feat(inbox): rebuild compact cards and share task review controls (#20961)

## Thinking Path > - Paperclip helps people manage AI agents and their work. > - The inbox collects decisions, requests, and updates for the people in a company. > - People need a clear personal queue and a consistent way to answer each request. > - Repeated headings, inconsistent card actions, and separate review flows make that work harder. > - This pull request connects the inbox UI to the routing foundation in #20959. > - Compact cards use shared task controls and open supporting work in a side panel. > - People can answer, claim, transfer, archive, and inspect outcomes from one place. ## Linked Issues or Issue Description **What existing behavior does this improve?** The inbox cards, personal views, shared task controls, and decision history. **Subsystem affected** UI. This PR targets master and uses the routing foundation merged in #20959. **Current behavior** The inbox repeats headings and counts. Cards have different layouts and action placement. The requester can repeat the signed-in person's name. Review and question controls differ between the inbox and task thread. **Proposed behavior** Open Assigned to you by default. Show one count line above the cards. Use a compact card layout with consistent actions and supporting details. Show the requester's avatar and name only when they differ from the signed-in person. Share question controls, including a radio option for Other that reveals a text field when selected. **Reason and benefit** People can scan their queue and complete requests without losing the surrounding task or creating separate drafts for the same review. **Breaking changes** The default inbox view becomes personal. The all-assignee and shared views remain available. Card close menus distinguish personal archive and snooze from shared withdrawal. **Additional context** Refs #20959, #19363, and #19520. Refs #20268 for related actionable-request work. This stack adds personal routing and shared controls. ROADMAP.md includes Multiple Human Users and Agent Reviews and Approvals. ## What Changed - Add personal, unassigned, company, all-assignee, and archived inbox views. Add claim, transfer, personal close actions, receipts, and history controls. - Use compact decision cards with a single count line, one-pixel borders, and equal space above, below, and to the right of each primary action. - Open artifacts and synchronized confirmation/approval controls in a shared side panel. Share their revision drafts and action state with the task thread. Other requests keep one editable form on the inbox card while reviewing an artifact. - Make Other match the question options and reveal its field only when selected. Apply this to inbox and task question cards. - Hide self-requester labels, space agent avatars, and use the standard canceled status icon for withdrawn requests. - Use connector logos in connector cards. Keep the connector promotion background and sidebar border continuous. - Add company and project decision-owner controls and document the updated inbox behavior. ## Verification - The complete [GitHub Actions CI matrix](https://github.com/paperclipai/paperclip/actions/runs/43141559641) passes on `8d81a75e49b518fff6b6ff4c23dd67979b0b97ee` (Linux/Node 24: typecheck, build, general and serialized tests, Runner support, browser shards, and aggregate gates). Greptile is 5/5 on that exact head with zero open findings, and the security scan passes. - Local UI typechecking passes. Eight focused suites pass 382 tests: 236 inbox/review/question/connector tests plus all 146 composer tests. Regressions passed red to green for attachment links, prompt rendering, single-form artifact review, connector scope copy, accessible headings, and the composer test harness's missing theme provider. The final commit changes only that test harness; production code is unchanged from `59d015833f`. - Browser acceptance on the production implementation confirms preserved selected answers with one editable question form, accessible Markdown prompts, inert image references, accurate connector scope copy, native PDF downloads, image sidebar previews, and Open file requesting the attachment endpoint while preserving the inbox URL. Request reads and file responses were intercepted; no question answers were written. The preview is healthy on the final head. - Visual and interaction checks cover Other radio behavior in both themes and on mobile, the loaded Google Calendar logo, and 20px above, below, and to the right of the primary action across all 23 visible cards. The affected desktop/mobile navigation and sidebar specs pass locally and in the final CI browser matrix. - Real-editor browser checks confirm Ctrl/Cmd+Enter cannot bypass another person's confirmation. Cancel preserves the draft and unlocks silently; Continue submits once. Approval write failures remain visible. - `pnpm verify` returns exit 2 because DESIGN.md requires broader coverage; the final full CI matrix supplies every requested gate. Maps and Storybook catalog structural checks pass. The routing foundation #20959 merged after passing 249 database tests, server typechecking, full CI, Greptile 5/5, and security scanning. Its backend and SDK registry are preserved. - Demo data is retained for testing; database suites and browser specs use separate disposable databases. ## Risks - The inbox uses the routing contracts merged in #20959. Personal filters and history affect shared task entry points; the affected controls are included in local regression coverage and full CI. - Personal defaults and close-menu wording change inbox behavior. Existing resolver permissions still control shared actions. - Shared revision state and live invalidation affect two surfaces. Focused tests cover draft synchronization, action locks, and incoming updates. - Visual changes use the existing design tokens and component primitives. ## Model Used OpenAI GPT-6 through Codex. Used repository tools, code execution, and browser checks. This session does not expose a more specific runtime model ID or its context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal Paperclip ticket id - [x] I have run focused tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Scott Tong <scott@scottsmbpm5max.lan> Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-11-14 00:26:28 +01:00 · 2026-11-11 21:05:00 -08:00
1 parent 156453fe7c
commit cf1def0ca6
@@ -114,9 +114,10 @@ API: `present` — representative operation IDs:
  and distinct accessible task IDs for Needs attention. It has the same board,
  company, privacy, addressee, dismissal, snooze, and archive gates as the feed.
 - `GET /api/companies/{companyId}/attention/history` — read-only canonical
-  interaction/Decisions-v1 projection with cursor, search, outcome, agent, project,
-  date, and chronological sort filters. Each source and v1 target must pass task
-  privacy checks. Bounded to 100 records per page; no second decision write store.
+  interaction/Decisions-v1/approval projection with cursor, search, outcome, agent,
+  project, date, and chronological sort filters. Each source and v1 target must pass
+  task privacy checks; an approval linked to a task needs that task to be readable.
+  Bounded to 100 records per page; no second decision write store.

