From 3ed859739205a2edeac522cfde37cc91afcdd04b Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 21:23:20 +0200
Subject: [PATCH 1/7] =?UTF-8?q?feat:=20phase=205=20=E2=80=94=20determinism?=
 =?UTF-8?q?=20classification,=20per-check=20config,=20activation=20authori?=
 =?UTF-8?q?ty?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Derive deterministic/stochastic badge from check type (no DB column):
  template/generated → deterministic, judge → stochastic
- CheckResult gains `type` field, stored in CaseResult.checks JSON for display
- registry.py stamps type on every result including error fallbacks
- New update_check_params() in service.py; deep-copies config to ensure
  SQLAlchemy JSON dirty detection; draft-only, recomputes content_hash
- _build_check_list adds determinism + check_index fields
- New GET /pipelines/versions/{vid}/checks and PATCH /pipelines/versions/{vid}/check-params endpoints
- POST /pipelines/generate surfaces PermissionError (activated:false + permission_error)
  instead of silently swallowing it in enforced mode
- determinism_badge macro added to _macros.html
- pipeline_review.html: badge per check row + All/Deterministic/Stochastic filter pills
- pipeline_new.html Step 3: fetches persisted checks, shows badges, inline param editing,
  draft warning banner for enforced-mode non-reviewer flows
- _transcript.html: badge + score/threshold display per check (graceful for old records)
- 10 new tests in test_phase5.py; all 143 tests passing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/checks/base.py                        |   4 +-
 assay/checks/registry.py                    |  15 +-
 assay/pipeline/service.py                   |  46 ++++
 assay/server/app.py                         |  64 ++++-
 assay/server/templates/_macros.html         |  15 ++
 assay/server/templates/_transcript.html     |  10 +
 assay/server/templates/pipeline_new.html    | 113 ++++++++-
 assay/server/templates/pipeline_review.html |  20 +-
 tests/test_phase5.py                        | 264 ++++++++++++++++++++
 9 files changed, 524 insertions(+), 27 deletions(-)
 create mode 100644 tests/test_phase5.py

diff --git a/assay/checks/base.py b/assay/checks/base.py
index dcba02e..1233d6a 100644
--- a/assay/checks/base.py
+++ b/assay/checks/base.py
@@ -13,12 +13,13 @@ class CheckResult:
     message: str = ""
     evidence: dict[str, Any] = field(default_factory=dict)
     required: bool = True
+    type: str = ""                      # template | generated | judge (for display)
 
     def to_dict(self) -> dict:
         return asdict(self)
 
 
-def from_raw(raw: dict, check_id: str, required: bool) -> CheckResult:
+def from_raw(raw: dict, check_id: str, required: bool, type: str = "") -> CheckResult:
     """Build a CheckResult from the plain dict a generated function returns."""
     return CheckResult(
         check_id=check_id,
@@ -28,4 +29,5 @@ def from_raw(raw: dict, check_id: str, required: bool) -> CheckResult:
         message=raw.get("message", ""),
         evidence=raw.get("evidence", {}) or {},
         required=required,
+        type=type,
     )
diff --git a/assay/checks/registry.py b/assay/checks/registry.py
index 5d4df39..4382b77 100644
--- a/assay/checks/registry.py
+++ b/assay/checks/registry.py
@@ -15,18 +15,21 @@ def run_check(spec: CheckSpec, response: dict, context: dict,
         fn = TEMPLATES.get(spec.uses)
         if fn is None:
             return CheckResult(cid, False, severity="fail",
-                               message=f"unknown template: {spec.uses}", required=spec.required)
+                               message=f"unknown template: {spec.uses}", required=spec.required,
+                               type="template")
         raw = fn(response, spec.with_)
-        return from_raw(raw, f"template:{spec.uses}", spec.required)
+        return from_raw(raw, f"template:{spec.uses}", spec.required, type="template")
     if spec.type == "generated":
         raw = run_generated_check(spec.uses, response, context)
-        return from_raw(raw, f"generated:{spec.uses}", spec.required)
+        return from_raw(raw, f"generated:{spec.uses}", spec.required, type="generated")
     if spec.type == "judge":
         provider = judges.get(spec.judge)
         if provider is None:
             return CheckResult(cid, False, severity="fail",
-                               message=f"unknown judge: {spec.judge}", required=spec.required)
+                               message=f"unknown judge: {spec.judge}", required=spec.required,
+                               type="judge")
         raw = run_judge_check(provider, spec.rubric, response, context)
-        return from_raw(raw, f"judge:{spec.judge}", spec.required)
+        return from_raw(raw, f"judge:{spec.judge}", spec.required, type="judge")
     return CheckResult(cid, False, severity="fail",
-                       message=f"unknown check type: {spec.type}", required=spec.required)
+                       message=f"unknown check type: {spec.type}", required=spec.required,
+                       type=spec.type)
diff --git a/assay/pipeline/service.py b/assay/pipeline/service.py
index 9acb318..7032849 100644
--- a/assay/pipeline/service.py
+++ b/assay/pipeline/service.py
@@ -78,6 +78,52 @@ def update_version_config(
         pv.content_hash = ch
 
 
+def update_check_params(
+    version_id: int,
+    suite_id: str,
+    case_id: str,
+    check_index: int,
+    params: dict,
+) -> None:
+    """Replace the `with` params of a single check in a draft PipelineVersion.
+
+    Locates config.suites[suite_id].cases[case_id].checks[check_index] and swaps
+    its `with` dict, then recomputes the content hash. Draft only.
+    """
+    import copy
+    with session_scope() as s:
+        pv = s.get(PipelineVersion, version_id)
+        if pv is None:
+            raise ValueError(f"PipelineVersion {version_id} not found")
+        if pv.status != "draft":
+            raise ValueError(f"Can only update draft versions (status: {pv.status})")
+        # Deep-copy so the reassignment is a genuinely distinct object from the
+        # loaded value — otherwise SQLAlchemy's JSON column won't flag the change.
+        config = copy.deepcopy(dict(pv.config or {}))
+        suites = config.get("suites", [])
+        target = None
+        for suite in suites:
+            if suite.get("id") != suite_id:
+                continue
+            for case in suite.get("cases", []):
+                if case.get("id") != case_id:
+                    continue
+                checks = case.get("checks", [])
+                if check_index < 0 or check_index >= len(checks):
+                    raise ValueError(
+                        f"check_index {check_index} out of range for {suite_id}/{case_id}"
+                    )
+                target = checks[check_index]
+                break
+            if target is not None:
+                break
+        if target is None:
+            raise ValueError(f"check not found: {suite_id}/{case_id}[{check_index}]")
+        target["with"] = params
+        pv.config = config
+        pv.content_hash = content_hash(config, pv.generated_sources or {}, pv.rubrics or {})
+
+
 def import_from_yaml(
     spec_path: str,
     project: str,
diff --git a/assay/server/app.py b/assay/server/app.py
index 42a9a62..7bfc29b 100644
--- a/assay/server/app.py
+++ b/assay/server/app.py
@@ -384,13 +384,27 @@ def pipeline_generate(
         pv = create_version(pid, spec_dict, {}, {}, actor)
         version_id = pv.id
     update_step_reached(version_id, "review")
+    activated = True
+    permission_error = None
     try:
         activate_version(version_id, actor)
-    except PermissionError:
-        pass  # stays draft if actor lacks reviewer role
+    except PermissionError as e:
+        # In enforced mode a non-reviewer cannot save-and-activate. Surface it
+        # instead of silently swallowing — the version stays a draft awaiting
+        # reviewer activation.
+        activated = False
+        permission_error = str(e)
     if _is_htmx(request):
         return Response(headers={"HX-Redirect": f"/projects/{_urlquote(body.project, safe='')}"})
-    return {"pipeline_version_id": version_id}
+    with session_scope() as s:
+        pv = s.get(PipelineVersion, version_id)
+        resolved_pipeline_id = pv.pipeline_id if pv else None
+    return {
+        "pipeline_version_id": version_id,
+        "pipeline_id": resolved_pipeline_id,
+        "activated": activated,
+        "permission_error": permission_error,
+    }
 
