", "blocked", "rejected"].includes(candidate.status),
+      );
+      if (!goal) throw new Error("Proposal was approved, but its queued Goal was not found.");
+      return { decided, draft: null, goal };
     },
     onSuccess: async (result, input) => {
       appendMotokoTranscript(input.routeKey, {
@@ -429,7 +428,15 @@ export function GitsCockpit() {
         message: motokoDecisionSummary(input.decision, input.title, result),
         createdAt: new Date().toISOString(),
       });
-      await Promise.all([hermesProposalsQuery.refetch(), hermesQuery.refetch()]);
+      await Promise.all([
+        hermesProposalsQuery.refetch(),
+        hermesQuery.refetch(),
+        automodeQuery.refetch(),
+        schedulerQuery.refetch(),
+        queryClient.invalidateQueries({
+          queryKey: ["gits", "cockpit-inbox", targetEnvironmentId],
+        }),
+      ]);
     },
     onError: (error, input) => {
       appendMotokoTranscript(input.routeKey, {
@@ -560,73 +567,6 @@ export function GitsCockpit() {
       await query.refetch();
     },
   });
-  const automodeKillSwitchEnabled = automodeQuery.data?.policy.killSwitchEnabled ?? true;
-  const automodeKillSwitchMutation = useMutation({
-    mutationFn: async (killSwitchEnabled: boolean) =>
-      readGitsClient().automode.updatePolicy({ killSwitchEnabled }),
-    onSuccess: async () => {
-      await automodeQuery.refetch();
-    },
-  });
-  const automodeEnqueueMutation = useMutation({
-    mutationFn: async () =>
-      readGitsClient().automode.enqueueGoal({
-        title: automodeGoalTitle.trim(),
-        repo: automodeGoalRepo.trim(),
-        prompt: automodeGoalPrompt.trim(),
-        ...(automodeGoalModel.trim().length > 0 ? { model: automodeGoalModel.trim() } : {}),
-      }),
-    onSuccess: async () => {
-      setAutomodeGoalTitle("");
-      setAutomodeGoalPrompt("");
-      await automodeQuery.refetch();
-    },
-  });
-  const automodeApproveMutation = useMutation({
-    mutationFn: async (goalId: string) => readGitsClient().automode.approveGoal({ goalId }),
-    onSuccess: async () => {
-      await automodeQuery.refetch();
-    },
-  });
-  const automodeRejectMutation = useMutation({
-    mutationFn: async (goalId: string) =>
-      readGitsClient().automode.rejectGoal({ goalId, reason: "Rejected in cockpit." }),
-    onSuccess: async () => {
-      await automodeQuery.refetch();
-    },
-  });
-  const automodeDispatchMutation = useMutation({
-    mutationFn: async (goalId: string) => readGitsClient().automode.dispatchGoal({ goalId }),
-    onSuccess: async () => {
-      await Promise.all([automodeQuery.refetch(), delamainQuery.refetch()]);
-    },
-  });
-  const schedulerSetConfigMutation = useMutation({
-    mutationFn: async (input: { enabled: boolean }) =>
-      readGitsClient().automode.schedulerSetConfig(input),
-    onSuccess: async () => {
-      await schedulerQuery.refetch();
-    },
-  });
-  const schedulerArmMutation = useMutation({
-    mutationFn: async () => readGitsClient().automode.schedulerArm(),
-    onSuccess: async () => {
-      await schedulerQuery.refetch();
-    },
-  });
-  const schedulerDisarmMutation = useMutation({
-    mutationFn: async () =>
-      readGitsClient().automode.schedulerDisarm({ reason: "Disarmed in cockpit." }),
-    onSuccess: async () => {
-      await schedulerQuery.refetch();
-    },
-  });
-  const driverResumeMutation = useMutation({
-    mutationFn: async () => readGitsClient().automode.resumeDriver(),
-    onSuccess: async () => {
-      await automodeQuery.refetch();
-    },
-  });
   const actionError =
     spawnMutation.error ??
     replyMutation.error ??
@@ -661,26 +601,6 @@ export function GitsCockpit() {
     hermesDecisionMutation.isPending ||
     hermesDraftMutation.isPending ||
     hermesScheduleMutation.isPending;
-  const automodeActionError =
-    automodeKillSwitchMutation.error ??
-    automodeEnqueueMutation.error ??
-    automodeApproveMutation.error ??
-    automodeRejectMutation.error ??
-    automodeDispatchMutation.error ??
-    schedulerSetConfigMutation.error ??
-    schedulerArmMutation.error ??
-    schedulerDisarmMutation.error ??
-    driverResumeMutation.error;
-  const automodeActionPending =
-    automodeKillSwitchMutation.isPending ||
-    automodeEnqueueMutation.isPending ||
-    automodeApproveMutation.isPending ||
-    automodeRejectMutation.isPending ||
-    automodeDispatchMutation.isPending ||
-    schedulerSetConfigMutation.isPending ||
-    schedulerArmMutation.isPending ||
-    schedulerDisarmMutation.isPending ||
-    driverResumeMutation.isPending;
   const updateSkillReview = (
     skillId: string,
     updater: (current: SkillReviewState[string]) => SkillReviewState[string],
@@ -729,13 +649,6 @@ export function GitsCockpit() {
     setSelectedProjectRoot(MOTOKO_ROOT_ROUTE_VALUE);
   }, [query.data?.projects, selectedProjectRoot]);
 
-  useEffect(() => {
-    if (automodeGoalRepo.trim().length > 0) {
-      return;
-    }
-    setAutomodeGoalRepo(selectedProjectRoot);
-  }, [automodeGoalRepo, selectedProjectRoot]);
-
   const tabCounts = useMemo<Record<GitsCockpitTab, string>>(() => {
     const runningGoals =
       automodeQuery.data?.goals.filter((goal) => goal.status === "running").length ?? 0;
@@ -948,48 +861,22 @@ export function GitsCockpit() {
               {activeTab === "autopilot" ? (
                 <AutopilotPanel
                   snapshot={automodeQuery.data}
-                  scheduler={schedulerQuery.data}
                   loading={automodeQuery.isPending || automodeQuery.isFetching}
                   error={automodeQuery.error}
-                  actionError={automodeActionError}
-                  actionPending={automodeActionPending}
-                  killSwitchEnabled={automodeKillSwitchEnabled}
-                  goalTitle={automodeGoalTitle}
-                  goalRepo={automodeGoalRepo}
-                  goalModel={automodeGoalModel}
-                  goalPrompt={automodeGoalPrompt}
                   projects={query.data?.projects}
                   proposals={hermesProposalsQuery.data}
                   focusedProposalId={focusedProposalId}
-                  onProposalDecision={(proposal, decision, edits) =>
-                    void hermesDecisionMutation.mutate({
+                  onProposalDecision={async (proposal, decision, edits) => {
+                    const result = await hermesDecisionMutation.mutateAsync({
                       proposalId: proposal.id,
                       decision,
                       routeKey: motokoRoute,
                       title: proposal.title,
                       edits,
-                    })
-                  }
-                  onRefresh={() => void automodeQuery.refetch()}
-                  onKillSwitchChange={(next) => void automodeKillSwitchMutation.mutate(next)}
-                  onGoalTitleChange={setAutomodeGoalTitle}
-                  onGoalRepoChange={setAutomodeGoalRepo}
-                  onGoalModelChange={setAutomodeGoalModel}
-                  onGoalPromptChange={setAutomodeGoalPrompt}
-                  onEnqueueGoal={() => void automodeEnqueueMutation.mutate()}
-                  onApproveGoal={(goalId) => void automodeApproveMutation.mutate(goalId)}
-                  onRejectGoal={(goalId) => {
-                    if (window.confirm(`Reject automode goal ${goalId}?`)) {
-                      void automodeRejectMutation.mutate(goalId);
-                    }
+                    });
+                    return result.goal;
                   }}
-                  onDispatchGoal={(goalId) => void automodeDispatchMutation.mutate(goalId)}
-                  onSchedulerEnabledChange={(enabled) =>
-                    void schedulerSetConfigMutation.mutate({ enabled })
-                  }
-                  onSchedulerArm={() => void schedulerArmMutation.mutate()}
-                  onSchedulerDisarm={() => void schedulerDisarmMutation.mutate()}
-                  onResumeDriver={() => void driverResumeMutation.mutate()}
+                  onRefresh={() => void automodeQuery.refetch()}
                 />
               ) : null}
               {activeTab === "fleet" ? (
diff --git a/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx b/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx
new file mode 100644
index 000000000000..2a095ca04462
--- /dev/null
+++ b/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx
@@ -0,0 +1,117 @@
+import "../../../index.css";
+
+import type { AutomodeSnapshot } from "@t3tools/contracts";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { page } from "vitest/browser";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { render } from "vitest-browser-react";
+
+const ENVIRONMENT_ID = "autopilot-environment" as never;
+const automode = vi.hoisted(() => ({ configure: vi.fn(), stopAll: vi.fn() }));
+const cockpitInbox = vi.hoisted(() => ({
+  list: vi.fn(),
+  markAllRead: vi.fn(),
+  markRead: vi.fn(),
+  pin: vi.fn(),
+}));
+
+vi.mock("~/environments/primary", async (importOriginal) => ({
+  ...(await importOriginal()),
+  usePrimaryEnvironmentId: () => ENVIRONMENT_ID,
+}));
+vi.mock("~/gitsClient", () => ({
+  readGitsEnvironmentClient: () => ({ automode, cockpitInbox }),
+}));
+vi.mock("~/components/ui/toast", () => ({ toastManager: { add: vi.fn() } }));
+
+import { AutopilotPanel } from "./AutopilotPanel";
+
+const snapshot = (on: boolean, repositories = ["/srv/project"]): AutomodeSnapshot =>
+  ({
+    policy: {
+      mode: on ? "autonomous" : "manual",
+      killSwitchEnabled: !on,
+      proposalRepos: repositories,
+      allowedRepos: repositories,
+      allowedModels: ["gpt-5.6-terra"],
+      defaultModel: "gpt-5.6-terra",
+      maxRuntimeMinutes: 60,
+      verificationCommands: [],
+      integrationBranch: null,
+    },
+    goals: [
+      {
+        id: "goal-1",
+        title: "Ship the simple flow",
+        repo: "/srv/project",
+        status: "queued",
+        createdAt: "2026-08-09T00:00:00.000Z",
+      },
+    ],
+    activePeerCount: 0,
+    pendingApprovalCount: 0,
+  }) as unknown as AutomodeSnapshot;
+
+function renderPanel(value: AutomodeSnapshot) {
+  return render(
+    <QueryClientProvider
+      client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}
+    >
+      <AutopilotPanel
+        error={null}
+        focusedProposalId={null}
+        loading={false}
+        onProposalDecision={vi.fn()}
+        onRefresh={vi.fn()}
+        projects={[]}
+        proposals={undefined}
+        snapshot={value}
+      />
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  automode.configure.mockResolvedValue(undefined);
+  automode.stopAll.mockResolvedValue({ stoppedPeers: 0, failures: 0 });
+  cockpitInbox.list.mockResolvedValue({
+    items: [],
+    counts: { unread: 0, active: 0, "needs-attention": 0, all: 0 },
+  });
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  document.body.innerHTML = "";
+});
+
+describe("AutopilotPanel", () => {
+  it("shows only the simple operator controls", async () => {
+    renderPanel(snapshot(false));
+    await expect.element(page.getByText("Paused", { exact: true })).toBeVisible();
+    await expect.element(page.getByText("Watched repositories")).toBeVisible();
+    await expect.element(page.getByText("Inbox", { exact: true })).toBeVisible();
+    await expect.element(page.getByText("Queue", { exact: true })).toBeVisible();
+    await expect.element(page.getByRole("button", { name: "Emergency Stop" })).toBeVisible();
+    expect(document.body.textContent).not.toContain("Automation switchboard");
+    expect(document.body.textContent).not.toContain("Max budget");
+    expect(document.body.textContent).not.toContain("Scheduler arm");
+    expect(document.body.textContent).not.toContain("Manual goal");
+  });
+
+  it("pauses through the narrow configure operation", async () => {
+    renderPanel(snapshot(true));
+    await page.getByRole("button", { name: "Pause" }).click();
+    expect(automode.configure).toHaveBeenCalledWith({
+      enabled: false,
+      repositories: ["/srv/project"],
+    });
+  });
+
+  it("refuses to enable without a watched repository", async () => {
+    renderPanel(snapshot(false, []));
+    await page.getByRole("button", { name: "Turn on" }).click();
+    await expect.element(page.getByRole("alert")).toHaveTextContent("Choose at least one");
+    expect(automode.configure).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
index 1aeb95839997..5df7dfa8309c 100644
--- a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
+++ b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
@@ -1,35 +1,14 @@
 import type {
-  AutomodeEpisode,
   AutomodeGoal,
-  AutomodeGoalStatus,
-  AutomodeMode,
-  AutomodePolicyUpdateInput,
   AutomodeSnapshot,
-  CodexModelTier,
   GitsCockpitProject,
-  GitsSchedulerSnapshot,
   HermesProposalCard,
   HermesProposalListResult,
-  MotokoAuthority,
 } from "@t3tools/contracts";
-import { CODEX_MODEL_TIER_LABELS, CODEX_MODEL_TIERS } from "@t3tools/contracts";
-import { useMutation, useQuery } from "@tanstack/react-query";
-import {
-  ListChecksIcon,
-  OctagonAlertIcon,
-  PlayIcon,
-  PowerIcon,
-  RefreshCwIcon,
-  ShieldCheckIcon,
-  SkullIcon,
-} from "lucide-react";
-import { useEffect, useState } from "react";
+import { useMutation } from "@tanstack/react-query";
+import { OctagonAlertIcon, RefreshCwIcon, RocketIcon } from "lucide-react";
+import { useEffect, useMemo, useState } from "react";
 
-import { usePrimaryEnvironmentId } from "~/environments/primary";
-import type { GitsEnvironmentClient } from "~/gitsClient";
-import { readGitsEnvironmentClient } from "~/gitsClient";
-import { cn } from "~/lib/utils";
-import { useStore } from "~/store";
 import {
   AlertDialog,
   AlertDialogClose,
@@ -40,7 +19,6 @@ import {
   AlertDialogTitle,
 } from "~/components/ui/alert-dialog";
 import { Button } from "~/components/ui/button";
-import { Checkbox } from "~/components/ui/checkbox";
 import {
   Combobox,
   ComboboxChip,
@@ -51,158 +29,21 @@ import {
   ComboboxList,
   ComboboxPopup,
 } from "~/components/ui/combobox";
-import { Input } from "~/components/ui/input";
-import {
-  MotokoProposalReview,
-  type MotokoProposalDecision,
-  type MotokoProposalEdits,
-} from "./MotokoPanel";
-import {
-  Select,
-  SelectGroup,
-  SelectItem,
-  SelectPopup,
-  SelectTrigger,
-  SelectValue,
-} from "~/components/ui/select";
-import { Switch } from "~/components/ui/switch";
 import { Textarea } from "~/components/ui/textarea";
 import { toastManager } from "~/components/ui/toast";
-import { InboxSection } from "./InboxSection";
-
-import {
-  type AutopilotPolicyForm,
-  formStateToPolicyUpdate,
-  formatGateDecision,
-  modelTierOf,
-  nextPolicyFormState,
-  policyToFormState,
-  reposNotAllowed,
-  verdictTone,
-} from "./autopilot/autopilot.logic";
-import {
-  EmptyState,
-  SectionHeader,
-  StatusPill,
-  formatCount,
-  formatIsoDate,
-  formatSlotRemaining,
-  formatUsd,
-  parseLines,
-  statusTone,
-} from "./primitives";
-
-const MODEL_TIERS = Object.keys(CODEX_MODEL_TIERS) as ReadonlyArray<CodexModelTier>;
-const AUTOMODE_MODES: ReadonlyArray<AutomodeMode> = ["manual", "supervised", "autonomous"];
-const GOAL_STATUS_FILTERS: ReadonlyArray<"all" | AutomodeGoalStatus> = [
-  "all",
-  "waiting-approval",
-  "queued",
-  "running",
-  "blocked",
-  "completed",
-  "failed",
-  "rejected",
-];
-const MOTOKO_AUTHORITY_OPTIONS: ReadonlyArray<{
-  value: MotokoAuthority;
-  label: string;
-  description: string;
-}> = [
-  {
-    value: "observe",
-    label: "Observe",
-    description: "Read-only — Motoko cannot send peer messages.",
-  },
-  {
-    value: "respond",
-    label: "Respond",
-    description: "Motoko may reply to open messages, but not start new ones.",
-  },
-  {
-    value: "dispatch",
-    label: "Dispatch",
-    description:
-      "Motoko may send new peer messages. Integrate, merge, and destructive actions stay human-gated.",
-  },
-];
-const SWITCHBOARD_FIELDS: ReadonlyArray<{
-  field: keyof Pick<
-    AutomodePolicyUpdateInput,
-    | "nightlyProposalSweep"
-    | "sweepRequiresConfirmation"
-    | "autoEnqueueApprovedProposals"
-    | "telegramDigestEnabled"
-    | "gitsNotificationsEnabled"
-    | "telegramNotificationsEnabled"
-  >;
-  label: string;
-  description: string;
-}> = [
-  {
-    field: "nightlyProposalSweep",
-    label: "Nightly proposal sweep",
-    description: "Motoko proposes changes nightly from 20:00 London for opted-in repos.",
-  },
-  {
-    field: "sweepRequiresConfirmation",
-    label: "Sweep requires confirmation",
-    description: "Sweep goals wait for your APPROVE before running.",
-  },
-  {
-    field: "autoEnqueueApprovedProposals",
-    label: "Auto-enqueue approved proposals",
-    description:
-      "Approved Motoko proposals join the goal queue automatically (autonomous mode only).",
-  },
-  {
-    field: "gitsNotificationsEnabled",
-    label: "GITS/PWA notifications",
-    description: "Notify this device about proposals and Automode attention states.",
-  },
-  {
-    field: "telegramNotificationsEnabled",
-    label: "Telegram notifications",
-    description: "Send proposal and Automode attention notifications through Telegram.",
-  },
-  {
-    field: "telegramDigestEnabled",
-    label: "Telegram digest",
-    description: "Send the daily Telegram digest/report.",
-  },
-];
-
-function automodeGoalTone(goal: AutomodeGoal): ReturnType<typeof statusTone> {
-  if (goal.status === "running" || goal.status === "completed") {
-    return "success";
-  }
-  if (goal.status === "waiting-approval" || goal.status === "queued") {
-    return "warning";
-  }
-  if (goal.status === "blocked" || goal.status === "failed" || goal.status === "rejected") {
-    return "danger";
-  }
-  return "default";
-}
-
-function formatFilterLabel(value: "all" | AutomodeGoalStatus): string {
-  return value === "all" ? "All" : value.replace(/-/g, " ");
-}
+import { usePrimaryEnvironmentId } from "~/environments/primary";
+import type { GitsEnvironmentClient } from "~/gitsClient";
+import { readGitsEnvironmentClient } from "~/gitsClient";
+import { cn } from "~/lib/utils";
+import { useStore } from "~/store";
 
-function tierLabelShort(tier: CodexModelTier): string {
-  return CODEX_MODEL_TIER_LABELS[tier].split(" —")[0] ?? tier;
-}
+import type { MotokoProposalDecision, MotokoProposalEdits } from "./MotokoPanel";
+import { InboxSection } from "./InboxSection";
+import { ProposalLaunchSheet } from "./ProposalLaunchSheet";
+import { EmptyState, StatusPill, formatCount } from "./primitives";
 
-function repoBasename(repo: string): string {
-  const trimmed = repo.replace(/\/+$/, "");
-  const parts = trimmed.split("/").filter(Boolean);
-  return parts[parts.length - 1] ?? repo;
-}
+const TERMINAL_GOAL_STATUSES = new Set(["completed", "failed", "blocked", "rejected"]);
 
-/** Panel-local client access: `GitsCockpit.tsx` (owned by another agent) doesn't thread
- *  `readGitsClient` down to this panel, so this mirrors the same construction
- *  `useGitsCockpitQueries.ts` uses (primary vs. active-environment resolution) rather than
- *  waiting on a shell change. See `~/gitsClient.ts` for the shared environmentId->client lookup. */
 function useAutopilotGitsClient(): {
   readGitsClient: () => GitsEnvironmentClient;
   targetEnvironmentId: string | null;
@@ -213,63 +54,54 @@ function useAutopilotGitsClient(): {
   return {
     readGitsClient: () => {
       const client = targetEnvironmentId ? readGitsEnvironmentClient(targetEnvironmentId) : null;
-      if (!client) {
-        throw new Error("No connected GITS environment.");
-      }
+      if (!client) throw new Error("No connected GITS environment.");
       return client;
     },
     targetEnvironmentId,
   };
 }
 
-function toastError(title: string, error: unknown) {
-  toastManager.add({
-    title,
-    description: error instanceof Error ? error.message : "Unknown error.",
-    type: "error",
-  });
-}
-
-/** Multi-repo picker: a Combobox chip-list when `projects` is available (the shell doesn't
- *  pass it today — see the `projects` prop below), otherwise the same one-path-per-line
- *  textarea every other repo list field already uses. */
-function RepoMultiSelect({
+function RepositoryPicker({
   value,
   onChange,
   projects,
-  placeholder,
 }: {
-  value: ReadonlyArray<string>;
-  onChange: (next: ReadonlyArray<string>) => void;
-  projects: ReadonlyArray<GitsCockpitProject> | undefined;
-  placeholder: string;
+  readonly value: ReadonlyArray<string>;
+  readonly onChange: (value: ReadonlyArray<string>) => void;
+  readonly projects: ReadonlyArray<GitsCockpitProject> | undefined;
 }) {
   if (!projects || projects.length === 0) {
     return (
       <Textarea
+        aria-label="Watched repositories"
+        className="min-h-20 font-mono text-xs"
+        placeholder="One repository path per line"
         value={value.join("\n")}
-        placeholder={placeholder}
-        className="min-h-20 text-xs"
-        onChange={(event) => onChange(parseLines(event.currentTarget.value))}
+        onChange={(event) =>
+          onChange(
+            event.currentTarget.value
+              .split("\n")
+              .map((entry) => entry.trim())
+              .filter(Boolean),
+          )
+        }
       />
     );
   }
   return (
-    <Combobox<string, true> multiple value={[...value]} onValueChange={(next) => onChange(next)}>
-      <ComboboxChips>
-        {value.map((repo) => (
-          <ComboboxChip key={repo}>
-            <span className="max-w-48 truncate px-1">{repo}</span>
-          </ComboboxChip>
+    <Combobox<string, true> multiple value={[...value]} onValueChange={onChange}>
+      <ComboboxChips aria-label="Watched repositories">
+        {value.map((repository) => (
+          <ComboboxChip key={repository}>{repository}</ComboboxChip>
         ))}
-        <ComboboxChipsInput placeholder={value.length === 0 ? placeholder : undefined} />
+        <ComboboxChipsInput placeholder={value.length === 0 ? "Choose repositories" : undefined} />
       </ComboboxChips>
       <ComboboxPopup>
-        <ComboboxEmpty>No projects found.</ComboboxEmpty>
+        <ComboboxEmpty>No repositories found.</ComboboxEmpty>
         <ComboboxList>
           {projects.map((entry) => (
             <ComboboxItem key={entry.project.id} value={entry.project.rootPath}>
-              <span className="grid min-w-0 gap-0.5">
+              <span className="grid min-w-0">
                 <span className="truncate text-sm">{entry.project.title}</span>
                 <span className="truncate font-mono text-[11px] text-muted-foreground">
                   {entry.project.rootPath}
@@ -283,900 +115,283 @@ function RepoMultiSelect({
   );
 }
 
