v0.17.0 — Wave 3: sandbox DB, DB isolation, mobile UI, cloud auth, X account, roadmap engine (#303)

* feat(sandbox): throwaway per-agent Postgres/Redis sandbox containers

Orchestrator-provisioned sibling containers per agent spawn
(SandboxProvisioner, roboco/runtime/sandbox.py). Per-project opt-in via
projects.sandbox_services (migration 057); master switch
ROBOCO_SANDBOX_DB_ENABLED, default-off, armed in the NAS compose only.

When active, ROBOCO_TEST_DB_* / ROBOCO_TEST_REDIS_* point at the sandbox
and the prod-creds gate-env injection is suppressed (sandbox replaces,
never coexists). Sandbox lifetime tracks the agent container: teardown at
every removal path, orphan janitor at startup + each reaper tick with a
grace window for mid-flight spawns. The pre-spawn stale-clear spares the
just-provisioned sandbox; provision pre-clears stale same-named
containers from a crash-missed teardown.

Panel: per-project sandbox-service switches in the edit dialog + feature
flag card entry.

* docs: CLAUDE.md entry for the sandboxed dev DB/Redis subsystem

* feat(security): isolate prod Postgres/Redis from agent containers (roboco_data network)

Second user-defined bridge roboco_data carries postgres+redis only; the
orchestrator is multi-homed (default + data). Spawned agents and their
sandbox sidecars stay on roboco_default and can no longer resolve or
reach roboco-postgres:5432 / roboco-redis:6379 (redis has no auth —
membership is its only containment). Normal bridge, so host-published
ports (15432/16379) keep working. Applied to both build composes and
the registry compose; docker-compose.yml re-synced byte-identical with
docker-compose.yaml (it had drifted by the sandbox flag block).

ROBOCO_DB_NETWORK_ISOLATED (config default false, armed alongside the
topology) suppresses the legacy _append_gate_env prod-creds injection:
under isolation those creds dead-end, and unreachable creds are worse
than none. DB-needing projects opt into sandbox_services instead. The
flag is deliberately not a panel feature flag - it must travel with the
compose networks: stanzas.

Preserved by construction: agent<->agent A2A and orchestrator->agent SDK
polls on :9000, MCP->orchestrator on :8000, ollama reachability, docker
exec/inspect (daemon socket), host port publishing.

* feat(panel): full mobile responsiveness pass

Shared primitives: useIsMobile (useSyncExternalStore, hydration-safe,
memoized matchMedia subscribe), ResponsiveTable table->card switch below
md (single subtree mounted, no duplicated interactive rows), scrollable
snap TabsList in the base primitive (justify-center-safe so the first
tab stays reachable on overflow), persistent md:hidden bottom tab bar
(Overview/Tasks/Kanban/Chat, safe-area padded).

Applied: card lists for tasks/projects/products/work-sessions/sessions
+ the three raw metrics tables; CEO approval queue / release proposal /
playbook review action rows stack on narrow; command-center reorders
approvals above the fold on mobile; task-header metadata wraps;
Communications + A2A become URL-driven single-pane drill-downs below lg
(fixes the unconstrained-height ScrollArea bug) with dvh heights;
recharts label density/radius adapts via useIsMobile; git diff viewer
gets mobile font + wrap toggle; vh->dvh sweep; chat composers get
safe-area-inset padding; dashboard main p-4 md:p-6 + pb-20 for the bar.

Verified at 375px on the built app: bottom bar, drawer, approval-first
overview, swipeable kanban tab strip. All gates green (eslint, tsc,
vitest 249, next build 24/24 routes).

* feat(auth): cloud auth via FastAPI Users (default-off, single-user cookie session)

ROBOCO_CLOUD_AUTH_ENABLED (default off) lets the panel/API be exposed
beyond localhost without changing the CEO's local no-login flow while
off — get_agent_context and the WS gate are byte-for-byte unchanged in
off-mode. On: header-trust dies for humans — any agent-role claim (ceo
or a privileged PM/board role) with no valid HMAC token or session
cookie is 401, closing the header-spoof hole on the host-published
:8000 port for every role. The agent-fleet HMAC path and the system
self-PATCH keep working unmodified in both modes.

Single seeded CEO user (migration 058 users table, UserTable), no
registration router — idempotent env-driven upsert at startup by PK.
Cookie transport (httponly/secure/samesite=lax) + a JWTStrategy bound
to a fingerprint of the current password hash (rotating the password
invalidates every prior session). Sliding 30-day session: every
authenticated request re-mints the cookie, so an active session never
expires — no unexpected logouts.

Panel: (auth)/login page + proxy.ts (Next 16 rename of middleware; probes
/auth/status over the docker-internal URL, fails open to off) gate the
dashboard; client.ts gets withCredentials + 401->/login. nginx unchanged.

Review hardening: broadened the on-mode rejection from ceo-only to every
non-CEO role without a valid token (was only closed when
ROBOCO_AGENT_AUTH_REQUIRED was also armed); Next-16 proxy.ts rename to
clear the middleware deprecation warning.

* feat(x): RoboCo X account engine — HoM drafts, per-post CEO approval (default-off)

ROBOCO_X_ENGINE_ENABLED (default off, inert without creds). Mirrors the
ReleaseManagerEngine held-artifact shape: XEngine drafts a post when a
release publishes (via a draft_release_post seam on ReleaseProposalService
.approve) and drafts replies to meaningful mentions (dedicated poll loop,
x_seen_mentions dedup ledger, per-cycle/open caps). Drafting is
local-model-only, clamped to 280 chars. Nothing auto-posts — every tweet
is a held task (source x_post/x_reply, confirmed_by_human=False,
Secretary-owned, dispatcher-skipped) the CEO edits/approves/rejects in a
panel queue.

The four OAuth 1.0a secrets live Fernet-encrypted in a singleton
x_credentials row (migration 059, all-or-nothing, API returns only
has_credentials); decryption is server-side, agents never hold creds or
egress. Hand-rolled OAuth 1.0a HMAC-SHA1 signer, no new dependency;
NullXClient makes the unconfigured path a graceful no-op.