 
 class SaveDraftBody(BaseModel):
@@ -756,7 +770,7 @@ def _build_check_list(pv) -> list[dict]:
     checks = []
     for suite in (pv.config or {}).get("suites", []):
         for case in suite.get("cases", []):
-            for chk in case.get("checks", []):
+            for idx, chk in enumerate(case.get("checks", [])):
                 ctype = chk.get("type", "template")
                 key = None
                 source = None
@@ -770,7 +784,9 @@ def _build_check_list(pv) -> list[dict]:
                 checks.append({
                     "suite_id": suite.get("id", ""),
                     "case_id": case.get("id", ""),
+                    "check_index": idx,
                     "type": ctype,
+                    "determinism": "stochastic" if ctype == "judge" else "deterministic",
                     "key": key,
                     "uses": chk.get("uses"),
                     "rubric": chk.get("rubric"),
@@ -816,6 +832,46 @@ def pipeline_review_page(request: Request, pipeline_id: int, version_id: int):
     return templates.TemplateResponse(request, "pipeline_review.html", ctx)
 
 
+@app.get("/pipelines/versions/{version_id}/checks")
+def get_version_checks(version_id: int):
+    """Return the flattened check list (with determinism) for a version as JSON."""
+    with session_scope() as s:
+        pv = s.get(PipelineVersion, version_id)
+        if not pv:
+            raise HTTPException(404, "version not found")
+        return _build_check_list(pv)
+
+
+class CheckParamsBody(BaseModel):
+    suite_id: str
+    case_id: str
+    check_index: int
+    params: dict
+
+
+@app.patch("/pipelines/versions/{version_id}/check-params")
+def patch_check_params(
+    version_id: int,
+    body: CheckParamsBody,
+    request: Request,
+    x_assay_user: str | None = Header(default=None),
+):
+    from ..pipeline.service import update_check_params
+    actor = _require_identity(request, x_assay_user)
+    try:
+        update_check_params(version_id, body.suite_id, body.case_id,
+                            body.check_index, body.params)
+    except ValueError as e:
+        status = 409 if "draft" in str(e) else 404
+        raise HTTPException(status, str(e))
+    if _is_htmx(request):
+        return HTMLResponse(
+            '<span class="badge badge-pass" style="font-size:12px">'
+            '<i class="ti ti-check" aria-hidden="true"></i> Saved</span>',
+        )
+    return {"ok": True, "version_id": version_id}
+
+
 class CheckEditBody(BaseModel):
     source: str
 
diff --git a/assay/server/templates/_macros.html b/assay/server/templates/_macros.html
index 180c128..dded58d 100644
--- a/assay/server/templates/_macros.html
+++ b/assay/server/templates/_macros.html
@@ -44,6 +44,21 @@
 <div class="filter-bar">{{ caller() }}</div>
 {% endmacro %}
 
+{#
+  determinism_badge(type)
+  ───────────────────────
+  Derived classification (no stored column):
+    judge                → stochastic (model-graded, scored)
+    template | generated → deterministic (coded, reproducible, binary)
+#}
+{% macro determinism_badge(type) %}
+{% if type == 'judge' %}
+<span class="badge badge-accent"><i class="ti ti-dice-3" aria-hidden="true"></i> Stochastic</span>
+{% else %}
+<span class="badge badge-neutral"><i class="ti ti-binary" aria-hidden="true"></i> Deterministic</span>
+{% endif %}
+{% endmacro %}
+
 {#
   model_selector(model_var, provider_var)
   ────────────────────────────────────────
diff --git a/assay/server/templates/_transcript.html b/assay/server/templates/_transcript.html
index 4670611..4bf4da2 100644
--- a/assay/server/templates/_transcript.html
+++ b/assay/server/templates/_transcript.html
@@ -1,3 +1,4 @@
+{% from "_macros.html" import determinism_badge %}
 <div style="padding:.75rem;font-size:13px">
   <div style="margin-bottom:.75rem">
     <h4 style="font-size:12px;font-weight:600;letter-spacing:.04em;color:var(--text-muted);text-transform:uppercase;margin:0 0 .35rem">Input</h4>
@@ -18,6 +19,15 @@ <h4 style="font-size:12px;font-weight:600;letter-spacing:.04em;color:var(--text-
       {% endif %}
       <div style="flex:1">
         <strong>{{ chk.get('check_id', chk.get('uses', '?')) }}</strong>
+        {% if chk.get('type') %}{{ determinism_badge(chk['type']) }}{% endif %}
+        {% if chk.get('score') is not none %}
+          <span style="font-size:12px;color:var(--text-muted)">
+            {{ '%.2f' | format(chk['score']) }}
+            {%- if chk.get('threshold') is not none %}
+              {{ '≥' if chk.get('passed') else '<' }} {{ '%.2f' | format(chk['threshold']) }}
+            {%- endif %}
+          </span>
+        {% endif %}
         {% if chk.get('message') %} — {{ chk['message'] }}{% endif %}
         {% if chk.get('evidence') %}
         <details style="margin-top:.25rem">
diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index 7b5bb17..927529d 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -26,6 +26,8 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
   judgeAdapter: {{ judge_adapter | tojson }},
   judgeModel: {{ judge_model | tojson }},
   preview: null,
+  generatedChecks: [],
+  permissionError: null,
   hasJudge() {
     return this.preview ? this.preview.checks.some(c => c.type === 'judge') : false;
   },
@@ -62,9 +64,26 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
     this.generating = false;
     if (d.pipeline_version_id) {
       this.generatedVersionId = d.pipeline_version_id;
+      if (d.pipeline_id) this.resumePipelineId = d.pipeline_id;
+      this.permissionError = d.permission_error || null;
+      try {
+        const cr = await fetch('/pipelines/versions/' + d.pipeline_version_id + '/checks');
+        this.generatedChecks = await cr.json();
+      } catch (e) {
+        this.generatedChecks = [];
+      }
       this.step = 3;
     }
   },
+  async saveCheckParams(chk, params) {
+    await fetch('/pipelines/versions/' + this.generatedVersionId + '/check-params', {
+      method: 'PATCH',
+      headers: {'Content-Type': 'application/json'},
+      body: JSON.stringify({suite_id: chk.suite_id, case_id: chk.case_id,
+                            check_index: chk.check_index, params})
+    });
+    chk.params = params;
+  },
   async saveDraft(s) {
     if (!this.requirements || !this.project || !this.name) return;
     await fetch('/pipelines/save-draft', {
@@ -243,8 +262,9 @@ <h2 style="margin:0 0 .75rem">
 
