diff --git a/packages/shared/src/artifact-shapes.ts b/packages/shared/src/artifact-shapes.ts
index 945c342be..d72260b1b 100644
--- a/packages/shared/src/artifact-shapes.ts
+++ b/packages/shared/src/artifact-shapes.ts
@@ -149,11 +149,10 @@ export function resolveLegacyShape(
     case 'result': {
       const d = data ?? {};
       const hasSummary = typeof d.summary === 'string' && d.summary.length > 0;
-      const hasUrl =
-        typeof d.url === 'string' ||
-        typeof d.pr_url === 'string' ||
-        typeof d.prUrl === 'string' ||
-        typeof d.review_url === 'string';
+      // findLinkUrl recognizes any *_url field (pr_url, merged_pr_url,
+      // review_url, …), so the post-approval merge audit (merged_pr_url) routes
+      // to a link like other URL-bearing results.
+      const hasUrl = findLinkUrl(d) !== null;
       // A summary is the important payload (QA outcome / completion note) and
       // must stay visible to decision readers, so prefer decision when present.
       // Only a URL-only result becomes a pure link.
@@ -168,6 +167,26 @@ export function isArtifactShape(value: unknown): value is ArtifactShape {
   return typeof value === 'string' && (ARTIFACT_SHAPES as readonly string[]).includes(value);
 }
 
+/**
+ * Find a URL-bearing field in legacy data. Pre-shape producers stored the URL
+ * under various keys (`url`, `pr_url`, `prUrl`, `review_url`, `merged_pr_url`,
+ * `image_url`, `external_url`, …), so match any key that is `url` or ends in
+ * `_url`/`Url`. Returns the first non-empty string value found, else null.
+ */
+function findLinkUrl(data: Record<string, unknown> | undefined): string | null {
+  if (!data) return null;
+  for (const [key, value] of Object.entries(data)) {
+    if (
+      (key === 'url' || key.endsWith('_url') || key.endsWith('Url')) &&
+      typeof value === 'string' &&
+      value
+    ) {
+      return value;
+    }
+  }
+  return null;
+}
+
 /**
  * For a legacy row being treated as a `link`, copy the URL-bearing field onto
  * `data.url` so link readers (which key off `data.url`) find it. Returns a new
@@ -175,10 +194,7 @@ export function isArtifactShape(value: unknown): value is ArtifactShape {
  */
 export function normalizeLinkData(data: Record<string, unknown>): Record<string, unknown> {
   if (typeof data.url === 'string' && data.url) return data;
-  const url =
-    (typeof data.pr_url === 'string' && data.pr_url) ||
-    (typeof data.prUrl === 'string' && data.prUrl) ||
-    (typeof data.review_url === 'string' && data.review_url);
+  const url = findLinkUrl(data);
   if (!url) return data;
   return { ...data, url };
 }
@@ -259,11 +275,26 @@ export function validateArtifactShape(
   data: Record<string, unknown>
 ): ArtifactValidation {
   switch (shape) {
-    case 'link':
+    case 'link': {
       if (!nonEmptyString(data.url)) {
         return { ok: false, error: "shape 'link' requires data.url (the URL)." };
       }
+      // Defense-in-depth: link URLs are agent-controlled and rendered as
+      // clickable anchors, so restrict storage to http(s). This prevents
+      // `javascript:` / custom-scheme URLs from ever reaching a renderer.
+      try {
+        const parsed = new URL(data.url as string);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+          return {
+            ok: false,
+            error: `shape 'link' requires an http(s) URL (got '${parsed.protocol}').`,
+          };
+        }
+      } catch {
+        return { ok: false, error: "shape 'link' requires a valid http(s) URL." };
+      }
       return { ok: true };
+    }
     case 'check':
       if (!nonEmptyString(data.name)) {
         return { ok: false, error: "shape 'check' requires data.name (the check identity)." };
diff --git a/packages/shared/tests/artifact-shapes.test.ts b/packages/shared/tests/artifact-shapes.test.ts
index 161e29154..78e83b059 100644
--- a/packages/shared/tests/artifact-shapes.test.ts
+++ b/packages/shared/tests/artifact-shapes.test.ts
@@ -77,10 +77,18 @@ describe('artifact-shapes: deriveArtifactKey (identity rules)', () => {
 describe('artifact-shapes: validateArtifactShape', () => {
   test('link requires data.url', () => {
     expect(validateArtifactShape('link', { url: 'https://x' })).toEqual({ ok: true });
+    expect(validateArtifactShape('link', { url: 'http://x.example' })).toEqual({ ok: true });
     const bad = validateArtifactShape('link', { title: 'no url' });
     expect(bad.ok).toBe(false);
   });
 
+  test('link rejects non-http(s) URLs (defense-in-depth against agent-controlled schemes)', () => {
+    expect(validateArtifactShape('link', { url: 'javascript:alert(1)' }).ok).toBe(false);
+    expect(validateArtifactShape('link', { url: 'data:text/html,<script>' }).ok).toBe(false);
+    expect(validateArtifactShape('link', { url: 'ftp://example.com/x' }).ok).toBe(false);
+    expect(validateArtifactShape('link', { url: 'not a url' }).ok).toBe(false);
+  });
+
   test('check requires name + status', () => {
     expect(validateArtifactShape('check', { name: 'ci', status: 'pass' })).toEqual({ ok: true });
     expect(validateArtifactShape('check', { name: 'ci' }).ok).toBe(false);
@@ -125,6 +133,8 @@ describe('artifact-shapes: resolveLegacyShape (data-aware router)', () => {
     expect(resolveLegacyShape('result', { pr_url: 'u' })).toBe('link');
     expect(resolveLegacyShape('result', { url: 'u' })).toBe('link');
     expect(resolveLegacyShape('result', { review_url: 'u' })).toBe('link');
+    // The post-approval merge audit stores the URL under merged_pr_url.
+    expect(resolveLegacyShape('result', { merged_pr_url: 'u' })).toBe('link');
   });
 
   test('result with a summary → decision (summary preserved even alongside a URL)', () => {
@@ -154,6 +164,14 @@ describe('artifact-shapes: normalizeLinkData', () => {
     });
   });
 