XPostService.approve (CEO-only) is the sole caller of post_tweet.

Review hardening: closed a double-post race — the approve path now
re-reads committed task state inside the Redis lock and commits COMPLETED
before releasing, so a concurrent approve that acquires the lock after the
winner released can't re-post (SET-NX is non-waiting, and the route-level
commit landed after the lock dropped). Added a regression test.

* feat(roadmap): board roadmap engine — PO proposes themed cycles, CEO approves per-item (default-off)

ROBOCO_ROADMAP_ENGINE_ENABLED (default off). Weekly, RoadmapEngine opens
ONE held exploration task (source=board_roadmap, confirmed_by_human=False,
Product-Owner-assigned), deduped to one open cycle. A dedicated one-shot
_dispatch_roadmap_exploration spawns the PO solo (not the two-reviewer
board path, which would also spawn HoM + fire Approve-&-Start). The PO
explores read-only (git/KB/metrics/releases/charter/web) and makes one
propose_roadmap call (PO-only content verb) authoring a themed cycle —
goal + 3-7 item drafts — persisted as a roadmap_cycle marker (no table,
no migration; head stays 059).

The CEO acts per-item in the panel roadmap queue: approve materializes a
BACKLOG task (source=roadmap, no assignee — never auto-starts), reject
records a reason; all-items-terminal completes the exploration task.
RoadmapService is idempotent per item. Dispatchers skip board_roadmap.

Includes a real SQLAlchemy dirty-check fix (deep-copy the JSON marker
before mutating, or the in-place edit + reassign compares equal to its
own baseline and the UPDATE is skipped).

Review hardening: create_task_from_draft now honors a draft-declared
source only from a {prompter, roadmap} whitelist — drafts are
LLM-authored, so an unbounded source could impersonate a privileged
origin (release_manager would even wedge that engine's dedup).

* chore(release): 0.17.0

Wave 3 — six default-off subsystems: sandboxed dev DB/Redis, prod
Postgres/Redis network isolation, full mobile UI pass, cloud auth
(FastAPI Users), the RoboCo X account engine, and the board roadmap
engine. Plus the waves 1+2 work already on master since 0.16.0.

Version bumped across the canonical set (config.py, __init__.py,
pyproject.toml, panel/package.json, uv.lock); CHANGELOG [Unreleased]
cut to [0.17.0]; docs/map delta added.

Compose: every optional feature armed :-true in the NAS composes, OFF
in the user-facing registry compose. Two opt-in exceptions default off
(CLOUD_AUTH — needs email/password/secret + TLS, would otherwise fail
startup; ROUTING_STRICT — fail-closed spawning). DB_NETWORK_ISOLATED
stays on in both (coupled to the roboco_data topology).

* chore(compose): arm cloud_auth + routing_strict ON in the NAS composes

Every feature defaults ON in the NAS composes per policy — these two
were wrongly left off. Both keep the ${VAR:-true} form so the operator
controls the real runtime via .env: cloud auth needs
ROBOCO_CLOUD_AUTH_EMAIL/_PASSWORD/_SECRET + TLS set there before a boot
(else startup fails loud), and routing_strict is fail-closed. Registry
compose keeps both off.

* fix(ci): reflow board.md prose (quality gate) + document v0.17.0 env creds

The roadmap section added hard-wrapped prose that failed the markdown
prose gate; reflowed (token-invariant). Also brought .env.example
current: cloud auth (now armed — needs SECRET or startup fails), routing
strict, the X engine (panel-entered OAuth), and web research.

* fix(ci): reduce cyclomatic complexity of five wave-3 blocks (xenon gate)

The wave-3 subagents introduced C-rank functions the CI xenon gate
rejects (my per-item reviews ran ruff/mypy/pytest but not xenon):
- sandbox.janitor_sweep -> extract _list_labeled_sandboxes /
  _list_live_agent_containers / _prune_grace
- x_client.fetch_mentions -> extract _parse_mention_items
- x_engine.run_cycle -> extract _process_mentions
- orchestrator._dispatch_pm_work -> extract the source-skip into a
  MODULE-level _is_held_ceo_source (module, not method, so the
  wholesale-mocked dispatcher unit tests exercise the real logic)
- auth/seed.ensure_seed_user -> extract _apply_seed_updates (module avg -> A)

Behavior-preserving; full suite green (11902), xenon clean.

* fix(ci): declare pyjwt + fastapi-users-db-sqlalchemy as direct deps (deptry)

The cloud-auth code imports jwt and fastapi_users_db_sqlalchemy directly
but they were only transitive deps (via fastapi-users), which deptry
(quality gate, DEP003) rejects. Declared explicitly; deptry roboco/ clean.
Missed originally because local make quality stopped at earlier gates
before reaching deptry.

* feat(x): gate mention replies behind ROBOCO_X_REPLIES_ENABLED (default off)

Per CEO decision: the X engine should only post about releases by
default. Reading mentions needs a paid X API tier, so the mention-reply
half is now a deliberate opt-in on top of release posting.

New default-off flag x_replies_enabled gates the mentions poll loop
(_x_mentions_poll_loop) and XEngine.run_cycle; release-post drafting
(the release-proposal approve hook) is unaffected and still runs when
x_engine_enabled + credentials are set. Added to FEATURE_FLAGS + the
panel card. Tests: release posting works with replies off; run_cycle +
the poll loop are no-ops with replies off.

* fix: 401 only redirects to /login when cloud auth is on; panel-token strips .env quotes

Two bugs that together dead-ended login in secure mode:
- client.ts redirected to /login on ANY 401, so a mismatched panel
  token (header-trust/secure mode, cloud auth off) bounced the user to a
  login page whose backend route isn't mounted -> 404. Now it probes
  /auth/status (bare fetch, no interceptor re-entry) and only redirects
  when cloud_auth_enabled.
- make panel-token read the .env secret with grep|cut without stripping
  surrounding quotes, so a quoted ROBOCO_AGENT_AUTH_SECRET produced a
  token signed with the quotes included — which never verifies against
  the orchestrator (docker-compose/pydantic unquote the secret). Now
  strips surrounding single/double quotes.

