Add phase guard toggle for contract phase confirmation (#2)

* Add phase_guard field to Contract model and database

This adds a new boolean field to control whether the supervisor should
wait for user confirmation before progressing to the next phase. When
enabled, users can review and potentially amend phase outputs (like
plans, requirements docs) before the contract continues.

Changes:
- Add migration for phase_guard column (defaults to false)
- Add phase_guard to Contract, CreateContractRequest, and
  UpdateContractRequest structs
- Update create_contract_for_owner and update_contract_for_owner
  repository functions to handle phase_guard
- Update all CreateContractRequest instantiations with phase_guard field

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: Add phase_guard for contract phase transitions

Implement phase_guard logic in the advance_phase tool. When a contract
has phase_guard enabled, the phase transition now:

1. Asks for user confirmation before advancing
2. Allows users to request changes to phase deliverables
3. Passes feedback to the task without advancing if changes requested

Changes:
- Add phase_guard field to Contract model and CreateContractRequest
- Add PhaseTransitionRequest, PhaseFileInfo, PhaseTaskInfo structs
- Update ChangePhaseRequest with confirmed and feedback fields
- Update ContractToolRequest::AdvancePhase with confirmed/feedback
- Modify advance_phase handling in contract_chat.rs with phase_guard logic
- Update change_phase endpoint in contracts.rs with phase_guard support
- Add database migration for phase_guard column

When phase_guard=false: Phase advances immediately (current behavior)
When phase_guard=true: Returns pending_confirmation status with deliverables
If user provides feedback: Returns feedback to task, doesn't advance

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(frontend): Add UI for phase transition confirmation requests

When phase_guard is enabled and a supervisor tries to advance the contract
phase, users now see a confirmation modal with:
- Current and proposed next phase visualization
- Phase deliverables checklist (if available)
- Summary of the phase work
- Options to "Approve & Advance" or "Request Changes" with feedback

Components added:
- PhaseConfirmationModal: Full modal dialog for phase confirmations
- PhaseConfirmationInline: Inline variant for task output view
- PhaseConfirmationNotification: Global notification wrapper
- PhaseConfirmationToast: Alternative toast-style notification

Integration:
- Added phase_confirmation message type to TaskOutput renderer
- Extended PendingQuestion API type with phase confirmation data
- Integrated notification into main app layout

The UI uses the existing supervisor question infrastructure (polling via
/api/v1/mesh/questions) and responds with APPROVE or CHANGES_REQUESTED
prefixed feedback.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat(frontend): Add Phase Guard toggle to AutopilotPanel

Added the phase_guard toggle to the AutopilotPanel component, which allows
users to enable/disable requiring confirmation before phase transitions.

Changes:
- Added phaseGuard and autonomousLoop fields to Contract interface in api.ts
- Added phaseGuard field to UpdateContractRequest in api.ts
- Added Phase Guard toggle UI in AutopilotPanel with similar styling to master
- Toggle shows an 'active' badge when enabled
- Connected toggle to contract update API

The toggle appears below the autopilot control buttons and allows users to
require confirmation before the supervisor advances to the next phase.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

2 files changed, 70 insertions, 5 deletions

diff --git a/makima/src/db/models.rs b/makima/src/db/models.rs
index 72ba6f2..99c8b8e 100644
--- a/makima/src/db/models.rs
+++ b/makima/src/db/models.rs
@@ -1264,6 +1264,11 @@ pub struct Contract {
     /// without a COMPLETION_GATE indicating ready: true.
     #[serde(default)]
     pub autonomous_loop: bool,
+    /// Whether to wait for user confirmation before progressing to the next phase.
+    /// When enabled, the supervisor will pause and ask the user to review and approve
+    /// phase outputs (like plans, requirements, etc.) before continuing.
+    #[serde(default)]
+    pub phase_guard: bool,
     pub version: i32,
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,
@@ -1389,6 +1394,11 @@ pub struct CreateContractRequest {
     /// without a COMPLETION_GATE indicating ready: true.
     #[serde(default)]
     pub autonomous_loop: Option<bool>,
+    /// Enable phase guard mode for this contract.
+    /// When enabled, the supervisor will pause and ask the user to review and approve
+    /// phase outputs before progressing to the next phase.
+    #[serde(default)]
+    pub phase_guard: Option<bool>,
 }
 