+  test('copies merged_pr_url onto data.url when missing', () => {
+    expect(normalizeLinkData({ merged_pr_url: 'https://x', merged_at: '2026-01-01' })).toEqual({
+      merged_pr_url: 'https://x',
+      merged_at: '2026-01-01',
+      url: 'https://x',
+    });
+  });
+
   test('leaves data.url untouched when already set', () => {
     expect(normalizeLinkData({ url: 'https://x', pr_url: 'https://y' })).toEqual({
       url: 'https://x',
diff --git a/packages/web/src/components/space/ArtifactCard.tsx b/packages/web/src/components/space/ArtifactCard.tsx
index edc7240ce..f9ab2a501 100644
--- a/packages/web/src/components/space/ArtifactCard.tsx
+++ b/packages/web/src/components/space/ArtifactCard.tsx
@@ -1,96 +1,111 @@
 /**
- * ArtifactCard — data-driven renderer for workflow run artifacts.
+ * ArtifactCard — shape-driven renderer for workflow run artifacts.
  *
- * Rendering is determined entirely by inspecting the shape of `artifact.data`,
- * NOT by the `artifactType` string.  The type is shown as a small badge/chip
- * on every card for human scanning, but never drives rendering logic.
- *
- * Renderer selection (first match wins):
- *   1. data.url matches a GitHub PR URL           → PrCard
- *   2. data.url matches a GitHub commit URL       → CommitRefCard
- *   3. data.url is any URL                        → LinkCard
- *   4. data has test_output / stdout / stderr     → TerminalOutputCard
- *   5. data has ONLY a `summary` string key       → MarkdownCard
- *   6. all data values are JSON primitives        → StructuredTableCard
- *   7. (default)                                  → GenericCard
+ * Rendering is keyed on `artifact.artifactType`, which (after the generic-shapes
+ * migration) holds a value from the closed `ArtifactShape` vocabulary
+ * (`link`, `commit_set`, `check`, `metric`, `decision`, `note`). The optional
+ * `data.kind` semantic hint supplies the icon/label — most importantly for the
+ * `link` shape, where `kind: 'pr'` renders a PR row, `kind: 'issue'` an issue
+ * row, etc. There is no freeform data-shape sniffing and no hardcoded URL
+ * detection; the default renderer handles any shape (including ones not yet
+ * known to this component).
  */
 
-import type { WorkflowRunArtifact } from '@hyperneo/shared';
+import type {
+  ArtifactShape,
+  CommitSetArtifactData,
+  CheckArtifactData,
+  DecisionArtifactData,
+  LinkArtifactData,
+  MetricArtifactData,
+  NoteArtifactData,
+  WorkflowRunArtifact,
+} from '@hyperneo/shared';
+import { isArtifactShape, normalizeLinkData, resolveLegacyShape } from '@hyperneo/shared';
 
-// ── URL pattern helpers ──────────────────────────────────────────────────────
+const cardBase =
+  'flex items-start gap-2 px-3 py-2 rounded bg-dark-700/50 border border-dark-600 w-full';
 
-const GITHUB_PR_RE = /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/;
-const GITHUB_COMMIT_RE = /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/commit\/([0-9a-f]{7,40})/;
+// ── Small helpers ────────────────────────────────────────────────────────────
 
-function isUrl(val: unknown): val is string {
-  return typeof val === 'string' && /^https?:\/\//.test(val);
+function str(value: unknown): string {
+  return typeof value === 'string' ? value : '';
 }
 
-// ── Renderer detector ────────────────────────────────────────────────────────
-
-type RendererKind = 'pr' | 'commit-ref' | 'link' | 'terminal' | 'markdown' | 'table' | 'generic';
-
-function detectRenderer(data: Record<string, unknown>): RendererKind {
-  const url = typeof data.url === 'string' ? data.url : null;
-
-  if (url && GITHUB_PR_RE.test(url)) return 'pr';
-  if (url && GITHUB_COMMIT_RE.test(url)) return 'commit-ref';
-  if (url && isUrl(url)) return 'link';
-  if ('test_output' in data || 'stdout' in data || 'stderr' in data) return 'terminal';
-
-  const keys = Object.keys(data);
-  if (keys.length === 1 && keys[0] === 'summary' && typeof data.summary === 'string')
-    return 'markdown';
-  if (keys.length > 0 && keys.every((k) => isPrimitive(data[k]))) return 'table';
+function capitalize(s: string): string {
+  return s.length === 0 ? s : s[0].toUpperCase() + s.slice(1);
+}
 
-  return 'generic';
+/** "40 passed · 1 failed · 3 skipped" from a {label: count} map. */
+function formatCounts(counts: unknown): string {
+  if (!counts || typeof counts !== 'object') return '';
+  const entries = Object.entries(counts as Record<string, unknown>).filter(
+    ([, v]) => typeof v === 'number'
+  );
+  if (entries.length === 0) return '';
+  return entries.map(([k, v]) => `${v} ${k}`).join(' · ');
 }
 
-function isPrimitive(v: unknown): boolean {
-  return v === null || typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean';
+/**
+ * Returns the URL only when it is an http(s) link. Artifact URLs are
+ * agent-controlled, so anything that would bind one to an `href` (link / check
+ * / decision renderers) must go through this — a `javascript:` or other
+ * custom-scheme value is rendered as plain text instead of an actionable link.
+ */
+function safeHref(url: string): string | null {
+  if (!url) return null;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === 'http:' || parsed.protocol === 'https:' ? url : null;
+  } catch {
+    return null;
+  }
 }
 