* fix: git-log 500 on '|' in commit message; X queue shows an empty state

- GET /api/git/log 500'd (ValueError: Invalid isoformat) when a commit
  SUBJECT contained a '|' (e.g. the 'curl|sh' lockdown commit): the
  fixed '|' field delimiter let the subject's pipe shift the split so
  author+date collapsed into one field. Switched to \x1f (Unit
  Separator), which can't appear in commit content. Regression test with
  a piped subject.
- The X Post Queue returned null when empty, so there was no visible
  place for the X drafts. It now renders a discoverable empty state
  pointing at Settings -> X credentials.

* docs: bring docs/rag + docs/map current for v0.17.0 (waves 1-3)

Agent-facing RAG corpus and codebase map updated for every feature in
the 0.17.0 span, code-verified:
- wave 3: sandbox DB, DB network isolation, cloud auth, X engine
  (+ x_replies_enabled sub-flag), board roadmap engine — new RAG
  architecture pages + role/tool/config-reference updates; new symbols,
  migrations 057-059, panel surfaces, and the get_agent_context
  dual-path across the map slices.
- waves 1-2: A2A live view + switchboard, prompter memory
  (search_past_tasks), Secretary edit access + PM-lighter scope, the
  PR-gate auto-submit turn cut (ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED).
- correctness fix: api-routes-schemas.md no longer claims the A2A admin
  routes are reachable by any authenticated agent — they carry a
  _require_ceo gate (wave 2c).

docs/internal, _front.md deltas, and the frozen _complete_map.md
snapshot untouched.

* fix(rag): atomic upsert for indexed-doc tracking (kills e2e segfault)

The indexed-document tracking write used check-then-insert in two paths
(IndexedDocumentRepository.upsert_batch and the file-source
_upsert_doc_record). Under concurrent indexing both callers saw no row
and both inserted, so the second violated uq_indexed_doc_source and
poisoned its transaction — surfacing in CI as the intermittent
_checkin_failed SIGSEGV on the failed connection's pool checkin.

Both paths now use INSERT ... ON CONFLICT DO UPDATE against the
constraint: coalesce keeps an existing title/preview when the new value
is empty (matching the old guards) and metadata is jsonb-merged. The
batch dedupes within itself first (ON CONFLICT can't touch a row twice
in one statement). expire_all after the Core upsert keeps same-session
ORM reads consistent with the merged DB row.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

panel/src/components/dashboard/__tests__/roadmap-review-queue.test.tsx

@@ -0,0 +1,137 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
+import type { RoadmapCycle } from "@/lib/api/roadmap";
+
+const { resolveApproveRef } = vi.hoisted(() => ({
+  resolveApproveRef: { current: null as null | ((v: unknown) => void) },
+}));
+
+const { listCycles, approveItem, rejectItem } = vi.hoisted(() => ({
+  listCycles: vi.fn(
+    async () =>
+      [
+        {
+          task_id: "cycle-1",
+          title: "Roadmap exploration cycle",
+          status: "pending",
+          goal: "Close onboarding friction",
+          items: [
+            {
+              id: "item-0",
+              title: "Streamline signup",
+              description: "Cut the signup form from 8 fields to 3",
+              acceptance_criteria: ["signup takes < 30s"],
+              project_slug: "backend-svc",
+              team: "backend",
+              priority: 2,
+              rationale: "signup drop-off is the top funnel leak",
+              status: "proposed",
+            },
+            {
+              id: "item-1",
+              title: "Simplify pricing page",
+              description: "Remove the three-tier confusion",
+              acceptance_criteria: ["one clear CTA"],
+              project_slug: "frontend-app",
+              team: "frontend",
+              priority: 3,
+              rationale: "pricing page bounce rate is high",
+              status: "proposed",
+            },
+          ],
+        },
+      ] as RoadmapCycle[],
+  ),
+  // Deferred so the test can freeze the approve mid-flight.
+  approveItem: vi.fn(
+    () =>
+      new Promise((r) => {
+        resolveApproveRef.current = r as (v: unknown) => void;
+      }),
+  ),
+  rejectItem: vi.fn(async () => ({})),
+}));
+
+vi.mock("@/lib/api", () => ({
+  roadmapApi: { listCycles, approveItem, rejectItem },
+}));
+
+import { RoadmapReviewQueue } from "../roadmap-review-queue";
+
+function withQueryClient(ui: ReactNode) {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+  return <QueryClientProvider client={client}>{ui}</QueryClientProvider>;
+}
+
+describe("RoadmapReviewQueue", () => {
+  beforeEach(() => {
+    listCycles.mockClear();
+    approveItem.mockClear();
+    rejectItem.mockClear();
+    resolveApproveRef.current = null;
+  });
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("renders the cycle goal and both item drafts", async () => {
+    render(withQueryClient(<RoadmapReviewQueue />));
+    expect(await screen.findByText("Close onboarding friction")).toBeInTheDocument();
+    expect(screen.getByText("Streamline signup")).toBeInTheDocument();
+    expect(screen.getByText("Simplify pricing page")).toBeInTheDocument();
+  });
+
+  it("disables only the item being approved, not every row's Approve", async () => {
+    render(withQueryClient(<RoadmapReviewQueue />));
+
+    const approveButtons = await screen.findAllByRole("button", {
+      name: /Approve/,
+    });
+    expect(approveButtons).toHaveLength(2);
+    expect(approveButtons[0]).not.toBeDisabled();
+    expect(approveButtons[1]).not.toBeDisabled();
+
+    fireEvent.click(approveButtons[0]);
+    await waitFor(() =>
+      expect(approveItem).toHaveBeenCalledWith("cycle-1", "item-0"),
+    );
+
+    await waitFor(() => expect(approveButtons[0]).toBeDisabled());
+    expect(approveButtons[1]).not.toBeDisabled();
+
+    resolveApproveRef.current?.({
+      status: "approved",
+      item_id: "item-0",
+      materialized_task_id: "t-1",
+      detail: "materialized into the backlog",
+    });
+    await waitFor(() => expect(approveButtons[0]).not.toBeDisabled());
+  });
+
+  it("rejects an item with a reason", async () => {
+    render(withQueryClient(<RoadmapReviewQueue />));
+    const rejectButtons = await screen.findAllByRole("button", {
+      name: "Reject",
+    });
+    fireEvent.click(rejectButtons[1]);
+
+    const reasonBox = await screen.findByLabelText("Reason");
+    fireEvent.change(reasonBox, { target: { value: "not a priority" } });
+    fireEvent.click(screen.getByRole("button", { name: "Reject" }));
+
+    await waitFor(() =>
+      expect(rejectItem).toHaveBeenCalledWith("cycle-1", "item-1", "not a priority"),
+    );
+  });
+
+  it("renders nothing when there is no authored cycle", async () => {
+    listCycles.mockResolvedValueOnce([]);
+    const { container } = render(withQueryClient(<RoadmapReviewQueue />));
+    await waitFor(() => expect(listCycles).toHaveBeenCalled());
+    expect(container).toBeEmptyDOMElement();
+  });
+});