+function goalTone(goal: AutomodeGoal): "default" | "success" | "warning" | "danger" {
+  if (goal.status === "running") return "success";
+  if (goal.status === "queued" || goal.status === "waiting-approval") return "warning";
+  return "default";
+}
+
 export function AutopilotPanel({
   snapshot,
-  scheduler,
   loading,
   error,
-  actionError,
-  actionPending,
-  killSwitchEnabled,
-  goalTitle,
-  goalRepo,
-  goalModel,
-  goalPrompt,
   projects,
   proposals,
   focusedProposalId,
   onProposalDecision,
   onRefresh,
-  onKillSwitchChange,
-  onGoalTitleChange,
-  onGoalRepoChange,
-  onGoalModelChange,
-  onGoalPromptChange,
-  onEnqueueGoal,
-  onApproveGoal,
-  onRejectGoal,
-  onDispatchGoal,
-  onSchedulerEnabledChange,
-  onSchedulerArm,
-  onSchedulerDisarm,
-  onResumeDriver,
 }: {
-  snapshot: AutomodeSnapshot | undefined;
-  scheduler: GitsSchedulerSnapshot | undefined;
-  loading: boolean;
-  error: unknown;
-  actionError: unknown;
-  actionPending: boolean;
-  killSwitchEnabled: boolean;
-  goalTitle: string;
-  goalRepo: string;
-  goalModel: string;
-  goalPrompt: string;
-  /** Not sent by the shell today (only Motoko/GSD panels get it) — falls back to a
-   *  textarea for repo entry until `GitsCockpit.tsx` is updated to pass it. */
-  projects?: ReadonlyArray<GitsCockpitProject>;
-  proposals: HermesProposalListResult | undefined;
-  focusedProposalId: string | null;
-  onProposalDecision: (
+  readonly snapshot: AutomodeSnapshot | undefined;
+  readonly loading: boolean;
+  readonly error: unknown;
+  readonly projects?: ReadonlyArray<GitsCockpitProject>;
+  readonly proposals: HermesProposalListResult | undefined;
+  readonly focusedProposalId: string | null;
+  readonly onProposalDecision: (
     proposal: HermesProposalCard,
     decision: MotokoProposalDecision,
     edits: MotokoProposalEdits,
-  ) => void;
-  onRefresh: () => void;
-  onKillSwitchChange: (value: boolean) => void;
-  onGoalTitleChange: (value: string) => void;
-  onGoalRepoChange: (value: string) => void;
-  onGoalModelChange: (value: string) => void;
-  onGoalPromptChange: (value: string) => void;
-  onEnqueueGoal: () => void;
-  onApproveGoal: (goalId: string) => void;
-  onRejectGoal: (goalId: string) => void;
-  onDispatchGoal: (goalId: string) => void;
-  onSchedulerEnabledChange: (value: boolean) => void;
-  onSchedulerArm: () => void;
-  onSchedulerDisarm: () => void;
-  onResumeDriver: () => void;
+  ) => Promise<AutomodeGoal | null>;
+  readonly onRefresh: () => void;
 }) {
   const { readGitsClient, targetEnvironmentId } = useAutopilotGitsClient();
+  const policy = snapshot?.policy;
+  const on = policy?.mode === "autonomous" && !policy.killSwitchEnabled;
+  const policyRepositories = policy?.proposalRepos ?? [];
+  const repositoryKey = policyRepositories.join("\n");
+  const [repositories, setRepositories] = useState<ReadonlyArray<string>>(policyRepositories);
+  const [validationError, setValidationError] = useState<string | null>(null);
+  const [stopOpen, setStopOpen] = useState(false);
+  const [selectedProposal, setSelectedProposal] = useState<HermesProposalCard | null>(null);
+  const notificationTest =
+    typeof window === "undefined"
+      ? null
+      : new URLSearchParams(window.location.search).get("notificationTest");
+  const proposalTest = notificationTest === "proposal";
+  const [launchOpen, setLaunchOpen] = useState(proposalTest);
+
+  useEffect(
+    () => setRepositories(repositoryKey.split("\n").filter(Boolean)),
+    [repositoryKey],
+  );
 
-  // ---------------------------------------------------------------------------
-  // Episode ledger ("Overnight results")
-  // ---------------------------------------------------------------------------
-  // ponytail: query key skips connectionState/authState (unlike useGitsCockpitQueries.ts's
-  // siblings) — a reconnect blip can serve one stale poll; the 30s refetch heals it.
-  const episodesQuery = useQuery({
-    queryKey: ["gits", "automode", "episodes", targetEnvironmentId],
-    queryFn: async () => readGitsClient().automode.episodesList({ limit: 25 }),
-    refetchInterval: 30_000,
-  });
-
-  // ---------------------------------------------------------------------------
-  // Emergency stop + per-goal kill
-  // ---------------------------------------------------------------------------
-  const [stopAllDialogOpen, setStopAllDialogOpen] = useState(false);
-  const stopAllMutation = useMutation({
-    mutationFn: async () => readGitsClient().automode.stopAll(),
-    onSuccess: (result) => {
-      setStopAllDialogOpen(false);
-      toastManager.add({
-        title: "Emergency stop",
-        description: `${formatCount(result.stoppedPeers)} peer(s) stopped${
-          result.failures > 0 ? `, ${formatCount(result.failures)} failed` : ""
-        }.`,
-        type: result.failures > 0 ? "error" : "success",
-      });
-      onRefresh();
-    },
-    onError: (cause) => toastError("Emergency stop failed", cause),
-  });
-
-  const [killGoalTarget, setKillGoalTarget] = useState<AutomodeGoal | null>(null);
-  const killGoalMutation = useMutation({
-    mutationFn: async (goalId: string) => readGitsClient().automode.killGoal({ goalId }),
-    onSuccess: () => {
-      setKillGoalTarget(null);
-      onRefresh();
-    },
-    onError: (cause) => toastError("Kill goal failed", cause),
-  });
+  useEffect(() => {
+    if (!focusedProposalId) return;
+    const proposal = proposals?.proposals.find((candidate) => candidate.id === focusedProposalId);
+    if (proposal) {
+      setSelectedProposal(proposal);
+      setLaunchOpen(true);
+    }
+  }, [focusedProposalId, proposals]);
 
-  // ---------------------------------------------------------------------------
-  // Automation switchboard + proposalRepos — immediate commit, optimistic with rollback.
-  // A single pending-patch object covers every field that commits on change instead of
-  // batching into the policy form's Save button.
-  // ---------------------------------------------------------------------------
-  const [pendingPatch, setPendingPatch] = useState<AutomodePolicyUpdateInput>({});
-  const quickPolicyMutation = useMutation({
-    mutationFn: async (patch: AutomodePolicyUpdateInput) =>
-      readGitsClient().automode.updatePolicy(patch),
-    onMutate: async (patch) => {
-      setPendingPatch((current) => ({ ...current, ...patch }));
+  const configure = useMutation({
+    mutationFn: (enabled: boolean) => {
+      if (enabled && repositories.length === 0) {
+        throw new Error("Choose at least one watched repository before turning Autopilot on.");
+      }
+      return readGitsClient().automode.configure({ enabled, repositories: [...repositories] });
     },
     onSuccess: () => {
-      setPendingPatch({});
+      setValidationError(null);
       onRefresh();
     },
-    onError: (cause) => {
-      setPendingPatch({});
-      toastError("Update failed", cause);
-    },
+    onError: (cause) =>
+      setValidationError(
+        cause instanceof Error ? cause.message : "Autopilot could not be updated.",
+      ),
   });
-  const policy = snapshot?.policy;
-  const effectiveProposalRepos = pendingPatch.proposalRepos ?? policy?.proposalRepos ?? [];
-
-  // ---------------------------------------------------------------------------
-  // Policy form — panel-owned dirty-merge state, seeded from `snapshot.policy` (which the
-  // shell already passes) rather than the shell's individually-threaded field props, since
-  // those don't cover the new fields (motokoAuthority, verificationCommands, ...). Fixes the
-  // 2026-07-07 audit's clobber bug (#5) via `nextPolicyFormState`.
-  // ---------------------------------------------------------------------------
-  const [policyForm, setPolicyForm] = useState<AutopilotPolicyForm | null>(null);
-  const [policyDirty, setPolicyDirty] = useState(false);
-  const [policyError, setPolicyError] = useState<string | null>(null);
-
-  useEffect(() => {
-    if (!policy) return;
-    setPolicyForm((current) =>
-      current === null
-        ? policyToFormState(policy)
-        : nextPolicyFormState(current, policy, policyDirty),
-    );
-  }, [policy, policyDirty]);
-
-  const updatePolicyForm = (patch: Partial<AutopilotPolicyForm>) => {
-    setPolicyDirty(true);
-    setPolicyForm((current) => (current ? { ...current, ...patch } : current));
-  };
-  const discardPolicyChanges = () => {
-    setPolicyDirty(false);
-    setPolicyError(null);
-    if (policy) setPolicyForm(policyToFormState(policy));
-  };
-  const policySaveMutation = useMutation({
-    mutationFn: async (input: AutomodePolicyUpdateInput) =>
-      readGitsClient().automode.updatePolicy(input),
-    onSuccess: () => {
-      setPolicyDirty(false);
-      setPolicyError(null);
+  const stopAll = useMutation({
+    mutationFn: () => readGitsClient().automode.stopAll(),
+    onSuccess: (result) => {
+      setStopOpen(false);
+      toastManager.add({
+        title: "Emergency stop complete",
+        description: `${formatCount(result.stoppedPeers)} running peer(s) stopped.`,
+        type: result.failures > 0 ? "error" : "success",
+      });
       onRefresh();
     },
-    onError: (cause) => setPolicyError(cause instanceof Error ? cause.message : "Save failed."),
   });
-  const handleSavePolicy = () => {
-    if (!policyForm) return;
-    const result = formStateToPolicyUpdate(policyForm);
-    if (!result.ok) {
-      setPolicyError(result.error);
-      return;
-    }
-    setPolicyError(null);
-    policySaveMutation.mutate(result.input);
-  };
-
-  // ---------------------------------------------------------------------------
-  // Goal queue
-  // ---------------------------------------------------------------------------
-  const [goalFilter, setGoalFilter] = useState<"all" | AutomodeGoalStatus>("all");
-  const goals = snapshot?.goals ?? [];
-  const filteredGoals = goalFilter === "all" ? goals : goals.filter((g) => g.status === goalFilter);
 
-  const budgetUsage = snapshot?.budgetUsage;
-  const policyBudget = snapshot?.policy.maxBudgetUsd ?? null;
-  const budgetStatus =
-    policyBudget === null
-      ? "No budget cap"
-      : budgetUsage?.totalCostUsd !== null && budgetUsage?.totalCostUsd !== undefined
-        ? `${formatUsd(budgetUsage.totalCostUsd)} / ${formatUsd(policyBudget)}`
-        : `unavailable / ${formatUsd(policyBudget)}`;
-  const tokenStatus =
-    budgetUsage?.totalProcessedTokens !== null && budgetUsage?.totalProcessedTokens !== undefined
-      ? `${formatCount(budgetUsage.totalProcessedTokens)} tokens`
-      : "tokens unavailable";
-  const canEnqueue =
-    goalTitle.trim().length > 0 && goalRepo.trim().length > 0 && goalPrompt.trim().length > 0;
+  const pendingProposals = useMemo(
+    () => proposals?.proposals.filter((proposal) => proposal.status === "proposed") ?? [],
+    [proposals],
+  );
+  const visibleGoals =
+    snapshot?.goals.filter((goal) => !TERMINAL_GOAL_STATUSES.has(goal.status)).slice(0, 5) ?? [];
   const errorMessage =
-    error instanceof Error
-      ? error.message
-      : actionError instanceof Error
-        ? actionError.message
-        : null;
+    validationError ??
+    (error instanceof Error ? error.message : null) ??
+    (stopAll.error instanceof Error ? stopAll.error.message : null);
 
   return (
     <section className="border-b border-border bg-background">
-      <MotokoProposalReview
-        proposals={proposals}
-        proposalId={focusedProposalId}
-        actionPending={actionPending}
-        onDecision={onProposalDecision}
-      />
-      <div className="flex flex-col gap-3 border-b border-border/70 px-4 py-4 sm:flex-row sm:items-start sm:justify-between sm:px-5">
-        <div className="min-w-0">
-          <div className="flex min-w-0 items-center gap-2">
-            <h2 className="truncate text-base font-semibold">Autopilot</h2>
-            <StatusPill label={snapshot?.policy.mode ?? "manual"} tone="default" />
-            <StatusPill
-              label={snapshot?.policy.killSwitchEnabled ? "kill switch" : "armed"}
-              tone={snapshot?.policy.killSwitchEnabled ? "danger" : "success"}
-            />
+      <header className="flex flex-col gap-4 border-b border-border/70 px-4 py-5 sm:flex-row sm:items-center sm:justify-between sm:px-5">
+        <div>
+          <div className="flex items-center gap-2">
+            <h2 className="font-heading text-xl font-semibold">Autopilot</h2>
+            <StatusPill label={on ? "On" : "Paused"} tone={on ? "success" : "warning"} />
           </div>
-          <p className="mt-1 text-xs text-muted-foreground">
-            {formatCount(snapshot?.activePeerCount ?? 0)} active peers |{" "}
-            {formatCount(snapshot?.pendingApprovalCount ?? 0)} approvals | {budgetStatus} |{" "}
-            {tokenStatus}
+          <p className="mt-1 text-sm text-muted-foreground">
+            Review an idea, choose a model, and queue it. Safety gates stay automatic.
           </p>
         </div>
-        <div className="flex shrink-0 flex-wrap gap-2">
+        <div className="flex gap-2">
           <Button size="sm" variant="outline" onClick={onRefresh} disabled={loading}>
             <RefreshCwIcon className={cn("size-3.5", loading && "animate-spin")} />
             Refresh
           </Button>
           <Button
             size="sm"
-            variant="destructive"
-            onClick={() => setStopAllDialogOpen(true)}
-            disabled={stopAllMutation.isPending}
+            variant={on ? "outline" : "default"}
+            disabled={configure.isPending || !policy}
+            onClick={() => configure.mutate(!on)}
           >
-            <OctagonAlertIcon className="size-3.5" />
-            Emergency Stop
+            {on ? "Pause" : "Turn on"}
           </Button>
-          <Button
-            size="sm"
-            variant={killSwitchEnabled ? "outline" : "destructive-outline"}
-            onClick={() => onKillSwitchChange(!killSwitchEnabled)}
-            disabled={actionPending}
-          >
-            <PowerIcon className="size-3.5" />
-            {killSwitchEnabled ? "Arm" : "Kill"}
+          <Button size="sm" variant="destructive" onClick={() => setStopOpen(true)}>
+            <OctagonAlertIcon /> Emergency Stop
           </Button>
         </div>
-      </div>
+      </header>
 
-      <AlertDialog open={stopAllDialogOpen} onOpenChange={setStopAllDialogOpen}>
-        <AlertDialogPopup>
-          <AlertDialogHeader>
-            <AlertDialogTitle>Emergency stop?</AlertDialogTitle>
-            <AlertDialogDescription>
-              Kills every running peer and arms the kill switch.
-            </AlertDialogDescription>
-          </AlertDialogHeader>
-          <AlertDialogFooter>
-            <AlertDialogClose
-              disabled={stopAllMutation.isPending}
-              render={<Button variant="outline" disabled={stopAllMutation.isPending} />}
-            >
-              Cancel
-            </AlertDialogClose>
-            <Button
-              variant="destructive"
-              disabled={stopAllMutation.isPending}
-              onClick={() => stopAllMutation.mutate()}
-            >
-              {stopAllMutation.isPending ? "Stopping…" : "Emergency stop"}
-            </Button>
-          </AlertDialogFooter>
-        </AlertDialogPopup>
-      </AlertDialog>
-
-      {errorMessage ? (
-        <div
-          aria-live="polite"
-          className="border-b border-border/60 px-4 py-2 text-xs text-destructive sm:px-5"
-        >
-          {errorMessage}
+      {notificationTest === "delivery" ? (
+        <div className="border-b border-success/25 bg-success/8 px-4 py-3 text-sm text-success-foreground sm:px-5">
+          Notification click confirmed — Android opened the GITS PWA.
         </div>
       ) : null}
-
-      {snapshot?.driverHalted ? (
-        <div
-          aria-live="polite"
-          className="flex min-w-0 flex-wrap items-center justify-between gap-2 border-b border-border/60 bg-destructive/5 px-4 py-2 text-xs text-destructive sm:px-5"
+      {errorMessage ? (
+        <p
+          role="alert"
+          className="border-b border-destructive/25 bg-destructive/6 px-4 py-3 text-sm text-destructive sm:px-5"
         >
-          <span className="min-w-0">
-            Driver halted{snapshot.driverHaltedReason ? `: ${snapshot.driverHaltedReason}` : "."}
-          </span>
-          <Button size="sm" variant="outline" onClick={onResumeDriver} disabled={actionPending}>
-            <PlayIcon className="size-3.5" />
-            Resume driver
-          </Button>
-        </div>
+          {errorMessage}
+        </p>
       ) : null}
 
-      {snapshot && (snapshot.heldPrUrl !== null || snapshot.runMerged) ? (
-        <div className="flex min-w-0 flex-wrap items-center gap-2 border-b border-border/60 px-4 py-2 text-xs sm:px-5">
-          <span className="font-medium text-muted-foreground">Last run</span>
-          {snapshot.runMerged ? <StatusPill label="run merged" tone="success" /> : null}
-          {snapshot.heldPrUrl ? (
-            <a
-              href={snapshot.heldPrUrl}
-              target="_blank"
-              rel="noreferrer"
-              className="text-primary underline-offset-2 hover:underline"
+      <div className="grid border-b border-border/60 lg:grid-cols-[minmax(0,0.8fr)_minmax(0,1.2fr)]">
+        <section className="grid content-start gap-3 border-b border-border/60 px-4 py-5 sm:px-5 lg:border-r lg:border-b-0">
+          <div>
+            <h3 className="text-sm font-semibold">Watched repositories</h3>
+            <p className="mt-1 text-xs text-muted-foreground">
+              Autopilot proposes and runs work only here.
+            </p>
+          </div>
+          <RepositoryPicker value={repositories} onChange={setRepositories} projects={projects} />
+          {policy && repositories.join("\n") !== repositoryKey ? (
+            <Button
+              size="sm"
+              variant="outline"
+              onClick={() => configure.mutate(Boolean(on))}
+              disabled={configure.isPending}
             >
-              Held PR{snapshot.heldPrNumber !== null ? ` #${snapshot.heldPrNumber}` : ""}
-            </a>
+              Save repositories
+            </Button>
           ) : null}
-        </div>
-      ) : null}
-
-      <InboxSection readGitsClient={readGitsClient} environmentId={targetEnvironmentId} />
-
-      <h3 className="border-b border-border/60 px-4 py-2.5 text-xs font-semibold uppercase text-muted-foreground/80 sm:px-5">
-        Automation switchboard
-      </h3>
-      <div className="grid gap-3 border-b border-border/60 px-4 py-4 sm:grid-cols-2 sm:px-5">
-        {SWITCHBOARD_FIELDS.map(({ field, label, description }) => {
-          const value = Boolean(pendingPatch[field] ?? policy?.[field] ?? false);
-          return (
-            <label key={field} className="flex items-start gap-2.5">
-              <Switch
-                checked={value}
-                onCheckedChange={(checked) => quickPolicyMutation.mutate({ [field]: checked })}
-                disabled={!policy || quickPolicyMutation.isPending}
-                className="mt-0.5"
-              />
-              <span className="min-w-0">
-                <span className="block text-xs font-medium">{label}</span>
-                <span className="block text-[11px] text-muted-foreground">{description}</span>
-              </span>
-            </label>
-          );
-        })}
-      </div>
-
-      <div className="grid min-w-0 grid-cols-1 xl:grid-cols-[minmax(0,0.9fr)_minmax(0,1.1fr)]">
-        <div className="grid min-w-0 gap-4 border-r border-border/60 px-4 py-4 sm:px-5">
-          {scheduler ? (
-            <div className="grid gap-2 rounded-lg border border-border/60 p-3 text-xs">
-              <div className="flex min-w-0 flex-wrap items-center gap-2">
-                <span className="font-medium">Night scheduler</span>
-                <StatusPill
-                  label={scheduler.arming.status === "armed" ? "armed" : "disarmed"}
-                  tone={scheduler.arming.status === "armed" ? "success" : "warning"}
-                />
-                <label className="ml-auto flex items-center gap-2 text-muted-foreground">
-                  Enabled
-                  <Switch
-                    checked={scheduler.config.enabled}
-                    onCheckedChange={onSchedulerEnabledChange}
-                    disabled={actionPending}
-                  />
-                </label>
-              </div>
-              <span className="text-muted-foreground">
-                {scheduler.currentSlot
-                  ? `slot ${scheduler.currentSlot.start}–${scheduler.currentSlot.end}${
-                      scheduler.slotRemainingMs !== null
-                        ? ` (${formatSlotRemaining(scheduler.slotRemainingMs)} left)`
-                        : ""
-                    }`
-                  : "no active slot"}{" "}
-                | {formatCount(scheduler.goalsStartedTonight)} /{" "}
-                {formatCount(scheduler.config.maxGoalsPerNight)} goals tonight
-              </span>
-              {scheduler.lastGateDecision ? (
-                <div className="text-muted-foreground">
-                  Last gate: {formatGateDecision(scheduler.lastGateDecision)} (
-                  {formatIsoDate(scheduler.lastGateDecision.at)})
-                </div>
-              ) : null}
-              {scheduler.arming.status === "disarmed" && scheduler.arming.disarmedReason ? (
-                <div className="text-destructive">{scheduler.arming.disarmedReason}</div>
-              ) : null}
-              <div className="flex gap-2">
-                <Button
-                  size="sm"
-                  variant="outline"
-                  onClick={onSchedulerArm}
-                  disabled={
-                    actionPending ||
-                    !scheduler.config.enabled ||
-                    scheduler.arming.status === "armed"
-                  }
-                >
-                  Arm tonight
-                </Button>
-                <Button
-                  size="sm"
-                  variant="destructive-outline"
-                  onClick={onSchedulerDisarm}
-                  disabled={actionPending || scheduler.arming.status !== "armed"}
-                >
-                  Disarm
-                </Button>
-              </div>
-              <div className="border-t border-border/60 pt-2">
-                <span className="mb-1 block text-muted-foreground">
-                  Proposal repos ({formatCount(effectiveProposalRepos.length)} opted in)
-                </span>
-                <RepoMultiSelect
-                  value={effectiveProposalRepos}
-                  onChange={(repos) => quickPolicyMutation.mutate({ proposalRepos: [...repos] })}
-                  projects={projects}
-                  placeholder="Proposal repos (one path per line)"
-                />
-                {reposNotAllowed(effectiveProposalRepos, policy?.allowedRepos ?? []).length > 0 ? (
-                  <ul className="mt-1 grid gap-0.5 text-destructive">
-                    {reposNotAllowed(effectiveProposalRepos, policy?.allowedRepos ?? []).map(
-                      (repo) => (
-                        <li key={repo} className="truncate font-mono text-[11px]">
-                          {repo} — won&apos;t run — not in allowedRepos
-                        </li>
-                      ),
-                    )}
-                  </ul>
-                ) : null}
-              </div>
+        </section>
+
+        <section className="px-4 py-5 sm:px-5" aria-labelledby="proposal-heading">
+          <div className="flex items-center justify-between gap-3">
+            <div>
+              <h3 id="proposal-heading" className="text-sm font-semibold">
+                Ideas ready to validate
+              </h3>
+              <p className="mt-1 text-xs text-muted-foreground">
+                Accepting adds exactly one Goal to the queue.
+              </p>
             </div>
-          ) : null}
-
-          {policyForm ? (
-            <div className="grid gap-3">
-              <span className="text-xs font-semibold uppercase text-muted-foreground/80">
-                Policy
-              </span>
-              <div className="grid gap-2 sm:grid-cols-2">
-                <Select<AutomodeMode>
-                  value={policyForm.mode}
-                  onValueChange={(value) => value !== null && updatePolicyForm({ mode: value })}
-                >
-                  <SelectTrigger size="sm">
-                    <SelectValue>{policyForm.mode}</SelectValue>
-                  </SelectTrigger>
-                  <SelectPopup>
-                    <SelectGroup>
-                      {AUTOMODE_MODES.map((mode) => (
-                        <SelectItem key={mode} value={mode}>
-                          {mode}
-                        </SelectItem>
-                      ))}
-                    </SelectGroup>
-                  </SelectPopup>
-                </Select>
-                <Input
-                  nativeInput
-                  size="sm"
-                  value={policyForm.maxActivePeers}
-                  placeholder="Max active peers"
-                  onChange={(event) =>
-                    updatePolicyForm({ maxActivePeers: event.currentTarget.value })
-                  }
-                />
-              </div>
-
-              <div>
-                <Select<MotokoAuthority>
-                  value={policyForm.motokoAuthority}
-                  onValueChange={(value) =>
-                    value !== null && updatePolicyForm({ motokoAuthority: value })
-                  }
+            <StatusPill
+              label={formatCount(pendingProposals.length)}
+              tone={pendingProposals.length > 0 ? "warning" : "default"}
+            />
+          </div>
+          {pendingProposals.length === 0 ? (
+            <EmptyState label="No proposals waiting." />
+          ) : (
+            <div className="mt-3 grid gap-2">
+              {pendingProposals.slice(0, 3).map((proposal) => (
+                <article
+                  key={proposal.id}
+                  className="flex items-start gap-3 rounded-xl border border-border/70 p-3"
                 >
-                  <SelectTrigger size="sm" className="w-full">
-                    <SelectValue>{policyForm.motokoAuthority}</SelectValue>
-                  </SelectTrigger>
-                  <SelectPopup className="w-72">
-                    <SelectGroup>
-                      {MOTOKO_AUTHORITY_OPTIONS.map((option) => (
-                        <SelectItem key={option.value} value={option.value} className="py-2">
-                          <span className="grid min-w-0 gap-0.5">
-                            <span className="text-sm">{option.label}</span>
-                            <span className="truncate text-[11px] text-muted-foreground">
-                              {option.description}
-                            </span>
-                          </span>
-                        </SelectItem>
-                      ))}
-                    </SelectGroup>
-                  </SelectPopup>
-                </Select>
-                <p className="mt-1 text-[11px] text-muted-foreground">
-                  {
-                    MOTOKO_AUTHORITY_OPTIONS.find((o) => o.value === policyForm.motokoAuthority)
-                      ?.description
-                  }
-                </p>
-              </div>
-
-              <div className="grid gap-2 sm:grid-cols-2">
-                <div>
-                  <Select<CodexModelTier | "custom">
-                    value={policyForm.defaultModelTier}
-                    onValueChange={(value) =>
-                      value !== null && updatePolicyForm({ defaultModelTier: value })
-                    }
-                  >
-                    <SelectTrigger size="sm" className="w-full">
-                      <SelectValue>
-                        {policyForm.defaultModelTier === "custom"
-                          ? "custom…"
-                          : tierLabelShort(policyForm.defaultModelTier)}
-                      </SelectValue>
-                    </SelectTrigger>
-                    <SelectPopup>
-                      <SelectGroup>
-                        {MODEL_TIERS.map((tier) => (
-                          <SelectItem key={tier} value={tier}>
-                            {CODEX_MODEL_TIER_LABELS[tier]}
-                          </SelectItem>
-                        ))}
-                        <SelectItem value="custom">custom…</SelectItem>
-                      </SelectGroup>
-                    </SelectPopup>
-                  </Select>
-                  {policyForm.defaultModelTier === "custom" ? (
-                    <Input
-                      nativeInput
-                      size="sm"
-                      className="mt-1.5"
-                      value={policyForm.defaultModelCustom}
-                      placeholder="Custom default model slug"
-                      onChange={(event) =>
-                        updatePolicyForm({ defaultModelCustom: event.currentTarget.value })
-                      }
-                    />
-                  ) : null}
-                </div>
-                <div className="grid gap-2 sm:grid-cols-2">
-                  <Input
-                    nativeInput
-                    size="sm"
-                    value={policyForm.maxBudgetUsd}
-                    placeholder="Max budget USD"
-                    onChange={(event) =>
-                      updatePolicyForm({ maxBudgetUsd: event.currentTarget.value })
-                    }
-                  />
-                  <Input
-                    nativeInput
+                  <RocketIcon className="mt-0.5 size-4 shrink-0 text-info-foreground" />
+                  <div className="min-w-0 flex-1">
+                    <p className="text-sm font-medium">{proposal.title}</p>
+                    <p className="mt-1 line-clamp-2 text-xs text-muted-foreground">
+                      {proposal.summary}
+                    </p>
+                  </div>
+                  <Button
                     size="sm"
-                    value={policyForm.maxRuntimeMinutes}
-                    placeholder="Max runtime min"
-                    onChange={(event) =>
-                      updatePolicyForm({ maxRuntimeMinutes: event.currentTarget.value })
-                    }
-                  />
-                </div>
-              </div>
-
-              <div>
-                <span className="mb-1 block text-[11px] text-muted-foreground">Allowed models</span>
-                <div className="flex flex-wrap gap-3">
-                  {MODEL_TIERS.map((tier) => {
-                    const checked = policyForm.allowedModelTiers.includes(tier);
-                    return (
-                      <label key={tier} className="flex items-center gap-1.5 text-xs">
-                        <Checkbox
-                          checked={checked}
-                          onCheckedChange={(next) =>
-                            updatePolicyForm({
-                              allowedModelTiers: next
-                                ? [...policyForm.allowedModelTiers, tier]
-                                : policyForm.allowedModelTiers.filter((t) => t !== tier),
-                            })
-                          }
-                        />
-                        {tierLabelShort(tier)}
-                      </label>
-                    );
-                  })}
-                </div>
-                <Textarea
-                  value={policyForm.allowedModelsExtra}
-                  placeholder="Additional allowed model slugs (one per line)"
-                  className="mt-1.5 min-h-16 text-xs"
-                  onChange={(event) =>
-                    updatePolicyForm({ allowedModelsExtra: event.currentTarget.value })
-                  }
-                />
-              </div>
-
-              <div>
-                <span className="mb-1 block text-[11px] text-muted-foreground">Allowed repos</span>
-                <RepoMultiSelect
-                  value={policyForm.allowedRepos}
-                  onChange={(repos) => updatePolicyForm({ allowedRepos: repos })}
-                  projects={projects}
-                  placeholder="Allowed repos (one path per line)"
-                />
-              </div>
-
-              <div className="grid gap-2 text-xs text-muted-foreground">
-                <label className="flex items-center gap-2">
-                  <Checkbox
-                    checked={policyForm.requireApprovalForPeerSpawn}
-                    onCheckedChange={(checked) =>
-                      updatePolicyForm({ requireApprovalForPeerSpawn: Boolean(checked) })
-                    }
-                  />
-                  Peer spawn approval
-                </label>
-                <label className="flex items-center gap-2">
-                  <Checkbox
-                    checked={policyForm.requireApprovalBeforeIntegrate}
-                    onCheckedChange={(checked) =>
-                      updatePolicyForm({ requireApprovalBeforeIntegrate: Boolean(checked) })
-                    }
-                  />
-                  Integrate approval
-                </label>
-                <label className="flex items-center gap-2">
-                  <Checkbox
-                    checked={policyForm.requireApprovalBeforeDestructiveAction}
-                    onCheckedChange={(checked) =>
-                      updatePolicyForm({ requireApprovalBeforeDestructiveAction: Boolean(checked) })
-                    }
-                  />
-                  Destructive approval
-                </label>
-              </div>
-
-              <Input
-                nativeInput
-                size="sm"
-                value={policyForm.integrationBranch}
-                placeholder="Integration branch"
-                onChange={(event) =>
-                  updatePolicyForm({ integrationBranch: event.currentTarget.value })
-                }
-              />
-
-              <div>
-                <span className="mb-1 block text-[11px] text-muted-foreground">
-                  Verification commands (JSON array of {"{"}label, cmd, timeoutSeconds?{"}"})
-                </span>
-                <Textarea
-                  value={policyForm.verificationCommandsText}
-                  placeholder='[{"label":"test","cmd":["bun","test"]}]'
-                  className="min-h-24 font-mono text-xs"
-                  onChange={(event) =>
-                    updatePolicyForm({ verificationCommandsText: event.currentTarget.value })
-                  }
-                />
-              </div>
-
-              {policyError ? <p className="text-xs text-destructive">{policyError}</p> : null}
-
-              <div className="flex justify-end gap-2">
-                {policyDirty ? (
-                  <Button size="sm" variant="ghost" onClick={discardPolicyChanges}>
-                    Discard changes
+                    variant="outline"
+                    onClick={() => {
+                      setSelectedProposal(proposal);
+                      setLaunchOpen(true);
+                    }}
+                  >
+                    Review
                   </Button>
-                ) : null}
-                <Button
-                  size="sm"
-                  onClick={handleSavePolicy}
-                  disabled={!policyDirty || policySaveMutation.isPending}
-                >
-                  <ShieldCheckIcon className="size-3.5" />
-                  {policySaveMutation.isPending ? "Saving…" : "Save Policy"}
-                </Button>
-              </div>
+                </article>
+              ))}
             </div>
-          ) : (
-            <EmptyState label="Loading policy…" />
           )}
-        </div>
+        </section>
+      </div>
 