   <!-- Step 3: Review -->
   <div x-show="step === 3">
-    <!-- Success header -->
-    <div class="card" style="border:1px solid var(--border-success,var(--border));margin-bottom:.75rem">
+    <!-- Success header (activated) -->
+    <div class="card" style="border:1px solid var(--border-success,var(--border));margin-bottom:.75rem"
+         x-show="!permissionError">
       <div style="display:flex;align-items:center;gap:.6rem">
         <i class="ti ti-circle-check" style="font-size:1.4rem;color:var(--text-success)" aria-hidden="true"></i>
         <div>
@@ -256,6 +276,26 @@ <h2 style="margin:0 0 .75rem">
       </div>
     </div>
 
+    <!-- Draft header (activation blocked in enforced mode) -->
+    <div class="card" style="border:1px solid var(--border-warning);background:var(--bg-warning);margin-bottom:.75rem"
+         x-show="permissionError">
+      <div style="display:flex;align-items:center;gap:.6rem">
+        <i class="ti ti-shield-lock" style="font-size:1.4rem;color:var(--text-warning)" aria-hidden="true"></i>
+        <div>
+          <p style="margin:0;font-weight:500;font-size:15px">Saved as draft — reviewer activation required</p>
+          <p style="margin:0;font-size:13px;color:var(--text-muted)">
+            You don't have reviewer authority to activate. A reviewer must open the
+            version and activate it before it can run.
+          </p>
+          <a class="btn btn-ghost" style="font-size:12px;margin-top:.4rem;padding:.2rem .5rem"
+             :href="'/pipelines/' + resumePipelineId + '/versions/' + generatedVersionId + '/review'"
+             x-show="resumePipelineId && generatedVersionId">
+            <i class="ti ti-external-link" aria-hidden="true"></i> Open version for review
+          </a>
+        </div>
+      </div>
+    </div>
+
     <!-- Config summary -->
     <div class="card" style="margin-bottom:.75rem">
       <h2 style="margin:0 0 .85rem;font-size:15px">Configuration</h2>
@@ -274,23 +314,70 @@ <h2 style="margin:0 0 .85rem;font-size:15px">Configuration</h2>
       </div>
     </div>
 
-    <!-- Checks summary -->
-    <div class="card" style="margin-bottom:.75rem" x-show="preview && preview.checks && preview.checks.length">
+    <!-- Checks summary + per-check configuration -->
+    <div class="card" style="margin-bottom:.75rem"
+         x-show="generatedChecks.length || (preview && preview.checks && preview.checks.length)">
       <h2 style="margin:0 0 .75rem;font-size:15px">
         Checks
         <span style="font-weight:400;color:var(--text-muted);font-size:13px"
-              x-text="'(' + (preview ? preview.checks.length : 0) + ' total)'"></span>
+              x-text="'(' + (generatedChecks.length || (preview ? preview.checks.length : 0)) + ' total)'"></span>
       </h2>
-      <template x-for="chk in (preview ? preview.checks : [])" :key="chk.id || chk.assertion">
-        <div style="display:flex;gap:.5rem;align-items:baseline;padding:.3rem 0;
-                    border-bottom:1px solid var(--border);font-size:13px">
-          <span class="badge"
-                :class="chk.type === 'template' ? 'badge-neutral' : chk.type === 'judge' ? 'badge-accent' : 'badge-warning'"
-                style="flex-shrink:0;font-size:11px"
-                x-text="chk.type"></span>
-          <span style="color:var(--text-primary)" x-text="chk.assertion || chk.id"></span>
+      <!-- Configurable list from the persisted version -->
+      <template x-if="generatedChecks.length">
+        <div>
+          <template x-for="(chk, ci) in generatedChecks" :key="chk.suite_id + '/' + chk.case_id + '/' + chk.check_index">
+            <div x-data="{ editing: false, draft: JSON.stringify(chk.params || {}, null, 2), saved: false }"
+                 style="padding:.4rem 0;border-bottom:1px solid var(--border);font-size:13px">
+              <div style="display:flex;gap:.5rem;align-items:center;flex-wrap:wrap">
+                <span class="badge"
+                      :class="chk.type === 'template' ? 'badge-template' : chk.type === 'judge' ? 'badge-judge' : 'badge-generated'"
+                      style="flex-shrink:0;font-size:11px" x-text="chk.type"></span>
+                <span class="badge"
+                      :class="chk.determinism === 'stochastic' ? 'badge-accent' : 'badge-neutral'"
+                      style="flex-shrink:0;font-size:11px"
+                      x-text="chk.determinism === 'stochastic' ? 'Stochastic' : 'Deterministic'"></span>
+                <span style="color:var(--text-primary)" x-text="chk.assertion || chk.case_id"></span>
+                <button type="button" class="btn btn-ghost"
+                        style="margin-left:auto;font-size:11px;padding:.15rem .4rem"
+                        @click="editing = !editing; saved = false"
+                        x-show="chk.type === 'template' || chk.type === 'judge'">
+                  <i class="ti ti-adjustments" aria-hidden="true"></i>
+                  <span x-text="editing ? 'Close' : 'Edit params'"></span>
+                </button>
+              </div>
+              <div x-show="editing" style="margin-top:.4rem">
+                <textarea x-model="draft" rows="4"
+                          style="width:100%;font-family:monospace;font-size:12px;resize:vertical"></textarea>
+                <div style="display:flex;gap:.5rem;align-items:center;margin-top:.35rem">
+                  <button type="button" class="btn btn-primary" style="font-size:11px"
+                          @click="try { await saveCheckParams(chk, JSON.parse(draft)); saved = true; } catch(e) { alert('Invalid JSON'); }">
+                    <i class="ti ti-device-floppy" aria-hidden="true"></i> Save params
+                  </button>
+                  <span x-show="saved" class="badge badge-pass" style="font-size:11px">
+                    <i class="ti ti-check" aria-hidden="true"></i> Saved</span>
+                </div>
+              </div>
+            </div>
+          </template>
         </div>
       </template>
+      <!-- Fallback preview list (no persisted checks) -->
+      <template x-if="!generatedChecks.length">
+        <template x-for="chk in (preview ? preview.checks : [])" :key="chk.id || chk.assertion">
+          <div style="display:flex;gap:.5rem;align-items:baseline;padding:.3rem 0;
+                      border-bottom:1px solid var(--border);font-size:13px">
+            <span class="badge"
+                  :class="chk.type === 'template' ? 'badge-neutral' : chk.type === 'judge' ? 'badge-accent' : 'badge-warning'"
+                  style="flex-shrink:0;font-size:11px"
+                  x-text="chk.type"></span>
+            <span class="badge"
+                  :class="chk.type === 'judge' ? 'badge-accent' : 'badge-neutral'"
+                  style="flex-shrink:0;font-size:11px"
+                  x-text="chk.type === 'judge' ? 'Stochastic' : 'Deterministic'"></span>
+            <span style="color:var(--text-primary)" x-text="chk.assertion || chk.id"></span>
+          </div>
+        </template>
+      </template>
     </div>
 
     <!-- Actions -->
diff --git a/assay/server/templates/pipeline_review.html b/assay/server/templates/pipeline_review.html
index f269b28..aa5cffa 100644
--- a/assay/server/templates/pipeline_review.html
+++ b/assay/server/templates/pipeline_review.html
@@ -1,5 +1,5 @@
 {% extends "base.html" %}
-{% from "_macros.html" import state_badge, check_type_badge %}
+{% from "_macros.html" import state_badge, check_type_badge, determinism_badge %}
 {% block title %}Review v{{ version_number }} — {{ pipeline_name }} — Assay{% endblock %}
 
 {% block content %}
@@ -76,11 +76,24 @@ <h2 style="margin:0">{{ check_count }} check{{ 's' if check_count != 1 }}</h2>
   {% endif %}
 </div>
 