panel/src/components/dashboard/__tests__/x-post-queue.test.tsx

@@ -0,0 +1,132 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
+import type { XPost } from "@/lib/api/x";
+
+const { resolveApproveRef } = vi.hoisted(() => ({
+  resolveApproveRef: { current: null as null | ((v: unknown) => void) },
+}));
+
+const { listPosts, approve, reject } = vi.hoisted(() => ({
+  listPosts: vi.fn(
+    async () =>
+      [
+        {
+          task_id: "x-1",
+          source: "x_post",
+          title: "X post: release v0.17.0",
+          status: "pending",
+          body: "RoboCo v0.17.0 just shipped!",
+          char_count: 28,
+          release_version: "0.17.0",
+        },
+        {
+          task_id: "x-2",
+          source: "x_reply",
+          title: "X reply: mention m1",
+          status: "pending",
+          body: "Thanks for the shoutout!",
+          char_count: 24,
+          mention: { id: "m1", author_id: "a1", text: "great work @roboco" },
+        },
+      ] as XPost[],
+  ),
+  // Deferred so the test can freeze the approve mid-flight.
+  approve: vi.fn(
+    () =>
+      new Promise((r) => {
+        resolveApproveRef.current = r as (v: unknown) => void;
+      }),
+  ),
+  reject: vi.fn(async () => ({})),
+}));
+
+vi.mock("@/lib/api", () => ({ xApi: { listPosts, approve, reject } }));
+
+import { XPostQueue } from "../x-post-queue";
+
+function withQueryClient(ui: ReactNode) {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+  return <QueryClientProvider client={client}>{ui}</QueryClientProvider>;
+}
+
+describe("XPostQueue", () => {
+  beforeEach(() => {
+    listPosts.mockClear();
+    approve.mockClear();
+    reject.mockClear();
+    resolveApproveRef.current = null;
+  });
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("renders both a release post and a mention reply draft", async () => {
+    render(withQueryClient(<XPostQueue />));
+    expect(await screen.findByText("Release post")).toBeInTheDocument();
+    expect(await screen.findByText("Mention reply")).toBeInTheDocument();
+    expect(screen.getByDisplayValue("RoboCo v0.17.0 just shipped!")).toBeInTheDocument();
+  });
+
+  it("disables only the row being approved, not every row's Approve", async () => {
+    render(withQueryClient(<XPostQueue />));
+
+    const approveButtons = await screen.findAllByRole("button", {
+      name: /Approve/,
+    });
+    expect(approveButtons).toHaveLength(2);
+    expect(approveButtons[0]).not.toBeDisabled();
+    expect(approveButtons[1]).not.toBeDisabled();
+
+    fireEvent.click(approveButtons[0]);
+    await waitFor(() =>
+      expect(approve).toHaveBeenCalledWith("x-1", "RoboCo v0.17.0 just shipped!"),
+    );
+
+    await waitFor(() => expect(approveButtons[0]).toBeDisabled());
+    expect(approveButtons[1]).not.toBeDisabled();
+
+    resolveApproveRef.current?.({ status: "posted", tweet_id: "1", detail: "ok" });
+    await waitFor(() => expect(approveButtons[0]).not.toBeDisabled());
+  });
+
+  it("disables Approve when the edited body exceeds 280 characters", async () => {
+    render(withQueryClient(<XPostQueue />));
+    const textarea = await screen.findByDisplayValue(
+      "RoboCo v0.17.0 just shipped!",
+    );
+    fireEvent.change(textarea, { target: { value: "x".repeat(281) } });
+
+    const approveButtons = await screen.findAllByRole("button", {
+      name: /Approve/,
+    });
+    expect(approveButtons[0]).toBeDisabled();
+    expect(screen.getByText("281/280")).toBeInTheDocument();
+  });
+
+  it("rejects a draft with a reason", async () => {
+    render(withQueryClient(<XPostQueue />));
+    const rejectButtons = await screen.findAllByRole("button", {
+      name: "Reject",
+    });
+    fireEvent.click(rejectButtons[1]);
+
+    const reasonBox = await screen.findByLabelText("Reason");
+    fireEvent.change(reasonBox, { target: { value: "not relevant" } });
+    fireEvent.click(screen.getByRole("button", { name: "Reject" }));
+
+    await waitFor(() =>
+      expect(reject).toHaveBeenCalledWith("x-2", "not relevant"),
+    );
+  });
+
+  it("renders nothing when the queue is empty", async () => {
+    listPosts.mockResolvedValueOnce([]);
+    const { container } = render(withQueryClient(<XPostQueue />));
+    await waitFor(() => expect(listPosts).toHaveBeenCalled());
+    expect(container).toBeEmptyDOMElement();
+  });
+});

