feat: add operating model workspace and tenant caller guards

client/src/App.tsx

@@ -88,6 +88,12 @@ function App() {
       });
   }, []);
 
+  const authContextValue = useMemo<AuthContextValue>(() => ({
+    user,
+    isAuthenticated: !!user,
+    isLoading: loading,
+  }), [user, loading]);
+
   if (loading) {
     return (
       <div className="flex items-center justify-center h-screen bg-[hsl(var(--cf-void))]">
@@ -101,12 +107,6 @@ function App() {
     );
   }
 
-  const authContextValue = useMemo<AuthContextValue>(() => ({
-    user,
-    isAuthenticated: !!user,
-    isLoading: loading,
-  }), [user, loading]);
-
   return (
     <QueryClientProvider client={queryClient}>
       <ThemeProvider>

client/src/__tests__/operating-model.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+import {
+  buildFocusQueue,
+  DEFAULT_OPERATING_PREFERENCES,
+  getEnabledAgentCards,
+} from '../lib/operating-model';
+
+describe('operating model helpers', () => {
+  it('prioritizes verification failures and approvals in the focus queue', () => {
+    const queue = buildFocusQueue({
+      role: 'cfo',
+      preferences: DEFAULT_OPERATING_PREFERENCES,
+      tasks: [
+        { id: 'task-1', title: 'Review uncategorized transactions', priority: 'urgent', status: 'pending' },
+      ],
+      workflows: [
+        { id: 'wf-1', title: 'Approve roof repair', status: 'requested', costEstimate: '$1,250' },
+      ],
+      checks: [
+        { id: 'close-1', status: 'fail', message: '2 transactions remain uncategorized' },
+      ],
+    });
+
+    expect(queue[0]?.title).toContain('uncategorized');
+    expect(queue.some((item) => item.title.includes('Approve roof repair'))).toBe(true);
+  });
+
+  it('marks approval sentinel for attention when approvals are stalled', () => {
+    const cards = getEnabledAgentCards({
+      role: 'user',
+      preferences: {
+        ...DEFAULT_OPERATING_PREFERENCES,
+        enabledAgentIds: ['approval-sentinel'],
+      },
+      tasks: [],
+      workflows: [{ id: 'wf-1', title: 'Dispatch vendor', status: 'requested' }],
+      integrationsConfigured: 3,
+      checks: [],
+    });
+
+    expect(cards[0]).toMatchObject({
+      id: 'approval-sentinel',
+      state: 'attention',
+      metric: '1 approvals waiting',
+    });
+  });
+});

client/src/contexts/RoleContext.tsx

@@ -1,19 +1,11 @@
 import { createContext, useContext, useState, ReactNode } from 'react';
+import {
+  ROLE_CONFIGS,
+  type RoleConfig,
+  type UserRole,
+} from '@/lib/operating-model';
 
-export type UserRole = 'cfo' | 'accountant' | 'bookkeeper' | 'user';
-
-export interface RoleConfig {
-  id: UserRole;
-  label: string;
-  description: string;
-}
-
-export const ROLES: RoleConfig[] = [
-  { id: 'cfo', label: 'CFO', description: 'Executive overview across all entities' },
-  { id: 'accountant', label: 'Accountant', description: 'GL, reconciliation, and reporting' },
-  { id: 'bookkeeper', label: 'Bookkeeper', description: 'Transaction entry and categorization' },
-  { id: 'user', label: 'User', description: 'Personal expenses and approvals' },
-];
+export type { UserRole, RoleConfig } from '@/lib/operating-model';
 
 interface RoleContextValue {
   currentRole: UserRole;
@@ -29,7 +21,7 @@ const STORAGE_KEY = 'cf-current-role';
 export function RoleProvider({ children }: { children: ReactNode }) {
   const [currentRole, setCurrentRoleState] = useState<UserRole>(() => {
     const saved = localStorage.getItem(STORAGE_KEY);
-    if (saved && ROLES.some(r => r.id === saved)) return saved as UserRole;
+    if (saved && ROLE_CONFIGS.some(r => r.id === saved)) return saved as UserRole;
     return 'cfo';
   });
 
@@ -38,10 +30,10 @@ export function RoleProvider({ children }: { children: ReactNode }) {
     localStorage.setItem(STORAGE_KEY, role);
   };
 
-  const roleConfig = ROLES.find(r => r.id === currentRole) || ROLES[0];
+  const roleConfig = ROLE_CONFIGS.find(r => r.id === currentRole) || ROLE_CONFIGS[0];
 
   return (
-    <RoleContext.Provider value={{ currentRole, setCurrentRole, roleConfig, roles: ROLES }}>
+    <RoleContext.Provider value={{ currentRole, setCurrentRole, roleConfig, roles: ROLE_CONFIGS }}>
       {children}
     </RoleContext.Provider>
   );

client/src/hooks/use-operating-preferences.ts

@@ -0,0 +1,59 @@
+import { useEffect, useState } from 'react';
+import {
+  DEFAULT_OPERATING_PREFERENCES,
+  type OperatingPreferences,
+} from '@/lib/operating-model';
+
+const STORAGE_KEY = 'cf-operating-preferences-v1';
+
+function loadPreferences(): OperatingPreferences {
+  if (typeof window === 'undefined') return DEFAULT_OPERATING_PREFERENCES;
+
+  try {
+    const raw = window.localStorage.getItem(STORAGE_KEY);
+    if (!raw) return DEFAULT_OPERATING_PREFERENCES;
+
+    const parsed = JSON.parse(raw) as Partial<OperatingPreferences>;
+    return {
+      ...DEFAULT_OPERATING_PREFERENCES,
+      ...parsed,
+      enabledAgentIds: parsed.enabledAgentIds?.length
+        ? parsed.enabledAgentIds
+        : DEFAULT_OPERATING_PREFERENCES.enabledAgentIds,
+    };
+  } catch {
+    return DEFAULT_OPERATING_PREFERENCES;
+  }
+}
+
+export function useOperatingPreferences() {
+  const [preferences, setPreferences] = useState<OperatingPreferences>(loadPreferences);
+
+  useEffect(() => {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(preferences));
+  }, [preferences]);
+
+  const updatePreferences = (patch: Partial<OperatingPreferences>) => {
+    setPreferences((current) => ({ ...current, ...patch }));
+  };
+
+  const toggleAgent = (agentId: string) => {
+    setPreferences((current) => {
+      const enabledAgentIds = current.enabledAgentIds.includes(agentId)
+        ? current.enabledAgentIds.filter((id) => id !== agentId)
+        : [...current.enabledAgentIds, agentId];
+      return { ...current, enabledAgentIds };
+    });
+  };
+
+  const resetPreferences = () => {
+    setPreferences(DEFAULT_OPERATING_PREFERENCES);
+  };
+
+  return {
+    preferences,
+    updatePreferences,
+    toggleAgent,
+    resetPreferences,
+  };
+}