-<!-- Check list -->
+<!-- Check list (with determinism grouping filter) -->
+{% if check_count > 0 %}
+<div x-data="{ filter: 'all' }">
+<div style="display:flex;gap:.4rem;margin-bottom:.75rem;flex-wrap:wrap">
+  {% for f in [('all', 'All'), ('deterministic', 'Deterministic'), ('stochastic', 'Stochastic')] %}
+  <button type="button" class="badge"
+          :class="filter === '{{ f[0] }}' ? 'badge-accent' : 'badge-neutral'"
+          style="cursor:pointer;border:1px solid var(--border);font-size:13px"
+          @click="filter = '{{ f[0] }}'">{{ f[1] }}</button>
+  {% endfor %}
+</div>
+{% endif %}
 {% for chk in checks %}
-<div class="card" id="check-row-{{ loop.index0 }}" style="padding:.85rem 1rem">
+<div class="card" id="check-row-{{ loop.index0 }}" style="padding:.85rem 1rem"
+     x-show="filter === 'all' || filter === '{{ chk.determinism }}'">
   <div style="display:flex;gap:.6rem;align-items:center;flex-wrap:wrap;margin-bottom:.5rem">
     {{ check_type_badge(chk.type) }}
+    {{ determinism_badge(chk.type) }}
     <span style="font-size:13px;color:var(--text-muted)">
       {{ chk.suite_id }}<span style="margin:0 .2rem;opacity:.5">/</span>{{ chk.case_id }}
     </span>
@@ -184,6 +197,7 @@ <h2 style="margin:0">{{ check_count }} check{{ 's' if check_count != 1 }}</h2>
   </p>
 </div>
 {% endfor %}
+{% if check_count > 0 %}</div>{% endif %}
 