panel/src/components/dashboard/ceo-approval-queue.tsx

@@ -213,9 +213,9 @@ export function CeoApprovalQueue({ className }: CeoApprovalQueueProps) {
   const renderRow = (task: Task, kind: "start" | "approve") => (
     <div
       key={task.id}
-      className="flex items-start justify-between p-4 border rounded-lg hover:bg-muted/50 transition-colors"
+      className="flex flex-col gap-3 border rounded-lg p-4 transition-colors hover:bg-muted/50 sm:flex-row sm:items-start sm:justify-between"
     >
-      <div className="flex-1 min-w-0">
+      <div className="min-w-0 flex-1">
         <div className="flex items-center gap-2 mb-1">
           {getPriorityBadge(task.priority)}
           <Badge variant="outline">{task.team}</Badge>
@@ -233,7 +233,9 @@ export function CeoApprovalQueue({ className }: CeoApprovalQueueProps) {
           </p>
         )}
       </div>
-      <div className="flex items-center gap-2 ml-4 flex-shrink-0">
+      {/* Action cluster — stacks below the task text on narrow instead of
+          clipping against it (mirrors the dialog footer's flex-col sm:flex-row). */}
+      <div className="flex flex-wrap items-center gap-2 sm:ml-4 sm:shrink-0">
         <Link href={`/tasks/${task.id}`} prefetch={false}>
           <Button variant="ghost" size="sm">
             <FileText className="h-4 w-4" />

panel/src/components/dashboard/command-center.tsx

@@ -16,6 +16,8 @@ import { CeoApprovalQueue } from "./ceo-approval-queue";
 import { PrReviewQueue } from "./pr-review-queue";
 import { ReleaseProposalCard } from "./release-proposal-card";
 import { PlaybookReviewQueue } from "./playbook-review-queue";
+import { XPostQueue } from "./x-post-queue";
+import { RoadmapReviewQueue } from "./roadmap-review-queue";
 import { StrategySignalsPanel } from "./strategy-signals-panel";
 import type { Activity } from "./activity-item";
 import { Button } from "@/components/ui/button";
@@ -60,9 +62,13 @@ export function CommandCenter() {
   };
 
   return (
-    <div className="space-y-6">
+    // flex-col + explicit `order` (reset via md:order-none): below md the CEO
+    // decision queues and activity move above the fold; at md+ every item
+    // shares order:0 and falls back to plain source order (unchanged desktop
+    // layout).
+    <div className="flex flex-col gap-6">
       {/* Header */}
-      <div className="flex items-center justify-between">
+      <div className="order-1 flex items-center justify-between md:order-none">
         <div>
           <h1 className="text-3xl font-bold tracking-tight">
             RoboCo Command Center
@@ -86,14 +92,56 @@ export function CommandCenter() {
 
       {/* Error indicator */}
       {hasError && (
-        <div className="flex items-center gap-2 rounded-md border border-destructive/50 bg-destructive/10 px-4 py-2 text-sm text-destructive">
+        <div className="order-2 flex items-center gap-2 rounded-md border border-destructive/50 bg-destructive/10 px-4 py-2 text-sm text-destructive md:order-none">
           <AlertCircle className="h-4 w-4 shrink-0" />
           Some data failed to load. Click Refresh to try again.
         </div>
       )}
 
+      {/* CEO Approval Queue + Strategy Signals - side-by-side on lg+. Ordered
+          first on mobile — the CEO's decisions shouldn't be below the fold. */}
+      <div className="order-3 grid grid-cols-1 gap-6 md:order-none lg:grid-cols-2">
+        <CeoApprovalQueue />
+        <StrategySignalsPanel />
+      </div>
+
+      {/* External-PR review decision queue (hidden when empty) */}
+      <div className="order-4 md:order-none">
+        <PrReviewQueue />
+      </div>
+
+      {/* Gated release proposal (hidden when none open) */}
+      <div className="order-4 md:order-none">
+        <ReleaseProposalCard />
+      </div>
+
+      {/* Playbook review queue (hidden when no drafts) */}
+      <div className="order-4 md:order-none">
+        <PlaybookReviewQueue />
+      </div>
+
+      {/* X post/reply queue (hidden when no drafts) */}
+      <div className="order-4 md:order-none">
+        <XPostQueue />
+      </div>
+
+      {/* Board roadmap queue (hidden when no cycle authored) */}
+      <div className="order-4 md:order-none">
+        <RoadmapReviewQueue />
+      </div>
+
+      {/* Blockers and Activity Row — activity brought up near the top on
+          mobile too, ahead of the Team Health / Quick Actions filler. */}
+      <div className="order-5 grid grid-cols-1 gap-6 md:order-none lg:grid-cols-2">
+        <ActiveBlockersPanel tasks={tasks} isLoading={loadingTasks} />
+        <RecentActivityFeed
+          activities={activity as Activity[] | undefined}
+          isLoading={loadingActivity}
+        />
+      </div>
+
       {/* Team Health */}
-      <section>
+      <section className="order-6 md:order-none">
         <h2 className="text-lg font-semibold mb-4">Team Health</h2>
         <TeamHealthCards
           teams={overview?.health_status}
@@ -101,31 +149,14 @@ export function CommandCenter() {
         />
       </section>
 
-      {/* Quick Actions — placed immediately after Team Health so it is
-          visible without scrolling on a 900px-tall viewport, before the
-          data-heavy grid rows below. */}
-      <section>
+      {/* Quick Actions */}
+      <section className="order-7 md:order-none">
         <h2 className="text-lg font-semibold mb-4">Quick Actions</h2>
         <QuickActionsBar />
       </section>
 
-      {/* CEO Approval Queue + Strategy Signals - side-by-side on lg+ */}
-      <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
-        <CeoApprovalQueue />
-        <StrategySignalsPanel />
-      </div>
-
-      {/* External-PR review decision queue (hidden when empty) */}
-      <PrReviewQueue />
-
-      {/* Gated release proposal (hidden when none open) */}
-      <ReleaseProposalCard />
-
-      {/* Playbook review queue (hidden when no drafts) */}
-      <PlaybookReviewQueue />
-
       {/* Metrics, Alerts, Usage, and Performance Row */}
-      <div className="grid grid-cols-1 lg:grid-cols-2 xl:grid-cols-4 gap-6">
+      <div className="order-8 grid grid-cols-1 gap-6 md:order-none lg:grid-cols-2 xl:grid-cols-4">
         <KeyMetricsPanel
           metrics={overview?.key_metrics}
           isLoading={loadingOverview}
@@ -134,15 +165,6 @@ export function CommandCenter() {
         <UsageOverviewPanel />
         <ScorecardOverviewPanel />
       </div>
-
-      {/* Blockers and Activity Row */}
-      <div className="grid grid-cols-1 lg:grid-cols-2 xl:grid-cols-2 2xl:grid-cols-2 gap-6">
-        <ActiveBlockersPanel tasks={tasks} isLoading={loadingTasks} />
-        <RecentActivityFeed
-          activities={activity as Activity[] | undefined}
-          isLoading={loadingActivity}
-        />
-      </div>
     </div>
   );
 }

