Persist normalized passive blockers and render safe next actions

[justsml]

Parent

#21

What to build

Project normalized passive blocker signals into durable blocker records and existing Render JSON surfaces without retrying or escalating.

Acceptance criteria

• Captcha, bot blocking, WAF denial, rate limiting, auth-required, approval-required, authorization-required, workspace lock, network-profile block, and tool-unavailable signals create or update deduplicated durable blockers.
• Each blocker links target, task, source artifacts, and summary artifact.
• Reload preserves blocked state and repeated normalization updates rather than duplicates records.
• The UI offers only safe next actions and never retries, raises intensity, or executes target work.
• A human reviews action wording and authorization/network implications before merge.

Blocked by

• Normalize passive discovery artifacts into an attributable auth inventory #162
• Persist passive auth summaries through the canonical artifact and RAG pipeline #163

[justsml]

This was generated by AI during triage.

Agent brief

Implement the durability-first, passive-only slice in draft PR #181.

• Persist blocker records in the app database and reconstruct them after restart.
• Deduplicate on project + target + task + normalized reason; repeat reports update the existing blocker.
• Preserve the latest summary Artifact and raw source Artifact IDs.
• Keep every projected next action review-only. Do not retry, schedule, probe, request approval, widen scope, or alter the network profile.
• Verify through the database/service seam and the existing passive-auth report path.
• Keep the PR in draft until a human approves the action wording and authorization/network implications.

Current implementation: 02b93196f on dan/issue-169-durable-passive-blockers.

[justsml]

Completed and shipped in #181. Passive-auth blockers are durable, deduplicated, reloadable, and expose safe inert review actions without target contact.