-// ── Shared sub-components ────────────────────────────────────────────────────
+// ── link: icon/label by kind ─────────────────────────────────────────────────
 
-/** Small badge showing the artifact type label. */
-function TypeBadge({ type }: { type: string }) {
-  if (!type) return null;
-  return (
-    <span class="flex-shrink-0 px-1.5 py-0.5 rounded text-[10px] font-medium bg-dark-600 text-gray-400 uppercase tracking-wide">
-      {type}
-    </span>
-  );
+interface LinkKindMeta {
+  label: string;
+  color: string;
+  /** Render the git fork/branch icon (PRs/issues) vs the external-link icon. */
+  fork: boolean;
 }
 
-const cardBase =
-  'flex items-start gap-2 px-3 py-2 rounded bg-dark-700/50 border border-dark-600 w-full';
+function linkKindMeta(kind: string): LinkKindMeta {
+  switch (kind) {
+    case 'pr':
+      return { label: 'Pull Request', color: 'text-purple-400', fork: true };
+    case 'issue':
+      return { label: 'Issue', color: 'text-blue-400', fork: true };
+    case 'preview':
+      return { label: 'Preview', color: 'text-green-400', fork: false };
+    case 'doc':
+      return { label: 'Doc', color: 'text-gray-300', fork: false };
+    case 'post':
+      return { label: 'Post', color: 'text-gray-300', fork: false };
+    default:
+      return { label: kind ? capitalize(kind) : 'Link', color: 'text-blue-400', fork: false };
+  }
+}
 
-// ── Individual renderers ─────────────────────────────────────────────────────
-
-function PrCard({ artifact }: { artifact: WorkflowRunArtifact }) {
-  const { data } = artifact;
-  const url = typeof data.url === 'string' ? data.url : null;
-  const match = url ? GITHUB_PR_RE.exec(url) : null;
-  const prNumber =
-    typeof data.number === 'number' ? data.number : match ? parseInt(match[3], 10) : null;
-  const title = typeof data.title === 'string' ? data.title : null;
-  const state = typeof data.state === 'string' ? data.state : null;
-  const headBranch = typeof data.headBranch === 'string' ? data.headBranch : null;
-
-  const stateColor =
-    state === 'open'
-      ? 'text-green-400'
-      : state === 'merged'
-        ? 'text-purple-400'
-        : state === 'closed'
-          ? 'text-red-400'
-          : 'text-gray-400';
+function stateColor(state: string): string {
+  switch (state) {
+    case 'open':
+      return 'text-green-400';
+    case 'merged':
+      return 'text-purple-400';
+    case 'closed':
+      return 'text-red-400';
+    default:
+      return 'text-gray-400';
+  }
+}
 
-  return (
-    <div class={cardBase} data-testid="artifact-card-pr">
-      {/* PR icon */}
+function LinkIcon({ fork, color }: { fork: boolean; color: string }) {
+  if (fork) {
+    return (
       <svg
-        class="w-4 h-4 text-purple-400 flex-shrink-0 mt-0.5"
+        class={`w-4 h-4 flex-shrink-0 mt-0.5 ${color}`}
         fill="none"
         viewBox="0 0 24 24"
         stroke="currentColor"
@@ -102,228 +117,388 @@ function PrCard({ artifact }: { artifact: WorkflowRunArtifact }) {
           d="M7 16V4m0 0L3 8m4-4l4 4m6 0v12m0 0l4-4m-4 4l-4-4"
         />
       </svg>
+    );
+  }
+  return (
+    <svg
+      class={`w-3.5 h-3.5 flex-shrink-0 mt-0.5 ${color}`}
+      fill="none"
+      viewBox="0 0 24 24"
+      stroke="currentColor"
+    >
+      <path
+        stroke-linecap="round"
+        stroke-linejoin="round"
+        stroke-width={2}
+        d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
+      />
+    </svg>
+  );
+}
+
+function LinkCard({ artifact }: { artifact: WorkflowRunArtifact }) {
+  // The shape dispatch guarantees this structure (save_artifact validates it),
+  // but `data` arrives as a plain record on the wire — cast through `unknown`.
+  const data = artifact.data as unknown as LinkArtifactData;
+  const url = str(data.url);
+  const kind = str(data.kind);
+  const meta = linkKindMeta(kind);
+  const number = typeof data.number === 'number' ? data.number : null;
+  const title = str(data.title);
+  const state = str(data.state);
+
+  // Label: "Pull Request #42 — Fix bug" for numbered pr/issue, else title, else
+  // the URL (so a minimal `{ url, kind: 'pr' }` is still distinguishable), else
+  // the kind label.
+  let label: string;
+  if (number != null && (kind === 'pr' || kind === 'issue')) {
+    label = `${meta.label} #${number}`;
+    if (title) label += ` — ${title}`;
+  } else if (title) {
+    label = title;
+  } else {
+    label = url || meta.label;
+  }
+
+  let hostname = '';
+  if (url) {
+    try {
+      hostname = new URL(url).hostname;
+    } catch {
+      hostname = url;
+    }
+  }
+  // Show the origin as a secondary line only when the label is not already the
+  // URL and there is no identifying number (numbered pr/issue rows are specific
+  // enough on their own).
+  const showHost = !!hostname && label !== url && number == null;
+  // Only http(s) URLs become actionable links; everything else renders as text.
+  const href = safeHref(url);
+
+  return (
+    <div class={cardBase} data-testid="artifact-card-link">
+      <LinkIcon fork={meta.fork} color={meta.color} />
       <div class="flex-1 min-w-0">
-        {url ? (
+        {href ? (
           <a
-            href={url}
+            href={href}
             target="_blank"
             rel="noopener noreferrer"
             class="text-xs text-blue-400 hover:text-blue-300 truncate block"
           >
-            {prNumber != null ? `PR #${prNumber}` : 'Pull Request'}
-            {title && <span class="text-gray-400 ml-1.5">— {title}</span>}
+            {label}
           </a>
         ) : (
-          <span class="text-xs text-gray-300">
-            {prNumber != null ? `PR #${prNumber}` : 'Pull Request'}
-            {title && <span class="text-gray-400 ml-1.5">— {title}</span>}
-          </span>
+          <span class="text-xs text-gray-300 truncate block">{label}</span>
         )}
-        {headBranch && <p class="text-xs text-gray-400 font-mono mt-0.5 truncate">{headBranch}</p>}
+        {showHost && <p class="text-xs text-gray-400 font-mono mt-0.5 truncate">{hostname}</p>}
       </div>
-      {state && <span class={`text-xs font-medium ${stateColor} flex-shrink-0`}>{state}</span>}
-      <TypeBadge type={artifact.artifactType} />
+      {state && (
+        <span class={`text-xs font-medium flex-shrink-0 ${stateColor(state)}`}>{state}</span>
+      )}
     </div>
   );
 }
 