-        <div className="min-w-0">
-          <SectionHeader title="Goal queue" count={filteredGoals.length} />
-          <div className="flex flex-wrap gap-1.5 border-b border-border/60 px-4 py-2.5 sm:px-5">
-            {GOAL_STATUS_FILTERS.map((filterValue) => (
-              <Button
-                key={filterValue}
-                size="xs"
-                variant={goalFilter === filterValue ? "default" : "outline"}
-                onClick={() => setGoalFilter(filterValue)}
-              >
-                {formatFilterLabel(filterValue)}
-              </Button>
-            ))}
-          </div>
+      <InboxSection readGitsClient={readGitsClient} environmentId={targetEnvironmentId} />
 
-          <div className="grid gap-2 border-b border-border/60 px-4 py-4 sm:px-5">
-            <div className="grid gap-2 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_minmax(0,0.7fr)]">
-              <Input
-                nativeInput
-                size="sm"
-                value={goalTitle}
-                placeholder="Goal title"
-                onChange={(event) => onGoalTitleChange(event.currentTarget.value)}
-              />
-              <Input
-                nativeInput
-                size="sm"
-                value={goalRepo}
-                placeholder="Repository path"
-                onChange={(event) => onGoalRepoChange(event.currentTarget.value)}
-              />
-              <Input
-                nativeInput
-                size="sm"
-                value={goalModel}
-                placeholder="Model"
-                onChange={(event) => onGoalModelChange(event.currentTarget.value)}
-              />
-            </div>
-            <Textarea
-              value={goalPrompt}
-              placeholder="Goal prompt"
-              className="min-h-20 text-xs"
-              onChange={(event) => onGoalPromptChange(event.currentTarget.value)}
-            />
-            <div className="flex justify-end">
-              <Button
-                size="sm"
-                variant="outline"
-                onClick={onEnqueueGoal}
-                disabled={!canEnqueue || actionPending}
-              >
-                <ListChecksIcon className="size-3.5" />
-                Queue Goal
-              </Button>
-            </div>
+      <section className="px-4 py-5 sm:px-5" aria-labelledby="queue-heading">
+        <div className="flex items-center justify-between gap-2">
+          <div>
+            <h3 id="queue-heading" className="text-sm font-semibold">
+              Queue
+            </h3>
+            <p className="mt-1 text-xs text-muted-foreground">
+              Accepted work waiting or running now.
+            </p>
           </div>
-
-          {filteredGoals.length === 0 ? (
-            <EmptyState
-              label={goals.length === 0 ? "No queued goals." : "No goals match this filter."}
-            />
-          ) : (
-            <div className="divide-y divide-border/60">
-              {filteredGoals.map((goal) => {
-                const tier = modelTierOf(goal.model ?? snapshot?.policy.defaultModel ?? null);
-                return (
-                  <div key={goal.id} className="grid gap-2 px-4 py-3 text-xs sm:px-5">
-                    <div className="flex min-w-0 items-center gap-2">
-                      <span className="truncate font-medium">{goal.title}</span>
-                      <StatusPill label={goal.status} tone={automodeGoalTone(goal)} />
-                      <StatusPill
-                        label={tier ? tierLabelShort(tier) : (goal.model ?? "no model")}
-                        tone="default"
-                      />
-                    </div>
-                    <div className="truncate font-mono text-[11px] text-muted-foreground">
-                      {goal.repo} · {goal.episodeId}
-                    </div>
-                    {goal.blockedReason ? (
-                      <div className="text-[11px] text-destructive">{goal.blockedReason}</div>
-                    ) : null}
-                    <div className="flex flex-wrap justify-end gap-2">
-                      <Button
-                        size="sm"
-                        variant="outline"
-                        onClick={() => onApproveGoal(goal.id)}
-                        disabled={actionPending}
-                      >
-                        Approve
-                      </Button>
-                      <Button
-                        size="sm"
-                        variant="outline"
-                        onClick={() => onDispatchGoal(goal.id)}
-                        disabled={actionPending || goal.status === "rejected"}
-                      >
-                        <PlayIcon className="size-3.5" />
-                        Dispatch
-                      </Button>
-                      <Button
-                        size="sm"
-                        variant="destructive-outline"
-                        onClick={() => onRejectGoal(goal.id)}
-                        disabled={actionPending || goal.status === "rejected"}
-                      >
-                        Reject
-                      </Button>
-                      <Button
-                        size="sm"
-                        variant="destructive"
-                        onClick={() => setKillGoalTarget(goal)}
-                        disabled={killGoalMutation.isPending}
-                      >
-                        <SkullIcon className="size-3.5" />
-                        Kill
-                      </Button>
-                    </div>
-                  </div>
-                );
-              })}
-            </div>
-          )}
+          <StatusPill label={formatCount(visibleGoals.length)} tone="default" />
         </div>
-      </div>
+        {visibleGoals.length === 0 ? (
+          <EmptyState label="The queue is empty." />
+        ) : (
+          <div className="mt-3 divide-y divide-border/60 rounded-xl border border-border/70">
+            {visibleGoals.map((goal) => (
+              <article key={goal.id} className="flex items-center gap-3 px-3 py-2.5">
+                <div className="min-w-0 flex-1">
+                  <p className="truncate text-sm font-medium">{goal.title}</p>
+                  <p className="truncate font-mono text-[11px] text-muted-foreground">
+                    {goal.repo.slice(goal.repo.lastIndexOf("/") + 1) || goal.repo}
+                  </p>
+                </div>
+                <StatusPill label={goal.status} tone={goalTone(goal)} />
+              </article>
+            ))}
+          </div>
+        )}
+      </section>
+
+      {policy ? (
+        <ProposalLaunchSheet
+          open={launchOpen}
+          onOpenChange={setLaunchOpen}
+          proposal={selectedProposal}
+          policy={policy}
+          {...(proposalTest ? { testMode: "proposal" as const } : {})}
+          onDecision={onProposalDecision}
+        />
+      ) : null}
 
