feat(board): Board Program registry — Phase 1 (engine, LEARN ledger, per-project scoping, panel) (#689)

* feat(board): Board Program registry — generic trigger/dedup/originate/LEARN engine

One registry (foundation/policy/board_programs.py) + one BoardProgramEngine +
one orchestrator loop replace the bespoke roadmap/spotlight loops, behavior-
preserved: same sources, dispatch routing, one-open-cycle dedup (ledger rows
auto-close when their exploration task goes terminal, so x_feature's
complete-at-propose flow can't wedge), and live per-program interval
overrides with the tick capped at 1h.

program_armed() is the single arming chokepoint: the settings-store
board_program.<key>.enabled override when present, else the legacy flag —
routed through BoardProgramEngine, RoadmapEngine.run_cycle, and XEngine's
spotlight gate, so the panel toggle can never be a silent no-op against a
legacy boot flag.

LEARN: board_program_cycles (migration 087) accrues per-item CEO decisions
(exact attribution by exploration_task_id where the caller holds it) and
feeds the last closed cycles back into both exploration prompts. The
strategy engine's idle signal now opens a roadmap cycle (enabled+dedup
respected) instead of only nudging.

Per-project scoping (migration 088, projects.board_programs, dual polarity):
plain keys opt a project INTO project-scoped programs; "!key" opts it OUT
of an org-scoped program's outputs (default eligible — parity). Enforced at
propose_roadmap (names the excluded project) and defensively at materialize;
validation rejects unknown keys and meaningless polarity both directions.

API: GET /api/board-programs + POST /api/board-programs/{key}/run-now
(CEO-gated); settings keys for both migrated programs.

* feat(panel): Board Programs card + per-project program controls

Business page gains a Programs tab: per-program rows (role, trigger, scope,
open-cycle badge), enabled switch on the settings-store key, Run now
(disabled while a cycle is open). The edit-project dialog gains the
program controls next to the CI-watch/video toggles: participates-in
checkboxes for project-scoped programs, excluded-from checkboxes for
org-scoped outputs.

* test(board): full-gate hermeticity — mypy casts + shared-DB purge fixtures

make quality runs one pytest process over all suites against the shared
persistent DB: integration collects before unit, so the board-programs API
test's committed run-now state (settings-store overrides, an open cycle row,
its board_roadmap task) poisoned 13 downstream unit tests that pass in
isolation. The polluter now purges its own committed state in fixture
teardown, and the four consumer files get an autouse per-test purge
(board_program.% settings keys, ledger rows, open exploration tasks) so
they are hermetic regardless of collection order. Also the four
cast("UUID", ...) sites the tests-scope mypy run requires.

* feat(panel): re-home per-project program controls onto the settings page

Wave C deleted the edit-project dialog these controls originally landed in;
they now live on the project settings page's budget/ops card next to the
CI-watch/video toggles — participates-in switches for project-scoped
programs, excluded-from switches for org-scoped outputs, dual-polarity
tooltips, order-independent dirty tracking. Nine makeProject test fixtures
gain the required board_programs field the rebase left behind.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/gateway/test_content_actions_roadmap.py

@@ -62,6 +62,20 @@ def _valid_items(n: int) -> list[dict[str, Any]]:
     return [_valid_item(i) for i in range(n)]
 
 
+@pytest.fixture(autouse=True)
+def _default_project_lookup(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Task 6b's exclusion check (``_reject_excluded_roadmap_project``) looks
+    up ``project_slug`` on every propose_roadmap call. Every test predating
+    that check builds its ``ContentActions`` with a bare ``MagicMock``
+    session, so default the lookup to "unresolvable" (None -> not rejected,
+    same as an unknown slug always behaved) instead of making every one of
+    them mock a project service it isn't testing. Tests exercising the
+    exclusion check override this target explicitly."""
+    stub = MagicMock()
+    stub.get_by_slug = AsyncMock(return_value=None)
+    monkeypatch.setattr("roboco.services.project.get_project_service", lambda _s: stub)
+
+
 @pytest.mark.asyncio
 async def test_propose_roadmap_forbidden_for_non_po() -> None:
     env = await _actions("head_marketing").propose_roadmap(
@@ -251,6 +265,67 @@ async def test_propose_roadmap_ignores_cycle_assigned_to_another_agent(
     assert env.error == "invalid_state"
 
 
+@pytest.mark.asyncio
+async def test_propose_roadmap_rejects_item_targeting_excluded_project(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Task 6b: an item targeting a project carrying '!roadmap' is refused
+    at propose time, naming the excluded project — before the PO even
+    finishes authoring the cycle, not just at the CEO's later approve."""
+    monkeypatch.setattr(cfg, "roadmap_min_items_per_cycle", 1)
+    monkeypatch.setattr(cfg, "roadmap_max_items_per_cycle", 7)
+    agent_id = uuid4()
+    cycle_task = _FakeTask(assigned_to=agent_id)
+    task_svc = MagicMock()
+    task_svc.list_open_roadmap_cycles = AsyncMock(return_value=[cycle_task])
+    monkeypatch.setattr("roboco.services.task.get_task_service", lambda _s: task_svc)
+
+    excluded_project = MagicMock(board_programs=["!roadmap"])
+    project_svc = MagicMock()
+    project_svc.get_by_slug = AsyncMock(return_value=excluded_project)
+    monkeypatch.setattr(
+        "roboco.services.project.get_project_service", lambda _s: project_svc
+    )
+
+    bad = _valid_item(0)
+    bad["project_slug"] = "excluded-proj"
+    env = await _actions("product_owner").propose_roadmap(
+        agent_id=agent_id, cycle_goal="Close onboarding friction", items=[bad]
+    )
+    assert env.error == "invalid_state"
+    assert "excluded-proj" in (env.message or "")
+
+
+@pytest.mark.asyncio
+async def test_propose_roadmap_allows_unresolvable_project_slug_through(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """An unknown project_slug is not this check's job — it surfaces
+    downstream at approve/materialize time, unchanged from before Task 6b."""
+    monkeypatch.setattr(cfg, "roadmap_min_items_per_cycle", 1)
+    monkeypatch.setattr(cfg, "roadmap_max_items_per_cycle", 7)
+    agent_id = uuid4()
+    cycle_task = _FakeTask(assigned_to=agent_id)
+    task_svc = MagicMock()
+    task_svc.list_open_roadmap_cycles = AsyncMock(return_value=[cycle_task])
+    monkeypatch.setattr("roboco.services.task.get_task_service", lambda _s: task_svc)
+
+    project_svc = MagicMock()
+    project_svc.get_by_slug = AsyncMock(return_value=None)
+    monkeypatch.setattr(
+        "roboco.services.project.get_project_service", lambda _s: project_svc
+    )
+
+    actions = _actions("product_owner")
+    actions.task.session.flush = AsyncMock()
+    bad = _valid_item(0)
+    bad["project_slug"] = "no-such-project"
+    env = await actions.propose_roadmap(
+        agent_id=agent_id, cycle_goal="Close onboarding friction", items=[bad]
+    )
+    assert env.error is None
+
+
 @pytest.mark.asyncio
 async def test_propose_roadmap_ignores_already_authored_cycle(
     monkeypatch: pytest.MonkeyPatch,