-function CommitRefCard({ artifact }: { artifact: WorkflowRunArtifact }) {
-  const { data } = artifact;
-  const url = typeof data.url === 'string' ? data.url : null;
-  const match = url ? GITHUB_COMMIT_RE.exec(url) : null;
-  const sha = typeof data.sha === 'string' ? data.sha : match ? match[3] : null;
-  const shortSha = sha ? sha.slice(0, 7) : null;
-  const message = typeof data.message === 'string' ? data.message : null;
-  const author = typeof data.author === 'string' ? data.author : null;
+// ── commit_set: commit list + +/- ────────────────────────────────────────────
+
+function CommitSetCard({ artifact }: { artifact: WorkflowRunArtifact }) {
+  const data = artifact.data as CommitSetArtifactData;
+  // `commit_set` has no required fields and the payload is untyped on the wire,
+  // so an agent could emit `{ commits: [null] }`. Filter to plain objects before
+  // dereferencing each entry so a malformed row can't throw and take down the
+  // artifacts panel.
+  const commits = Array.isArray(data.commits)
+    ? (data.commits as unknown[]).filter(
+        (c): c is Record<string, unknown> => c !== null && typeof c === 'object'
+      )
+    : [];
+  const additions = typeof data.additions === 'number' ? data.additions : null;
+  const deletions = typeof data.deletions === 'number' ? data.deletions : null;
+  const branch = str(data.branch);
+  const head = str(data.head);
+  const shown = commits.slice(0, 5);
 
   return (
-    <div class={cardBase} data-testid="artifact-card-commit-ref">
-      {/* Commit icon */}
-      <svg
-        class="w-3.5 h-3.5 text-gray-400 flex-shrink-0 mt-0.5"
-        fill="none"
-        viewBox="0 0 24 24"
-        stroke="currentColor"
-      >
-        <circle cx="12" cy="12" r="3" stroke-width={2} />
-        <path stroke-linecap="round" stroke-width={2} d="M12 3v6m0 6v6M3 12h6m6 0h6" />
-      </svg>
-      <div class="flex-1 min-w-0">
-        {url ? (
-          <a
-            href={url}
-            target="_blank"
-            rel="noopener noreferrer"
-            class="text-xs font-mono text-blue-400 hover:text-blue-300"
+    <div
+      class="rounded border border-dark-600 bg-dark-700/50 overflow-hidden w-full"
+      data-testid="artifact-card-commit-set"
+    >
+      <div class="flex items-center justify-between gap-2 px-3 py-1.5 border-b border-dark-700">
+        <div class="flex items-center gap-1.5 min-w-0">
+          <svg
+            class="w-3.5 h-3.5 text-gray-400 flex-shrink-0"
+            fill="none"
+            viewBox="0 0 24 24"
+            stroke="currentColor"
           >
-            {shortSha ?? 'commit'}
-          </a>
-        ) : (
-          <span class="text-xs font-mono text-gray-400">{shortSha ?? 'commit'}</span>
-        )}
-        {message && <p class="text-xs text-gray-300 truncate mt-0.5">{message}</p>}
-        {author && <p class="text-xs text-gray-400 mt-0.5">{author}</p>}
+            <circle cx="12" cy="12" r="3" stroke-width={2} />
+            <path stroke-linecap="round" stroke-width={2} d="M12 3v6m0 6v6M3 12h6m6 0h6" />
+          </svg>
+          <span class="text-xs text-gray-300 flex-shrink-0">
+            {commits.length} commit{commits.length === 1 ? '' : 's'}
+          </span>
+          {(branch || head) && (
+            <span class="text-xs text-gray-400 font-mono truncate">
+              {branch}
+              {head && ` @ ${head.slice(0, 7)}`}
+            </span>
+          )}
+        </div>
+        <div class="flex items-center gap-1 text-xs font-mono flex-shrink-0">
+          {additions != null && <span class="text-green-400">+{additions}</span>}
+          {deletions != null && <span class="text-red-400">-{deletions}</span>}
+        </div>
       </div>
-      <TypeBadge type={artifact.artifactType} />
+      {shown.length > 0 && (
+        <div class="px-3 py-1 space-y-0.5">
+          {shown.map((c, i) => {
+            const sha = str(c.sha).slice(0, 7);
+            const message = str(c.message);
+            return (
+              <div key={i} class="flex items-center gap-2 text-xs min-w-0">
+                {sha && <span class="font-mono text-gray-400 flex-shrink-0">{sha}</span>}
+                <span class="text-gray-300 truncate">{message}</span>
+              </div>
+            );
+          })}
+          {commits.length > shown.length && (
+            <p class="text-xs text-gray-400">+{commits.length - shown.length} more</p>
+          )}
+        </div>
+      )}
     </div>
   );
 }
 