-      <AlertDialog
-        open={killGoalTarget !== null}
-        onOpenChange={(open) => {
-          if (!open && !killGoalMutation.isPending) setKillGoalTarget(null);
-        }}
-      >
+      <AlertDialog open={stopOpen} onOpenChange={setStopOpen}>
         <AlertDialogPopup>
           <AlertDialogHeader>
-            <AlertDialogTitle>Kill goal?</AlertDialogTitle>
+            <AlertDialogTitle>Emergency stop?</AlertDialogTitle>
             <AlertDialogDescription>
-              {killGoalTarget ? (
-                <>
-                  This stops <strong>{killGoalTarget.title}</strong> and its peer, if running.
-                </>
-              ) : null}
+              Pause future work and stop every running autonomous peer.
             </AlertDialogDescription>
           </AlertDialogHeader>
           <AlertDialogFooter>
-            <AlertDialogClose
-              disabled={killGoalMutation.isPending}
-              render={<Button variant="outline" disabled={killGoalMutation.isPending} />}
-            >
-              Cancel
-            </AlertDialogClose>
+            <AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>
             <Button
               variant="destructive"
-              disabled={killGoalMutation.isPending || !killGoalTarget}
-              onClick={() => killGoalTarget && killGoalMutation.mutate(killGoalTarget.id)}
+              disabled={stopAll.isPending}
+              onClick={() => stopAll.mutate()}
             >
-              {killGoalMutation.isPending ? "Killing…" : "Kill goal"}
+              {stopAll.isPending ? "Stopping…" : "Emergency stop"}
             </Button>
           </AlertDialogFooter>
         </AlertDialogPopup>
       </AlertDialog>
-
-      <SectionHeader title="Overnight results" count={episodesQuery.data?.length ?? 0} />
-      {episodesQuery.error ? (
-        <div className="px-4 py-3 text-xs text-destructive sm:px-5">
-          {episodesQuery.error instanceof Error
-            ? episodesQuery.error.message
-            : "Failed to load episode history."}
-        </div>
-      ) : !episodesQuery.data || episodesQuery.data.length === 0 ? (
-        <EmptyState
-          label={episodesQuery.isPending ? "Loading…" : "No completed runs yet tonight."}
-        />
-      ) : (
-        <div className="overflow-x-auto">
-          <table className="w-full min-w-[640px] text-left text-xs">
-            <thead>
-              <tr className="border-b border-border/60 text-[11px] uppercase text-muted-foreground/80">
-                <th className="px-4 py-2 font-medium sm:px-5">Created</th>
-                <th className="px-2 py-2 font-medium">Repo</th>
-                <th className="px-2 py-2 font-medium">Goal</th>
-                <th className="px-2 py-2 font-medium">Verdict</th>
-                <th className="px-2 py-2 font-medium">Flagged</th>
-                <th className="px-2 py-2 font-medium">Slice branch</th>
-              </tr>
-            </thead>
-            <tbody className="divide-y divide-border/60">
-              {episodesQuery.data.map((episode: AutomodeEpisode) => (
-                <tr key={episode.id}>
-                  <td className="whitespace-nowrap px-4 py-2 text-muted-foreground sm:px-5">
-                    {formatIsoDate(episode.createdAt)}
-                  </td>
-                  <td className="px-2 py-2 font-mono text-[11px]">{repoBasename(episode.repo)}</td>
-                  <td className="max-w-56 truncate px-2 py-2">{episode.goalTitle}</td>
-                  <td className="px-2 py-2">
-                    <StatusPill label={episode.verdict} tone={verdictTone(episode.verdict)} />
-                  </td>
-                  <td className="px-2 py-2">
-                    {episode.flagged ? <StatusPill label="flagged" tone="danger" /> : null}
-                  </td>
-                  <td className="max-w-56 truncate px-2 py-2 font-mono text-[11px] text-primary">
-                    {episode.sliceBranch ?? "—"}
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        </div>
-      )}
     </section>
   );
 }
diff --git a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
new file mode 100644
index 000000000000..7044399b5a01
--- /dev/null
+++ b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
@@ -0,0 +1,129 @@
+import "../../../index.css";
+
+import type { AutomodeGoal, AutomodePolicy } from "@t3tools/contracts";
+import { page } from "vitest/browser";
+import { describe, expect, it, vi } from "vitest";
+import { render } from "vitest-browser-react";
+
+import { ProposalLaunchSheet } from "./ProposalLaunchSheet";
+import { TEST_PROPOSAL } from "./proposal-launch/proposalLaunch.logic";
+
+const policy = {
+  allowedRepos: ["/srv/example-project"],
+  proposalRepos: ["/srv/example-project"],
+  allowedModels: ["gpt-5.6-terra", "gpt-5.6-sol"],
+  defaultModel: "gpt-5.6-terra",
+  maxRuntimeMinutes: 60,
+  verificationCommands: [],
+  integrationBranch: null,
+} as unknown as AutomodePolicy;
+
+const queuedGoal = {
+  id: "goal-1",
+  episodeId: TEST_PROPOSAL.episodeId,
+  title: TEST_PROPOSAL.title,
+  prompt: TEST_PROPOSAL.nextCommandOrPrompt!,
+  repo: TEST_PROPOSAL.projectDir!,
+  model: TEST_PROPOSAL.model,
+  status: "queued",
+  peerId: null,
+  blockedReason: null,
+  createdAt: "2026-08-09T00:00:00.000Z",
+  updatedAt: "2026-08-09T00:00:00.000Z",
+  approvedAt: "2026-08-09T00:00:00.000Z",
+  rejectedAt: null,
+  workflowId: null,
+  origin: "proposal",
+  branch: null,
+  notBefore: null,
+  maxRuntimeMinutes: 45,
+  verificationCommands: [],
+  integrationBranch: null,
+  planningNotes: null,
+  planningBoundary: null,
+} satisfies AutomodeGoal;
+
+describe("ProposalLaunchSheet", () => {
+  it("guides review, model choice, advanced details, and queue confirmation", async () => {
+    const onDecision = vi.fn().mockResolvedValue(queuedGoal);
+    render(
+      <ProposalLaunchSheet
+        onDecision={onDecision}
+        onOpenChange={() => undefined}
+        open
+        policy={policy}
+        proposal={TEST_PROPOSAL}
+      />,
+    );
+
+    await expect.element(page.getByText("1 of 3")).toBeVisible();
+    await expect.element(page.getByText(TEST_PROPOSAL.summary)).toBeVisible();
+    await expect.element(page.getByText("Notification delivery")).toBeVisible();
+    await page.getByRole("button", { name: "Continue" }).click();
+
+    await expect.element(page.getByText("2 of 3")).toBeVisible();
+    await expect.element(page.getByRole("combobox", { name: "Model" })).toBeVisible();
+    await expect.element(page.getByText("Terra · Balanced")).toBeVisible();
+    await expect.element(page.getByText("Repository override")).not.toBeInTheDocument();
+    await page.getByRole("button", { name: "Advanced details" }).click();
+    await expect.element(page.getByText("Repository override")).toBeVisible();
+    await page.getByRole("button", { name: "Review queue" }).click();
+
+    await expect.element(page.getByText("3 of 3")).toBeVisible();
+    await expect.element(page.getByText("/srv/example-project")).toBeVisible();
+    await page.getByRole("button", { name: "Accept & Queue" }).click();
+    expect(onDecision).toHaveBeenCalledTimes(1);
+    await expect.element(page.getByText("Queued", { exact: true })).toBeVisible();
+    await expect.element(page.getByText(queuedGoal.title)).toBeVisible();
+  });
+
+  it("keeps Later on the existing decision callback", async () => {
+    const onDecision = vi.fn().mockResolvedValue(null);
+    render(
+      <ProposalLaunchSheet
+        onDecision={onDecision}
+        onOpenChange={() => undefined}
+        open
+        policy={policy}
+        proposal={TEST_PROPOSAL}
+      />,
+    );
+    await page.getByRole("button", { name: "Later" }).click();
+    expect(onDecision).toHaveBeenCalledWith(TEST_PROPOSAL, "defer", expect.any(Object));
+  });
+
+  it("keeps Reject on the existing decision callback", async () => {
+    const onDecision = vi.fn().mockResolvedValue(null);
+    render(
+      <ProposalLaunchSheet
+        onDecision={onDecision}
+        onOpenChange={() => undefined}
+        open
+        policy={policy}
+        proposal={TEST_PROPOSAL}
+      />,
+    );
+    await page.getByRole("button", { name: "Reject" }).click();
+    expect(onDecision).toHaveBeenCalledWith(TEST_PROPOSAL, "reject", expect.any(Object));
+  });
+
+  it("completes proposal notification test mode without a decision", async () => {
+    const onDecision = vi.fn();
+    render(
+      <ProposalLaunchSheet
+        onDecision={onDecision}
+        onOpenChange={() => undefined}
+        open
+        policy={policy}
+        proposal={null}
+        testMode="proposal"
+      />,
+    );
+    await expect.element(page.getByText("Test notification")).toBeVisible();
+    await page.getByRole("button", { name: "Continue" }).click();
+    await page.getByRole("button", { name: "Review queue" }).click();
+    await page.getByRole("button", { name: "Complete Test" }).click();
+    expect(onDecision).not.toHaveBeenCalled();
+    await expect.element(page.getByText("Test complete")).toBeVisible();
+  });
+});
diff --git a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
new file mode 100644
index 000000000000..7a6b9e8e1c33
--- /dev/null
+++ b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
@@ -0,0 +1,491 @@
+import type {
+  AutomodeGoal,
+  AutomodePolicy,
+  GitsVerifyCommand,
+  HermesProposalCard,
+} from "@t3tools/contracts";
+import {
+  CheckCircle2Icon,
+  ChevronDownIcon,
+  ChevronUpIcon,
+  PlusIcon,
+  Trash2Icon,
+} from "lucide-react";
+import { useEffect, useMemo, useState } from "react";
+
+import { Badge } from "~/components/ui/badge";
+import { Button } from "~/components/ui/button";
+import { Input } from "~/components/ui/input";
+import {
+  Select,
+  SelectGroup,
+  SelectItem,
+  SelectPopup,
+  SelectTrigger,
+  SelectValue,
+} from "~/components/ui/select";
+import {
+  Sheet,
+  SheetDescription,
+  SheetFooter,
+  SheetHeader,
+  SheetPanel,
+  SheetPopup,
+  SheetTitle,
+} from "~/components/ui/sheet";
+import { cn } from "~/lib/utils";
+
+import type { MotokoProposalDecision, MotokoProposalEdits } from "./MotokoPanel";
+import {
+  TEST_PROPOSAL,
+  initialProposalLaunchForm,
+  launchModelOptions,
+  proposalLaunchEdits,
+  validateProposalLaunchForm,
+  type LaunchStep,
+  type ProposalLaunchForm,
+} from "./proposal-launch/proposalLaunch.logic";
+
+interface ProposalLaunchSheetProps {
+  readonly open: boolean;
+  readonly onOpenChange: (open: boolean) => void;
+  readonly proposal: HermesProposalCard | null;
+  readonly policy: AutomodePolicy;
+  readonly testMode?: "proposal";
+  readonly onDecision: (
+    proposal: HermesProposalCard,
+    decision: MotokoProposalDecision,
+    edits: MotokoProposalEdits,
+  ) => Promise<AutomodeGoal | null>;
+}
+
+const steps: ReadonlyArray<{ readonly id: LaunchStep; readonly label: string }> = [
+  { id: "idea", label: "Idea" },
+  { id: "model", label: "Run" },
+  { id: "review", label: "Queue" },
+];
+
+function StepRail({ current }: { readonly current: LaunchStep }) {
+  const activeIndex = steps.findIndex((step) => step.id === current);
+  return (
+    <div className="grid grid-cols-3 gap-1" aria-label={`Step ${activeIndex + 1} of 3`}>
+      {steps.map((step, index) => (
+        <div key={step.id} className="grid gap-1.5">
+          <div
+            className={cn(
+              "h-1 rounded-full bg-border transition-colors",
+              index <= activeIndex && "bg-info",
+            )}
+          />
+          <div className="flex items-baseline justify-between gap-2 text-[11px]">
+            <span
+              className={
+                index === activeIndex ? "font-medium text-foreground" : "text-muted-foreground"
+              }
+            >
+              {step.label}
+            </span>
+            {index === activeIndex ? (
+              <span className="font-mono text-[10px] text-muted-foreground">{index + 1} of 3</span>
+            ) : null}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function IdeaStep({ proposal }: { readonly proposal: HermesProposalCard }) {
+  return (
+    <div className="grid gap-5">
+      <section className="grid gap-2">
+        <p className="text-xs font-medium tracking-wide text-muted-foreground uppercase">Outcome</p>
+        <h3 className="font-heading text-2xl font-semibold tracking-tight">{proposal.title}</h3>
+        <p className="text-sm leading-6 text-muted-foreground">{proposal.summary}</p>
+      </section>
+      <div className="grid gap-4 rounded-xl border border-border/70 bg-muted/24 p-4">
+        <section className="grid gap-2">
+          <p className="text-xs font-medium text-muted-foreground">What changes</p>
+          <div className="flex flex-wrap gap-1.5">
+            {proposal.scope.map((item) => (
+              <Badge key={item} variant="outline">
+                {item}
+              </Badge>
+            ))}
+          </div>
+        </section>
+        <section className="grid gap-2 border-t border-border/60 pt-4">
+          <p className="text-xs font-medium text-muted-foreground">Why now</p>
+          <ul className="grid gap-1.5 text-sm leading-5">
+            {proposal.evidence.map((item) => (
+              <li key={item}>— {item}</li>
+            ))}
+          </ul>
+        </section>
+      </div>
+      <p className="text-sm leading-6 text-muted-foreground">{proposal.detail}</p>
+    </div>
+  );
+}
+
+function VerificationRows({
+  commands,
+  onChange,
+}: {
+  readonly commands: ReadonlyArray<GitsVerifyCommand>;
+  readonly onChange: (commands: ReadonlyArray<GitsVerifyCommand>) => void;
+}) {
+  const update = (index: number, patch: Partial<GitsVerifyCommand>) =>
+    onChange(commands.map((command, row) => (row === index ? { ...command, ...patch } : command)));
+  return (
+    <div className="grid gap-2">
+      <div className="flex items-center justify-between gap-2">
+        <span className="text-xs font-medium text-muted-foreground">Verification checks</span>
+        <Button
+          size="xs"
+          variant="ghost"
+          onClick={() => onChange([...commands, { label: "Check", cmd: ["bun", "run", "test"] }])}
+        >
+          <PlusIcon /> Add check
+        </Button>
+      </div>
+      {commands.map((command, index) => (
+        <div
+          key={`${command.label}-${index}`}
+          className="grid grid-cols-[minmax(0,1fr)_minmax(0,1.6fr)_auto] gap-2"
+        >
+          <Input
+            aria-label={`Verification ${index + 1} label`}
+            value={command.label}
+            onChange={(event) => update(index, { label: event.currentTarget.value })}
+          />
+          <Input
+            aria-label={`Verification ${index + 1} command`}
+            className="font-mono text-xs"
+            value={command.cmd.join(" ")}
+            onChange={(event) =>
+              update(index, { cmd: event.currentTarget.value.trim().split(/\s+/).filter(Boolean) })
+            }
+          />
+          <Button
+            aria-label={`Remove verification ${index + 1}`}
+            size="icon"
+            variant="ghost"
+            onClick={() => onChange(commands.filter((_, row) => row !== index))}
+          >
+            <Trash2Icon />
+          </Button>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function RunStep({
+  form,
+  policy,
+  advanced,
+  onAdvancedChange,
+  onFormChange,
+}: {
+  readonly form: ProposalLaunchForm;
+  readonly policy: AutomodePolicy;
+  readonly advanced: boolean;
+  readonly onAdvancedChange: (open: boolean) => void;
+  readonly onFormChange: (form: ProposalLaunchForm) => void;
+}) {
+  const modelOptions = launchModelOptions(policy);
+  return (
+    <div className="grid gap-5">
+      <section className="grid gap-2">
+        <label
+          className="text-xs font-medium tracking-wide text-muted-foreground uppercase"
+          htmlFor="proposal-model"
+        >
+          Model
+        </label>
+        <Select
+          items={modelOptions}
+          value={form.model}
+          onValueChange={(value) =>
+            typeof value === "string" && onFormChange({ ...form, model: value })
+          }
+        >
+          <SelectTrigger id="proposal-model" aria-label="Model" size="lg">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectPopup>
+            <SelectGroup>
+              {modelOptions.map((option) => (
+                <SelectItem key={option.value} value={option.value}>
+                  {option.label}
+                </SelectItem>
+              ))}
+            </SelectGroup>
+          </SelectPopup>
+        </Select>
+        <p className="text-xs text-muted-foreground">
+          The recommended model is preselected. Change it only when the idea needs a different
+          depth.
+        </p>
+      </section>
+
+      <div className="border-t border-border/70 pt-3">
+        <Button
+          className="w-full justify-between px-0 hover:bg-transparent"
+          variant="ghost"
+          onClick={() => onAdvancedChange(!advanced)}
+        >
+          Advanced details
+          {advanced ? <ChevronUpIcon /> : <ChevronDownIcon />}
+        </Button>
+        {advanced ? (
+          <div className="mt-3 grid gap-4 rounded-xl border border-border/70 bg-muted/20 p-4">
+            <label className="grid gap-1.5 text-xs font-medium text-muted-foreground">
+              Repository override
+              <Input
+                value={form.repository}
+                onChange={(event) =>
+                  onFormChange({ ...form, repository: event.currentTarget.value })
+                }
+              />
+            </label>
+            <div className="grid grid-cols-2 gap-3">
+              <label className="grid gap-1.5 text-xs font-medium text-muted-foreground">
+                Start after
+                <Input
+                  type="datetime-local"
+                  value={form.notBefore}
+                  onChange={(event) =>
+                    onFormChange({ ...form, notBefore: event.currentTarget.value })
+                  }
+                />
+              </label>
+              <label className="grid gap-1.5 text-xs font-medium text-muted-foreground">
+                Runtime minutes
+                <Input
+                  min="0"
+                  type="number"
+                  value={form.runtime}
+                  onChange={(event) =>
+                    onFormChange({ ...form, runtime: event.currentTarget.value })
+                  }
+                />
+              </label>
+            </div>
+            <VerificationRows
+              commands={form.verificationCommands}
+              onChange={(verificationCommands) => onFormChange({ ...form, verificationCommands })}
+            />
+            <label className="grid gap-1.5 text-xs font-medium text-muted-foreground">
+              Integration branch
+              <Input
+                value={form.integrationBranch}
+                onChange={(event) =>
+                  onFormChange({ ...form, integrationBranch: event.currentTarget.value })
+                }
+              />
+            </label>
+          </div>
+        ) : null}
+      </div>
+    </div>
+  );
+}
+
+function ReviewStep({ form }: { readonly form: ProposalLaunchForm }) {
+  const rows = [
+    ["Model", form.model],
+    ["Repository", form.repository],
+    ["Runtime", form.runtime ? `${form.runtime} minutes` : "Policy default"],
+    ["Start", form.notBefore || "Next eligible slot"],
+  ] as const;
+  return (
+    <div className="grid gap-5">
+      <div className="rounded-xl border border-info/30 bg-info/6 p-4">
+        <p className="font-mono text-[10px] tracking-[0.18em] text-info-foreground uppercase">
+          Queue ready
+        </p>
+        <p className="mt-2 text-sm leading-6">
+          Accepting creates one queued Goal. Autopilot starts it only when policy and schedule gates
+          allow.
+        </p>
+      </div>
+      <dl className="divide-y divide-border/60 rounded-xl border border-border/70">
+        {rows.map(([label, value]) => (
+          <div key={label} className="grid grid-cols-[7rem_minmax(0,1fr)] gap-3 px-4 py-3 text-sm">
+            <dt className="text-muted-foreground">{label}</dt>
+            <dd
+              className={cn("min-w-0 break-words", label === "Repository" && "font-mono text-xs")}
+            >
+              {value}
+            </dd>
+          </div>
+        ))}
+      </dl>
+    </div>
+  );
+}
+
+export function ProposalLaunchSheet({
+  open,
+  onOpenChange,
+  proposal,
+  policy,
+  testMode,
+  onDecision,
+}: ProposalLaunchSheetProps) {
+  const activeProposal = testMode === "proposal" ? TEST_PROPOSAL : proposal;
+  const seed = activeProposal ?? TEST_PROPOSAL;
+  const [step, setStep] = useState<LaunchStep>("idea");
+  const [form, setForm] = useState(() => initialProposalLaunchForm(seed, policy));
+  const [advanced, setAdvanced] = useState(false);
+  const [working, setWorking] = useState(false);
+  const [queued, setQueued] = useState<AutomodeGoal | null>(null);
+  const [testComplete, setTestComplete] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const identity = `${activeProposal?.id ?? "none"}:${testMode ?? "real"}`;
+
+  useEffect(() => {
+    if (!open || activeProposal === null) return;
+    setStep("idea");
+    setForm(initialProposalLaunchForm(activeProposal, policy));
+    setAdvanced(false);
+    setWorking(false);
+    setQueued(null);
+    setTestComplete(false);
+    setError(null);
+  }, [identity, open, activeProposal, policy]);
+
+  const validation = useMemo(() => validateProposalLaunchForm(form), [form]);
+  if (activeProposal === null) return null;
+
+  const decide = async (decision: MotokoProposalDecision) => {
+    if (decision === "approve" && !validation.ok) {
+      setError(validation.message);
+      return;
+    }
+    if (testMode === "proposal") {
+      setTestComplete(true);
+      return;
+    }
+    setWorking(true);
+    setError(null);
+    try {
+      const goal = await onDecision(activeProposal, decision, proposalLaunchEdits(form));
+      if (decision === "approve" && goal === null) {
+        throw new Error("The proposal was approved, but its queued Goal could not be confirmed.");
+      }
+      if (decision === "approve") setQueued(goal);
+      else onOpenChange(false);
+    } catch (cause) {
+      setError(
+        cause instanceof Error ? cause.message : "The proposal could not be updated. Retry.",
+      );
+    } finally {
+      setWorking(false);
+    }
+  };
+
+  const finished = queued !== null || testComplete;
+  return (
+    <Sheet open={open} onOpenChange={onOpenChange}>
+      <SheetPopup side="right" className="max-w-xl">
+        <SheetHeader className="gap-4 border-b border-border/60 pb-4">
+          <div className="flex items-center gap-2 pr-8">
+            <SheetTitle>Validate and queue</SheetTitle>
+            {testMode === "proposal" ? <Badge variant="warning">Test notification</Badge> : null}
+          </div>
+          <SheetDescription>One decision, one model choice, one queued Goal.</SheetDescription>
+          {!finished ? <StepRail current={step} /> : null}
+        </SheetHeader>
+
+        <SheetPanel className="min-h-0 py-6">
+          {queued !== null ? (
+            <div className="grid place-items-center gap-3 py-16 text-center">
+              <div className="grid size-12 place-items-center rounded-full bg-success/12 text-success-foreground">
+                <CheckCircle2Icon />
+              </div>
+              <p className="font-heading text-2xl font-semibold">Queued</p>
+              <p className="max-w-sm text-sm text-muted-foreground">{queued.title}</p>
+              <Badge variant="success">{queued.status}</Badge>
+            </div>
+          ) : testComplete ? (
+            <div className="grid place-items-center gap-3 py-16 text-center">
+              <div className="grid size-12 place-items-center rounded-full bg-success/12 text-success-foreground">
+                <CheckCircle2Icon />
+              </div>
+              <p className="font-heading text-2xl font-semibold">Test complete</p>
+              <p className="max-w-sm text-sm text-muted-foreground">
+                The notification opened the real review experience without creating work.
+              </p>
+            </div>
+          ) : step === "idea" ? (
+            <IdeaStep proposal={activeProposal} />
+          ) : step === "model" ? (
+            <RunStep
+              form={form}
+              policy={policy}
+              advanced={advanced}
+              onAdvancedChange={setAdvanced}
+              onFormChange={setForm}
+            />
+          ) : (
+            <ReviewStep form={form} />
+          )}
+          {error !== null ? (
+            <p
+              role="alert"
+              className="mt-4 rounded-lg border border-destructive/30 bg-destructive/8 px-3 py-2 text-sm text-destructive"
+            >
+              {error}
+            </p>
+          ) : null}
+        </SheetPanel>
+
+        <SheetFooter>
+          {finished ? (
+            <Button onClick={() => onOpenChange(false)}>Done</Button>
+          ) : (
+            <>
+              <div className="flex flex-1 gap-2">
+                <Button disabled={working} variant="ghost" onClick={() => void decide("reject")}>
+                  Reject
+                </Button>
+                <Button disabled={working} variant="ghost" onClick={() => void decide("defer")}>
+                  Later
+                </Button>
+              </div>
+              {step !== "idea" ? (
+                <Button
+                  disabled={working}
+                  variant="outline"
+                  onClick={() => setStep(step === "review" ? "model" : "idea")}
+                >
+                  Back
+                </Button>
+              ) : null}
+              {step === "idea" ? (
+                <Button onClick={() => setStep("model")}>Continue</Button>
+              ) : step === "model" ? (
+                <Button
+                  onClick={() => (validation.ok ? setStep("review") : setError(validation.message))}
+                >
+                  Review queue
+                </Button>
+              ) : (
+                <Button disabled={working} onClick={() => void decide("approve")}>
+                  {testMode === "proposal"
+                    ? "Complete Test"
+                    : working
+                      ? "Queueing…"
+                      : "Accept & Queue"}
+                </Button>
+              )}
+            </>
+          )}
+        </SheetFooter>
+      </SheetPopup>
+    </Sheet>
+  );
+}
diff --git a/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts b/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts
index 6af16d2a1f57..51786d6f2895 100644
--- a/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts
+++ b/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts
@@ -1,182 +1,15 @@
-import type { AutomodePolicy } from "@t3tools/contracts";
 import { describe, expect, it } from "vitest";
 
-import {
-  formStateToPolicyUpdate,
-  formatGateDecision,
-  modelTierOf,
-  nextPolicyFormState,
-  parseVerificationCommands,
-  policyToFormState,
-  reposNotAllowed,
-  stringifyVerificationCommands,
-  verdictTone,
-} from "./autopilot.logic";
+import { formatGateDecision, modelTierOf } from "./autopilot.logic";
 
-const BASE_POLICY: AutomodePolicy = {
-  mode: "manual",
-  killSwitchEnabled: true,
-  maxActivePeers: 2,
-  allowedRepos: ["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/repos/a", "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/repos/b"],
-  allowedModels: ["gpt-5.6-luna", "custom-model"],
-  defaultModel: "gpt-5.6-sol",
-  maxBudgetUsd: 50,
-  maxRuntimeMinutes: 60,
-  requireApprovalForPeerSpawn: true,
-  requireApprovalBeforeIntegrate: true,
-  requireApprovalBeforeDestructiveAction: true,
-  autoEnqueueApprovedProposals: false,
-  nightlyProposalSweep: false,
-  proposalRepos: [],
-  verificationCommands: [{ label: "test", cmd: ["bun", "test"] }],
-  integrationBranch: "gits",
-  motokoAuthority: "observe",
-  telegramDigestEnabled: true,
-  gitsNotificationsEnabled: true,
-  telegramNotificationsEnabled: false,
-  sweepRequiresConfirmation: true,
-  updatedAt: "2026-07-20T00:00:00.000Z",
-};
-
-describe("modelTierOf", () => {
-  it("maps known tier slugs", () => {
+describe("autopilot overview formatting", () => {
+  it("maps known model tiers", () => {
     expect(modelTierOf("gpt-5.6-luna")).toBe("light");
-    expect(modelTierOf("gpt-5.6-terra")).toBe("medium");
-    expect(modelTierOf("gpt-5.6-sol")).toBe("high");
-  });
-
-  it("returns null for a custom or missing model", () => {
     expect(modelTierOf("custom-model")).toBeNull();
-    expect(modelTierOf(null)).toBeNull();
-    expect(modelTierOf(undefined)).toBeNull();
   });
-});
-
-describe("policyToFormState", () => {
-  it("splits allowedModels into recognized tiers and free-text extras", () => {
-    const form = policyToFormState(BASE_POLICY);
-    expect(form.allowedModelTiers).toEqual(["light"]);
-    expect(form.allowedModelsExtra).toBe("custom-model");
-  });
-
-  it("marks a tier-matching defaultModel and leaves the custom field empty", () => {
-    const form = policyToFormState(BASE_POLICY);
-    expect(form.defaultModelTier).toBe("high");
-    expect(form.defaultModelCustom).toBe("");
-  });
-
-  it("falls back to custom for a non-tier defaultModel", () => {
-    const form = policyToFormState({ ...BASE_POLICY, defaultModel: "gpt-5.9-experimental" });
-    expect(form.defaultModelTier).toBe("custom");
-    expect(form.defaultModelCustom).toBe("gpt-5.9-experimental");
-  });
-
-  it("round-trips verificationCommands through JSON text", () => {
-    const form = policyToFormState(BASE_POLICY);
-    expect(JSON.parse(form.verificationCommandsText)).toEqual(BASE_POLICY.verificationCommands);
-  });
-});
 
-describe("nextPolicyFormState", () => {
-  it("reseeds from the incoming policy when the form is pristine", () => {
-    const stale = policyToFormState({ ...BASE_POLICY, maxActivePeers: 1 });
-    const next = nextPolicyFormState(stale, BASE_POLICY, false);
-    expect(next.maxActivePeers).toBe("2");
-  });
-
-  it("ignores the incoming policy while the form is dirty (the clobber-bug fix)", () => {
-    const edited = { ...policyToFormState(BASE_POLICY), maxActivePeers: "9" };
-    const next = nextPolicyFormState(edited, BASE_POLICY, true);
-    expect(next).toBe(edited);
-    expect(next.maxActivePeers).toBe("9");
-  });
-});
-
-describe("formStateToPolicyUpdate", () => {
-  it("builds a full update input from a valid form", () => {
-    const form = policyToFormState(BASE_POLICY);
-    const result = formStateToPolicyUpdate(form);
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.input.maxActivePeers).toBe(2);
-    expect(result.input.defaultModel).toBe("gpt-5.6-sol");
-    expect(result.input.allowedModels).toEqual(["gpt-5.6-luna", "custom-model"]);
-    expect(result.input.verificationCommands).toEqual(BASE_POLICY.verificationCommands);
-  });
-
-  it("rejects invalid JSON in the verification commands field", () => {
-    const form = { ...policyToFormState(BASE_POLICY), verificationCommandsText: "{not json" };
-    const result = formStateToPolicyUpdate(form);
-    expect(result.ok).toBe(false);
-  });
-
-  it("rejects a non-numeric budget", () => {
-    const form = { ...policyToFormState(BASE_POLICY), maxBudgetUsd: "lots" };
-    const result = formStateToPolicyUpdate(form);
-    expect(result.ok).toBe(false);
-  });
-
-  it("treats an empty budget as uncapped (null)", () => {
-    const form = { ...policyToFormState(BASE_POLICY), maxBudgetUsd: "" };
-    const result = formStateToPolicyUpdate(form);
-    expect(result.ok).toBe(true);
-    if (result.ok) expect(result.input.maxBudgetUsd).toBeNull();
-  });
-});
-
-describe("parseVerificationCommands / stringifyVerificationCommands", () => {
-  it("round-trips a command list", () => {
-    const text = stringifyVerificationCommands(BASE_POLICY.verificationCommands);
-    const parsed = parseVerificationCommands(text);
-    expect(parsed).toEqual({ ok: true, commands: BASE_POLICY.verificationCommands });
-  });
-
-  it("accepts empty text as an empty list", () => {
-    expect(parseVerificationCommands("  ")).toEqual({ ok: true, commands: [] });
-  });
-
-  it("rejects a command missing cmd", () => {
-    const result = parseVerificationCommands(JSON.stringify([{ label: "x" }]));
-    expect(result.ok).toBe(false);
-  });
-});
-
-describe("reposNotAllowed", () => {
-  it("flags repos outside the allowlist", () => {
-    expect(reposNotAllowed(["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/repos/a", "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/repos/c"], ["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/repos/a", "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/repos/b"])).toEqual([
-      "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/repos/c",
-    ]);
-  });
-
-  it("allows exact matches and path-prefixed matches", () => {
-    expect(reposNotAllowed(["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/repos/a", "/repos/b/sub"], ["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/repos/a", "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/repos/b"])).toEqual([]);
-  });
-
-  it("flags nothing when allowedRepos is empty (server treats empty as allow-all)", () => {
-    expect(reposNotAllowed(["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/repos/a", "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/repos/c"], [])).toEqual([]);
-  });
-});
-
-describe("verdictTone", () => {
-  it("maps verifier verdicts to status tones", () => {
-    expect(verdictTone("pass")).toBe("success");
-    expect(verdictTone("fail")).toBe("danger");
-    expect(verdictTone("uncertain")).toBe("warning");
-  });
-});
-
-describe("formatGateDecision", () => {
-  it("returns null when there is no decision yet", () => {
+  it("formats scheduler gate decisions", () => {
     expect(formatGateDecision(null)).toBeNull();
-  });
-
-  it("formats an allowed decision without a reason", () => {
-    expect(
-      formatGateDecision({ at: "2026-07-20T00:00:00.000Z", allowed: true, reason: null }),
-    ).toBe("allowed");
-  });
-
-  it("formats a denied decision with its reason", () => {
     expect(
       formatGateDecision({
         at: "2026-07-20T00:00:00.000Z",
diff --git a/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.ts b/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.ts
index 5f62b79b5d6f..05ea7c51ce0c 100644
--- a/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.ts
+++ b/apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.ts
@@ -1,216 +1,17 @@
-/** Pure Autopilot panel logic: policy-form dirty-merge, model-tier display, gate-reason
- *  formatting, and the repo-allowlist warning check. No DOM, no React, no network. */
-
 import {
   CODEX_MODEL_TIERS,
-  type AutomodeMode,
-  type AutomodePolicy,
-  type AutomodePolicyUpdateInput,
   type CodexModelTier,
   type GitsSchedulerGateDecision,
-  type GitsVerifierVerdict,
-  type GitsVerifyCommand,
-  type MotokoAuthority,
 } from "@t3tools/contracts";
 