 <!-- Activation gate -->
 {% if version_status == 'draft' %}
diff --git a/tests/test_phase5.py b/tests/test_phase5.py
new file mode 100644
index 0000000..07ab487
--- /dev/null
+++ b/tests/test_phase5.py
@@ -0,0 +1,264 @@
+"""Phase 5: determinism classification, per-check param config, activation authority."""
+from __future__ import annotations
+import importlib
+import pytest
+from itsdangerous import URLSafeSerializer
+
+_REAL_SECRET = "test-only-real-secret-not-the-dev-default"
+
+
+@pytest.fixture(autouse=True)
+def _tmp_db(tmp_path, monkeypatch):
+    monkeypatch.setenv("ASSAY_HOME", str(tmp_path / ".assay"))
+    monkeypatch.setenv("ASSAY_DB_URL", f"sqlite:///{tmp_path / 't.db'}")
+    monkeypatch.delenv("ASSAY_LINEAR_API_KEY", raising=False)
+    monkeypatch.delenv("ASSAY_AUTH", raising=False)
+    monkeypatch.delenv("ASSAY_SECRET_KEY", raising=False)
+    import assay.config, assay.store.db
+    importlib.reload(assay.config)
+    importlib.reload(assay.store.db)
+    from assay.store.db import init_db
+    init_db()
+    yield
+
+
+@pytest.fixture
+def client(_tmp_db):
+    import assay.server.app as _mod
+    importlib.reload(_mod)
+    from fastapi.testclient import TestClient
+    return TestClient(_mod.app, follow_redirects=False)
+
+
+def _fresh_client(monkeypatch, *, auth=None, secret=None):
+    if auth is not None:
+        monkeypatch.setenv("ASSAY_AUTH", auth)
+    if secret is not None:
+        monkeypatch.setenv("ASSAY_SECRET_KEY", secret)
+    import assay.config
+    importlib.reload(assay.config)
+    import assay.server.app as _mod
+    importlib.reload(_mod)
+    from fastapi.testclient import TestClient
+    return TestClient(_mod.app, follow_redirects=False)
+
+
+def _make_draft_mixed_checks():
+    """Pipeline + draft version with template, generated, and judge checks."""
+    from assay.pipeline import create_pipeline, create_version
+    pipe = create_pipeline(project="proj", name="mixed-pipe")
+    config = {
+        "version": 1, "project": "mixed-pipe",
+        "target": {"adapter": "mock"}, "judges": {"primary": {"provider": "mock", "model": "mock"}},
+        "suites": [
+            {"id": "s1", "requirement_ref": "R1", "cases": [
+                {"id": "c1", "input": {}, "checks": [
+                    {"type": "template", "uses": "latency_bound", "with": {"max_ms": 5000}},
+                    {"type": "generated", "uses": "generated/checks/g1.py"},
+                    {"type": "judge", "judge": "primary", "rubric": "generated/rubrics/r1.yaml"},
+                ]},
+            ]},
+        ],
+        "gating": {},
+    }
+    sources = {"generated/checks/g1.py": "def g1(r, **kw):\n    return True\n"}
+    rubrics = {"generated/rubrics/r1.yaml": "judge: primary\n"}
+    pv = create_version(pipe.id, config, sources, rubrics)
+    return pipe, pv
+
+
+# ── 1. determinism derivation ────────────────────────────────────────────────
+
+def test_determinism_classification():
+    """_build_check_list derives deterministic/stochastic from check type."""
+    import assay.server.app as app
+    _, pv = _make_draft_mixed_checks()
+    from assay.store import session_scope
+    from assay.store.models import PipelineVersion
+    with session_scope() as s:
+        pv_obj = s.get(PipelineVersion, pv.id)
+        checks = app._build_check_list(pv_obj)
+    by_type = {c["type"]: c["determinism"] for c in checks}
+    assert by_type["template"] == "deterministic"
+    assert by_type["generated"] == "deterministic"
+    assert by_type["judge"] == "stochastic"
+
+
+def test_determinism_badge_in_review_page(client):
+    """Review page HTML shows both Deterministic and Stochastic badges."""
+    pipe, pv = _make_draft_mixed_checks()
+    resp = client.get(f"/pipelines/{pipe.id}/versions/{pv.id}/review")
+    assert resp.status_code == 200
+    assert "Deterministic" in resp.text
+    assert "Stochastic" in resp.text
+
+
+def test_get_version_checks_json(client):
+    """GET /pipelines/versions/{vid}/checks returns the flattened list with determinism."""
+    _, pv = _make_draft_mixed_checks()
+    resp = client.get(f"/pipelines/versions/{pv.id}/checks")
+    assert resp.status_code == 200
+    data = resp.json()
+    assert len(data) == 3
+    assert {c["determinism"] for c in data} == {"deterministic", "stochastic"}
+    # check_index is populated per case
+    assert [c["check_index"] for c in data] == [0, 1, 2]
+
+
+# ── 2. per-check param config ─────────────────────────────────────────────────
+
+def test_check_params_update_draft(client):
+    """PATCH check-params on a draft updates the config in place."""
+    from assay.store import session_scope
+    from assay.store.models import PipelineVersion
+    _, pv = _make_draft_mixed_checks()
+    resp = client.patch(
+        f"/pipelines/versions/{pv.id}/check-params",
+        json={"suite_id": "s1", "case_id": "c1", "check_index": 0,
+              "params": {"max_ms": 1200}},
+        headers={"X-Assay-User": "dev"},
+    )
+    assert resp.status_code == 200
+    with session_scope() as s:
+        updated = s.get(PipelineVersion, pv.id)
+        chk = updated.config["suites"][0]["cases"][0]["checks"][0]
+        assert chk["with"] == {"max_ms": 1200}
+
+
+def test_check_params_update_active_rejected(client):
+    """PATCH check-params on an active version → 409."""
+    from assay.store import session_scope
+    from assay.store.models import User
+    from assay.pipeline import activate_version
+    with session_scope() as s:
+        s.add(User(name="rev1", role="reviewer"))
+    _, pv = _make_draft_mixed_checks()
+    activate_version(pv.id, "rev1")
+    resp = client.patch(
+        f"/pipelines/versions/{pv.id}/check-params",
+        json={"suite_id": "s1", "case_id": "c1", "check_index": 0,
+              "params": {"max_ms": 1200}},
+        headers={"X-Assay-User": "rev1"},
+    )
+    assert resp.status_code == 409
+
+
+def test_check_params_bad_index(client):
+    """PATCH check-params with an out-of-range index → 404."""
+    _, pv = _make_draft_mixed_checks()
+    resp = client.patch(
+        f"/pipelines/versions/{pv.id}/check-params",
+        json={"suite_id": "s1", "case_id": "c1", "check_index": 99,
+              "params": {}},
+        headers={"X-Assay-User": "dev"},
+    )
+    assert resp.status_code == 404
+
+
+# ── 3. stored CheckResult carries type ────────────────────────────────────────
+
+def test_case_result_checks_carry_type():
+    """After a run, each stored check dict includes its type for display."""
+    from assay.pipeline import create_pipeline, create_version, activate_version
+    from assay.engine import execute_run
+    from assay.store import session_scope
+    from assay.store.models import CaseResult
+    pipe = create_pipeline(project="p", name="typed")
+    config = {
+        "version": 1, "project": "typed", "target": {"adapter": "mock"},
+        "judges": {}, "suites": [
+            {"id": "s1", "requirement_ref": None, "cases": [
+                {"id": "c1", "input": {}, "checks": [
+                    {"type": "template", "uses": "valid_json"}]}
+            ]}
+        ], "gating": {},
+    }
+    pv = create_version(pipe.id, config, {}, {})
+    activate_version(pv.id, "solo-dev")
+    run_id = execute_run(pipeline_version_id=pv.id, triggered_by="tester")
+    with session_scope() as s:
+        cr = s.query(CaseResult).filter_by(run_id=run_id).first()
+        assert cr.checks[0]["type"] == "template"
+
+
+# ── 4. activation authority preserved in enforced mode ────────────────────────
+
+def test_enforced_mode_generate_returns_permission_error(monkeypatch):
+    """Enforced mode + non-reviewer POST generate → draft, activated:false, error surfaced."""
+    from assay.store import session_scope
+    from assay.store.models import User, Pipeline, PipelineVersion
+    with session_scope() as s:
+        s.add(User(name="alice", role="reviewer"))   # seed so table is non-empty
+        s.add(User(name="bob", role="runner"))
+    client = _fresh_client(monkeypatch, auth="enforced", secret=_REAL_SECRET)
+    bob_cookie = URLSafeSerializer(_REAL_SECRET).dumps("bob")
+    resp = client.post(
+        "/pipelines/generate",
+        json={"project": "e", "name": "e-pipe",
+              "requirements": "The response must be valid JSON.",
+              "adapter_spec": {"adapter": "mock"}},
+        cookies={"assay_user": bob_cookie},
+    )
+    assert resp.status_code == 200
+    data = resp.json()
+    assert data["activated"] is False
+    assert data["permission_error"]
+    with session_scope() as s:
+        pv = s.get(PipelineVersion, data["pipeline_version_id"])
+        assert pv.status == "draft"
+
+
+def test_open_mode_generate_activates(client):
+    """Open mode + empty User table → generate auto-activates."""
+    from assay.store import session_scope
+    from assay.store.models import PipelineVersion
+    resp = client.post(
+        "/pipelines/generate",
+        json={"project": "o", "name": "o-pipe",
+              "requirements": "The response must be valid JSON.",
+              "adapter_spec": {"adapter": "mock"}},
+        headers={"X-Assay-User": "solo-dev"},
+    )
+    assert resp.status_code == 200
+    data = resp.json()
+    assert data["activated"] is True
+    with session_scope() as s:
+        pv = s.get(PipelineVersion, data["pipeline_version_id"])
+        assert pv.status == "active"
+
+
+# ── 5. edit → new active version → archive-old flow still works ───────────────
+
+def test_edit_new_version_archive_flow(client):
+    """Reviewer generates then edits: new version activates, prior one archived."""
+    from assay.store import session_scope
+    from assay.store.models import User, PipelineVersion
+    with session_scope() as s:
+        s.add(User(name="rev1", role="reviewer"))
+    # First generate (as reviewer) → active v1
+    r1 = client.post(
+        "/pipelines/generate",
+        json={"project": "ed", "name": "ed-pipe",
+              "requirements": "The response must be valid JSON.",
+              "adapter_spec": {"adapter": "mock"}},
+        headers={"X-Assay-User": "rev1"},
+    )
+    d1 = r1.json()
+    assert d1["activated"] is True
+    v1_id = d1["pipeline_version_id"]
+    pipe_id = d1["pipeline_id"]
+    # Edit: generate again on the same pipeline → new active version, v1 archived
+    r2 = client.post(
+        "/pipelines/generate",
+        json={"project": "ed", "name": "ed-pipe",
+              "requirements": "The response must be valid JSON.\nNo PII in the output.",
+              "adapter_spec": {"adapter": "mock"}, "pipeline_id": pipe_id},
+        headers={"X-Assay-User": "rev1"},
+    )
+    d2 = r2.json()
+    v2_id = d2["pipeline_version_id"]
+    assert v2_id != v1_id
+    assert d2["activated"] is True
+    with session_scope() as s:
+        assert s.get(PipelineVersion, v1_id).status == "archived"
+        assert s.get(PipelineVersion, v2_id).status == "active"

From 0386e9385d3a9a1f68bc355dd7dc1366369e133e Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 23:13:31 +0200
Subject: [PATCH 2/7] fix: determinism badge colors, wizard redirect, and
 step-3 simplification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Stochastic badge → badge-pro (purple); deterministic badge → badge-accent (blue)
  Applies everywhere: _macros.html, pipeline_new.html Alpine bindings, review
  page coverage bar (judge segment now var(--text-pro))
- Wizard step 3: auto-redirects to /pipelines after 2.5 s with a "Draft saved"
  banner and "Go now" link — eliminates the ephemeral-state refresh problem
- Remove per-check param editing expanders from wizard step 3; checks are now
  a read-only preview before redirect