-function LinkCard({ artifact }: { artifact: WorkflowRunArtifact }) {
-  const { data } = artifact;
-  const url = typeof data.url === 'string' ? data.url : '';
-  const title = typeof data.title === 'string' ? data.title : url;
+// ── check: status chip + counts ──────────────────────────────────────────────
 
-  let hostname = '';
-  try {
-    hostname = new URL(url).hostname;
-  } catch {
-    hostname = url;
+interface CheckStatusMeta {
+  bg: string;
+  color: string;
+}
+
+function checkStatusMeta(status: string): CheckStatusMeta {
+  switch (status) {
+    case 'pass':
+    case 'passed':
+      return { bg: 'bg-green-500/15', color: 'text-green-400' };
+    case 'fail':
+    case 'failed':
+      return { bg: 'bg-red-500/15', color: 'text-red-400' };
+    case 'running':
+      return { bg: 'bg-blue-500/15', color: 'text-blue-400' };
+    default:
+      return { bg: 'bg-dark-600', color: 'text-gray-400' };
   }
+}
+
+function CheckCard({ artifact }: { artifact: WorkflowRunArtifact }) {
+  const data = artifact.data as unknown as CheckArtifactData;
+  const name = str(data.name);
+  const status = str(data.status);
+  const counts = formatCounts(data.counts);
+  const href = safeHref(str(data.url));
+  const meta = checkStatusMeta(status);
 
   return (
-    <div class={cardBase} data-testid="artifact-card-link">
-      <svg
-        class="w-3.5 h-3.5 text-blue-400 flex-shrink-0 mt-0.5"
-        fill="none"
-        viewBox="0 0 24 24"
-        stroke="currentColor"
+    <div class={cardBase} data-testid="artifact-card-check">
+      <span
+        class={`flex-shrink-0 px-1.5 py-0.5 rounded text-[10px] font-semibold uppercase tracking-wide ${meta.bg} ${meta.color}`}
       >
-        <path
-          stroke-linecap="round"
-          stroke-linejoin="round"
-          stroke-width={2}
-          d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
-        />
-      </svg>
+        {status || 'unknown'}
+      </span>
       <div class="flex-1 min-w-0">
+        <span class="text-xs text-gray-300">{name}</span>
+        {counts && <span class="text-xs text-gray-400 ml-2">{counts}</span>}
+      </div>
+      {href && (
         <a
-          href={url}
+          href={href}
           target="_blank"
           rel="noopener noreferrer"
-          class="text-xs text-blue-400 hover:text-blue-300 truncate block"
+          class="text-xs text-blue-400 hover:text-blue-300 flex-shrink-0"
         >
-          {title}
+          view
         </a>
-        <p class="text-xs text-gray-400 font-mono mt-0.5 truncate">{hostname}</p>
-      </div>
-      <TypeBadge type={artifact.artifactType} />
+      )}
     </div>
   );
 }
 
-function TerminalOutputCard({ artifact }: { artifact: WorkflowRunArtifact }) {
-  const { data } = artifact;
-  const output =
-    (typeof data.test_output === 'string' && data.test_output) ||
-    (typeof data.stdout === 'string' && data.stdout) ||
-    (typeof data.stderr === 'string' && data.stderr) ||
-    '';
+// ── metric: name value unit → target ─────────────────────────────────────────
 
-  const preview = output.split('\n').slice(0, 5).join('\n');
-  const truncated = output.split('\n').length > 5;
+function MetricCard({ artifact }: { artifact: WorkflowRunArtifact }) {
+  const data = artifact.data as unknown as MetricArtifactData;
+  const name = str(data.name);
+  const value = data.value;
+  const unit = str(data.unit);
+  const target = data.target;
+  // Only render scalar values; a stray object value must not stringify to
+  // "[object Object]".
+  const hasValue = typeof value === 'number' || typeof value === 'string';
+  const hasTarget = typeof target === 'number' || typeof target === 'string';
 
   return (
-    <div
-      class="rounded border border-dark-600 bg-dark-800 overflow-hidden w-full"
-      data-testid="artifact-card-terminal"
-    >
-      <div class="flex items-center justify-between px-3 py-1.5 border-b border-dark-700 bg-dark-700/50">
-        <div class="flex items-center gap-1.5">
-          <svg
-            class="w-3.5 h-3.5 text-gray-400"
-            fill="none"
-            viewBox="0 0 24 24"
-            stroke="currentColor"
-          >
-            <path
-              stroke-linecap="round"
-              stroke-linejoin="round"
-              stroke-width={2}
-              d="M8 9l3 3-3 3m5 0h3"
-            />
-          </svg>
-          <span class="text-xs text-gray-400">
-            {'test_output' in data ? 'Test output' : 'stdout' in data ? 'stdout' : 'stderr'}
+    <div class={cardBase} data-testid="artifact-card-metric">
+      <svg
+        class="w-3.5 h-3.5 text-gray-400 flex-shrink-0 mt-0.5"
+        fill="none"
+        viewBox="0 0 24 24"
+        stroke="currentColor"
+      >
+        <path
+          stroke-linecap="round"
+          stroke-linejoin="round"
+          stroke-width={2}
+          d="M3 12h4l3-8 4 16 3-8h4"
+        />
+      </svg>
+      <div class="flex-1 min-w-0 text-xs flex items-baseline gap-1.5 flex-wrap">
+        <span class="text-gray-400 font-mono">{name}</span>
+        {hasValue && (
+          <span class="text-gray-100 font-medium">
+            {String(value)}
+            {unit && <span class="text-gray-400 font-normal ml-0.5">{unit}</span>}
           </span>
-        </div>
-        <TypeBadge type={artifact.artifactType} />
+        )}
+        {hasTarget && (
+          <span class="text-gray-400">
+            → {String(target)}
+            {unit}
+          </span>
+        )}
       </div>
-      <pre class="px-3 py-2 text-xs font-mono text-gray-300 overflow-x-auto whitespace-pre-wrap break-words">
-        {preview}
-        {truncated && <span class="text-gray-400">{'\n…'}</span>}
-      </pre>
     </div>
   );
 }
 