-import { parseLines } from "../primitives";
-
-const MODEL_TIER_KEYS = Object.keys(CODEX_MODEL_TIERS) as ReadonlyArray<CodexModelTier>;
-
-/** Editable policy-form state — one field per `AutomodePolicy` input, plus the
- *  tier/free-text split for `defaultModel` and `allowedModels`. Numeric fields stay
- *  strings so the input can hold transient invalid text while the operator types. */
-export interface AutopilotPolicyForm {
-  readonly mode: AutomodeMode;
-  readonly motokoAuthority: MotokoAuthority;
-  readonly maxActivePeers: string;
-  readonly defaultModelTier: CodexModelTier | "custom";
-  readonly defaultModelCustom: string;
-  readonly allowedModelTiers: ReadonlyArray<CodexModelTier>;
-  readonly allowedModelsExtra: string;
-  readonly allowedRepos: ReadonlyArray<string>;
-  readonly maxBudgetUsd: string;
-  readonly maxRuntimeMinutes: string;
-  readonly requireApprovalForPeerSpawn: boolean;
-  readonly requireApprovalBeforeIntegrate: boolean;
-  readonly requireApprovalBeforeDestructiveAction: boolean;
-  readonly integrationBranch: string;
-  readonly verificationCommandsText: string;
-}
-
-/** Which fixed tier (if any) a model slug belongs to; `null` for a custom/unrecognized slug. */
 export function modelTierOf(model: string | null | undefined): CodexModelTier | null {
   if (!model) return null;
   const match = (Object.entries(CODEX_MODEL_TIERS) as Array<[CodexModelTier, string]>).find(
     ([, slug]) => slug === model,
   );
-  return match ? match[0] : null;
-}
-
-export function stringifyVerificationCommands(commands: ReadonlyArray<GitsVerifyCommand>): string {
-  return commands.length === 0 ? "" : JSON.stringify(commands, null, 2);
-}
-
-export type ParsedVerificationCommands =
-  | { readonly ok: true; readonly commands: ReadonlyArray<GitsVerifyCommand> }
-  | { readonly ok: false; readonly error: string };
-
-/** Verification commands are JSON-edited (argv arrays, not shell strings) — there is no
- *  existing structured-form UX to match, so this keeps the same "raw text, parse on save"
- *  shape as the other list fields (allowedRepos/allowedModels) instead of inventing one. */
-export function parseVerificationCommands(text: string): ParsedVerificationCommands {
-  const trimmed = text.trim();
-  if (trimmed.length === 0) {
-    return { ok: true, commands: [] };
-  }
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return { ok: false, error: "Verification commands must be valid JSON." };
-  }
-  if (!Array.isArray(parsed)) {
-    return { ok: false, error: "Verification commands must be a JSON array." };
-  }
-  for (const entry of parsed) {
-    const label = (entry as { label?: unknown } | null)?.label;
-    const cmd = (entry as { cmd?: unknown } | null)?.cmd;
-    if (
-      typeof entry !== "object" ||
-      entry === null ||
-      typeof label !== "string" ||
-      !Array.isArray(cmd) ||
-      !cmd.every((part) => typeof part === "string")
-    ) {
-      return {
-        ok: false,
-        error: 'Each verification command needs a "label" string and a "cmd" array of strings.',
-      };
-    }
-  }
-  return { ok: true, commands: parsed as ReadonlyArray<GitsVerifyCommand> };
-}
-
-export function policyToFormState(policy: AutomodePolicy): AutopilotPolicyForm {
-  const defaultTier = modelTierOf(policy.defaultModel);
-  const allowedModelTiers = MODEL_TIER_KEYS.filter((tier) =>
-    policy.allowedModels.includes(CODEX_MODEL_TIERS[tier]),
-  );
-  const allowedModelsExtra = policy.allowedModels
-    .filter((model) => modelTierOf(model) === null)
-    .join("\n");
-  return {
-    mode: policy.mode,
-    motokoAuthority: policy.motokoAuthority,
-    maxActivePeers: String(policy.maxActivePeers),
-    defaultModelTier: defaultTier ?? (policy.defaultModel ? "custom" : "high"),
-    defaultModelCustom: defaultTier ? "" : (policy.defaultModel ?? ""),
-    allowedModelTiers,
-    allowedModelsExtra,
-    allowedRepos: policy.allowedRepos,
-    maxBudgetUsd: policy.maxBudgetUsd === null ? "" : String(policy.maxBudgetUsd),
-    maxRuntimeMinutes: policy.maxRuntimeMinutes === null ? "" : String(policy.maxRuntimeMinutes),
-    requireApprovalForPeerSpawn: policy.requireApprovalForPeerSpawn,
-    requireApprovalBeforeIntegrate: policy.requireApprovalBeforeIntegrate,
-    requireApprovalBeforeDestructiveAction: policy.requireApprovalBeforeDestructiveAction,
-    integrationBranch: policy.integrationBranch ?? "",
-    verificationCommandsText: stringifyVerificationCommands(policy.verificationCommands),
-  };
-}
-
-/** The clobber-bug fix (2026-07-07 audit finding #5), as a pure decision: while the
- *  operator has unsaved edits, ignore the poll; only reseed the form once it is pristine. */
-export function nextPolicyFormState(
-  current: AutopilotPolicyForm,
-  policy: AutomodePolicy,
-  dirty: boolean,
-): AutopilotPolicyForm {
-  return dirty ? current : policyToFormState(policy);
-}
-
-export type PolicyFormResult =
-  | { readonly ok: true; readonly input: AutomodePolicyUpdateInput }
-  | { readonly ok: false; readonly error: string };
-
-export function formStateToPolicyUpdate(form: AutopilotPolicyForm): PolicyFormResult {
-  const maxActivePeers = Math.max(0, Math.floor(Number(form.maxActivePeers)));
-  if (!Number.isFinite(maxActivePeers)) {
-    return { ok: false, error: "Max active peers must be a number." };
-  }
-  const maxBudgetUsd = form.maxBudgetUsd.trim().length === 0 ? null : Number(form.maxBudgetUsd);
-  if (maxBudgetUsd !== null && (!Number.isFinite(maxBudgetUsd) || maxBudgetUsd < 0)) {
-    return { ok: false, error: "Max budget must be a non-negative number." };
-  }
-  const maxRuntimeMinutes =
-    form.maxRuntimeMinutes.trim().length === 0
-      ? null
-      : Math.max(0, Math.floor(Number(form.maxRuntimeMinutes)));
-  if (maxRuntimeMinutes !== null && !Number.isFinite(maxRuntimeMinutes)) {
-    return { ok: false, error: "Max runtime must be a number." };
-  }
-  const verification = parseVerificationCommands(form.verificationCommandsText);
-  if (!verification.ok) {
-    return { ok: false, error: verification.error };
-  }
-  const defaultModel =
-    form.defaultModelTier === "custom"
-      ? form.defaultModelCustom.trim().length > 0
-        ? form.defaultModelCustom.trim()
-        : null
-      : CODEX_MODEL_TIERS[form.defaultModelTier];
-  const allowedModels = [
-    ...form.allowedModelTiers.map((tier) => CODEX_MODEL_TIERS[tier]),
-    ...parseLines(form.allowedModelsExtra),
-  ];
-  return {
-    ok: true,
-    input: {
-      mode: form.mode,
-      motokoAuthority: form.motokoAuthority,
-      maxActivePeers,
-      defaultModel,
-      allowedModels,
-      allowedRepos: form.allowedRepos.filter((repo) => repo.trim().length > 0),
-      maxBudgetUsd,
-      maxRuntimeMinutes,
-      requireApprovalForPeerSpawn: form.requireApprovalForPeerSpawn,
-      requireApprovalBeforeIntegrate: form.requireApprovalBeforeIntegrate,
-      requireApprovalBeforeDestructiveAction: form.requireApprovalBeforeDestructiveAction,
-      integrationBranch:
-        form.integrationBranch.trim().length > 0 ? form.integrationBranch.trim() : null,
-      verificationCommands: verification.commands as GitsVerifyCommand[],
-    },
-  };
-}
-
-/** Repos selected but missing from `allowedRepos` — the "won't run" diagnostic for the
- *  nightly-sweep repo picker. An empty `allowedRepos` means allow-all on the server
- *  (`AutomodeSupervisor.ts:201-204`, audit finding #9), so nothing is flagged in that case —
- *  the previous cockpit panel got this backwards and flagged every repo. */
-export function reposNotAllowed(
-  selected: ReadonlyArray<string>,
-  allowedRepos: ReadonlyArray<string>,
-): ReadonlyArray<string> {
-  if (allowedRepos.length === 0) {
-    return [];
-  }
-  return selected.filter(
-    (repo) =>
-      !allowedRepos.some(
-        (allowed) =>
-          repo === allowed || repo.startsWith(allowed.endsWith("/") ? allowed : `${allowed}/`),
-      ),
-  );
-}
-
-export function verdictTone(verdict: GitsVerifierVerdict): "success" | "warning" | "danger" {
-  if (verdict === "pass") return "success";
-  if (verdict === "fail") return "danger";
-  return "warning";
+  return match?.[0] ?? null;
 }
 
-/** "allowed" / "denied — reason" — the scheduler's last gate decision, minus the timestamp
- *  (the caller formats that with `formatIsoDate` so this stays deterministic to test). */
 export function formatGateDecision(decision: GitsSchedulerGateDecision | null): string | null {
   if (!decision) return null;
   const verdict = decision.allowed ? "allowed" : "denied";

From 4c7b5ae832e67ed271fc0814f043c7f93c909759 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 23:04:54 +0100
Subject: [PATCH 09/13] feat: add Android PWA notification diagnostics

---
 .../settings/SettingsPanels.browser.tsx       |   3 +
 .../components/settings/SettingsPanels.tsx    | 111 +++++++++++++++++-
 apps/web/src/lib/notificationTarget.test.ts   |  14 +++
 apps/web/src/lib/notificationTarget.ts        |   4 +
 apps/web/src/lib/webPush.test.ts              |  92 +++++++++++++++
 apps/web/src/lib/webPush.ts                   |  81 ++++++++++++-
 apps/web/src/service-worker.ts                |   7 +-
 7 files changed, 306 insertions(+), 6 deletions(-)
 create mode 100644 apps/web/src/lib/notificationTarget.test.ts
 create mode 100644 apps/web/src/lib/notificationTarget.ts
 create mode 100644 apps/web/src/lib/webPush.test.ts

diff --git a/apps/web/src/components/settings/SettingsPanels.browser.tsx b/apps/web/src/components/settings/SettingsPanels.browser.tsx
index a04184d609d3..0faae9033965 100644
--- a/apps/web/src/components/settings/SettingsPanels.browser.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.browser.tsx
@@ -753,6 +753,9 @@ describe("GeneralSettingsPanel observability", () => {
       .element(page.getByRole("heading", { name: "Diagnostics", exact: true }))
       .toBeInTheDocument();
     await expect.element(page.getByRole("link", { name: "View diagnostics" })).toBeInTheDocument();
+    await expect.element(page.getByLabelText("Push notification diagnostics")).toBeVisible();
+    await expect.element(page.getByRole("button", { name: "Send delivery test" })).toBeDisabled();
+    await expect.element(page.getByRole("button", { name: "Send proposal test" })).toBeDisabled();
     await expect
       .element(
         page.getByText(
diff --git a/apps/web/src/components/settings/SettingsPanels.tsx b/apps/web/src/components/settings/SettingsPanels.tsx
index be73b6e84ac7..0bb0cbda612e 100644
--- a/apps/web/src/components/settings/SettingsPanels.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.tsx
@@ -36,6 +36,7 @@ import { TraitsPicker } from "../chat/TraitsPicker";
 import { isElectron } from "../../env";
 import { buildHostedChannelSelectionUrl, type HostedAppChannel } from "../../hostedPairing";
 import { useTheme } from "../../hooks/useTheme";
+import { cn } from "../../lib/utils";
 import {
   DEFAULT_GITS_CHAT_PREFS,
   useGitsChatPrefs,
@@ -44,7 +45,12 @@ import {
 } from "../../hooks/useGitsChatPrefs";
 import { useSettings, useUpdateSettings } from "../../hooks/useSettings";
 import { useThreadActions } from "../../hooks/useThreadActions";
-import { canUseWebPush } from "../../lib/webPush";
+import {
+  canUseWebPush,
+  readWebPushDiagnostics,
+  sendWebPushTest,
+  type WebPushDiagnostics,
+} from "../../lib/webPush";
 import {
   setDesktopUpdateStateQueryData,
   useDesktopUpdateState,
@@ -537,6 +543,107 @@ export function useSettingsRestore(onRestored?: () => void) {
   };
 }
 
+function PushNotificationDiagnostics() {
+  const [diagnostics, setDiagnostics] = useState<WebPushDiagnostics | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [sending, setSending] = useState<"delivery" | "proposal" | null>(null);
+  const [result, setResult] = useState<string | null>(null);
+
+  const refresh = useCallback(async () => {
+    setLoading(true);
+    try {
+      setDiagnostics(await readWebPushDiagnostics());
+    } catch (cause) {
+      setResult(cause instanceof Error ? cause.message : "Push diagnostics failed.");
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  const send = async (kind: "delivery" | "proposal") => {
+    setSending(kind);
+    setResult(null);
+    try {
+      await sendWebPushTest(kind);
+      setResult("Sent — tap the notification to confirm Android delivery.");
+    } catch (cause) {
+      setResult(
+        cause instanceof Error ? cause.message : "The test notification could not be sent.",
+      );
+    } finally {
+      setSending(null);
+    }
+  };
+
+  const rows = [
+    ["Secure PWA", diagnostics?.secureContext === true],
+    ["Browser push", diagnostics?.supported === true],
+    ["Permission", diagnostics?.permission === "granted"],
+    ["Server keys", diagnostics?.serverConfigured === true],
+    ["This device", diagnostics?.subscription !== null && diagnostics?.subscription !== undefined],
+  ] as const;
+  return (
+    <div
+      className="border-b border-border/50 px-4 py-4 sm:px-6"
+      aria-label="Push notification diagnostics"
+    >
+      <div className="flex flex-wrap items-start justify-between gap-3">
+        <div>
+          <p className="text-sm font-medium">Android notification test</p>
+          <p className="mt-1 text-xs text-muted-foreground">
+            Tests this installed PWA and its existing device subscription.
+          </p>
+        </div>
+        <Button size="xs" variant="ghost" disabled={loading} onClick={() => void refresh()}>
+          <RefreshCwIcon className={cn("size-3.5", loading && "animate-spin")} /> Refresh
+        </Button>
+      </div>
+      <dl className="mt-3 grid gap-1.5 sm:grid-cols-5">
+        {rows.map(([label, ready]) => (
+          <div key={label} className="rounded-lg border border-border/60 px-2.5 py-2">
+            <dt className="text-[10px] tracking-wide text-muted-foreground uppercase">{label}</dt>
+            <dd
+              className={cn(
+                "mt-1 text-xs font-medium",
+                ready ? "text-success-foreground" : "text-muted-foreground",
+              )}
+            >
+              {loading ? "Checking…" : ready ? "Ready" : "Not ready"}
+            </dd>
+          </div>
+        ))}
+      </dl>
+      <div className="mt-3 flex flex-wrap items-center gap-2">
+        <Button
+          size="sm"
+          variant="outline"
+          disabled={!diagnostics?.ready || sending !== null}
+          onClick={() => void send("delivery")}
+        >
+          {sending === "delivery" ? "Sending…" : "Send delivery test"}
+        </Button>
+        <Button
+          size="sm"
+          variant="outline"
+          disabled={!diagnostics?.ready || sending !== null}
+          onClick={() => void send("proposal")}
+        >
+          {sending === "proposal" ? "Sending…" : "Send proposal test"}
+        </Button>
+        {result ? (
+          <p role="status" className="text-xs text-muted-foreground">
+            {result}
+          </p>
+        ) : null}
+      </div>
+    </div>
+  );
+}
+
 export function GeneralSettingsPanel() {
   const { theme, setTheme } = useTheme();
   const { prefs: gitsChatPrefs, setPref: setGitsChatPref } = useGitsChatPrefs();
@@ -888,6 +995,8 @@ export function GeneralSettingsPanel() {
           }
         />
 
+        <PushNotificationDiagnostics />
+
         <SettingsRow
           title="Diff line wrapping"
           description="Set the default wrap state when the diff panel opens."
diff --git a/apps/web/src/lib/notificationTarget.test.ts b/apps/web/src/lib/notificationTarget.test.ts
new file mode 100644
index 000000000000..3e9a1d51498a
--- /dev/null
+++ b/apps/web/src/lib/notificationTarget.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+
+import { notificationTargetUrl } from "./notificationTarget";
+
+describe("notificationTargetUrl", () => {
+  it("keeps same-origin deep links and rejects external targets", () => {
+    expect(notificationTargetUrl("/gits?notificationTest=proposal", "https://gits.example")).toBe(
+      "https://gits.example/gits?notificationTest=proposal",
+    );
+    expect(notificationTargetUrl("https://evil.example/", "https://gits.example")).toBe(
+      "https://gits.example/",
+    );
+  });
+});
diff --git a/apps/web/src/lib/notificationTarget.ts b/apps/web/src/lib/notificationTarget.ts
new file mode 100644
index 000000000000..64dd021f5661
--- /dev/null
+++ b/apps/web/src/lib/notificationTarget.ts
@@ -0,0 +1,4 @@
+export function notificationTargetUrl(value: unknown, origin: string): string {
+  const target = new URL(typeof value === "string" ? value : "/", origin);
+  return target.origin === origin ? target.toString() : new URL("/", origin).toString();
+}
diff --git a/apps/web/src/lib/webPush.test.ts b/apps/web/src/lib/webPush.test.ts
new file mode 100644
index 000000000000..cb69a5f6356a
--- /dev/null
+++ b/apps/web/src/lib/webPush.test.ts
@@ -0,0 +1,92 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { readWebPushDiagnostics, sendWebPushTest } from "./webPush";
+
+const endpoint = "https://push.example/device";
+const PushManagerStub = function PushManager() {};
+const subscription = {
+  endpoint,
+  toJSON: () => ({
+    endpoint,
+    expirationTime: null,
+    keys: { p256dh: "p256dh", auth: "auth" },
+  }),
+};
+
+function installBrowser({
+  permission = "granted",
+  currentSubscription = subscription,
+  secure = true,
+}: {
+  permission?: NotificationPermission;
+  currentSubscription?: typeof subscription | null;
+  secure?: boolean;
+} = {}) {
+  vi.stubGlobal("window", {
+    isSecureContext: secure,
+    PushManager: PushManagerStub,
+    Notification: {},
+  });
+  vi.stubGlobal("Notification", { permission });
+  vi.stubGlobal("navigator", {
+    serviceWorker: {
+      ready: Promise.resolve({
+        pushManager: { getSubscription: vi.fn().mockResolvedValue(currentSubscription) },
+      }),
+    },
+  });
+}
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("web push diagnostics", () => {
+  it("distinguishes unsupported, denied, missing subscription, and ready", async () => {
+    vi.stubGlobal("window", { isSecureContext: false });
+    vi.stubGlobal("navigator", {});
+    expect((await readWebPushDiagnostics()).status).toBe("unsupported");
+
+    installBrowser({ permission: "denied" });
+    expect((await readWebPushDiagnostics()).status).toBe("permission-denied");
+
+    installBrowser({ currentSubscription: null });
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValue({ ok: true, json: async () => ({ enabled: true, publicKey: "key" }) }),
+    );
+    expect((await readWebPushDiagnostics()).status).toBe("subscription-missing");
+
+    installBrowser();
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValue({ ok: true, json: async () => ({ enabled: true, publicKey: "key" }) }),
+    );
+    expect(await readWebPushDiagnostics()).toMatchObject({ status: "ready", ready: true });
+  });
+
+  it("sends only the current normalized endpoint and fixed kind", async () => {
+    installBrowser();
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({ ok: true, json: async () => ({ enabled: true, publicKey: "key" }) })
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ accepted: true, url: "/gits?notificationTest=proposal" }),
+      });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await sendWebPushTest("proposal");
+
+    expect(fetchMock).toHaveBeenLastCalledWith(
+      "/api/push/test",
+      expect.objectContaining({
+        method: "POST",
+        credentials: "include",
+        body: JSON.stringify({ endpoint, kind: "proposal" }),
+      }),
+    );
+  });
+});
diff --git a/apps/web/src/lib/webPush.ts b/apps/web/src/lib/webPush.ts
index 988ec96bf097..16efbbfb91c5 100644
--- a/apps/web/src/lib/webPush.ts
+++ b/apps/web/src/lib/webPush.ts
@@ -2,6 +2,8 @@ import type {
   WebPushPublicConfig,
   WebPushRegisterInput,
   WebPushSubscription,
+  WebPushTestKind,
+  WebPushTestResult,
   WebPushUnregisterInput,
 } from "@t3tools/contracts";
 
@@ -18,7 +20,7 @@ function urlBase64ToArrayBuffer(base64String: string): ArrayBuffer {
   return outputArray.buffer;
 }
 
-function normalizeSubscription(subscription: PushSubscription): WebPushSubscription | null {
+export function normalizeSubscription(subscription: PushSubscription): WebPushSubscription | null {
   const json = subscription.toJSON();
   if (
     typeof json.endpoint !== "string" ||
@@ -38,6 +40,25 @@ function normalizeSubscription(subscription: PushSubscription): WebPushSubscript
   };
 }
 
+export type WebPushDiagnosticStatus =
+  | "unsupported"
+  | "permission-required"
+  | "permission-denied"
+  | "server-disabled"
+  | "subscription-missing"
+  | "ready";
+
+export interface WebPushDiagnostics {
+  readonly status: WebPushDiagnosticStatus;
+  readonly supported: boolean;
+  readonly secureContext: boolean;
+  readonly permission: NotificationPermission | "unsupported";
+  readonly serviceWorkerReady: boolean;
+  readonly serverConfigured: boolean;
+  readonly subscription: WebPushSubscription | null;
+  readonly ready: boolean;
+}
+
 async function postJson(path: string, body: unknown): Promise<void> {
   const response = await fetch(path, {
     method: "POST",
@@ -67,6 +88,64 @@ export async function getWebPushPublicConfig(): Promise<WebPushPublicConfig> {
   return (await response.json()) as WebPushPublicConfig;
 }
 
+export async function readWebPushDiagnostics(): Promise<WebPushDiagnostics> {
+  const secureContext = typeof window !== "undefined" && window.isSecureContext;
+  const supported = typeof navigator !== "undefined" && canUseWebPush();
+  const base = {
+    supported,
+    secureContext,
+    permission: supported ? Notification.permission : ("unsupported" as const),
+    serviceWorkerReady: false,
+    serverConfigured: false,
+    subscription: null,
+    ready: false,
+  };
+  if (!supported) return { ...base, status: "unsupported" };
+  if (Notification.permission === "denied") return { ...base, status: "permission-denied" };
+  if (Notification.permission !== "granted") return { ...base, status: "permission-required" };
+
+  const [config, registration] = await Promise.all([
+    getWebPushPublicConfig(),
+    navigator.serviceWorker.ready,
+  ]);
+  if (!config.enabled || !config.publicKey) {
+    return { ...base, serviceWorkerReady: true, status: "server-disabled" };
+  }
+  const subscription = await registration.pushManager.getSubscription();
+  const normalized = subscription ? normalizeSubscription(subscription) : null;
+  if (!normalized) {
+    return {
+      ...base,
+      serviceWorkerReady: true,
+      serverConfigured: true,
+      status: "subscription-missing",
+    };
+  }
+  return {
+    ...base,
+    serviceWorkerReady: true,
+    serverConfigured: true,
+    subscription: normalized,
+    ready: true,
+    status: "ready",
+  };
+}
+
+export async function sendWebPushTest(kind: WebPushTestKind): Promise<WebPushTestResult> {
+  const diagnostics = await readWebPushDiagnostics();
+  if (!diagnostics.ready || diagnostics.subscription === null) {
+    throw new Error("Push to phone is not ready on this device.");
+  }
+  const response = await fetch("/api/push/test", {
+    method: "POST",
+    credentials: "include",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ endpoint: diagnostics.subscription.endpoint, kind }),
+  });
+  if (!response.ok) throw new Error(`/api/push/test failed with HTTP ${response.status}`);
+  return (await response.json()) as WebPushTestResult;
+}
+
 export async function registerWebPushSubscription(): Promise<void> {
   if (!canUseWebPush()) {
     return;
diff --git a/apps/web/src/service-worker.ts b/apps/web/src/service-worker.ts
index 673fb11b8778..789be8a7721e 100644
--- a/apps/web/src/service-worker.ts
+++ b/apps/web/src/service-worker.ts
@@ -1,5 +1,7 @@
 /// <reference lib="webworker" />
 
+import { notificationTargetUrl } from "./lib/notificationTarget";
+
 type PrecacheEntry = {
   readonly url: string;
   readonly revision: string | null;
@@ -100,10 +102,7 @@ sw.addEventListener("push", (event) => {
 
 sw.addEventListener("notificationclick", (event) => {
   event.notification.close();
-  const url = new URL(
-    typeof event.notification.data?.url === "string" ? event.notification.data.url : "/",
-    sw.location.origin,
-  ).toString();
+  const url = notificationTargetUrl(event.notification.data?.url, sw.location.origin);
 
   event.waitUntil(
     sw.clients.matchAll({ type: "window", includeUncontrolled: true }).then(async (clients) => {

From ec2232c5796c7de56ba529d7f07d473c79a6a29d Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 23:10:45 +0100
Subject: [PATCH 10/13] docs: mark guided autopilot implemented