 The history route is **operator-only**: a board user with company access is
 required. It does not grant an agent resolver authority. Existing task interaction
@@ -26,10 +26,13 @@ API: `present` — representative operation IDs:
 Agent access: `available` — Native create_project/list_projects; REST / CLI / MCP.

 Policy: Company/project visibility, protected configuration/runtime policies; some
-repository/privacy management requires board.
+repository/privacy management requires board. Only a board user may set or clear a
+project's `decisionOwnerUserId` (PAP-749 escalation owner); an agent's change is 403,
+and a value that is not an active company member is 422.

 Evidence: `source-only` — [implementation](../../server/src/routes/projects.ts#L278) at
-the reviewed commit above.
+the reviewed commit above; the decision-owner rule is covered by
+[route tests](../../server/src/__tests__/project-decision-owner-route.test.ts).

 Verification: `not-run` — exercise a listed permitted operation with actual agent
 credentials/run context; inspect its result and applicable persistence/attribution.
@@ -261,6 +261,15 @@ Verification: `not-run` — Withdraw through each permitted actor, reload termin

 Gaps: No agent skip authority or generic manual expiry API.

+The board-only attention close route
+(`POST /api/companies/{companyId}/attention/{sourceKind}/{sourceId}/close`,
+`mode: "withdraw"`) runs this same withdraw flow for every interaction kind and
+also lets a person withdraw a pending card that outlived its closed task (no
+wake). Its `archive`/`snooze` modes and the `…/transfer` route ("Route to @x",
+sets `addresseeUserId` after checking the new owner can answer) are board-only
+presentation and routing changes, not agent capabilities. Evidence:
+[route tests](../../server/src/__tests__/attention-close.test.ts).
+
 ### `skip`

 API: `present` — POST /api/issues/{id}/interactions/{interactionId}/skip.
@@ -466,6 +475,14 @@ Verification: `not-run` — Board decisions and revision request, reload audit +

 Gaps: Request-revision concurrency/replay not claimed as equivalent to approve/reject; payload integrations remain explicit.

+Withdraw (PAP-749 task 2b): POST /api/approvals/{id}/cancel and the attention
+close route with `mode: "withdraw"` cancel an open approval as out of date. They
+are board-only and never approve: the gate stays closed, `decidedByUserId` and
+the reason are recorded, `approval.cancelled` is logged and the requesting agent
+is woken. Hire requests return 422 (reject them instead); a resolved approval
+returns 409 `attention_already_closed`. Evidence: `source-only` plus
+[route tests](../../server/src/__tests__/attention-close.test.ts); no agent path.
+
 ### `resubmit`

 API: `present` — POST /api/approvals/{id}/resubmit.
@@ -32,6 +32,58 @@ Open `/decisions`, then a queue at `/decisions/queues/:key` and its source item.

