[MonaDevAI]

Problem

Dashboard intake leaves routine source access unchecked, so fix-and-validate jobs can repeatedly request permission to create backend regression tests and run configured checks.

Change

Enable the existing routine-source-access choice by default. Fix-and-validate jobs receive non-sensitive source/test edit trust and dashboard-owned validation gates; read-only modes still receive reads only. Users can opt out. API callers still require explicit consent, and existing jobs, earlier denials, unrestricted commands, protected configuration, credentials, business writes, and publication permissions are unchanged.

Validation

• Focused Node integration test passed, including default consent, opt-out, read-only mode, and exact-job binding.
• Both focused Playwright tests passed.
• Lint, typecheck, formatting, documentation drift, learned-rule governance, repository policy, and self-healing checks passed.
• All 492 unit tests passed using the Windows validation runner with an isolated TEMP directory outside the checkout.
• Monolithic npm run validate did not pass: 48/49 browser tests passed, with the previously observed linked-application case timing out at 30 seconds. This failed attempt is not reported as a pass.
• The remaining linked-application browser case passed separately with one worker in 6.6 seconds.
• npm pack --dry-run contains the required files.
• Exact-head GitHub CI test, windows-containment, CodeQL analyze, and CodeQL checks passed.
• Documentation is updated.
• No credentials, tokens, private endpoints, or consumer test data are included.

Validation dependencies were restored using the configured internal feed. The existing lockfile was preserved. Earlier local attempts were affected by an overfull shared TEMP session catalog, fixtures inheriting packages when TEMP was inside the checkout, and a multi-hour timer interruption. The final Windows run used an outside-checkout isolated TEMP directory and the repository's temporary idle-sleep prevention. Logs are retained locally.

Risk

New dashboard fix-and-validate submissions grant routine source/test editing unless the user opts out. Consent remains bound to one job and canonical checkout; sensitive operations and arbitrary commands retain separate review.

[Copilot]

🔵 Needs a closer look

The default permission change has unresolved linked-application unit failures, while full validation and the package-content check remain pending.

No open issues 🎉

What changed in this PR

This PR enables the dashboard’s existing routine source-access option by default, allowing new fix-and-validate jobs to edit non-sensitive source/tests and run dashboard-owned validation gates. Users can opt out; read-only modes and explicit API consent requirements remain unchanged.

Changes:

• Preselect routine source access for new dashboard submissions.
• Extend integration and browser coverage for default consent, opt-out, read-only access, and job-bound permissions.
• Document the default and its permission boundaries.

File	Description
test/​dashboard-server.test.js	Tests the intake default and read-only access while retaining job-binding checks.
e2e/​dashboard-readiness.spec.js	Adds default-access browser coverage and explicitly opts out in the manual-trust test.
docs/​commands.md	Documents default access, opt-out, and unchanged API consent requirements.
dashboard/​public/​index.html	Checks the routine source-access option by default.

_{Review effort: Balanced}