panel/src/components/dashboard/index.ts

@@ -12,6 +12,7 @@ export { HealthIndicator } from "./health-indicator";
 export { CeoApprovalQueue } from "./ceo-approval-queue";
 export { ReleaseProposalCard } from "./release-proposal-card";
 export { PlaybookReviewQueue } from "./playbook-review-queue";
+export { RoadmapReviewQueue } from "./roadmap-review-queue";
 export { StrategySignalsPanel } from "./strategy-signals-panel";
 export { UsageOverviewPanel } from "./usage-overview-panel";
 export { ScorecardOverviewPanel } from "./scorecard-overview-panel";

panel/src/components/dashboard/playbook-review-queue.tsx

@@ -119,7 +119,7 @@ export function PlaybookReviewQueue({ className }: { className?: string }) {
               <pre className="mt-2 max-h-40 overflow-auto rounded bg-muted p-2 text-xs whitespace-pre-wrap">
                 {pb.procedure}
               </pre>
-              <div className="mt-3 flex items-center justify-end gap-2">
+              <div className="mt-3 flex flex-col-reverse gap-2 sm:flex-row sm:items-center sm:justify-end">
                 <Button
                   variant="outline"
                   size="sm"

panel/src/components/dashboard/release-proposal-card.tsx

@@ -227,7 +227,7 @@ export function ReleaseProposalCard({ className }: { className?: string }) {
             </p>
           )}
 
-          <div className="flex items-center justify-end gap-2 pt-1">
+          <div className="flex flex-col-reverse gap-2 pt-1 sm:flex-row sm:items-center sm:justify-end">
             <Button
               variant="outline"
               size="sm"