---
 .../src/gits/Layers/AutopilotControl.test.ts  |  5 +-
 .../src/gits/Layers/AutopilotControl.ts       | 10 ++-
 .../src/gits/Layers/HermesAutomodeBridge.ts   |  3 +-
 .../Layers/PushNotificationService.test.ts    | 14 ++--
 apps/server/src/push/http.test.ts             | 11 ++-
 apps/server/src/push/http.ts                  |  5 +-
 apps/server/src/server.test.ts                |  5 +-
 apps/server/src/ws.ts                         |  5 +-
 .../proposalLaunch.logic.test.ts              | 14 ++--
 .../2026-08-09-guided-autopilot-inbox.md      | 70 ++++++++++++-------
 ...026-08-09-guided-autopilot-inbox-design.md |  2 +-
 packages/contracts/src/gits.test.ts           |  4 +-
 12 files changed, 88 insertions(+), 60 deletions(-)

diff --git a/apps/server/src/gits/Layers/AutopilotControl.test.ts b/apps/server/src/gits/Layers/AutopilotControl.test.ts
index 1df028a2b4f0..bdd40d814b97 100644
--- a/apps/server/src/gits/Layers/AutopilotControl.test.ts
+++ b/apps/server/src/gits/Layers/AutopilotControl.test.ts
@@ -64,7 +64,10 @@ describe("AutopilotControl", () => {
     const exit = await Effect.runPromiseExit(
       configureAutopilot(
         {
-          scheduler: { setConfig: () => Effect.succeed(scheduler), disarm: () => Effect.succeed(scheduler) },
+          scheduler: {
+            setConfig: () => Effect.succeed(scheduler),
+            disarm: () => Effect.succeed(scheduler),
+          },
           supervisor: { updatePolicy: () => Effect.succeed(automode) },
         },
         { enabled: true, repositories: [] },
diff --git a/apps/server/src/gits/Layers/AutopilotControl.ts b/apps/server/src/gits/Layers/AutopilotControl.ts
index ccca895bd956..1540d1076b33 100644
--- a/apps/server/src/gits/Layers/AutopilotControl.ts
+++ b/apps/server/src/gits/Layers/AutopilotControl.ts
@@ -62,10 +62,8 @@ export function emergencyStopAutopilot(dependencies: {
   readonly supervisor: Pick<AutomodeSupervisorShape, "stopAll">;
   readonly scheduler: Pick<GitsSlotSchedulerShape, "disarm">;
 }): Effect.Effect<AutomodeStopAllResult, AutomodeSupervisorError> {
-  return dependencies.scheduler
-    .disarm({ reason: "Autopilot emergency stop." })
-    .pipe(
-      Effect.mapError(schedulerError("Failed to disarm the Autopilot scheduler.")),
-      Effect.flatMap(() => dependencies.supervisor.stopAll()),
-    );
+  return dependencies.scheduler.disarm({ reason: "Autopilot emergency stop." }).pipe(
+    Effect.mapError(schedulerError("Failed to disarm the Autopilot scheduler.")),
+    Effect.flatMap(() => dependencies.supervisor.stopAll()),
+  );
 }
diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
index 7923303f106a..7bc5b49c4427 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
@@ -265,7 +265,8 @@ export const decideProposalWithAutomodeBridge = (
               repository: decided.projectDir,
               eventKey: `proposal:${decided.id}:acceptance-failed`,
               state: "attention-required",
-              reason: "Acceptance did not finish. Retry Accept & Queue; any existing Goal will be reused.",
+              reason:
+                "Acceptance did not finish. Retry Accept & Queue; any existing Goal will be reused.",
               deepLink:
                 goal === undefined
                   ? `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`
diff --git a/apps/server/src/push/Layers/PushNotificationService.test.ts b/apps/server/src/push/Layers/PushNotificationService.test.ts
index a0d0cc9b037f..5fe1de959570 100644
--- a/apps/server/src/push/Layers/PushNotificationService.test.ts
+++ b/apps/server/src/push/Layers/PushNotificationService.test.ts
@@ -203,7 +203,10 @@ it.effect("sends a test only to the exact registered endpoint", () => {
     const service = yield* PushNotificationService;
     const payload = { title: "Test", body: "Body", tag: "test-1", url: "/gits" };
     assert.strictEqual(yield* service.sendToEndpoint(active.endpoint, payload), "sent");
-    assert.strictEqual(yield* service.sendToEndpoint("https://push.example.test/missing", payload), "not-found");
+    assert.strictEqual(
+      yield* service.sendToEndpoint("https://push.example.test/missing", payload),
+      "not-found",
+    );
     assert.deepStrictEqual(sentEndpoints, [active.endpoint]);
   }).pipe(Effect.provide(layer));
 });
@@ -220,16 +223,17 @@ it.effect("reports disabled and failed targeted delivery and deletes expired end
     list: () => Effect.succeed([persisted(expired)]),
   });
   const senderLayer = Layer.succeed(WebPushSender, {
-    send: () =>
-      Effect.fail(new WebPushSendError({ endpoint: expired.endpoint, statusCode: 410 })),
+    send: () => Effect.fail(new WebPushSendError({ endpoint: expired.endpoint, statusCode: 410 })),
   });
   const payload = { title: "Test", body: "Body", tag: "test-2", url: "/gits" };
 
   return Effect.gen(function* () {
     const configuredService = yield* PushNotificationService;
-    assert.strictEqual(yield* configuredService.sendToEndpoint(expired.endpoint, payload), "failed");
+    assert.strictEqual(
+      yield* configuredService.sendToEndpoint(expired.endpoint, payload),
+      "failed",
+    );
     assert.deepStrictEqual(deletedEndpoints, [expired.endpoint]);
-
   }).pipe(
     Effect.provide(
       PushNotificationServiceLive.pipe(
diff --git a/apps/server/src/push/http.test.ts b/apps/server/src/push/http.test.ts
index aa682fe3fcd0..dc0f69284a14 100644
--- a/apps/server/src/push/http.test.ts
+++ b/apps/server/src/push/http.test.ts
@@ -58,7 +58,8 @@ const execute = (
 
 it.effect("push test route uses fixed server payload and a unique test tag", () =>
   Effect.gen(function* () {
-    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> = [];
+    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> =
+      [];
     const response = yield* execute(
       "owner",
       {
@@ -77,17 +78,15 @@ it.effect("push test route uses fixed server payload and a unique test tag", ()
     assert.equal(sent[0]!.endpoint, "https://push.example/device");
     assert.equal(sent[0]!.payload.title, "Test proposal ready");
     assert.equal(sent[0]!.payload.body, "Tap to test the guided proposal launch.");
-    assert.equal(
-      sent[0]!.payload.url,
-      "/gits?panel=autopilot&notificationTest=proposal",
-    );
+    assert.equal(sent[0]!.payload.url, "/gits?panel=autopilot&notificationTest=proposal");
     assert.match(sent[0]!.payload.tag, /^gits:test:proposal:/);
   }),
 );
 
 it.effect("push test route rejects thread-scoped sessions before sending", () =>
   Effect.gen(function* () {
-    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> = [];
+    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> =
+      [];
     const response = yield* execute(
       "thread-scoped",
       { endpoint: "https://push.example/device", kind: "delivery" },
diff --git a/apps/server/src/push/http.ts b/apps/server/src/push/http.ts
index 50975705fa62..55a6e980d6af 100644
--- a/apps/server/src/push/http.ts
+++ b/apps/server/src/push/http.ts
@@ -200,9 +200,6 @@ export const pushTestRouteLayer = HttpRouter.add(
         : result === "not-found"
           ? [404, "This device subscription is not registered."]
           : [502, "The push provider rejected the test notification."];
-    return HttpServerResponse.jsonUnsafe(
-      { error },
-      { status, headers: browserApiCorsHeaders },
-    );
+    return HttpServerResponse.jsonUnsafe({ error }, { status, headers: browserApiCorsHeaders });
   }).pipe(Effect.catchTag("AuthError", respondToAuthError)),
 );
diff --git a/apps/server/src/server.test.ts b/apps/server/src/server.test.ts
index 4fd31becdf55..8c8d5740842c 100644
--- a/apps/server/src/server.test.ts
+++ b/apps/server/src/server.test.ts
@@ -5045,7 +5045,10 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
                 calls.push(`scheduler:${input.enabled}`);
                 return {
                   ...defaultGitsSchedulerSnapshot,
-                  config: { ...defaultGitsSchedulerSnapshot.config, enabled: input.enabled ?? false },
+                  config: {
+                    ...defaultGitsSchedulerSnapshot.config,
+                    enabled: input.enabled ?? false,
+                  },
                 };
               }),
           },
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index df26716d8ce4..af5b54258e3d 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -113,10 +113,7 @@ import {
   hasLiveGoalForEpisode,
 } from "./gits/Layers/HermesAutomodeBridge.ts";
 import { AutomodeNotifications } from "./gits/Layers/AutomodeNotifications.ts";
-import {
-  configureAutopilot,
-  emergencyStopAutopilot,
-} from "./gits/Layers/AutopilotControl.ts";
+import { configureAutopilot, emergencyStopAutopilot } from "./gits/Layers/AutopilotControl.ts";
 import { ServerEnvironment } from "./environment/Services/ServerEnvironment.ts";
 import {
   denyThreadAccess,
diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
index 754806c90f94..9879347928fe 100644
--- a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
@@ -1,4 +1,8 @@
-import { CODEX_MODEL_TIERS, type AutomodePolicy, type HermesProposalCard } from "@t3tools/contracts";
+import {
+  CODEX_MODEL_TIERS,
+  type AutomodePolicy,
+  type HermesProposalCard,
+} from "@t3tools/contracts";
 import { describe, expect, it } from "vitest";
 
 import {
@@ -46,9 +50,11 @@ describe("guided proposal launch logic", () => {
 
   it("uses allowed models or the three built-in tiers without duplicates", () => {
     expect(launchModelOptions(policy).map((item) => item.value)).toEqual(["model-a", "model-b"]);
-    expect(
-      launchModelOptions({ ...policy, allowedModels: [] }).map((item) => item.value),
-    ).toEqual([CODEX_MODEL_TIERS.light, CODEX_MODEL_TIERS.medium, CODEX_MODEL_TIERS.high]);
+    expect(launchModelOptions({ ...policy, allowedModels: [] }).map((item) => item.value)).toEqual([
+      CODEX_MODEL_TIERS.light,
+      CODEX_MODEL_TIERS.medium,
+      CODEX_MODEL_TIERS.high,
+    ]);
   });
 
   it("validates repository, model, runtime, and start time", () => {
diff --git a/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md b/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md
index 097c10207d09..5b5738d62a71 100644
--- a/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md
+++ b/docs/superpowers/plans/2026-08-09-guided-autopilot-inbox.md
@@ -63,6 +63,7 @@
 ### Task 1: Add Narrow Contracts and Client Method
 
 **Files:**
+
 - Modify: `packages/contracts/src/gits.ts`
 - Modify: `packages/contracts/src/push.ts`
 - Modify: `packages/contracts/src/rpc.ts`
@@ -71,6 +72,7 @@
 - Modify: `packages/client-runtime/src/wsRpcClient.ts`
 
 **Interfaces:**
+
 - Produces: `AutopilotConfigureInput`, `AutopilotControlSnapshot`, `WebPushTestKind`, `WebPushTestInput`, `WebPushTestResult`, and `WsGitsAutomodeConfigureRpc`.
 - Produces client call: `client.gits.automode.configure(input)`.
 
@@ -144,12 +146,14 @@ git commit -m "feat: add guided autopilot contracts"
 ### Task 2: Add Fail-Closed Autopilot Controls
 
 **Files:**
+
 - Create: `apps/server/src/gits/Layers/AutopilotControl.ts`
 - Create: `apps/server/src/gits/Layers/AutopilotControl.test.ts`
 - Modify: `apps/server/src/ws.ts`
 - Modify: `apps/server/src/server.test.ts`
 
 **Interfaces:**
+
 - Consumes: `AutopilotConfigureInput`, `AutopilotControlSnapshot`.
 - Produces: `configureAutopilot(dependencies, input)` and `emergencyStopAutopilot(dependencies)`.
 
@@ -160,27 +164,33 @@ Cover these observable calls:
 ```ts
 expect(onCalls).toEqual([
   ["scheduler.setConfig", { enabled: true }],
-  ["supervisor.updatePolicy", {
-    mode: "autonomous",
-    killSwitchEnabled: false,
-    maxActivePeers: 1,
-    allowedRepos: [repo],
-    proposalRepos: [repo],
-    nightlyProposalSweep: true,
-    sweepRequiresConfirmation: true,
-    autoEnqueueApprovedProposals: true,
-    gitsNotificationsEnabled: true,
-  }],
+  [
+    "supervisor.updatePolicy",
+    {
+      mode: "autonomous",
+      killSwitchEnabled: false,
+      maxActivePeers: 1,
+      allowedRepos: [repo],
+      proposalRepos: [repo],
+      nightlyProposalSweep: true,
+      sweepRequiresConfirmation: true,
+      autoEnqueueApprovedProposals: true,
+      gitsNotificationsEnabled: true,
+    },
+  ],
 ]);
 
 expect(pauseCalls).toEqual([
   ["scheduler.disarm", { reason: "Autopilot paused." }],
-  ["supervisor.updatePolicy", {
-    mode: "manual",
-    allowedRepos: [repo],
-    proposalRepos: [repo],
-    nightlyProposalSweep: false,
-  }],
+  [
+    "supervisor.updatePolicy",
+    {
+      mode: "manual",
+      allowedRepos: [repo],
+      proposalRepos: [repo],
+      nightlyProposalSweep: false,
+    },
+  ],
 ]);
 ```
 
@@ -205,12 +215,10 @@ export function configureAutopilot(
   input: AutopilotConfigureInput,
 ): Effect.Effect<AutopilotControlSnapshot, AutomodeSupervisorError>;
 
-export function emergencyStopAutopilot(
-  dependencies: {
-    supervisor: Pick<AutomodeSupervisorShape, "stopAll">;
-    scheduler: Pick<GitsSlotSchedulerShape, "disarm">;
-  },
-): Effect.Effect<AutomodeStopAllResult, AutomodeSupervisorError>;
+export function emergencyStopAutopilot(dependencies: {
+  supervisor: Pick<AutomodeSupervisorShape, "stopAll">;
+  scheduler: Pick<GitsSlotSchedulerShape, "disarm">;
+}): Effect.Effect<AutomodeStopAllResult, AutomodeSupervisorError>;
 ```
 
 Map scheduler errors into `AutomodeSupervisorError`. Do not arm on On; accepted work remains the authorization point through `scheduleApprovedGoal`.
@@ -235,10 +243,12 @@ git commit -m "feat: add simple autopilot controls"
 ### Task 3: Make Acceptance Recovery Visible and Idempotent
 
 **Files:**
+
 - Modify: `apps/server/src/gits/Layers/HermesAutomodeBridge.ts`
 - Modify: `apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts`
 
 **Interfaces:**
+
 - Consumes: existing `decideProposalWithAutomodeBridge` dependencies.
 - Produces: the same external result with a new recovery invariant: approval failure records `attention-required` when the Proposal is known.
 
@@ -287,6 +297,7 @@ git commit -m "fix: make proposal launch retries visible"
 ### Task 4: Add Current-Device Push Tests
 
 **Files:**
+
 - Modify: `apps/server/src/push/Services/PushNotificationService.ts`
 - Modify: `apps/server/src/push/Layers/PushNotificationService.ts`
 - Modify: `apps/server/src/push/Layers/PushNotificationService.test.ts`
@@ -295,6 +306,7 @@ git commit -m "fix: make proposal launch retries visible"
 - Modify: `apps/server/src/server.ts`
 
 **Interfaces:**
+
 - Produces: `sendToEndpoint(endpoint, payload): Effect<"sent" | "disabled" | "not-found" | "failed">`.
 - Produces: authenticated `POST /api/push/test` accepting only `WebPushTestInput`.
 
@@ -303,7 +315,7 @@ git commit -m "fix: make proposal launch retries visible"
 Create two registered subscriptions, call `sendToEndpoint` for one, and assert only that endpoint is sent. Cover disabled VAPID, missing endpoint, sender failure, and expired-subscription deletion.
 