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/server/templates/_macros.html         |  4 +-
 assay/server/templates/pipeline_new.html    | 93 ++++++++-------------
 assay/server/templates/pipeline_review.html |  2 +-
 3 files changed, 37 insertions(+), 62 deletions(-)

diff --git a/assay/server/templates/_macros.html b/assay/server/templates/_macros.html
index dded58d..beaa664 100644
--- a/assay/server/templates/_macros.html
+++ b/assay/server/templates/_macros.html
@@ -53,9 +53,9 @@
 #}
 {% macro determinism_badge(type) %}
 {% if type == 'judge' %}
-<span class="badge badge-accent"><i class="ti ti-dice-3" aria-hidden="true"></i> Stochastic</span>
+<span class="badge badge-pro"><i class="ti ti-dice-3" aria-hidden="true"></i> Stochastic</span>
 {% else %}
-<span class="badge badge-neutral"><i class="ti ti-binary" aria-hidden="true"></i> Deterministic</span>
+<span class="badge badge-accent"><i class="ti ti-binary" aria-hidden="true"></i> Deterministic</span>
 {% endif %}
 {% endmacro %}
 
diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index 927529d..60f4924 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -73,6 +73,7 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
         this.generatedChecks = [];
       }
       this.step = 3;
+      setTimeout(() => { window.location.href = '/pipelines'; }, 2500);
     }
   },
   async saveCheckParams(chk, params) {
@@ -267,12 +268,15 @@ <h2 style="margin:0 0 .75rem">
          x-show="!permissionError">
       <div style="display:flex;align-items:center;gap:.6rem">
         <i class="ti ti-circle-check" style="font-size:1.4rem;color:var(--text-success)" aria-hidden="true"></i>
-        <div>
-          <p style="margin:0;font-weight:500;font-size:15px">Pipeline ready</p>
+        <div style="flex:1">
+          <p style="margin:0;font-weight:500;font-size:15px">Draft saved</p>
           <p style="margin:0;font-size:13px;color:var(--text-muted)">
-            Generated and activated — you can run it now.
+            Generated and activated — taking you to Pipelines…
           </p>
         </div>
+        <a href="/pipelines" class="btn btn-primary" style="flex-shrink:0;font-size:13px">
+          <i class="ti ti-arrow-right" aria-hidden="true"></i> Go now
+        </a>
       </div>
     </div>
 
@@ -281,18 +285,15 @@ <h2 style="margin:0 0 .75rem">
          x-show="permissionError">
       <div style="display:flex;align-items:center;gap:.6rem">
         <i class="ti ti-shield-lock" style="font-size:1.4rem;color:var(--text-warning)" aria-hidden="true"></i>
-        <div>
-          <p style="margin:0;font-weight:500;font-size:15px">Saved as draft — reviewer activation required</p>
+        <div style="flex:1">
+          <p style="margin:0;font-weight:500;font-size:15px">Draft saved — reviewer activation required</p>
           <p style="margin:0;font-size:13px;color:var(--text-muted)">
-            You don't have reviewer authority to activate. A reviewer must open the
-            version and activate it before it can run.
+            You don't have reviewer authority to activate. Taking you to Pipelines…
           </p>
-          <a class="btn btn-ghost" style="font-size:12px;margin-top:.4rem;padding:.2rem .5rem"
-             :href="'/pipelines/' + resumePipelineId + '/versions/' + generatedVersionId + '/review'"
-             x-show="resumePipelineId && generatedVersionId">
-            <i class="ti ti-external-link" aria-hidden="true"></i> Open version for review
-          </a>
         </div>
+        <a href="/pipelines" class="btn" style="flex-shrink:0;font-size:13px;border-color:var(--border-warning)">
+          <i class="ti ti-arrow-right" aria-hidden="true"></i> Go now
+        </a>
       </div>
     </div>
 
@@ -322,56 +323,35 @@ <h2 style="margin:0 0 .75rem;font-size:15px">
         <span style="font-weight:400;color:var(--text-muted);font-size:13px"
               x-text="'(' + (generatedChecks.length || (preview ? preview.checks.length : 0)) + ' total)'"></span>
       </h2>
-      <!-- Configurable list from the persisted version -->
+      <!-- Persisted check list (read-only) -->
       <template x-if="generatedChecks.length">
         <div>
-          <template x-for="(chk, ci) in generatedChecks" :key="chk.suite_id + '/' + chk.case_id + '/' + chk.check_index">
-            <div x-data="{ editing: false, draft: JSON.stringify(chk.params || {}, null, 2), saved: false }"
-                 style="padding:.4rem 0;border-bottom:1px solid var(--border);font-size:13px">
-              <div style="display:flex;gap:.5rem;align-items:center;flex-wrap:wrap">
-                <span class="badge"
-                      :class="chk.type === 'template' ? 'badge-template' : chk.type === 'judge' ? 'badge-judge' : 'badge-generated'"
-                      style="flex-shrink:0;font-size:11px" x-text="chk.type"></span>
-                <span class="badge"
-                      :class="chk.determinism === 'stochastic' ? 'badge-accent' : 'badge-neutral'"
-                      style="flex-shrink:0;font-size:11px"
-                      x-text="chk.determinism === 'stochastic' ? 'Stochastic' : 'Deterministic'"></span>
-                <span style="color:var(--text-primary)" x-text="chk.assertion || chk.case_id"></span>
-                <button type="button" class="btn btn-ghost"
-                        style="margin-left:auto;font-size:11px;padding:.15rem .4rem"
-                        @click="editing = !editing; saved = false"
-                        x-show="chk.type === 'template' || chk.type === 'judge'">
-                  <i class="ti ti-adjustments" aria-hidden="true"></i>
-                  <span x-text="editing ? 'Close' : 'Edit params'"></span>
-                </button>
-              </div>
-              <div x-show="editing" style="margin-top:.4rem">
-                <textarea x-model="draft" rows="4"
-                          style="width:100%;font-family:monospace;font-size:12px;resize:vertical"></textarea>
-                <div style="display:flex;gap:.5rem;align-items:center;margin-top:.35rem">
-                  <button type="button" class="btn btn-primary" style="font-size:11px"
-                          @click="try { await saveCheckParams(chk, JSON.parse(draft)); saved = true; } catch(e) { alert('Invalid JSON'); }">
-                    <i class="ti ti-device-floppy" aria-hidden="true"></i> Save params
-                  </button>
-                  <span x-show="saved" class="badge badge-pass" style="font-size:11px">
-                    <i class="ti ti-check" aria-hidden="true"></i> Saved</span>
-                </div>
-              </div>
+          <template x-for="chk in generatedChecks" :key="chk.suite_id + '/' + chk.case_id + '/' + chk.check_index">
+            <div style="display:flex;gap:.5rem;align-items:center;flex-wrap:wrap;
+                        padding:.4rem 0;border-bottom:1px solid var(--border);font-size:13px">
+              <span class="badge"
+                    :class="chk.type === 'template' ? 'badge-template' : chk.type === 'judge' ? 'badge-judge' : 'badge-generated'"
+                    style="flex-shrink:0;font-size:11px" x-text="chk.type"></span>
+              <span class="badge"
+                    :class="chk.determinism === 'stochastic' ? 'badge-pro' : 'badge-accent'"
+                    style="flex-shrink:0;font-size:11px"
+                    x-text="chk.determinism === 'stochastic' ? 'Stochastic' : 'Deterministic'"></span>
+              <span style="color:var(--text-primary)" x-text="chk.assertion || chk.case_id"></span>
             </div>
           </template>
         </div>
       </template>
-      <!-- Fallback preview list (no persisted checks) -->
+      <!-- Fallback preview list (generation fetch failed) -->
       <template x-if="!generatedChecks.length">
         <template x-for="chk in (preview ? preview.checks : [])" :key="chk.id || chk.assertion">
-          <div style="display:flex;gap:.5rem;align-items:baseline;padding:.3rem 0;
+          <div style="display:flex;gap:.5rem;align-items:center;padding:.3rem 0;
                       border-bottom:1px solid var(--border);font-size:13px">
             <span class="badge"
-                  :class="chk.type === 'template' ? 'badge-neutral' : chk.type === 'judge' ? 'badge-accent' : 'badge-warning'"
+                  :class="chk.type === 'template' ? 'badge-template' : chk.type === 'judge' ? 'badge-judge' : 'badge-generated'"
                   style="flex-shrink:0;font-size:11px"
                   x-text="chk.type"></span>
             <span class="badge"
-                  :class="chk.type === 'judge' ? 'badge-accent' : 'badge-neutral'"
+                  :class="chk.type === 'judge' ? 'badge-pro' : 'badge-accent'"
                   style="flex-shrink:0;font-size:11px"
                   x-text="chk.type === 'judge' ? 'Stochastic' : 'Deterministic'"></span>
             <span style="color:var(--text-primary)" x-text="chk.assertion || chk.id"></span>
@@ -380,16 +360,11 @@ <h2 style="margin:0 0 .75rem;font-size:15px">
       </template>
     </div>
 