 /// Request payload for updating a contract
@@ -1405,6 +1415,11 @@ pub struct UpdateContractRequest {
     /// Enable or disable autonomous loop mode for tasks in this contract.
     #[serde(default)]
     pub autonomous_loop: Option<bool>,
+    /// Enable or disable phase guard mode for this contract.
+    /// When enabled, the supervisor will pause and ask the user to review and approve
+    /// phase outputs before progressing to the next phase.
+    #[serde(default)]
+    pub phase_guard: Option<bool>,
     /// Version for optimistic locking
     pub version: Option<i32>,
 }
@@ -1443,6 +1458,51 @@ pub struct CreateManagedRepositoryRequest {
 #[serde(rename_all = "camelCase")]
 pub struct ChangePhaseRequest {
     pub phase: String,
+    /// If phase_guard is enabled, this must be true to confirm the transition.
+    /// If not provided or false, returns phase deliverables for review.
+    #[serde(default)]
+    pub confirmed: Option<bool>,
+    /// User feedback for changes (used when not confirming)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub feedback: Option<String>,
+}
+
+/// Response for phase transition when phase_guard is enabled
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PhaseTransitionRequest {
+    /// Current contract phase
+    pub current_phase: String,
+    /// Requested next phase
+    pub next_phase: String,
+    /// Summary of phase deliverables/outputs
+    pub deliverables_summary: String,
+    /// List of files created in this phase
+    pub phase_files: Vec<PhaseFileInfo>,
+    /// List of completed tasks in this phase
+    pub phase_tasks: Vec<PhaseTaskInfo>,
+    /// Whether user confirmation is required
+    pub requires_confirmation: bool,
+    /// Unique ID for tracking this transition request
+    pub transition_id: String,
+}
+
+/// File info for phase transition review
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PhaseFileInfo {
+    pub id: Uuid,
+    pub name: String,
+    pub description: Option<String>,
+}
+
+/// Task info for phase transition review
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct PhaseTaskInfo {
+    pub id: Uuid,
+    pub name: String,
+    pub status: String,
 }
 
 /// Contract event record from the database
diff --git a/makima/src/db/repository.rs b/makima/src/db/repository.rs
index 43b8e3a..3d1efd1 100644
--- a/makima/src/db/repository.rs
+++ b/makima/src/db/repository.rs
@@ -2136,11 +2136,12 @@ pub async fn create_contract_for_owner(
     }
 
     let autonomous_loop = req.autonomous_loop.unwrap_or(false);
+    let phase_guard = req.phase_guard.unwrap_or(false);
 
     sqlx::query_as::<_, Contract>(
         r#"
-        INSERT INTO contracts (owner_id, name, description, contract_type, phase, autonomous_loop)
-        VALUES ($1, $2, $3, $4, $5, $6)
+        INSERT INTO contracts (owner_id, name, description, contract_type, phase, autonomous_loop, phase_guard)
+        VALUES ($1, $2, $3, $4, $5, $6, $7)
         RETURNING *
         "#,
     )
@@ -2150,6 +2151,7 @@ pub async fn create_contract_for_owner(
     .bind(contract_type)
     .bind(phase)
     .bind(autonomous_loop)
+    .bind(phase_guard)
     .fetch_one(pool)
     .await
 }
@@ -2249,14 +2251,15 @@ pub async fn update_contract_for_owner(
     let status = req.status.unwrap_or(existing.status);
     let supervisor_task_id = req.supervisor_task_id.or(existing.supervisor_task_id);
     let autonomous_loop = req.autonomous_loop.unwrap_or(existing.autonomous_loop);
+    let phase_guard = req.phase_guard.unwrap_or(existing.phase_guard);
 
     let result = if req.version.is_some() {
         sqlx::query_as::<_, Contract>(
             r#"
             UPDATE contracts
             SET name = $3, description = $4, phase = $5, status = $6,
-                supervisor_task_id = $7, autonomous_loop = $8, version = version + 1, updated_at = NOW()
-            WHERE id = $1 AND owner_id = $2 AND version = $9
+                supervisor_task_id = $7, autonomous_loop = $8, phase_guard = $9, version = version + 1, updated_at = NOW()
+            WHERE id = $1 AND owner_id = $2 AND version = $10
             RETURNING *
             "#,
         )
@@ -2268,6 +2271,7 @@ pub async fn update_contract_for_owner(
         .bind(&status)
         .bind(supervisor_task_id)
         .bind(autonomous_loop)
+        .bind(phase_guard)
         .bind(req.version.unwrap())
         .fetch_optional(pool)
         .await?
@@ -2276,7 +2280,7 @@ pub async fn update_contract_for_owner(
             r#"
             UPDATE contracts
             SET name = $3, description = $4, phase = $5, status = $6,
-                supervisor_task_id = $7, autonomous_loop = $8, version = version + 1, updated_at = NOW()
+                supervisor_task_id = $7, autonomous_loop = $8, phase_guard = $9, version = version + 1, updated_at = NOW()
             WHERE id = $1 AND owner_id = $2
             RETURNING *
             "#,
@@ -2289,6 +2293,7 @@ pub async fn update_contract_for_owner(
         .bind(&status)
         .bind(supervisor_task_id)
         .bind(autonomous_loop)
+        .bind(phase_guard)
         .fetch_optional(pool)
         .await?
     };