 ```ts
-const result = yield* service.sendToEndpoint(active.endpoint, payload);
+const result = yield * service.sendToEndpoint(active.endpoint, payload);
 assert.strictEqual(result, "sent");
 assert.deepStrictEqual(sentEndpoints, [active.endpoint]);
 ```
@@ -360,10 +372,12 @@ git commit -m "feat: add targeted PWA notification tests"
 ### Task 5: Build Guided Launch Logic Test-First
 
 **Files:**
+
 - Create: `apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts`
 - Create: `apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts`
 
 **Interfaces:**
+
 - Produces: `LaunchStep`, `ProposalLaunchForm`, `launchModelOptions`, `initialProposalLaunchForm`, `validateProposalLaunchForm`, `proposalLaunchEdits`, and `TEST_PROPOSAL`.
 
 - [ ] **Step 1: Write failing pure tests**
@@ -411,11 +425,13 @@ git commit -m "feat: add guided proposal launch logic"
 ### Task 6: Build the Three-Step Launch Sheet
 
 **Files:**
+
 - Create: `apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx`
 - Create: `apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx`
 - Modify: `apps/web/src/components/gits/GitsCockpit.tsx`
 
 **Interfaces:**
+
 - Consumes: Task 5 launch logic and existing `onDecision(proposal, decision, edits)` callback.
 - Produces: `ProposalLaunchSheet` supporting real Proposal IDs and `testMode="proposal"`.
 - Produces callback: `onDecision(...): Promise<AutomodeGoal | null>` so the sheet can render the actual queued Goal.
@@ -465,6 +481,7 @@ git commit -m "feat: add guided proposal launch sheet"
 ### Task 7: Replace the Autopilot Policy Dashboard
 
 **Files:**
+
 - Rewrite: `apps/web/src/components/gits/cockpit/AutopilotPanel.tsx`
 - Create: `apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx`
 - Modify: `apps/web/src/components/gits/GitsCockpit.tsx`
@@ -472,6 +489,7 @@ git commit -m "feat: add guided proposal launch sheet"
 - Delete: `apps/web/src/components/gits/cockpit/autopilot/autopilot.logic.test.ts`
 
 **Interfaces:**
+
 - Consumes: `automode.configure`, `ProposalLaunchSheet`, `InboxSection`, existing `stopAll`.
 - Produces: compact Autopilot operator surface.
 
@@ -522,6 +540,7 @@ git commit -m "feat: simplify autopilot around the inbox"
 ### Task 8: Add PWA Diagnostics UI and Test Routing
 
 **Files:**
+
 - Modify: `apps/web/src/lib/webPush.ts`
 - Create: `apps/web/src/lib/webPush.test.ts`
 - Modify: `apps/web/src/components/settings/SettingsPanels.tsx`
@@ -530,6 +549,7 @@ git commit -m "feat: simplify autopilot around the inbox"
 - Modify: `apps/web/src/service-worker.ts`
 
 **Interfaces:**
+
 - Produces: `readWebPushDiagnostics()` and `sendWebPushTest(kind)`.
 - Consumes: `POST /api/push/test` and `notificationTest` query values.
 
@@ -589,10 +609,12 @@ git commit -m "feat: add Android PWA notification diagnostics"
 ### Task 9: Integration Audit, Verification, and Documentation
 
 **Files:**
+
 - Modify as failures require: files already listed above
 - Modify: `docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md`
 
 **Interfaces:**
+
 - Verifies the complete Proposal → Inbox → PWA → guided Acceptance → Queue path and notification-test isolation.
 
 - [ ] **Step 1: Run focused integration suites**
diff --git a/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md b/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md
index 074eb8e9db57..ee58a85c376f 100644
--- a/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md
+++ b/docs/superpowers/specs/2026-08-09-guided-autopilot-inbox-design.md
@@ -1,6 +1,6 @@
 # Guided Inbox-First Autopilot Design
 
-**Status:** Draft for operator review
+**Status:** Implemented
 **Date:** 2026-08-09
 
 ## Objective
diff --git a/packages/contracts/src/gits.test.ts b/packages/contracts/src/gits.test.ts
index 32b31f803a49..8f2089d3c462 100644
--- a/packages/contracts/src/gits.test.ts
+++ b/packages/contracts/src/gits.test.ts
@@ -49,9 +49,7 @@ describe("AutopilotConfigureInput", () => {
       enabled: true,
       repositories: ["/srv/repo"],
     });
-    expect(() =>
-      decodeAutopilotConfigureInput({ enabled: true, repositories: [] }),
-    ).not.toThrow();
+    expect(() => decodeAutopilotConfigureInput({ enabled: true, repositories: [] })).not.toThrow();
   });
 });
 

From 4282582264e1fd67f27a68a79d22026ef87a8acb Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 23:32:39 +0100
Subject: [PATCH 11/13] fix: harden guided autopilot invariants

---
 .../gits/Layers/AutomodeSupervisor.test.ts    | 31 +++++++++++
 .../src/gits/Layers/AutomodeSupervisor.ts     | 27 +++++++---
 .../src/gits/Layers/AutopilotControl.test.ts  | 15 ++++--
 .../src/gits/Layers/AutopilotControl.ts       | 16 ++++--
 .../gits/Layers/HermesAutomodeBridge.test.ts  | 31 +++++++++++
 .../src/gits/Layers/HermesAutomodeBridge.ts   | 10 +---
 apps/server/src/push/http.test.ts             | 24 +++++----
 apps/server/src/push/http.ts                  | 13 ++++-
 apps/web/src/components/gits/GitsCockpit.tsx  |  3 +-
 .../gits/cockpit/AutopilotPanel.tsx           | 37 ++++++++++---
 .../cockpit/ProposalLaunchSheet.browser.tsx   |  8 ++-
 .../gits/cockpit/ProposalLaunchSheet.tsx      | 48 +++++++++++++++--
 .../proposalLaunch.logic.test.ts              | 52 ++++++++++++++-----
 .../proposal-launch/proposalLaunch.logic.ts   | 20 ++++++-
 apps/web/src/lib/webPush.test.ts              | 22 ++++++++
 apps/web/src/lib/webPush.ts                   |  9 +++-
 16 files changed, 303 insertions(+), 63 deletions(-)

diff --git a/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts b/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts
index fe5477f6324b..274fb89f1495 100644
--- a/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts
+++ b/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts
@@ -256,6 +256,37 @@ describe("AutomodeSupervisorLive", () => {
     }).pipe(Effect.provide(makeLayer())),
   );
 
+  it.effect("enqueues at most one live goal for an episode", () =>
+    Effect.gen(function* () {
+      const supervisor = yield* AutomodeSupervisor;
+      yield* Effect.all(
+        [
+          supervisor.enqueueGoal({
+            episodeId: "episode-concurrent",
+            title: "First acceptance",
+            repo: "/tmp/source-repo",
+            prompt: "Run once.",
+          }),
+          supervisor.enqueueGoal({
+            episodeId: "episode-concurrent",
+            title: "Second acceptance",
+            repo: "/tmp/source-repo",
+            prompt: "Run once.",
+          }),
+        ],
+        { concurrency: "unbounded" },
+      );
+
+      const snapshot = yield* supervisor.getSnapshot();
+      assert.equal(
+        snapshot.goals.filter(
+          (goal) => goal.episodeId === "episode-concurrent" && goal.status !== "completed",
+        ).length,
+        1,
+      );
+    }).pipe(Effect.provide(makeLayer())),
+  );
+
   it.effect("blocks dispatch when the kill switch is enabled", () =>
     Effect.gen(function* () {
       const supervisor = yield* AutomodeSupervisor;
diff --git a/apps/server/src/gits/Layers/AutomodeSupervisor.ts b/apps/server/src/gits/Layers/AutomodeSupervisor.ts
index fbfb9c54f6b0..21035f7ef1f2 100644
--- a/apps/server/src/gits/Layers/AutomodeSupervisor.ts
+++ b/apps/server/src/gits/Layers/AutomodeSupervisor.ts
@@ -67,6 +67,12 @@ interface AutomodeState {
 }
 
 const ACTIVE_PEER_STATUSES = new Set<PeerStatus>(["pending", "running", "blocked", "waiting"]);
+const TERMINAL_GOAL_STATUSES = new Set<AutomodeGoalStatus>([
+  "completed",
+  "failed",
+  "blocked",
+  "rejected",
+]);
 const INTEGRATION_PATTERN = /\b(merge|admin-merge|integrate|pull request|pr)\b/i;
 const DESTRUCTIVE_PATTERN = /\b(reset --hard|rm -rf|delete|destroy|drop|truncate|force push)\b/i;
 const AUTOMODE_STATE_FILE_NAME = "automode-state.json";
@@ -718,12 +724,21 @@ export const AutomodeSupervisorLive = Layer.effect(
             planningNotes: null,
             planningBoundary: null,
           };
-          const nextState = yield* commitState((state) => ({
-            ...state,
-            goals: [goal, ...state.goals],
-            lastEvent: `Queued ${input.title}.`,
-            updatedAt: createdAt,
-          }));
+          const nextState = yield* commitState((state) =>
+            input.episodeId !== undefined &&
+            state.goals.some(
+              (existing) =>
+                existing.episodeId === input.episodeId &&
+                !TERMINAL_GOAL_STATUSES.has(existing.status),
+            )
+              ? state
+              : {
+                  ...state,
+                  goals: [goal, ...state.goals],
+                  lastEvent: `Queued ${input.title}.`,
+                  updatedAt: createdAt,
+                },
+          );
           return yield* snapshotFromState(nextState);
         }),
       deferGoal: (input) =>
diff --git a/apps/server/src/gits/Layers/AutopilotControl.test.ts b/apps/server/src/gits/Layers/AutopilotControl.test.ts
index bdd40d814b97..64095047291c 100644
--- a/apps/server/src/gits/Layers/AutopilotControl.test.ts
+++ b/apps/server/src/gits/Layers/AutopilotControl.test.ts
@@ -3,7 +3,6 @@ import * as Exit from "effect/Exit";
 import { describe, expect, it } from "vitest";
 
 import {
-  AutomodeSupervisorError,
   GitsSlotSchedulerError,
   type AutomodeSnapshot,
   type GitsSchedulerSnapshot,
@@ -103,7 +102,7 @@ describe("AutopilotControl", () => {
     expect(policyCalls).toBe(0);
   });
 
-  it("disarms before pausing and before emergency stop", async () => {
+  it("disarms before pausing and stops peers before disarming an emergency stop", async () => {
     const pauseCalls: Array<readonly [string, unknown]> = [];
     await Effect.runPromise(
       configureAutopilot(
@@ -159,21 +158,27 @@ describe("AutopilotControl", () => {
         },
       }),
     );
-    expect(stopCalls).toEqual(["scheduler.disarm", "supervisor.stopAll"]);
+    expect(stopCalls).toEqual(["supervisor.stopAll", "scheduler.disarm"]);
   });
 
-  it("maps scheduler errors into the supervisor error contract", async () => {
+  it("still stops peers when emergency scheduler disarm fails", async () => {
+    let stopCalls = 0;
     const exit = await Effect.runPromiseExit(
       emergencyStopAutopilot({
         scheduler: {
           disarm: () => Effect.fail(new GitsSlotSchedulerError({ message: "cannot disarm" })),
         },
         supervisor: {
-          stopAll: () => Effect.fail(new AutomodeSupervisorError({ message: "not reached" })),
+          stopAll: () =>
+            Effect.sync(() => {
+              stopCalls += 1;
+              return { stoppedPeers: 1, failures: 0 };
+            }),
         },
       }),
     );
 
     expect(Exit.isFailure(exit)).toBe(true);
+    expect(stopCalls).toBe(1);
   });
 });
diff --git a/apps/server/src/gits/Layers/AutopilotControl.ts b/apps/server/src/gits/Layers/AutopilotControl.ts
index 1540d1076b33..f2094003e6ca 100644
--- a/apps/server/src/gits/Layers/AutopilotControl.ts
+++ b/apps/server/src/gits/Layers/AutopilotControl.ts
@@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
 
 import {
   AutomodeSupervisorError,
@@ -62,8 +63,15 @@ export function emergencyStopAutopilot(dependencies: {
   readonly supervisor: Pick<AutomodeSupervisorShape, "stopAll">;
   readonly scheduler: Pick<GitsSlotSchedulerShape, "disarm">;
 }): Effect.Effect<AutomodeStopAllResult, AutomodeSupervisorError> {
-  return dependencies.scheduler.disarm({ reason: "Autopilot emergency stop." }).pipe(
-    Effect.mapError(schedulerError("Failed to disarm the Autopilot scheduler.")),
-    Effect.flatMap(() => dependencies.supervisor.stopAll()),
-  );
+  return Effect.gen(function* () {
+    const stopped = yield* Effect.result(dependencies.supervisor.stopAll());
+    const disarmed = yield* Effect.result(
+      dependencies.scheduler
+        .disarm({ reason: "Autopilot emergency stop." })
+        .pipe(Effect.mapError(schedulerError("Failed to disarm the Autopilot scheduler."))),
+    );
+    if (Result.isFailure(stopped)) return yield* stopped.failure;
+    if (Result.isFailure(disarmed)) return yield* disarmed.failure;
+    return stopped.success;
+  });
 }
diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
index a70a343fe0ea..0444ab3513e8 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
@@ -220,6 +220,35 @@ const armAutonomous = Effect.gen(function* () {
 });
 
 describe("decideProposalWithAutomodeBridge", () => {
+  it.effect("concurrent acceptance creates one live Goal", () =>
+    Effect.gen(function* () {
+      const supervisor = yield* armAutonomous;
+      const { hermes } = makeFakeHermes();
+
+      yield* Effect.all(
+        [
+          decideProposalWithAutomodeBridge(hermes, supervisor, {
+            proposalId: "proposal-1",
+            decision: "approve",
+          }),
+          decideProposalWithAutomodeBridge(hermes, supervisor, {
+            proposalId: "proposal-1",
+            decision: "approve",
+          }),
+        ],
+        { concurrency: "unbounded" },
+      );
+
+      const snapshot = yield* supervisor.getSnapshot();
+      assert.equal(
+        snapshot.goals.filter(
+          (goal) => goal.episodeId === "epi-proposal-1" && goal.status === "queued",
+        ).length,
+        1,
+      );
+    }).pipe(Effect.provide(makeSupervisorLayer())),
+  );
+
   it.effect("approval queues once, arms for eligibility, and records the durable transition", () =>
     Effect.gen(function* () {
       const supervisor = yield* armAutonomous;
@@ -601,6 +630,7 @@ describe("decideProposalWithAutomodeBridge", () => {
         state: "attention-required",
       });
       assert.include(events.at(-1)!.reason, "Retry");
+      assert.equal(events.at(-1)!.deepLink, "/gits?panel=autopilot&proposal=proposal-1");
 
       yield* decideProposalWithAutomodeBridge(
         hermes,
@@ -649,6 +679,7 @@ describe("decideProposalWithAutomodeBridge", () => {
         eventKey: "proposal:proposal-1:acceptance-failed",
         state: "attention-required",
       });
+      assert.equal(events.at(-1)!.deepLink, "/gits?panel=autopilot&proposal=proposal-1");
 
       yield* decideProposalWithAutomodeBridge(
         hermes,
diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
index 7bc5b49c4427..274712e2966d 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
@@ -203,10 +203,7 @@ export const decideProposalWithAutomodeBridge = (
             targetsCurrentNight = scheduled.targetsCurrentNight;
           }
           const eventKey = `proposal:${decided.id}:${input.decision}`;
-          const deepLink =
-            current === undefined
-              ? `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`
-              : `/gits?panel=autopilot&goal=${encodeURIComponent(current.id)}`;
+          const deepLink = `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`;
           yield* dependencies.inbox.record({
             episodeId: decided.episodeId,
             proposalId: decided.id,
@@ -267,10 +264,7 @@ export const decideProposalWithAutomodeBridge = (
               state: "attention-required",
               reason:
                 "Acceptance did not finish. Retry Accept & Queue; any existing Goal will be reused.",
-              deepLink:
-                goal === undefined
-                  ? `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`
-                  : `/gits?panel=autopilot&goal=${encodeURIComponent(goal.id)}`,
+              deepLink: `/gits?panel=autopilot&proposal=${encodeURIComponent(decided.id)}`,
             }),
           ),
           Effect.catch(() => Effect.void),
diff --git a/apps/server/src/push/http.test.ts b/apps/server/src/push/http.test.ts
index dc0f69284a14..bb284a9125c7 100644
--- a/apps/server/src/push/http.test.ts
+++ b/apps/server/src/push/http.test.ts
@@ -83,18 +83,20 @@ it.effect("push test route uses fixed server payload and a unique test tag", ()
   }),
 );
 
-it.effect("push test route rejects thread-scoped sessions before sending", () =>
+it.effect("push test route only allows owner sessions", () =>
   Effect.gen(function* () {
-    const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> =
-      [];
-    const response = yield* execute(
-      "thread-scoped",
-      { endpoint: "https://push.example/device", kind: "delivery" },
-      "sent",
-      sent,
-    );
-    assert.equal(response.status, 403);
-    assert.equal(sent.length, 0);
+    for (const role of ["client", "thread-scoped"] as const) {
+      const sent: Array<{ readonly endpoint: string; readonly payload: PushNotificationPayload }> =
+        [];
+      const response = yield* execute(
+        role,
+        { endpoint: "https://push.example/device", kind: "delivery" },
+        "sent",
+        sent,
+      );
+      assert.equal(response.status, 403);
+      assert.equal(sent.length, 0);
+    }
   }),
 );
 
diff --git a/apps/server/src/push/http.ts b/apps/server/src/push/http.ts
index 55a6e980d6af..8dc558d5af2f 100644
--- a/apps/server/src/push/http.ts
+++ b/apps/server/src/push/http.ts
@@ -49,6 +49,17 @@ const authenticatePushSession = Effect.gen(function* () {
   return session;
 });
 
+const authenticatePushOwnerSession = Effect.gen(function* () {
+  const session = yield* authenticatePushSession;
+  if (session.role !== "owner") {
+    return yield* new AuthError({
+      message: "Only owner sessions can send web push tests.",
+      status: 403,
+    });
+  }
+  return session;
+});
+
 export const pushPublicConfigRouteLayer = HttpRouter.add(
   "GET",
   "/api/push/config",
@@ -167,7 +178,7 @@ export const pushTestRouteLayer = HttpRouter.add(
   "POST",
   "/api/push/test",
   Effect.gen(function* () {
-    yield* authenticatePushSession;
+    yield* authenticatePushOwnerSession;
     const input = yield* HttpServerRequest.schemaBodyJson(WebPushTestInput).pipe(
       Effect.mapError(
         (cause) =>
diff --git a/apps/web/src/components/gits/GitsCockpit.tsx b/apps/web/src/components/gits/GitsCockpit.tsx
index 102146c174ad..2f688b9380e9 100644
--- a/apps/web/src/components/gits/GitsCockpit.tsx
+++ b/apps/web/src/components/gits/GitsCockpit.tsx
@@ -418,8 +418,7 @@ export function GitsCockpit() {
           candidate.episodeId === decided.episodeId &&
           !["completed", "failed", "blocked", "rejected"].includes(candidate.status),
       );
-      if (!goal) throw new Error("Proposal was approved, but its queued Goal was not found.");
-      return { decided, draft: null, goal };
+      return { decided, draft: null, goal: goal ?? null };
     },
     onSuccess: async (result, input) => {
       appendMotokoTranscript(input.routeKey, {
diff --git a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
index 5df7dfa8309c..8490e5951222 100644
--- a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
+++ b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
@@ -40,6 +40,10 @@ import { useStore } from "~/store";
 import type { MotokoProposalDecision, MotokoProposalEdits } from "./MotokoPanel";
 import { InboxSection } from "./InboxSection";
 import { ProposalLaunchSheet } from "./ProposalLaunchSheet";
+import {
+  guidedAutopilotRepositories,
+  isGuidedAutopilotProposal,
+} from "./proposal-launch/proposalLaunch.logic";
 import { EmptyState, StatusPill, formatCount } from "./primitives";
 
 const TERMINAL_GOAL_STATUSES = new Set(["completed", "failed", "blocked", "rejected"]);
@@ -147,7 +151,10 @@ export function AutopilotPanel({
   const { readGitsClient, targetEnvironmentId } = useAutopilotGitsClient();
   const policy = snapshot?.policy;
   const on = policy?.mode === "autonomous" && !policy.killSwitchEnabled;
-  const policyRepositories = policy?.proposalRepos ?? [];
+  const policyRepositories = useMemo(
+    () => (policy ? guidedAutopilotRepositories(policy) : []),
+    [policy],
+  );
   const repositoryKey = policyRepositories.join("\n");
   const [repositories, setRepositories] = useState<ReadonlyArray<string>>(policyRepositories);
   const [validationError, setValidationError] = useState<string | null>(null);
@@ -160,15 +167,16 @@ export function AutopilotPanel({
   const proposalTest = notificationTest === "proposal";
   const [launchOpen, setLaunchOpen] = useState(proposalTest);
 
-  useEffect(
-    () => setRepositories(repositoryKey.split("\n").filter(Boolean)),
-    [repositoryKey],
-  );
+  useEffect(() => setRepositories(repositoryKey.split("\n").filter(Boolean)), [repositoryKey]);
 
   useEffect(() => {
     if (!focusedProposalId) return;
     const proposal = proposals?.proposals.find((candidate) => candidate.id === focusedProposalId);
-    if (proposal) {
+    if (
+      proposal &&
+      ["proposed", "approved"].includes(proposal.status) &&
+      isGuidedAutopilotProposal(proposal)
+    ) {
       setSelectedProposal(proposal);
       setLaunchOpen(true);
     }
@@ -204,13 +212,28 @@ export function AutopilotPanel({
   });
 
   const pendingProposals = useMemo(
-    () => proposals?.proposals.filter((proposal) => proposal.status === "proposed") ?? [],
+    () =>
+      proposals?.proposals.filter(
+        (proposal) => proposal.status === "proposed" && isGuidedAutopilotProposal(proposal),
+      ) ?? [],
     [proposals],
   );
+  const focusedProposalUnavailable =
+    focusedProposalId !== null &&
+    proposals !== undefined &&
+    !proposals.proposals.some(
+      (proposal) =>
+        proposal.id === focusedProposalId &&
+        ["proposed", "approved"].includes(proposal.status) &&
+        isGuidedAutopilotProposal(proposal),
+    )
+      ? "This proposal is no longer available for guided Autopilot. Refresh the Inbox or review it in Motoko."
+      : null;
   const visibleGoals =
     snapshot?.goals.filter((goal) => !TERMINAL_GOAL_STATUSES.has(goal.status)).slice(0, 5) ?? [];
   const errorMessage =
     validationError ??
+    focusedProposalUnavailable ??
     (error instanceof Error ? error.message : null) ??
     (stopAll.error instanceof Error ? stopAll.error.message : null);
 
diff --git a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
index 7044399b5a01..3464afb1ef09 100644
--- a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
+++ b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
@@ -59,6 +59,9 @@ describe("ProposalLaunchSheet", () => {
     await expect.element(page.getByText("1 of 3")).toBeVisible();
     await expect.element(page.getByText(TEST_PROPOSAL.summary)).toBeVisible();
     await expect.element(page.getByText("Notification delivery")).toBeVisible();
+    await expect.element(page.getByText("/srv/example-project")).toBeVisible();
+    await expect.element(page.getByText("Low risk")).toBeVisible();
+    await expect.element(page.getByText("Complete the local test flow.")).toBeVisible();
     await page.getByRole("button", { name: "Continue" }).click();
 
     await expect.element(page.getByText("2 of 3")).toBeVisible();
@@ -71,6 +74,7 @@ describe("ProposalLaunchSheet", () => {
 
     await expect.element(page.getByText("3 of 3")).toBeVisible();
     await expect.element(page.getByText("/srv/example-project")).toBeVisible();
+    await expect.element(page.getByText(/held PR for review/)).toBeVisible();
     await page.getByRole("button", { name: "Accept & Queue" }).click();
     expect(onDecision).toHaveBeenCalledTimes(1);
     await expect.element(page.getByText("Queued", { exact: true })).toBeVisible();
@@ -89,7 +93,7 @@ describe("ProposalLaunchSheet", () => {
       />,
     );
     await page.getByRole("button", { name: "Later" }).click();
-    expect(onDecision).toHaveBeenCalledWith(TEST_PROPOSAL, "defer", expect.any(Object));
+    expect(onDecision).toHaveBeenCalledWith(TEST_PROPOSAL, "defer", {});
   });
 
   it("keeps Reject on the existing decision callback", async () => {
@@ -104,7 +108,7 @@ describe("ProposalLaunchSheet", () => {
       />,
     );
     await page.getByRole("button", { name: "Reject" }).click();
-    expect(onDecision).toHaveBeenCalledWith(TEST_PROPOSAL, "reject", expect.any(Object));
+    expect(onDecision).toHaveBeenCalledWith(TEST_PROPOSAL, "reject", {});
   });
 
   it("completes proposal notification test mode without a decision", async () => {
diff --git a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
index 7a6b9e8e1c33..fd2b310d2487 100644
--- a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
+++ b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
@@ -102,6 +102,15 @@ function IdeaStep({ proposal }: { readonly proposal: HermesProposalCard }) {
         <p className="text-xs font-medium tracking-wide text-muted-foreground uppercase">Outcome</p>
         <h3 className="font-heading text-2xl font-semibold tracking-tight">{proposal.title}</h3>
         <p className="text-sm leading-6 text-muted-foreground">{proposal.summary}</p>
+        <div className="flex flex-wrap items-center gap-1.5">
+          <Badge variant="outline">
+            {proposal.risk[0]!.toUpperCase() + proposal.risk.slice(1)} risk
+          </Badge>
+          <Badge variant="outline">{proposal.actionKind}</Badge>
+          <span className="font-mono text-[11px] text-muted-foreground">
+            {proposal.projectDir ?? "Repository chosen before queueing"}
+          </span>
+        </div>
       </section>
       <div className="grid gap-4 rounded-xl border border-border/70 bg-muted/24 p-4">
         <section className="grid gap-2">
@@ -122,6 +131,16 @@ function IdeaStep({ proposal }: { readonly proposal: HermesProposalCard }) {
             ))}
           </ul>
         </section>
+        {proposal.verificationPlan.length > 0 ? (
+          <section className="grid gap-2 border-t border-border/60 pt-4">
+            <p className="text-xs font-medium text-muted-foreground">How it will be checked</p>
+            <ul className="grid gap-1.5 text-sm leading-5">
+              {proposal.verificationPlan.map((item) => (
+                <li key={item}>— {item}</li>
+              ))}
+            </ul>
+          </section>
+        ) : null}
       </div>
       <p className="text-sm leading-6 text-muted-foreground">{proposal.detail}</p>
     </div>
@@ -293,7 +312,13 @@ function RunStep({
   );
 }
 
-function ReviewStep({ form }: { readonly form: ProposalLaunchForm }) {
+function ReviewStep({
+  form,
+  proposal,
+}: {
+  readonly form: ProposalLaunchForm;
+  readonly proposal: HermesProposalCard;
+}) {
   const rows = [
     ["Model", form.model],
     ["Repository", form.repository],
@@ -323,6 +348,19 @@ function ReviewStep({ form }: { readonly form: ProposalLaunchForm }) {
           </div>
         ))}
       </dl>
+      <div className="grid gap-2 rounded-xl border border-border/70 p-4 text-sm">
+        <p className="font-medium">What runs</p>
+        <p className="text-muted-foreground">{form.prompt}</p>
+        {proposal.verificationPlan.length > 0 ? (
+          <p className="text-muted-foreground">
+            Expected verification: {proposal.verificationPlan.join(" · ")}
+          </p>
+        ) : null}
+        <p className="text-muted-foreground">
+          Successful work stays on an isolated branch and ends in a held PR for review. Autopilot
+          does not merge it automatically.
+        </p>
+      </div>
     </div>
   );
 }
@@ -372,7 +410,11 @@ export function ProposalLaunchSheet({
     setWorking(true);
     setError(null);
     try {
-      const goal = await onDecision(activeProposal, decision, proposalLaunchEdits(form));
+      const goal = await onDecision(
+        activeProposal,
+        decision,
+        decision === "approve" ? proposalLaunchEdits(form) : {},
+      );
       if (decision === "approve" && goal === null) {
         throw new Error("The proposal was approved, but its queued Goal could not be confirmed.");
       }
@@ -431,7 +473,7 @@ export function ProposalLaunchSheet({
               onFormChange={setForm}
             />
           ) : (
-            <ReviewStep form={form} />
+            <ReviewStep form={form} proposal={activeProposal} />
           )}
           {error !== null ? (
             <p
diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
index 9879347928fe..576079f294e4 100644
--- a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
@@ -8,6 +8,8 @@ import { describe, expect, it } from "vitest";
 import {
   TEST_PROPOSAL,
   initialProposalLaunchForm,
+  guidedAutopilotRepositories,
+  isGuidedAutopilotProposal,
   launchModelOptions,
   proposalLaunchEdits,
   validateProposalLaunchForm,
@@ -37,7 +39,6 @@ describe("guided proposal launch logic", () => {
     expect(initialProposalLaunchForm(proposal, policy)).toMatchObject({
       repository: "/srv/repo",
       model: "model-a",
-      notBefore: "2026-08-10T20:30",
       runtime: "45",
       integrationBranch: "autopilot/proposal",
       verificationCommands: [{ label: "lint", cmd: ["bun", "lint"] }],
@@ -79,17 +80,24 @@ describe("guided proposal launch logic", () => {
   });
 
   it("builds typed edits and converts local time to ISO", () => {
-    const form = initialProposalLaunchForm(proposal, policy);
-    expect(proposalLaunchEdits(form)).toEqual({
-      title: proposal.title,
-      prompt: proposal.nextCommandOrPrompt,
-      projectDir: "/srv/repo",
-      model: "model-a",
-      notBefore: new Date("2026-08-10T20:30").toISOString(),
-      maxRuntimeMinutes: 45,
-      verificationCommands: [{ label: "lint", cmd: ["bun", "lint"] }],
-      integrationBranch: "autopilot/proposal",
-    });
+    const previousTimezone = process.env.TZ;
+    process.env.TZ = "Europe/London";
+    try {
+      const form = initialProposalLaunchForm(proposal, policy);
+      expect(form.notBefore).toBe("2026-08-10T21:30");
+      expect(proposalLaunchEdits(form)).toEqual({
+        title: proposal.title,
+        prompt: proposal.nextCommandOrPrompt,
+        projectDir: "/srv/repo",
+        model: "model-a",
+        notBefore: proposal.notBefore,
+        maxRuntimeMinutes: 45,
+        verificationCommands: [{ label: "lint", cmd: ["bun", "lint"] }],
+        integrationBranch: "autopilot/proposal",
+      });
+    } finally {
+      process.env.TZ = previousTimezone;
+    }
   });
 
   it("exports a deterministic proposal-only test fixture", () => {
@@ -100,4 +108,24 @@ describe("guided proposal launch logic", () => {
       projectDir: "/srv/example-project",
     });
   });
+
+  it("only guides actionable Delamain proposals", () => {
+    expect(isGuidedAutopilotProposal(TEST_PROPOSAL)).toBe(true);
+    expect(isGuidedAutopilotProposal({ ...TEST_PROPOSAL, actionKind: "read-only" })).toBe(false);
+    expect(isGuidedAutopilotProposal({ ...TEST_PROPOSAL, recommendedExecutor: "open-gsd" })).toBe(
+      false,
+    );