-function MarkdownCard({ artifact }: { artifact: WorkflowRunArtifact }) {
-  const summary = typeof artifact.data.summary === 'string' ? artifact.data.summary : '';
+// ── decision: recommendation badge ───────────────────────────────────────────
+
+interface DecisionMeta {
+  bg: string;
+  color: string;
+}
+
+function decisionMeta(recommendation: string): DecisionMeta {
+  switch (recommendation) {
+    case 'approve':
+    case 'approved':
+      return { bg: 'bg-green-500/15', color: 'text-green-400' };
+    case 'request_changes':
+      return { bg: 'bg-amber-500/15', color: 'text-amber-400' };
+    case 'reject':
+    case 'rejected':
+      return { bg: 'bg-red-500/15', color: 'text-red-400' };
+    default:
+      return { bg: 'bg-dark-600', color: 'text-gray-400' };
+  }
+}
+
+function DecisionCard({ artifact }: { artifact: WorkflowRunArtifact }) {
+  const data = artifact.data as unknown as DecisionArtifactData;
+  const recommendation = str(data.recommendation);
+  const summary = str(data.summary);
+  const counts = formatCounts(data.counts);
+  // Legacy rows mapped to `decision` (review-history carries review_url; a mixed
+  // QA `result` carries pr_url) don't have a recommendation, so surface their
+  // evidence link. Validate each URL candidate independently so a non-http
+  // `data.url` can't shadow a valid `review_url`/`pr_url`, and label the link by
+  // the candidate actually selected. Producer migration is a follow-up.
+  const urlHref = safeHref(str(artifact.data.url));
+  const reviewHref = safeHref(str(artifact.data.review_url));
+  const prHref = safeHref(str(artifact.data.pr_url));
+  const picked = urlHref
+    ? { href: urlHref, label: 'view' }
+    : reviewHref
+      ? { href: reviewHref, label: 'review' }
+      : prHref
+        ? { href: prHref, label: 'view' }
+        : null;
+  const meta = decisionMeta(recommendation);
 
   return (
-    <div
-      class="rounded border border-dark-600 bg-dark-700/50 px-3 py-2 w-full"
-      data-testid="artifact-card-markdown"
-    >
-      <div class="flex items-start justify-between gap-2 mb-1">
-        <TypeBadge type={artifact.artifactType} />
+    <div class={cardBase} data-testid="artifact-card-decision">
+      <span
+        class={`flex-shrink-0 px-1.5 py-0.5 rounded text-[10px] font-semibold uppercase tracking-wide ${meta.bg} ${meta.color}`}
+      >
+        {recommendation || 'decision'}
+      </span>
+      <div class="flex-1 min-w-0">
+        {summary && <span class="text-xs text-gray-300">{summary}</span>}
+        {counts && <span class="text-xs text-gray-400 ml-2">{counts}</span>}
       </div>
-      <p class="text-xs text-gray-300 whitespace-pre-wrap leading-relaxed">{summary}</p>
+      {picked && (
+        <a
+          href={picked.href}
+          target="_blank"
+          rel="noopener noreferrer"
+          class="text-xs text-blue-400 hover:text-blue-300 flex-shrink-0"
+        >
+          {picked.label}
+        </a>
+      )}
     </div>
   );
 }
 
-function StructuredTableCard({ artifact }: { artifact: WorkflowRunArtifact }) {
-  const entries = Object.entries(artifact.data);
+// ── note: status text line ───────────────────────────────────────────────────
+
+function NoteCard({ artifact }: { artifact: WorkflowRunArtifact }) {
+  const data = artifact.data as NoteArtifactData;
+  const text = str(data.text) || str(data.summary);
+  const ts = str(data.ts);
 
   return (
-    <div
-      class="rounded border border-dark-600 bg-dark-700/50 overflow-hidden w-full"
-      data-testid="artifact-card-table"
-    >
-      <div class="flex items-center justify-between px-3 py-1.5 border-b border-dark-700">
-        <span class="text-xs text-gray-400">
-          {entries.length} field{entries.length === 1 ? '' : 's'}
-        </span>
-        <TypeBadge type={artifact.artifactType} />
-      </div>
-      <table class="w-full text-xs">
-        <tbody>
-          {entries.map(([key, value]) => (
-            <tr key={key} class="border-b border-dark-700/50 last:border-0">
-              <td class="px-3 py-1.5 text-gray-400 font-mono align-top whitespace-nowrap w-1/3">
-                {key}
-              </td>
-              <td class="px-3 py-1.5 text-gray-300 break-all">
-                {value === null ? (
-                  <span class="text-gray-400 italic">null</span>
-                ) : typeof value === 'boolean' ? (
-                  <span class={value ? 'text-green-400' : 'text-red-400'}>{String(value)}</span>
-                ) : (
-                  String(value)
-                )}
-              </td>
-            </tr>
-          ))}
-        </tbody>
-      </table>
+    <div class={cardBase} data-testid="artifact-card-note">
+      <svg
+        class="w-3.5 h-3.5 text-gray-400 flex-shrink-0 mt-0.5"
+        fill="none"
+        viewBox="0 0 24 24"
+        stroke="currentColor"
+      >
+        <path
+          stroke-linecap="round"
+          stroke-linejoin="round"
+          stroke-width={2}
+          d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+        />
+      </svg>
+      <p class="flex-1 min-w-0 text-xs text-gray-300 whitespace-pre-wrap break-words leading-relaxed">
+        {text}
+      </p>
+      {ts && <span class="text-xs text-gray-400 font-mono flex-shrink-0">{ts}</span>}
     </div>
   );
 }
 
