feat(approval): add task workflow and waiver decisions

web/tests/risk-disposition-ui.test.mjs

@@ -28,6 +28,8 @@ test('risk observation normalizes persisted json evidence and typed disposition'
       adjudication: 'confirmed',
       lifecycle_status: 'remediation_in_progress',
       version: 2,
+      available_actions: ['request_waiver'],
+      read_only_reason: null,
       events: [{ id: 'event-1', action: 'confirm', version: 1 }]
     }
   })
@@ -37,6 +39,8 @@ test('risk observation normalizes persisted json evidence and typed disposition'
   assert.deepEqual(observation.graphNodeKeys, ['claim:1'])
   assert.equal(observation.decisionTrace.action, 'manual_review')
   assert.equal(observation.disposition.lifecycleStatus, 'remediation_in_progress')
+  assert.deepEqual(observation.disposition.availableActions, ['request_waiver'])
+  assert.equal(observation.disposition.readOnlyReason, '')
   assert.equal(observation.disposition.events[0].action, 'confirm')
 })
 
@@ -56,8 +60,9 @@ test('risk evidence card exposes typed actions and never offers direct approval'
   assert.match(evidenceCard, /确认已解决/)
   assert.match(evidenceCard, /expectedVersion: currentDisposition\.value\.version/)
   assert.doesNotMatch(evidenceCard, /自动审批|直接通过|batchApprove/)
-  assert.match(evidenceCard, /RISK_DISPOSITION_VERSION_CONFLICT/)
-  assert.match(evidenceCard, /lifecycle !== 'supplement_requested'/)
+  assert.match(evidenceCard, /normalizeRiskDispositionError/)
+  assert.match(evidenceCard, /currentDisposition\.value\.availableActions/)
+  assert.doesNotMatch(evidenceCard, /roleCodes|role_codes|isAdmin|is_admin/)
 })
 
 test('risk action request ids bind action and observation', () => {