 In Coordinator, `/decisions` is **Inbox**. Pending cards use the existing attention feed and canonical
 resolvers. **Tasks → Needs attention** projects the same feed as distinct tasks.
+With **Settings → Experimental → Coordinator workspace** enabled, `/decisions`
+is **Needs You**. Pending cards use the existing attention feed and canonical
+resolvers. **Tasks → Needs attention** projects the **For you** feed as distinct tasks.
+
+Both `/decisions` surfaces switch between **For you** (default), **Unassigned**,
+**Company** and **Archived** (`?view=unassigned|company|archived`); each list is
+cached per person and view. Board members (not viewers) also get **Everyone**
+(`?view=all`): every person's open cards, with its own tab count that is never
+in the badge. **Archived** lists only the open cards you archived
+(with the archive date and any Stale chip), then a **Snoozed** group with the
+time each card comes back; its Close… menu offers **Restore** (or **Restore
+now** and **Change snooze time**) instead of Archive, and the cards stay
+answerable. Its tab count is never in the badge, and the other views no longer
+show Snoozed/Archived curtains. Your own cards say **Why me?**, a different person's card shows **For
+@name**, and an ownerless request card offers **Claim**, which makes you its
+addressee and removes it from everyone else's pool (`attention.claimed` activity).
+For you shows "N cards need an owner" while the pool has cards; that count is
+not in the badge.
+Escalation owners catch cards that name no person: a project's **Decision owner**
+(Project → Configuration) first, then the company's **Default decision owner**
+(Company Settings → Decisions), else Unassigned. The company's **Budget owner**
+gets each budget hard stop in For you ("You own budget escalation", with Raise
+limit / Keep paused) while Company still shows it to every operator as "For
+@owner"; a different person's Raise limit or Keep paused leaves the owner a
+receipt. An owner who is no longer an active member is skipped.
+Every card carries `closeModes` for one close API
+(`POST /companies/:companyId/attention/:sourceKind/:sourceId/close`):
+**Withdraw** closes an interaction, decision or approval for everyone through
+its own withdraw/cancel, never as consent, and tells the agent; **Archive** and
+**Snooze** hide the card for you only. **Transfer** (`…/transfer`) routes an
+interaction to another person who can answer it. A late second answer gets 409
+"Already answered" naming who answered first. Failed-run, recovery and
+agent-error cards offer only actions they can complete (Retry, Open run, Open
+recovery, Inspect).
+Each card on both surfaces has one **Close…** menu with only its `closeModes`:
+**Withdraw request…** (confirms, optional reason, cannot be undone), **Archive
+for me**, **Snooze for me** (both with Undo) and, for interactions, **Transfer
+to @x**. A card for a different person asks "This is for @x. Continue?" before
+its answer controls, Withdraw or Transfer. Failed runs **Retry** inline; budget
+stops **Raise budget** or **Keep paused** inline. Stale cards carry a **Stale ·
+reason** chip and sit in a collapsed **Stale (N)** group at the bottom of each
+view; **Withdraw all stale** lists every card first and withdraws only those
+with a real withdraw. "Dismiss — no effects" and the questions-only Cancel are
+gone; archived and snoozed cards live in the **Archived** view.
+One obligation is one card: a pending approval leads, with the in-review task
+that waits on it as a line under it, and a failed run leads (with **Retry**),
+with the task it blocks under it; the run then shows where the blocked task
+does. A budget hard stop leads its override approval ("Approval this answers"):
+Raise limit or Keep paused answers both, and the approval is no longer an
+ownerless card in Unassigned. The feed still returns every card, the evidence hides and returns with
+its lead, and each view count and the badge count the obligation once. A task
+with a configured human review stage keeps its review card next to the approval.
 Search, filter by agent/project, sort, and group by task/agent/project apply to
 both open decisions and the visible Recent Decisions receipts. Successful
 resolutions resize into compact receipts while the same contained Gather Light
@@ -46,8 +98,14 @@ canonical stalled-review item stays in Inbox and Tasks → Needs attention.
 Coordinator presents the existing recovery actions with **Mark task done** as
 the task-level verdict, distinct from the saved artifact receipt.

-Open **Decision history** on this surface for the paginated history sidebar;
-it merges answered questions and confirmations with Decisions-v1 outcomes.
+Open **Decision history** (on both `/decisions` surfaces) for the paginated
+history panel; it merges answered questions and confirmations, Decisions-v1
+outcomes and approvals. It opens on **Handled by me or for me** (what you
+answered, withdrew or transferred, what someone handled for you, and the cards
+that were for you); **Everyone** in the same panel lists every person's.
+Coordinator's Recent Decisions opens on the same scope. Outcome filters include **Withdrawn**, **Expired** (not
+cards closed with their task), **Closed with task** and **Handled for me**, within either scope; a
+withdrawn entry names who withdrew it and the reason.