-    <!-- Actions -->
-    <div style="display:flex;gap:.5rem;justify-content:flex-end;margin-top:.25rem">
-      <button type="button" class="btn btn-ghost" @click="step = 2">
-        <i class="ti ti-arrow-left" aria-hidden="true"></i> Back
-      </button>
-      <button type="button" class="btn btn-primary"
-              @click="window.location.href = '/projects/' + encodeURIComponent(project)">
-        <i class="ti ti-target" aria-hidden="true"></i> Go to project
-      </button>
-    </div>
+    <!-- Redirect notice -->
+    <p style="font-size:12px;color:var(--text-muted);text-align:right;margin:.25rem 0 0">
+      <i class="ti ti-loader-2" aria-hidden="true"></i>
+      Redirecting… or <a href="/pipelines">go now</a>
+    </p>
   </div>
 
 </div>
diff --git a/assay/server/templates/pipeline_review.html b/assay/server/templates/pipeline_review.html
index aa5cffa..91c7eee 100644
--- a/assay/server/templates/pipeline_review.html
+++ b/assay/server/templates/pipeline_review.html
@@ -70,7 +70,7 @@ <h2 style="margin:0">{{ check_count }} check{{ 's' if check_count != 1 }}</h2>
     <div style="display:flex;height:100%">
       <div style="width:{{ pct_t }}%;background:var(--text-muted)"></div>
       <div style="width:{{ pct_g }}%;background:var(--text-warning)"></div>
-      <div style="width:{{ pct_j }}%;background:var(--text-accent)"></div>
+      <div style="width:{{ pct_j }}%;background:var(--text-pro)"></div>
     </div>
   </div>
   {% endif %}

From 23773dc39bd73f2b69eccebf26a719b62aa26672 Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 23:17:15 +0200
Subject: [PATCH 3/7] fix: persist new-pipeline wizard inputs across page
 refresh via localStorage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds init() + _persist() to the Alpine component:
- On page load (new pipeline only), restores requirements/project/name/adapter/
  model/endpoint/key_env from localStorage key 'assay_wizard_new'
- $watch on each field saves to localStorage on every change
- localStorage cleared on successful generate so the next new-pipeline visit
  starts blank
- Edit flows (resumeVersionId set) skip localStorage entirely — server supplies
  the pre-populated values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/server/templates/pipeline_new.html | 28 ++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index 60f4924..aab0ed5 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -73,6 +73,7 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
         this.generatedChecks = [];
       }
       this.step = 3;
+      localStorage.removeItem('assay_wizard_new');
       setTimeout(() => { window.location.href = '/pipelines'; }, 2500);
     }
   },
@@ -93,6 +94,33 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
       body: JSON.stringify({project: this.project, name: this.name,
                             requirements: this.requirements, step: s})
     });
+  },
+  _persist() {
+    try {
+      localStorage.setItem('assay_wizard_new', JSON.stringify({
+        requirements: this.requirements, project: this.project, name: this.name,
+        adapter: this.adapter, model: this.model,
+        endpoint: this.endpoint, key_env: this.key_env,
+      }));
+    } catch(e) {}
+  },
+  init() {
+    if (this.resumeVersionId) return;
+    try {
+      const d = JSON.parse(localStorage.getItem('assay_wizard_new') || 'null');
+      if (d) {
+        if (d.requirements !== undefined) this.requirements = d.requirements;
+        if (d.project !== undefined) this.project = d.project;
+        if (d.name !== undefined) this.name = d.name;
+        if (d.adapter !== undefined) this.adapter = d.adapter;
+        if (d.model !== undefined) this.model = d.model;
+        if (d.endpoint !== undefined) this.endpoint = d.endpoint;
+        if (d.key_env !== undefined) this.key_env = d.key_env;
+      }
+    } catch(e) {}
+    ['requirements','project','name','adapter','model','endpoint','key_env'].forEach(k => {
+      this.$watch(k, () => this._persist());
+    });
   }
 }">
 

From 9bd54a0ae36867e444ae47ffd81948b5a7a46e41 Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 23:19:22 +0200
Subject: [PATCH 4/7] fix: saveDraft shows toast notification and redirects to
 /pipelines

saveDraft() now: clears localStorage, sets draftSaved flag (shows fixed-position
success toast), then navigates to /pipelines after 1.5 s. Previously it silently
fired the POST with no user feedback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/server/templates/pipeline_new.html | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index aab0ed5..7f13de0 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -28,6 +28,7 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
   preview: null,
   generatedChecks: [],
   permissionError: null,
+  draftSaved: false,
   hasJudge() {
     return this.preview ? this.preview.checks.some(c => c.type === 'judge') : false;
   },
@@ -94,6 +95,9 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
       body: JSON.stringify({project: this.project, name: this.name,
                             requirements: this.requirements, step: s})
     });
+    localStorage.removeItem('assay_wizard_new');
+    this.draftSaved = true;
+    setTimeout(() => { window.location.href = '/pipelines'; }, 1500);
   },
   _persist() {
     try {
@@ -124,6 +128,18 @@ <h1 style="margin:0">{% if resume_data %}Edit pipeline{% else %}New pipeline{% e
   }
 }">
 
+  <!-- Draft saved toast -->
+  <div x-show="draftSaved" x-cloak
+       style="position:fixed;top:1.25rem;right:1.25rem;z-index:999;
+              display:flex;align-items:center;gap:.5rem;
+              background:var(--bg-success);color:var(--text-success);
+              border:1px solid var(--border-success);border-radius:var(--radius);
+              padding:.6rem 1rem;font-size:14px;font-weight:500;
+              box-shadow:0 4px 12px rgba(0,0,0,.1)">
+    <i class="ti ti-circle-check" aria-hidden="true"></i>
+    Draft saved — taking you to Pipelines…
+  </div>
+
   <!-- Step tabs -->
   <div style="display:flex;align-items:center;margin-bottom:1.25rem;gap:.25rem">
     {% for label in ['Define', 'Connect', 'Review'] %}

From 236eb6099f8dd0b1719beb7bb5836fe2c2b0ccf9 Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 23:22:45 +0200
Subject: [PATCH 5/7] fix: wizard delete routes to /pipelines instead of
 project page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After deleting a draft from the new/edit wizard (steps 1 or 2), the user
lands on /pipelines. The review-page delete is unchanged — it still goes
to /projects/{name} since that page is the natural parent from there.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/server/templates/pipeline_new.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index 7f13de0..121d1de 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -190,7 +190,7 @@ <h2 style="margin:0 0 .5rem">What should your model do?</h2>
                 style="color:var(--text-danger)"
                 hx-delete="/pipelines/{{ resume_data.pipeline_id }}"
                 hx-confirm="Delete pipeline '{{ resume_data.name }}'? This removes all versions and cannot be undone."
-                hx-on:htmx:after-request="if(event.detail.successful) window.location='/projects/{{ resume_data.project | urlencode }}'">
+                hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
           <i class="ti ti-trash" aria-hidden="true"></i> Delete
         </button>
         {% endif %}
@@ -284,7 +284,7 @@ <h2 style="margin:0 0 .75rem">
               style="color:var(--text-danger)"
               hx-delete="/pipelines/{{ resume_data.pipeline_id }}"
               hx-confirm="Delete pipeline '{{ resume_data.name }}'? This removes all versions and cannot be undone."
-              hx-on:htmx:after-request="if(event.detail.successful) window.location='/projects/{{ resume_data.project | urlencode }}'">
+              hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
         <i class="ti ti-trash" aria-hidden="true"></i> Delete
       </button>
       {% endif %}