panel/src/components/dashboard/roadmap-review-queue.tsx

@@ -0,0 +1,284 @@
+"use client";
+
+import { useState } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { roadmapApi } from "@/lib/api";
+import type { RoadmapCycle, RoadmapItem } from "@/lib/api/roadmap";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Textarea } from "@/components/ui/textarea";
+import { Label } from "@/components/ui/label";
+import { CheckCircle2, Map, XCircle } from "lucide-react";
+import { toast } from "sonner";
+
+const _MIN_REASON_CHARS = 4;
+
+interface RejectTarget {
+  taskId: string;
+  item: RoadmapItem;
+}
+
+function itemStatusBadge(item: RoadmapItem) {
+  if (item.status === "approved") {
+    return (
+      <Badge variant="secondary" className="bg-green-600/10 text-green-700">
+        Approved
+      </Badge>
+    );
+  }
+  if (item.status === "rejected") {
+    return <Badge variant="outline">Rejected</Badge>;
+  }
+  return null;
+}
+
+// One roadmap item row: details + per-item approve/reject (proposed only).
+function RoadmapItemRow({
+  taskId,
+  item,
+  onApprove,
+  onReject,
+  approving,
+}: {
+  taskId: string;
+  item: RoadmapItem;
+  onApprove: (taskId: string, itemId: string) => void;
+  onReject: (target: RejectTarget) => void;
+  approving: boolean;
+}) {
+  const isProposed = item.status === "proposed";
+
+  return (
+    <div className="rounded-lg border p-4 transition-colors hover:bg-muted/50">
+      <div className="mb-2 flex flex-wrap items-center gap-2">
+        <span className="font-medium">{item.title}</span>
+        <Badge variant="outline">{item.team}</Badge>
+        <Badge variant="outline">{item.project_slug}</Badge>
+        <Badge variant="secondary">P{item.priority}</Badge>
+        {itemStatusBadge(item)}
+      </div>
+      <p className="text-sm text-muted-foreground">{item.description}</p>
+      <p className="mt-1 text-sm text-muted-foreground">
+        <span className="font-semibold">Why:</span> {item.rationale}
+      </p>
+      {item.acceptance_criteria.length > 0 && (
+        <ul className="mt-2 list-disc space-y-0.5 pl-5 text-sm text-muted-foreground">
+          {item.acceptance_criteria.map((ac) => (
+            <li key={ac}>{ac}</li>
+          ))}
+        </ul>
+      )}
+      {item.status === "rejected" && item.reject_reason && (
+        <p className="mt-2 text-sm text-destructive">
+          Rejected: {item.reject_reason}
+        </p>
+      )}
+      {isProposed && (
+        <div className="mt-3 flex flex-col-reverse gap-2 sm:flex-row sm:items-center sm:justify-end">
+          <Button
+            variant="outline"
+            size="sm"
+            className="text-destructive hover:text-destructive"
+            onClick={() => onReject({ taskId, item })}
+          >
+            <XCircle className="mr-1 h-4 w-4" />
+            Reject
+          </Button>
+          <Button
+            size="sm"
+            className="bg-green-600 hover:bg-green-700"
+            disabled={approving}
+            onClick={() => onApprove(taskId, item.id)}
+          >
+            <CheckCircle2 className="mr-1 h-4 w-4" />
+            Approve
+          </Button>
+        </div>
+      )}
+    </div>
+  );
+}
+
+function RoadmapCycleCard({
+  cycle,
+  onApprove,
+  onReject,
+  approvingItemId,
+}: {
+  cycle: RoadmapCycle;
+  onApprove: (taskId: string, itemId: string) => void;
+  onReject: (target: RejectTarget) => void;
+  approvingItemId: string | null;
+}) {
+  const pending = cycle.items.filter((i) => i.status === "proposed").length;
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2">
+          <Map className="h-5 w-5" />
+          Roadmap Cycle
+          <Badge variant="secondary">{pending} pending</Badge>
+        </CardTitle>
+        <CardDescription>{cycle.goal}</CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-3">
+        {cycle.items.map((item) => (
+          <RoadmapItemRow
+            key={item.id}
+            taskId={cycle.task_id}
+            item={item}
+            onApprove={onApprove}
+            onReject={onReject}
+            approving={approvingItemId === item.id}
+          />
+        ))}
+      </CardContent>
+    </Card>
+  );
+}
+
+// CEO queue for the Product Owner's held roadmap cycles. Hidden when no
+// cycle has been authored yet (mirrors the playbook + X post queues).
+export function RoadmapReviewQueue({ className }: { className?: string }) {
+  const queryClient = useQueryClient();
+  const [rejecting, setRejecting] = useState<RejectTarget | null>(null);
+  const [reason, setReason] = useState("");
+  const [approvingItemId, setApprovingItemId] = useState<string | null>(null);
+
+  const { data: cycles, isLoading } = useQuery({
+    queryKey: ["roadmap", "cycles"],
+    queryFn: () => roadmapApi.listCycles(),
+    refetchInterval: 30000,
+  });
+
+  const invalidate = () =>
+    queryClient.invalidateQueries({ queryKey: ["roadmap", "cycles"] });
+
+  const approveMutation = useMutation({
+    mutationFn: ({ taskId, itemId }: { taskId: string; itemId: string }) =>
+      roadmapApi.approveItem(taskId, itemId),
+    onSuccess: (result) => {
+      invalidate();
+      if (result.status === "approved" || result.status === "already_approved") {
+        toast.success("Item approved — added to the backlog");
+      } else {
+        toast.warning(result.detail);
+      }
+    },
+    onError: (e) =>
+      toast.error(
+        `Approve failed: ${e instanceof Error ? e.message : "error"}`,
+      ),
+    onSettled: () => setApprovingItemId(null),
+  });
+
+  const rejectMutation = useMutation({
+    mutationFn: ({
+      taskId,
+      itemId,
+      reason,
+    }: {
+      taskId: string;
+      itemId: string;
+      reason: string;
+    }) => roadmapApi.rejectItem(taskId, itemId, reason),
+    onSuccess: () => {
+      invalidate();
+      toast.success("Item rejected");
+      closeReject();
+    },
+    onError: (e) =>
+      toast.error(`Reject failed: ${e instanceof Error ? e.message : "error"}`),
+  });
+
+  const closeReject = () => {
+    setRejecting(null);
+    setReason("");
+  };
+
+  const confirmReject = () => {
+    if (!rejecting) return;
+    if (reason.trim().length < _MIN_REASON_CHARS) {
+      toast.error("Give a brief reason for rejecting");
+      return;
+    }
+    rejectMutation.mutate({
+      taskId: rejecting.taskId,
+      itemId: rejecting.item.id,
+      reason: reason.trim(),
+    });
+  };
+
+  const handleApprove = (taskId: string, itemId: string) => {
+    setApprovingItemId(itemId);
+    approveMutation.mutate({ taskId, itemId });
+  };
+
+  if (isLoading || !cycles || cycles.length === 0) return null;
+
+  return (
+    <>
+      <div className={`space-y-4 ${className ?? ""}`}>
+        {cycles.map((cycle) => (
+          <RoadmapCycleCard
+            key={cycle.task_id}
+            cycle={cycle}
+            onApprove={handleApprove}
+            onReject={setRejecting}
+            approvingItemId={approvingItemId}
+          />
+        ))}
+      </div>
+
+      <Dialog open={!!rejecting} onOpenChange={() => closeReject()}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Reject roadmap item</DialogTitle>
+            <DialogDescription>
+              This records your reason and feeds the next cycle&apos;s prompt
+              — it is not added to the backlog.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-2">
+            <Label htmlFor="roadmap-reject-reason">Reason</Label>
+            <Textarea
+              id="roadmap-reject-reason"
+              placeholder="e.g. not a priority this quarter; overlaps an existing task..."
+              value={reason}
+              onChange={(e) => setReason(e.target.value)}
+              rows={3}
+            />
+          </div>
+          <DialogFooter>
+            <Button variant="outline" onClick={closeReject}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={confirmReject}
+              disabled={rejectMutation.isPending}
+            >
+              {rejectMutation.isPending ? "Rejecting..." : "Reject"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