 ### `search`

@@ -110,6 +168,41 @@ after an answer with retained history, and company/task-visibility/addressee che
 Idle chats without structured requests remain absent. The
 [Inbox component test](../../ui/src/components/coordinator/CoordinatorNeedsYou.test.tsx)
 checks that a chat-sourced canonical question reaches its original resolver and context.
+Idle chats without structured requests remain absent.
+[Audience, badge and claim tests](../../server/src/__tests__/attention-audience-service.test.ts)
+cover the view partition, the For you badge with per-view counts, the personal
+`view=archived` list and its tab count, and the claim service and route
+permission matrix. The [canonical history](../../server/src/__tests__/decision-history.test.ts)
+tests also cover approvals, the Withdrawn / Expired / Closed with task filters,
+and the Handled by me or for me / Everyone scope (instigator walk, addressee and
+assignee precedence, receipts, filters and paging inside a scope).
+[Close and transfer tests](../../server/src/__tests__/attention-close.test.ts)
+cover withdraw for every interaction kind (including on a closed task), approval
+and decision cancel, personal archive/snooze, transfer, history labels, and the
+400/403/404/409/422 matrix of the close, transfer and approval-cancel routes.
+[Current-card tests](../../server/src/__tests__/attention-current-cards.test.ts)
+cover the shared active-request predicate with Mine, the 30-day, closed-task,
+decision-deadline and 7-day Unassigned stale rules, stale approval escalation
+without withdrawal, fingerprint-only resurfacing of dismissed and snoozed cards,
+and the idempotent closed-task sweep.
+[Escalation owner tests](../../server/src/__tests__/attention-escalation-owners.test.ts)
+cover project decision owners ahead of the default owner, skipping an inactive
+owner, the budget owner's hard stop in For you and in everyone's Company view
+(one badge card), Company only without a budget owner, and the budget owner's
+receipt; the [project](../../server/src/__tests__/project-decision-owner-route.test.ts)
+and [company](../../server/src/__tests__/company-default-decision-owner-route.test.ts)
+route tests cover the active-member 422 and board-only writes.
+[Obligation tests](../../server/src/__tests__/attention-obligations.test.ts)
+cover the approval/review, budget-stop/override-approval and blocked-task/failed-run joins, the separate human
+review gate, placement with the blocked task's person, one count per obligation,
+evidence that hides and restores with its lead, and the split after an answer. The
+[Needs You component test](../../ui/src/components/coordinator/CoordinatorNeedsYou.test.tsx)
+checks that a chat-sourced canonical question reaches its original resolver and context,
+and the view switch, banner, Why me?, For @name and Claim, and Everyone for a board member only (with the withdraw confirmation for another person's card); the
+[classic page view test](../../ui/src/pages/WhatNeedsMe.views.test.tsx) checks the same on Decisions,
+plus the Archived view with Restore, Change time and Decision history on both pages.
+The [Decisions views stories](../../ui/storybook/stories/inbox-search/needs-you-views.stories.tsx)
+show For you, Unassigned, Company, Archived, Everyone, a different person's cards, one card for each obligation and the escalation owners (including the budget owner's hard stop in another person's Company view).
 It also checks simultaneous resize/light and delayed movement to Recent Decisions.
 [Shared card-motion tests](../../ui/src/components/coordinator/CoordinatorTaskCommitment.test.tsx)
 cover reduced-motion settlement and returning to a resolved card without replay.
@@ -187,3 +280,5 @@ Scope: ui
 Storybook: Eligible live task toast, explicit mention, quiet unrelated event, own-action/visible-task suppression, dedupe and company/account switch.
 Production: Persisted participation and mentions determine per-viewer socket eligibility; quiet events still refresh caches; reload retains eligibility, unauthorized resources remain denied.
 Sources: Source: [ToastViewport.tsx](../../ui/src/components/ToastViewport.tsx), [ToastContext.tsx](../../ui/src/context/ToastContext.tsx), [LiveUpdatesProvider.tsx](../../ui/src/context/LiveUpdatesProvider.tsx), [task-toast-eligibility.ts](../../server/src/realtime/task-toast-eligibility.ts). Tests: [ToastContext.test.tsx](../../ui/src/context/ToastContext.test.tsx), [ToastViewport.test.tsx](../../ui/src/components/ToastViewport.test.tsx), [LiveUpdatesProvider.hook.test.tsx](../../ui/src/context/LiveUpdatesProvider.hook.test.tsx), [task-toast-eligibility.test.ts](../../server/src/__tests__/task-toast-eligibility.test.ts), [live-events-toast.test.ts](../../server/src/__tests__/live-events-toast.test.ts), [multi-user-authenticated.spec.ts](../../tests/e2e/multi-user-authenticated.spec.ts)
+
+Coordinator and classic navigation, the phone bar and both Decisions pages show one badge: the person's current **For you** cards, read from the same per-person feed, with no midnight reset. Unassigned and Company counts stay on their own tabs. Task questions resolve through their original interaction; pending chat projections, counts and recorded receipts invalidate together.