From c3f5cbdd9cd1c2ffd490647aba4dcbb4dedd365b Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 23:26:49 +0200
Subject: [PATCH 6/7] fix: delete pipeline routes to previous page via
 document.referrer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All three delete buttons (review page + wizard steps 1 & 2) now navigate
to document.referrer if it's same-origin, otherwise fall back to /pipelines.
This means: arrived from /projects/foo → goes back there; arrived from
/pipelines → goes back there; no referrer → /pipelines.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/server/templates/pipeline_new.html    | 4 ++--
 assay/server/templates/pipeline_review.html | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index 121d1de..200a3f6 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -190,7 +190,7 @@ <h2 style="margin:0 0 .5rem">What should your model do?</h2>
                 style="color:var(--text-danger)"
                 hx-delete="/pipelines/{{ resume_data.pipeline_id }}"
                 hx-confirm="Delete pipeline '{{ resume_data.name }}'? This removes all versions and cannot be undone."
-                hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
+                hx-on:htmx:after-request="if(event.detail.successful){ const p=document.referrer; window.location=(p&&new URL(p).origin===location.origin)?p:'/pipelines'; }">
           <i class="ti ti-trash" aria-hidden="true"></i> Delete
         </button>
         {% endif %}
@@ -284,7 +284,7 @@ <h2 style="margin:0 0 .75rem">
               style="color:var(--text-danger)"
               hx-delete="/pipelines/{{ resume_data.pipeline_id }}"
               hx-confirm="Delete pipeline '{{ resume_data.name }}'? This removes all versions and cannot be undone."
-              hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
+              hx-on:htmx:after-request="if(event.detail.successful){ const p=document.referrer; window.location=(p&&new URL(p).origin===location.origin)?p:'/pipelines'; }">
         <i class="ti ti-trash" aria-hidden="true"></i> Delete
       </button>
       {% endif %}
diff --git a/assay/server/templates/pipeline_review.html b/assay/server/templates/pipeline_review.html
index 91c7eee..9e194b0 100644
--- a/assay/server/templates/pipeline_review.html
+++ b/assay/server/templates/pipeline_review.html
@@ -19,7 +19,7 @@ <h1 style="margin:0">Review pipeline</h1>
   <button class="btn btn-ghost" style="color:var(--text-danger);margin-left:auto"
           hx-delete="/pipelines/{{ pipeline_id }}"
           hx-confirm="Delete pipeline '{{ pipeline_name }}'? This removes all versions and cannot be undone."
-          hx-on:htmx:after-request="if(event.detail.successful) window.location='/projects/{{ project_name | urlencode }}'">
+          hx-on:htmx:after-request="if(event.detail.successful){ const p=document.referrer; window.location=(p&&new URL(p).origin===location.origin)?p:'/pipelines'; }">
     <i class="ti ti-trash" aria-hidden="true"></i> Delete pipeline
   </button>
 </div>

From 4c8fb3ed10ea89c5211bca497f07cc2c91a171b4 Mon Sep 17 00:00:00 2001
From: baran <baran.baloglu@gmail.com>
Date: Thu, 2 Jul 2026 23:37:33 +0200
Subject: [PATCH 7/7] fix: pipeline delete always routes to /pipelines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two root causes fixed:
1. Server was returning HX-Redirect to /projects/{name} which htmx processed
   immediately, racing against (and winning over) the client-side handler.
   delete_pipeline now returns plain {"ok": true} — client controls routing.
2. document.referrer is unreliable here: if the user arrived from the project
   detail page, referrer was /projects/{name} which is now an empty ghost.
   All three delete buttons (wizard step 1, step 2, review page) now
   unconditionally navigate to /pipelines on success.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 assay/server/app.py                         | 3 ---
 assay/server/templates/pipeline_new.html    | 4 ++--
 assay/server/templates/pipeline_review.html | 2 +-
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/assay/server/app.py b/assay/server/app.py
index 7bfc29b..4babe02 100644
--- a/assay/server/app.py
+++ b/assay/server/app.py
@@ -681,10 +681,7 @@ def delete_pipeline(pipeline_id: int, request: Request):
                 )
         for pv in list(pipe.versions):
             s.delete(pv)
-        project = pipe.project
         s.delete(pipe)
-    if _is_htmx(request):
-        return Response(headers={"HX-Redirect": f"/projects/{_urlquote(project, safe='')}"})
     return {"ok": True}
 
 
diff --git a/assay/server/templates/pipeline_new.html b/assay/server/templates/pipeline_new.html
index 200a3f6..121d1de 100644
--- a/assay/server/templates/pipeline_new.html
+++ b/assay/server/templates/pipeline_new.html
@@ -190,7 +190,7 @@ <h2 style="margin:0 0 .5rem">What should your model do?</h2>
                 style="color:var(--text-danger)"
                 hx-delete="/pipelines/{{ resume_data.pipeline_id }}"
                 hx-confirm="Delete pipeline '{{ resume_data.name }}'? This removes all versions and cannot be undone."
-                hx-on:htmx:after-request="if(event.detail.successful){ const p=document.referrer; window.location=(p&&new URL(p).origin===location.origin)?p:'/pipelines'; }">
+                hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
           <i class="ti ti-trash" aria-hidden="true"></i> Delete
         </button>
         {% endif %}
@@ -284,7 +284,7 @@ <h2 style="margin:0 0 .75rem">
               style="color:var(--text-danger)"
               hx-delete="/pipelines/{{ resume_data.pipeline_id }}"
               hx-confirm="Delete pipeline '{{ resume_data.name }}'? This removes all versions and cannot be undone."
-              hx-on:htmx:after-request="if(event.detail.successful){ const p=document.referrer; window.location=(p&&new URL(p).origin===location.origin)?p:'/pipelines'; }">
+              hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
         <i class="ti ti-trash" aria-hidden="true"></i> Delete
       </button>
       {% endif %}
diff --git a/assay/server/templates/pipeline_review.html b/assay/server/templates/pipeline_review.html
index 9e194b0..13a6580 100644
--- a/assay/server/templates/pipeline_review.html
+++ b/assay/server/templates/pipeline_review.html
@@ -19,7 +19,7 @@ <h1 style="margin:0">Review pipeline</h1>
   <button class="btn btn-ghost" style="color:var(--text-danger);margin-left:auto"
           hx-delete="/pipelines/{{ pipeline_id }}"
           hx-confirm="Delete pipeline '{{ pipeline_name }}'? This removes all versions and cannot be undone."
-          hx-on:htmx:after-request="if(event.detail.successful){ const p=document.referrer; window.location=(p&&new URL(p).origin===location.origin)?p:'/pipelines'; }">
+          hx-on:htmx:after-request="if(event.detail.successful) window.location='/pipelines'">
     <i class="ti ti-trash" aria-hidden="true"></i> Delete pipeline
   </button>
 </div>