panel/src/components/dashboard/x-post-queue.tsx

@@ -0,0 +1,275 @@
+"use client";
+
+import { useState } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { xApi } from "@/lib/api";
+import type { XPost, XPostExecuteResult } from "@/lib/api/x";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Textarea } from "@/components/ui/textarea";
+import { Label } from "@/components/ui/label";
+import { AtSign, CheckCircle2, Rocket, XCircle } from "lucide-react";
+import { toast } from "sonner";
+
+const MAX_TWEET_CHARS = 280;
+const _MIN_REASON_CHARS = 4;
+
+function sourceMeta(source: XPost["source"]) {
+  return source === "x_post"
+    ? { label: "Release post", icon: Rocket }
+    : { label: "Mention reply", icon: AtSign };
+}
+
+function describeExecuteResult(result: XPostExecuteResult): string {
+  if (result.status === "posted") return "Posted to X.";
+  if (result.status === "already_posted") return "Already posted — no-op.";
+  if (result.status === "already_in_progress")
+    return "A post is already in progress for this draft.";
+  if (result.status === "no_credentials")
+    return "No X credentials configured — set them below first.";
+  return `${result.status}: ${result.detail}`;
+}
+
+// One row of the queue: an editable draft body + char counter + approve/reject.
+function XPostRow({
+  post,
+  onApprove,
+  onReject,
+  approving,
+}: {
+  post: XPost;
+  onApprove: (taskId: string, body: string) => void;
+  onReject: (post: XPost) => void;
+  approving: boolean;
+}) {
+  // `edited` holds the user's in-progress textarea input; null means "show
+  // the server value". Deriving the displayed body avoids syncing query
+  // state into local state with an effect (mirrors TranscriptRetentionCard).
+  const [edited, setEdited] = useState<string | null>(null);
+  const body = edited ?? post.body;
+  const meta = sourceMeta(post.source);
+  const overLimit = body.length > MAX_TWEET_CHARS;
+
+  return (
+    <div className="rounded-lg border p-4 transition-colors hover:bg-muted/50">
+      <div className="mb-2 flex flex-wrap items-center gap-2">
+        <meta.icon className="h-4 w-4 text-muted-foreground" />
+        <span className="font-medium">{meta.label}</span>
+        {post.release_version && (
+          <Badge variant="outline">v{post.release_version}</Badge>
+        )}
+        {post.mention && (
+          <Badge variant="secondary" className="max-w-56 truncate">
+            re: {post.mention.text}
+          </Badge>
+        )}
+      </div>
+
+      <Textarea
+        value={body}
+        onChange={(e) => setEdited(e.target.value)}
+        rows={3}
+        className={overLimit ? "border-destructive" : undefined}
+      />
+      <p
+        className={`mt-1 text-right text-xs ${
+          overLimit ? "text-destructive" : "text-muted-foreground"
+        }`}
+      >
+        {body.length}/{MAX_TWEET_CHARS}
+      </p>
+
+      <div className="mt-2 flex flex-col-reverse gap-2 sm:flex-row sm:items-center sm:justify-end">
+        <Button
+          variant="outline"
+          size="sm"
+          className="text-destructive hover:text-destructive"
+          onClick={() => onReject(post)}
+        >
+          <XCircle className="mr-1 h-4 w-4" />
+          Reject
+        </Button>
+        <Button
+          size="sm"
+          className="bg-green-600 hover:bg-green-700"
+          disabled={approving || overLimit || body.trim().length === 0}
+          onClick={() => onApprove(post.task_id, body)}
+        >
+          <CheckCircle2 className="mr-1 h-4 w-4" />
+          Approve &amp; post
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+// CEO queue for held X drafts (release posts + mention replies). Hidden when
+// empty (mirrors the release-proposal + playbook-review queues).
+export function XPostQueue({ className }: { className?: string }) {
+  const queryClient = useQueryClient();
+  const [rejecting, setRejecting] = useState<XPost | null>(null);
+  const [reason, setReason] = useState("");
+  const [approvingId, setApprovingId] = useState<string | null>(null);
+
+  const { data: posts, isLoading } = useQuery({
+    queryKey: ["x", "posts"],
+    queryFn: () => xApi.listPosts(),
+    refetchInterval: 30000,
+  });
+
+  const invalidate = () =>
+    queryClient.invalidateQueries({ queryKey: ["x", "posts"] });
+
+  const approveMutation = useMutation({
+    mutationFn: ({ taskId, body }: { taskId: string; body: string }) =>
+      xApi.approve(taskId, body),
+    onSuccess: (result) => {
+      invalidate();
+      if (result.status === "posted") {
+        toast.success(describeExecuteResult(result));
+      } else {
+        toast.warning(describeExecuteResult(result));
+      }
+    },
+    onError: (e) =>
+      toast.error(
+        `Approve failed: ${e instanceof Error ? e.message : "error"}`,
+      ),
+    onSettled: () => setApprovingId(null),
+  });
+
+  const rejectMutation = useMutation({
+    mutationFn: ({ taskId, reason }: { taskId: string; reason: string }) =>
+      xApi.reject(taskId, reason),
+    onSuccess: () => {
+      invalidate();
+      toast.success("Draft rejected");
+      closeReject();
+    },
+    onError: (e) =>
+      toast.error(`Reject failed: ${e instanceof Error ? e.message : "error"}`),
+  });
+
+  const closeReject = () => {
+    setRejecting(null);
+    setReason("");
+  };
+
+  const confirmReject = () => {
+    if (!rejecting) return;
+    if (reason.trim().length < _MIN_REASON_CHARS) {
+      toast.error("Give a brief reason for rejecting");
+      return;
+    }
+    rejectMutation.mutate({ taskId: rejecting.task_id, reason: reason.trim() });
+  };
+
+  const handleApprove = (taskId: string, body: string) => {
+    setApprovingId(taskId);
+    approveMutation.mutate({ taskId, body });
+  };
+
+  if (isLoading) return null;
+
+  if (!posts || posts.length === 0) {
+    return (
+      <Card className={className}>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Rocket className="h-5 w-5" />
+            X Post Queue
+          </CardTitle>
+          <CardDescription>
+            Drafted release announcements (and mention replies, if enabled) land
+            here for you to edit, approve, or reject. Nothing posts on its own.
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <p className="text-sm text-muted-foreground">
+            No drafts yet. A post is drafted here when a release publishes — set
+            your keys in Settings → X (Twitter) Credentials and enable the X
+            engine to start.
+          </p>
+        </CardContent>
+      </Card>
+    );
+  }
+
+  return (
+    <>
+      <Card className={className}>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Rocket className="h-5 w-5" />
+            X Post Queue
+            <Badge variant="secondary">{posts.length}</Badge>
+          </CardTitle>
+          <CardDescription>
+            Drafted release announcements and mention replies — edit, approve
+            (posts to X), or reject. Nothing posts on its own.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-3">
+          {posts.map((post) => (
+            <XPostRow
+              key={post.task_id}
+              post={post}
+              onApprove={handleApprove}
+              onReject={setRejecting}
+              approving={approvingId === post.task_id}
+            />
+          ))}
+        </CardContent>
+      </Card>
+
+      <Dialog open={!!rejecting} onOpenChange={() => closeReject()}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Reject draft</DialogTitle>
+            <DialogDescription>
+              This cancels the draft — it will not be posted. Give a brief
+              reason (it is recorded).
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-2">
+            <Label htmlFor="x-reject-reason">Reason</Label>
+            <Textarea
+              id="x-reject-reason"
+              placeholder="e.g. tone doesn't match our voice; not worth a public reply..."
+              value={reason}
+              onChange={(e) => setReason(e.target.value)}
+              rows={3}
+            />
+          </div>
+          <DialogFooter>
+            <Button variant="outline" onClick={closeReject}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={confirmReject}
+              disabled={rejectMutation.isPending}
+            >
+              {rejectMutation.isPending ? "Rejecting..." : "Reject"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}