+// ── default: works for any shape ─────────────────────────────────────────────
+
 function GenericCard({ artifact }: { artifact: WorkflowRunArtifact }) {
   const keyCount = Object.keys(artifact.data).length;
   return (
     <div class={cardBase} data-testid="artifact-card-generic">
+      <svg
+        class="w-3.5 h-3.5 text-gray-400 flex-shrink-0 mt-0.5"
+        fill="none"
+        viewBox="0 0 24 24"
+        stroke="currentColor"
+      >
+        <path
+          stroke-linecap="round"
+          stroke-linejoin="round"
+          stroke-width={2}
+          d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4"
+        />
+      </svg>
       <div class="flex-1 min-w-0">
-        {artifact.artifactKey && (
+        {artifact.artifactKey && artifact.artifactKey !== 'default' && (
           <p class="text-xs text-gray-400 font-mono truncate">{artifact.artifactKey}</p>
         )}
         <p class="text-xs text-gray-400">
-          {keyCount} field{keyCount === 1 ? '' : 's'}
+          {artifact.artifactType || 'artifact'} · {keyCount} field{keyCount === 1 ? '' : 's'}
         </p>
       </div>
-      <TypeBadge type={artifact.artifactType} />
     </div>
   );
 }
@@ -334,22 +509,41 @@ interface ArtifactCardProps {
   artifact: WorkflowRunArtifact;
 }
 
+/**
+ * Resolve the generic shape for an artifact. Post-migration rows already carry
+ * a value from the closed `ArtifactShape` vocabulary; pre-migration / in-flight
+ * legacy rows (`progress` / `result` / `pr` / `review`) are mapped to a shape
+ * here at the UI boundary so they keep rendering correctly until the backend
+ * producer + DB migration land. Anything truly unknown falls through to the
+ * default renderer. This is idempotent: once the backend stores shapes, the
+ * legacy branch is never taken.
+ */
+function resolveArtifactShape(artifact: WorkflowRunArtifact): ArtifactShape | null {
+  const declared = artifact.artifactType;
+  if (isArtifactShape(declared)) return declared;
+  return resolveLegacyShape(declared, artifact.data) ?? null;
+}
+
 export function ArtifactCard({ artifact }: ArtifactCardProps) {
-  const renderer = detectRenderer(artifact.data);
+  const shape = resolveArtifactShape(artifact);
+  // Legacy link rows may carry the URL under pr_url/review_url; normalize it onto
+  // data.url so the link renderer finds it (no-op for already-shaped rows).
+  const linkArtifact =
+    shape === 'link' ? { ...artifact, data: normalizeLinkData(artifact.data) } : artifact;
 
-  switch (renderer) {
-    case 'pr':
-      return <PrCard artifact={artifact} />;
-    case 'commit-ref':
-      return <CommitRefCard artifact={artifact} />;
+  switch (shape) {
     case 'link':
-      return <LinkCard artifact={artifact} />;
-    case 'terminal':
-      return <TerminalOutputCard artifact={artifact} />;
-    case 'markdown':
-      return <MarkdownCard artifact={artifact} />;
-    case 'table':
-      return <StructuredTableCard artifact={artifact} />;
+      return <LinkCard artifact={linkArtifact} />;
+    case 'commit_set':
+      return <CommitSetCard artifact={artifact} />;
+    case 'check':
+      return <CheckCard artifact={artifact} />;
+    case 'metric':
+      return <MetricCard artifact={artifact} />;
+    case 'decision':
+      return <DecisionCard artifact={artifact} />;
+    case 'note':
+      return <NoteCard artifact={artifact} />;
     default:
       return <GenericCard artifact={artifact} />;
   }
diff --git a/packages/web/src/components/space/__tests__/ArtifactCard.test.tsx b/packages/web/src/components/space/__tests__/ArtifactCard.test.tsx
index d7a5743ec..f259d9162 100644
--- a/packages/web/src/components/space/__tests__/ArtifactCard.test.tsx
+++ b/packages/web/src/components/space/__tests__/ArtifactCard.test.tsx
@@ -1,9 +1,11 @@
 /**
- * ArtifactCard — data-driven renderer tests.
+ * ArtifactCard — shape-driven renderer tests.
  *
- * Verifies that the correct renderer is selected based on the shape of
- * artifact.data, NOT the artifactType string.  Also checks that artifactType
- * always appears as a badge regardless of which renderer is active.
+ * Verifies that rendering is keyed on `artifact.artifactType` (a value from the
+ * closed `ArtifactShape` vocabulary), that `data.kind` supplies the icon/label
+ * (especially for the `link` shape), and that a default renderer handles any
+ * shape. The old data-shape sniffing and hardcoded GitHub-PR URL detection are
+ * gone — a PR is now `link` with `kind: 'pr'`.
  */
 
 import { describe, it, expect } from 'vitest';
@@ -18,7 +20,7 @@ function makeArtifact(
     id: 'art-1',
     runId: 'run-1',
     nodeId: 'node-1',
-    artifactType: 'result',
+    artifactType: 'note',
     artifactKey: 'key',
     createdAt: Date.now(),
     updatedAt: Date.now(),
@@ -26,303 +28,431 @@ function makeArtifact(
   };
 }
 
-// ── PR card ──────────────────────────────────────────────────────────────────
+// ── link shape ───────────────────────────────────────────────────────────────
 
-describe('ArtifactCard — PR renderer', () => {
-  it('renders artifact-card-pr when data.url is a GitHub PR URL', () => {
+describe('ArtifactCard — link shape', () => {
+  it('renders artifact-card-link for the link shape', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://github.com/owner/repo/pull/42', number: 42, title: 'My PR' },
+      artifactType: 'link',
+      data: { url: 'https://example.com/report', title: 'Full report' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-pr')).toBeTruthy();
+    expect(getByTestId('artifact-card-link')).toBeTruthy();
   });
 