+    expect(isGuidedAutopilotProposal({ ...TEST_PROPOSAL, blockedReason: "Needs input" })).toBe(
+      false,
+    );
+  });
+
+  it("keeps legacy allowed repositories in the watched list", () => {
+    expect(
+      guidedAutopilotRepositories({
+        ...policy,
+        proposalRepos: ["/srv/proposals", "/srv/repo"],
+      }),
+    ).toEqual(["/srv/proposals", "/srv/repo"]);
+  });
 });
diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
index 00e32829324b..c360f363a346 100644
--- a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
@@ -42,6 +42,12 @@ const tierLabels = new Map<string, string>([
   [CODEX_MODEL_TIERS.medium, "Terra · Balanced"],
   [CODEX_MODEL_TIERS.high, "Sol · Deep"],
 ]);
+const padDatePart = (value: number) => String(value).padStart(2, "0");
+
+function localDateTimeInput(iso: string): string {
+  const date = new Date(iso);
+  return `${date.getFullYear()}-${padDatePart(date.getMonth() + 1)}-${padDatePart(date.getDate())}T${padDatePart(date.getHours())}:${padDatePart(date.getMinutes())}`;
+}
 
 export function launchModelOptions(policy: AutomodePolicy): ReadonlyArray<LaunchModelOption> {
   const models =
@@ -51,6 +57,18 @@ export function launchModelOptions(policy: AutomodePolicy): ReadonlyArray<Launch
   return [...new Set(models)].map((value) => ({ value, label: tierLabels.get(value) ?? value }));
 }
 
+export function isGuidedAutopilotProposal(proposal: HermesProposalCard): boolean {
+  return (
+    proposal.actionKind !== "read-only" &&
+    proposal.recommendedExecutor === "delamain" &&
+    proposal.blockedReason === null
+  );
+}
+
+export function guidedAutopilotRepositories(policy: AutomodePolicy): ReadonlyArray<string> {
+  return [...new Set([...policy.proposalRepos, ...policy.allowedRepos])];
+}
+
 export function initialProposalLaunchForm(
   proposal: HermesProposalCard,
   policy: AutomodePolicy,
@@ -67,7 +85,7 @@ export function initialProposalLaunchForm(
     prompt: proposal.nextCommandOrPrompt ?? proposal.detail,
     repository: proposal.projectDir ?? policy.allowedRepos[0] ?? "",
     model,
-    notBefore: proposal.notBefore?.slice(0, 16) ?? "",
+    notBefore: proposal.notBefore === null ? "" : localDateTimeInput(proposal.notBefore),
     runtime:
       proposal.maxRuntimeMinutes !== null
         ? String(proposal.maxRuntimeMinutes)
diff --git a/apps/web/src/lib/webPush.test.ts b/apps/web/src/lib/webPush.test.ts
index cb69a5f6356a..088419b52f18 100644
--- a/apps/web/src/lib/webPush.test.ts
+++ b/apps/web/src/lib/webPush.test.ts
@@ -89,4 +89,26 @@ describe("web push diagnostics", () => {
       }),
     );
   });
+
+  it("surfaces the server reason when a notification test fails", async () => {
+    installBrowser();
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ enabled: true, publicKey: "key" }),
+        })
+        .mockResolvedValueOnce({
+          ok: false,
+          status: 404,
+          json: async () => ({ error: "This device subscription is not registered." }),
+        }),
+    );
+
+    await expect(sendWebPushTest("delivery")).rejects.toThrow(
+      "This device subscription is not registered.",
+    );
+  });
 });
diff --git a/apps/web/src/lib/webPush.ts b/apps/web/src/lib/webPush.ts
index 16efbbfb91c5..3ca0eaae25ff 100644
--- a/apps/web/src/lib/webPush.ts
+++ b/apps/web/src/lib/webPush.ts
@@ -142,7 +142,14 @@ export async function sendWebPushTest(kind: WebPushTestKind): Promise<WebPushTes
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ endpoint: diagnostics.subscription.endpoint, kind }),
   });
-  if (!response.ok) throw new Error(`/api/push/test failed with HTTP ${response.status}`);
+  if (!response.ok) {
+    const body = (await response.json().catch(() => null)) as { readonly error?: unknown } | null;
+    throw new Error(
+      typeof body?.error === "string"
+        ? body.error
+        : `/api/push/test failed with HTTP ${response.status}`,
+    );
+  }
   return (await response.json()) as WebPushTestResult;
 }
 

From e2425cd2448327d235bb6384a1e5ad38f2facc54 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 23:44:21 +0100
Subject: [PATCH 12/13] fix: preserve guided launch safety state

---
 .../gits/Layers/AutomodeSupervisor.test.ts    |  16 +++
 .../src/gits/Layers/AutomodeSupervisor.ts     |  10 ++
 .../gits/Layers/HermesAutomodeBridge.test.ts  |   8 ++
 .../src/gits/Layers/HermesAutomodeBridge.ts   |   5 +
 .../gits/cockpit/AutopilotPanel.tsx           |  38 ++++--
 .../cockpit/ProposalLaunchSheet.browser.tsx   |  32 ++++-
 .../gits/cockpit/ProposalLaunchSheet.tsx      | 117 ++++++++++++++----
 .../proposalLaunch.logic.test.ts              |  17 +++
 .../proposal-launch/proposalLaunch.logic.ts   |  27 +++-
 9 files changed, 227 insertions(+), 43 deletions(-)

diff --git a/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts b/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts
index 274fb89f1495..4421e3a08d89 100644
--- a/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts
+++ b/apps/server/src/gits/Layers/AutomodeSupervisor.test.ts
@@ -287,6 +287,22 @@ describe("AutomodeSupervisorLive", () => {
     }).pipe(Effect.provide(makeLayer())),
   );
 
+  it.effect("rejects a zero-minute Goal runtime override", () =>
+    Effect.gen(function* () {
+      const supervisor = yield* AutomodeSupervisor;
+      const error = yield* supervisor
+        .enqueueGoal({
+          title: "Uncapped goal",
+          repo: "/tmp/source-repo",
+          prompt: "Run without a cap.",
+          maxRuntimeMinutes: 0,
+        })
+        .pipe(Effect.flip);
+
+      assert.include(error.message, "positive");
+    }).pipe(Effect.provide(makeLayer())),
+  );
+
   it.effect("blocks dispatch when the kill switch is enabled", () =>
     Effect.gen(function* () {
       const supervisor = yield* AutomodeSupervisor;
diff --git a/apps/server/src/gits/Layers/AutomodeSupervisor.ts b/apps/server/src/gits/Layers/AutomodeSupervisor.ts
index 21035f7ef1f2..d44a91753985 100644
--- a/apps/server/src/gits/Layers/AutomodeSupervisor.ts
+++ b/apps/server/src/gits/Layers/AutomodeSupervisor.ts
@@ -118,6 +118,10 @@ function toAutomodeError(message: string, cause?: unknown) {
   });
 }
 
+function hasValidGoalRuntime(runtime: number | null | undefined): boolean {
+  return runtime === null || runtime === undefined || runtime > 0;
+}
+
 function unavailableBudgetUsage(note: string): AutomodeBudgetUsage {
   return {
     source: "unavailable",
@@ -698,6 +702,9 @@ export const AutomodeSupervisorLive = Layer.effect(
         }),
       enqueueGoal: (input) =>
         Effect.gen(function* () {
+          if (!hasValidGoalRuntime(input.maxRuntimeMinutes)) {
+            return yield* toAutomodeError("Goal runtime must be a positive number of minutes.");
+          }
           const createdAt = yield* nowIso;
           const goal: AutomodeGoal = {
             id: `goal-${randomUUID()}`,
@@ -769,6 +776,9 @@ export const AutomodeSupervisorLive = Layer.effect(
         }),
       updateQueuedGoal: (input) =>
         Effect.gen(function* () {
+          if (!hasValidGoalRuntime(input.maxRuntimeMinutes)) {
+            return yield* toAutomodeError("Goal runtime must be a positive number of minutes.");
+          }
           const updatedAt = yield* nowIso;
           const nextState = yield* commitStateOrFail((state) => {
             const current = findGoal(state, input.goalId);
diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
index 0444ab3513e8..3c8e94d08fa7 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.test.ts
@@ -452,6 +452,14 @@ describe("decideProposalWithAutomodeBridge", () => {
         readonly input: HermesProposalDecisionInput;
         readonly message: string;
       }> = [
+        {
+          input: {
+            proposalId: "proposal-1",
+            decision: "approve",
+            maxRuntimeMinutes: 0,
+          },
+          message: "positive",
+        },
         {
           input: {
             proposalId: "proposal-1",
diff --git a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
index 274712e2966d..8a2b53033701 100644
--- a/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
+++ b/apps/server/src/gits/Layers/HermesAutomodeBridge.ts
@@ -96,6 +96,11 @@ export const decideProposalWithAutomodeBridge = (
           message: "Proposal model is not allowed by Automode policy.",
         });
       }
+      if (effectiveRuntime !== null && effectiveRuntime <= 0) {
+        return yield* new HermesAdapterError({
+          message: "Proposal runtime must be a positive number of minutes.",
+        });
+      }
       if (
         snapshot.policy.maxRuntimeMinutes !== null &&
         effectiveRuntime !== null &&
diff --git a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
index 8490e5951222..b2d29c76d913 100644
--- a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
+++ b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
@@ -7,7 +7,7 @@ import type {
 } from "@t3tools/contracts";
 import { useMutation } from "@tanstack/react-query";
 import { OctagonAlertIcon, RefreshCwIcon, RocketIcon } from "lucide-react";
-import { useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 
 import {
   AlertDialog,
@@ -167,6 +167,26 @@ export function AutopilotPanel({
   const proposalTest = notificationTest === "proposal";
   const [launchOpen, setLaunchOpen] = useState(proposalTest);
 
+  const openProposal = useCallback((proposal: HermesProposalCard, resetStep = true) => {
+    setSelectedProposal(proposal);
+    setLaunchOpen(true);
+    if (typeof window === "undefined") return;
+    const url = new URL(window.location.href);
+    url.searchParams.set("panel", "autopilot");
+    url.searchParams.set("proposal", proposal.id);
+    if (resetStep) url.searchParams.set("proposalStep", "idea");
+    window.history.replaceState(null, "", url);
+  }, []);
+
+  const changeLaunchOpen = (open: boolean) => {
+    setLaunchOpen(open);
+    if (open || proposalTest || typeof window === "undefined") return;
+    const url = new URL(window.location.href);
+    url.searchParams.delete("proposal");
+    url.searchParams.delete("proposalStep");
+    window.history.replaceState(null, "", url);
+  };
+
   useEffect(() => setRepositories(repositoryKey.split("\n").filter(Boolean)), [repositoryKey]);
 
   useEffect(() => {
@@ -177,10 +197,9 @@ export function AutopilotPanel({
       ["proposed", "approved"].includes(proposal.status) &&
       isGuidedAutopilotProposal(proposal)
     ) {
-      setSelectedProposal(proposal);
-      setLaunchOpen(true);
+      openProposal(proposal, false);
     }
-  }, [focusedProposalId, proposals]);
+  }, [focusedProposalId, proposals, openProposal]);
 
   const configure = useMutation({
     mutationFn: (enabled: boolean) => {
@@ -334,14 +353,7 @@ export function AutopilotPanel({
                       {proposal.summary}
                     </p>
                   </div>
-                  <Button
-                    size="sm"
-                    variant="outline"
-                    onClick={() => {
-                      setSelectedProposal(proposal);
-                      setLaunchOpen(true);
-                    }}
-                  >
+                  <Button size="sm" variant="outline" onClick={() => openProposal(proposal)}>
                     Review
                   </Button>
                 </article>
@@ -387,7 +399,7 @@ export function AutopilotPanel({
       {policy ? (
         <ProposalLaunchSheet
           open={launchOpen}
-          onOpenChange={setLaunchOpen}
+          onOpenChange={changeLaunchOpen}
           proposal={selectedProposal}
           policy={policy}
           {...(proposalTest ? { testMode: "proposal" as const } : {})}
diff --git a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
index 3464afb1ef09..364daf3d949e 100644
--- a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
+++ b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.browser.tsx
@@ -2,7 +2,7 @@ import "../../../index.css";
 
 import type { AutomodeGoal, AutomodePolicy } from "@t3tools/contracts";
 import { page } from "vitest/browser";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { render } from "vitest-browser-react";
 
 import { ProposalLaunchSheet } from "./ProposalLaunchSheet";
@@ -43,7 +43,25 @@ const queuedGoal = {
   planningBoundary: null,
 } satisfies AutomodeGoal;
 
+afterEach(() => window.history.replaceState(null, "", window.location.pathname));
+
 describe("ProposalLaunchSheet", () => {
+  it("restores the current step from the URL", async () => {
+    window.history.replaceState(null, "", `${window.location.pathname}?proposalStep=review`);
+    render(
+      <ProposalLaunchSheet
+        onDecision={vi.fn()}
+        onOpenChange={() => undefined}
+        open
+        policy={policy}
+        proposal={TEST_PROPOSAL}
+      />,
+    );
+
+    await expect.element(page.getByText("3 of 3")).toBeVisible();
+    await expect.element(page.getByRole("button", { name: "Accept & Queue" })).toBeVisible();
+  });
+
   it("guides review, model choice, advanced details, and queue confirmation", async () => {
     const onDecision = vi.fn().mockResolvedValue(queuedGoal);
     render(
@@ -63,6 +81,7 @@ describe("ProposalLaunchSheet", () => {
     await expect.element(page.getByText("Low risk")).toBeVisible();
     await expect.element(page.getByText("Complete the local test flow.")).toBeVisible();
     await page.getByRole("button", { name: "Continue" }).click();
+    expect(new URL(window.location.href).searchParams.get("proposalStep")).toBe("model");
 
     await expect.element(page.getByText("2 of 3")).toBeVisible();
     await expect.element(page.getByRole("combobox", { name: "Model" })).toBeVisible();
@@ -70,13 +89,24 @@ describe("ProposalLaunchSheet", () => {
     await expect.element(page.getByText("Repository override")).not.toBeInTheDocument();
     await page.getByRole("button", { name: "Advanced details" }).click();
     await expect.element(page.getByText("Repository override")).toBeVisible();
+    await page.getByRole("button", { name: "Add check" }).click();
+    await page
+      .getByRole("textbox", { name: "Verification 1 argument 3", exact: true })
+      .fill("test file.ts");
+    await page.getByLabelText("Verification 1 timeout seconds").fill("30");
     await page.getByRole("button", { name: "Review queue" }).click();
+    expect(new URL(window.location.href).searchParams.get("proposalStep")).toBe("review");
 
     await expect.element(page.getByText("3 of 3")).toBeVisible();
     await expect.element(page.getByText("/srv/example-project")).toBeVisible();
     await expect.element(page.getByText(/held PR for review/)).toBeVisible();
     await page.getByRole("button", { name: "Accept & Queue" }).click();
     expect(onDecision).toHaveBeenCalledTimes(1);
+    expect(onDecision.mock.calls[0]?.[2]).toMatchObject({
+      verificationCommands: [
+        { label: "Check", cmd: ["bun", "run", "test file.ts"], timeoutSeconds: 30 },
+      ],
+    });
     await expect.element(page.getByText("Queued", { exact: true })).toBeVisible();
     await expect.element(page.getByText(queuedGoal.title)).toBeVisible();
   });
diff --git a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
index fd2b310d2487..48821ee0ece3 100644
--- a/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
+++ b/apps/web/src/components/gits/cockpit/ProposalLaunchSheet.tsx
@@ -41,6 +41,7 @@ import {
   initialProposalLaunchForm,
   launchModelOptions,
   proposalLaunchEdits,
+  readProposalLaunchStep,
   validateProposalLaunchForm,
   type LaunchStep,
   type ProposalLaunchForm,
@@ -171,29 +172,83 @@ function VerificationRows({
       {commands.map((command, index) => (
         <div
           key={`${command.label}-${index}`}
-          className="grid grid-cols-[minmax(0,1fr)_minmax(0,1.6fr)_auto] gap-2"
+          className="grid gap-2 rounded-lg border border-border/60 p-3"
         >
-          <Input
-            aria-label={`Verification ${index + 1} label`}
-            value={command.label}
-            onChange={(event) => update(index, { label: event.currentTarget.value })}
-          />
-          <Input
-            aria-label={`Verification ${index + 1} command`}
-            className="font-mono text-xs"
-            value={command.cmd.join(" ")}
-            onChange={(event) =>
-              update(index, { cmd: event.currentTarget.value.trim().split(/\s+/).filter(Boolean) })
-            }
-          />
-          <Button
-            aria-label={`Remove verification ${index + 1}`}
-            size="icon"
-            variant="ghost"
-            onClick={() => onChange(commands.filter((_, row) => row !== index))}
-          >
-            <Trash2Icon />
-          </Button>
+          <div className="grid grid-cols-[minmax(0,1fr)_8rem_auto] gap-2">
+            <Input
+              aria-label={`Verification ${index + 1} label`}
+              value={command.label}
+              onChange={(event) => update(index, { label: event.currentTarget.value })}
+            />
+            <Input
+              aria-label={`Verification ${index + 1} timeout seconds`}
+              min="0"
+              placeholder="Timeout"
+              type="number"
+              value={command.timeoutSeconds ?? ""}
+              onChange={(event) => {
+                const { timeoutSeconds: _, ...withoutTimeout } = command;
+                const value = event.currentTarget.value;
+                onChange(
+                  commands.map((entry, row) =>
+                    row === index
+                      ? value === ""
+                        ? withoutTimeout
+                        : { ...withoutTimeout, timeoutSeconds: Number(value) }
+                      : entry,
+                  ),
+                );
+              }}
+            />
+            <Button
+              aria-label={`Remove verification ${index + 1}`}
+              size="icon"
+              variant="ghost"
+              onClick={() => onChange(commands.filter((_, row) => row !== index))}
+            >
+              <Trash2Icon />
+            </Button>
+          </div>
+          <div className="grid gap-2">
+            {command.cmd.map((argument, argumentIndex) => (
+              // oxlint-disable-next-line react/no-array-index-key -- argv values can repeat; position is their identity
+              <div key={argumentIndex} className="flex gap-2">
+                <Input
+                  aria-label={`Verification ${index + 1} argument ${argumentIndex + 1}`}
+                  className="font-mono text-xs"
+                  value={argument}
+                  onChange={(event) =>
+                    update(index, {
+                      cmd: command.cmd.map((entry, row) =>
+                        row === argumentIndex ? event.currentTarget.value : entry,
+                      ),
+                    })
+                  }
+                />
+                <Button
+                  aria-label={`Remove verification ${index + 1} argument ${argumentIndex + 1}`}
+                  disabled={command.cmd.length === 1}
+                  size="icon"
+                  variant="ghost"
+                  onClick={() =>
+                    update(index, {
+                      cmd: command.cmd.filter((_, row) => row !== argumentIndex),
+                    })
+                  }
+                >
+                  <Trash2Icon />
+                </Button>
+              </div>
+            ))}
+            <Button
+              className="justify-self-start"
+              size="xs"
+              variant="ghost"
+              onClick={() => update(index, { cmd: [...command.cmd, ""] })}
+            >
+              <PlusIcon /> Add argument
+            </Button>
+          </div>
         </div>
       ))}
     </div>
@@ -386,7 +441,7 @@ export function ProposalLaunchSheet({
 
   useEffect(() => {
     if (!open || activeProposal === null) return;
-    setStep("idea");
+    setStep(readProposalLaunchStep(typeof window === "undefined" ? "" : window.location.search));
     setForm(initialProposalLaunchForm(activeProposal, policy));
     setAdvanced(false);
     setWorking(false);
@@ -398,6 +453,14 @@ export function ProposalLaunchSheet({
   const validation = useMemo(() => validateProposalLaunchForm(form), [form]);
   if (activeProposal === null) return null;
 
+  const changeStep = (next: LaunchStep) => {
+    setStep(next);
+    if (typeof window === "undefined") return;
+    const url = new URL(window.location.href);
+    url.searchParams.set("proposalStep", next);
+    window.history.replaceState(null, "", url);
+  };
+
   const decide = async (decision: MotokoProposalDecision) => {
     if (decision === "approve" && !validation.ok) {
       setError(validation.message);
@@ -502,16 +565,18 @@ export function ProposalLaunchSheet({
                 <Button
                   disabled={working}
                   variant="outline"
-                  onClick={() => setStep(step === "review" ? "model" : "idea")}
+                  onClick={() => changeStep(step === "review" ? "model" : "idea")}
                 >
                   Back
                 </Button>
               ) : null}
               {step === "idea" ? (
-                <Button onClick={() => setStep("model")}>Continue</Button>
+                <Button onClick={() => changeStep("model")}>Continue</Button>
               ) : step === "model" ? (
                 <Button
-                  onClick={() => (validation.ok ? setStep("review") : setError(validation.message))}
+                  onClick={() =>
+                    validation.ok ? changeStep("review") : setError(validation.message)
+                  }
                 >
                   Review queue
                 </Button>
diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
index 576079f294e4..983ba14f144b 100644
--- a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.test.ts
@@ -12,6 +12,7 @@ import {
   isGuidedAutopilotProposal,
   launchModelOptions,
   proposalLaunchEdits,
+  readProposalLaunchStep,
   validateProposalLaunchForm,
 } from "./proposalLaunch.logic.ts";
 
@@ -73,10 +74,20 @@ describe("guided proposal launch logic", () => {
       ok: false,
       field: "runtime",
     });
+    expect(validateProposalLaunchForm({ ...form, runtime: "0" })).toMatchObject({
+      ok: false,
+      field: "runtime",
+    });
     expect(validateProposalLaunchForm({ ...form, notBefore: "invalid" })).toMatchObject({
       ok: false,
       field: "notBefore",
     });
+    expect(
+      validateProposalLaunchForm({
+        ...form,
+        verificationCommands: [{ label: "Check", cmd: ["bun", ""] }],
+      }),
+    ).toMatchObject({ ok: false, field: "verification" });
   });
 
   it("builds typed edits and converts local time to ISO", () => {
@@ -128,4 +139,10 @@ describe("guided proposal launch logic", () => {
       }),
     ).toEqual(["/srv/proposals", "/srv/repo"]);
   });
+
+  it("restores only valid URL-backed launch steps", () => {
+    expect(readProposalLaunchStep("?proposalStep=review")).toBe("review");
+    expect(readProposalLaunchStep("?proposalStep=unknown")).toBe("idea");
+    expect(readProposalLaunchStep("")).toBe("idea");
+  });
 });
diff --git a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
index c360f363a346..91754b4a5d2a 100644
--- a/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
+++ b/apps/web/src/components/gits/cockpit/proposal-launch/proposalLaunch.logic.ts
@@ -24,6 +24,11 @@ export interface LaunchModelOption {
   readonly label: string;
 }
 
+export function readProposalLaunchStep(search: string): LaunchStep {
+  const step = new URLSearchParams(search).get("proposalStep");
+  return step === "model" || step === "review" ? step : "idea";
+}
+
 export type ProposalLaunchEdits = Omit<
   HermesProposalDecisionInput,
   "proposalId" | "decision" | "reason"
@@ -33,7 +38,7 @@ export type ProposalLaunchValidation =
   | { readonly ok: true }
   | {
       readonly ok: false;
-      readonly field: "repository" | "model" | "runtime" | "notBefore";
+      readonly field: "repository" | "model" | "runtime" | "notBefore" | "verification";
       readonly message: string;
     };
 
@@ -109,13 +114,29 @@ export function validateProposalLaunchForm(form: ProposalLaunchForm): ProposalLa
   }
   if (form.runtime.length > 0) {
     const runtime = Number(form.runtime);
-    if (!Number.isInteger(runtime) || runtime < 0) {
-      return { ok: false, field: "runtime", message: "Runtime must be zero or more minutes." };
+    if (!Number.isInteger(runtime) || runtime <= 0) {
+      return { ok: false, field: "runtime", message: "Runtime must be at least one minute." };
     }
   }
   if (form.notBefore.length > 0 && Number.isNaN(new Date(form.notBefore).getTime())) {
     return { ok: false, field: "notBefore", message: "Choose a valid start time." };
   }
+  if (
+    form.verificationCommands.some(
+      (command) =>
+        command.label.trim().length === 0 ||
+        command.cmd.length === 0 ||
+        command.cmd.some((argument) => argument.trim().length === 0) ||
+        (command.timeoutSeconds !== undefined &&
+          (!Number.isInteger(command.timeoutSeconds) || command.timeoutSeconds < 0)),
+    )
+  ) {
+    return {
+      ok: false,
+      field: "verification",
+      message: "Each verification check needs a label, non-empty arguments, and a valid timeout.",
+    };
+  }
   return { ok: true };
 }
 

From 60c8cad66cfc6911bf033ee91436d05df19ad8b4 Mon Sep 17 00:00:00 2001
From: Joshua <joshuaduffill@gmail.com>
Date: Sun, 9 Aug 2026 23:47:54 +0100
Subject: [PATCH 13/13] fix: consume proposal deep links once

---
 .../gits/cockpit/AutopilotPanel.browser.tsx   | 40 ++++++++++++++++---
 .../gits/cockpit/AutopilotPanel.tsx           |  6 ++-
 2 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx b/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx
index 2a095ca04462..39669a87ed06 100644
--- a/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx
+++ b/apps/web/src/components/gits/cockpit/AutopilotPanel.browser.tsx
@@ -1,6 +1,6 @@
 import "../../../index.css";
 
-import type { AutomodeSnapshot } from "@t3tools/contracts";
+import type { AutomodeSnapshot, HermesProposalListResult } from "@t3tools/contracts";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { page } from "vitest/browser";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -25,6 +25,7 @@ vi.mock("~/gitsClient", () => ({
 vi.mock("~/components/ui/toast", () => ({ toastManager: { add: vi.fn() } }));
 
 import { AutopilotPanel } from "./AutopilotPanel";
+import { TEST_PROPOSAL } from "./proposal-launch/proposalLaunch.logic";
 
 const snapshot = (on: boolean, repositories = ["/srv/project"]): AutomodeSnapshot =>
   ({
@@ -52,25 +53,33 @@ const snapshot = (on: boolean, repositories = ["/srv/project"]): AutomodeSnapsho
     pendingApprovalCount: 0,
   }) as unknown as AutomodeSnapshot;
 
-function renderPanel(value: AutomodeSnapshot) {
-  return render(
+function panel(
+  value: AutomodeSnapshot,
+  focusedProposalId: string | null = null,
+  proposals: HermesProposalListResult | undefined = undefined,
+) {
+  return (
     <QueryClientProvider
       client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}
     >
       <AutopilotPanel
         error={null}
-        focusedProposalId={null}
+        focusedProposalId={focusedProposalId}
         loading={false}
         onProposalDecision={vi.fn()}
         onRefresh={vi.fn()}
         projects={[]}
-        proposals={undefined}
+        proposals={proposals}
         snapshot={value}
       />
-    </QueryClientProvider>,
+    </QueryClientProvider>
   );
 }
 
+function renderPanel(value: AutomodeSnapshot) {
+  return render(panel(value));
+}
+
 beforeEach(() => {
   automode.configure.mockResolvedValue(undefined);
   automode.stopAll.mockResolvedValue({ stoppedPeers: 0, failures: 0 });
@@ -114,4 +123,23 @@ describe("AutopilotPanel", () => {
     await expect.element(page.getByRole("alert")).toHaveTextContent("Choose at least one");
     expect(automode.configure).not.toHaveBeenCalled();
   });
+
+  it("does not reopen a consumed deep-linked proposal after polling", async () => {
+    const proposals = {
+      proposals: [TEST_PROPOSAL],
+      checkedAt: "2026-08-09T00:00:00.000Z",
+    } satisfies HermesProposalListResult;
+    const screen = await render(panel(snapshot(false), TEST_PROPOSAL.id, proposals));
+    await expect.element(page.getByText("Validate and queue")).toBeVisible();
+    await page.getByRole("button", { name: "Close" }).click();
+    await expect.element(page.getByText("Validate and queue")).not.toBeInTheDocument();
+
+    await screen.rerender(
+      panel(snapshot(false), TEST_PROPOSAL.id, {
+        ...proposals,
+        checkedAt: "2026-08-09T00:01:00.000Z",
+      }),
+    );
+    await expect.element(page.getByText("Validate and queue")).not.toBeInTheDocument();
+  });
 });
diff --git a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
index b2d29c76d913..af31a608d4f6 100644
--- a/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
+++ b/apps/web/src/components/gits/cockpit/AutopilotPanel.tsx
@@ -7,7 +7,7 @@ import type {
 } from "@t3tools/contracts";
 import { useMutation } from "@tanstack/react-query";
 import { OctagonAlertIcon, RefreshCwIcon, RocketIcon } from "lucide-react";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 
 import {
   AlertDialog,
@@ -160,6 +160,7 @@ export function AutopilotPanel({
   const [validationError, setValidationError] = useState<string | null>(null);
   const [stopOpen, setStopOpen] = useState(false);
   const [selectedProposal, setSelectedProposal] = useState<HermesProposalCard | null>(null);
+  const consumedFocus = useRef<string | null>(null);
   const notificationTest =
     typeof window === "undefined"
       ? null
@@ -190,13 +191,14 @@ export function AutopilotPanel({
   useEffect(() => setRepositories(repositoryKey.split("\n").filter(Boolean)), [repositoryKey]);
 
   useEffect(() => {
-    if (!focusedProposalId) return;
+    if (!focusedProposalId || consumedFocus.current === focusedProposalId) return;
     const proposal = proposals?.proposals.find((candidate) => candidate.id === focusedProposalId);
     if (
       proposal &&
       ["proposed", "approved"].includes(proposal.status) &&
       isGuidedAutopilotProposal(proposal)
     ) {
+      consumedFocus.current = focusedProposalId;
       openProposal(proposal, false);
     }
   }, [focusedProposalId, proposals, openProposal]);