-  it('shows PR number and title from data fields', () => {
+  it('renders a PR row when kind is "pr" — no GitHub URL detection involved', () => {
+    // Note: the URL is NOT a github.com pull URL; kind alone drives the PR styling.
     const artifact = makeArtifact({
-      data: { url: 'https://github.com/owner/repo/pull/7', number: 7, title: 'Fix bug' },
+      artifactType: 'link',
+      data: {
+        url: 'https://gitlab.internal/o/r/-/merge_requests/42',
+        kind: 'pr',
+        number: 42,
+        title: 'Fix bug',
+      },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    const card = getByTestId('artifact-card-pr');
-    expect(card.textContent).toContain('PR #7');
+    const card = getByTestId('artifact-card-link');
+    expect(card.textContent).toContain('Pull Request #42');
     expect(card.textContent).toContain('Fix bug');
   });
 
-  it('shows state badge when data.state is provided', () => {
+  it('shows PR state badge from data.state', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://github.com/owner/repo/pull/1', state: 'merged' },
+      artifactType: 'link',
+      data: { url: 'https://github.com/o/r/pull/7', kind: 'pr', state: 'merged' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-pr').textContent).toContain('merged');
+    expect(getByTestId('artifact-card-link').textContent).toContain('merged');
   });
 
-  it('shows artifactType badge on the PR card', () => {
+  it('labels an issue by kind', () => {
     const artifact = makeArtifact({
-      artifactType: 'pr',
-      data: { url: 'https://github.com/owner/repo/pull/1' },
+      artifactType: 'link',
+      data: { url: 'https://github.com/o/r/issues/9', kind: 'issue', number: 9 },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-pr').textContent).toContain('pr');
+    expect(getByTestId('artifact-card-link').textContent).toContain('Issue #9');
   });
-});
-
-// ── Commit reference card ─────────────────────────────────────────────────────
 
-describe('ArtifactCard — commit-ref renderer', () => {
-  it('renders artifact-card-commit-ref when data.url is a GitHub commit URL', () => {
+  it('shows hostname for a plain link without a title', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://github.com/owner/repo/commit/abc1234def5678' },
+      artifactType: 'link',
+      data: { url: 'https://docs.example.com/api' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-commit-ref')).toBeTruthy();
+    expect(getByTestId('artifact-card-link').textContent).toContain('docs.example.com');
   });
 
-  it('shows short SHA from the URL', () => {
+  it('uses the title as the link label when present', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://github.com/owner/repo/commit/abc1234def5678' },
+      artifactType: 'link',
+      data: { url: 'https://example.com/x', title: 'Custom title' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-commit-ref').textContent).toContain('abc1234');
+    expect(getByTestId('artifact-card-link').textContent).toContain('Custom title');
   });
 
-  it('shows commit message and author when provided in data', () => {
+  it('does NOT special-case github.com pull URLs without kind:"pr" — renders as a plain link', () => {
+    // Removal of the hardcoded GITHUB_PR_RE detection: a PR URL with no kind is a
+    // generic link, not a PR card.
     const artifact = makeArtifact({
-      data: {
-        url: 'https://github.com/owner/repo/commit/abc1234def5678',
-        message: 'feat: do thing',
-        author: 'Alice',
-      },
+      artifactType: 'link',
+      data: { url: 'https://github.com/owner/repo/pull/42' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    const card = getByTestId('artifact-card-commit-ref');
-    expect(card.textContent).toContain('feat: do thing');
-    expect(card.textContent).toContain('Alice');
+    const card = getByTestId('artifact-card-link');
+    expect(card.textContent).not.toContain('Pull Request');
   });
 
-  it('does NOT use commit-ref renderer for GitHub PR URLs (PR wins)', () => {
+  it('renders an http(s) URL as a clickable anchor', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://github.com/owner/repo/pull/99' },
+      artifactType: 'link',
+      data: { url: 'https://example.com/safe', title: 'safe' },
     });
-    const { getByTestId, queryByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-pr')).toBeTruthy();
-    expect(queryByTestId('artifact-card-commit-ref')).toBeNull();
+    const { container } = render(<ArtifactCard artifact={artifact} />);
+    const anchor = container.querySelector('a');
+    expect(anchor).not.toBeNull();
+    expect(anchor?.getAttribute('href')).toBe('https://example.com/safe');
   });
-});
-
-// ── Link card ─────────────────────────────────────────────────────────────────
 
-describe('ArtifactCard — link renderer', () => {
-  it('renders artifact-card-link for a non-GitHub URL', () => {
+  it('renders a non-http URL as plain text, never as an actionable anchor (XSS guard)', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://example.com/report' },
+      artifactType: 'link',
+      data: { url: 'javascript:alert(1)', title: 'evil' },
     });
-    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-link')).toBeTruthy();
+    const { container, getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(container.querySelector('a')).toBeNull();
+    expect(getByTestId('artifact-card-link').textContent).toContain('evil');
   });
 
-  it('shows custom title when provided', () => {
+  it('shows the URL for a minimal PR link with no number or title (keeps rows distinguishable)', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://example.com/report', title: 'Full report' },
+      artifactType: 'link',
+      data: { url: 'https://gitlab.internal/o/r/-/merge_requests/5', kind: 'pr' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-link').textContent).toContain('Full report');
+    expect(getByTestId('artifact-card-link').textContent).toContain('gitlab.internal');
   });
+});
 
-  it('falls back to URL as title when title is absent', () => {
+// ── commit_set shape ─────────────────────────────────────────────────────────
+
+describe('ArtifactCard — commit_set shape', () => {
+  it('renders artifact-card-commit-set with the commit count and +/- totals', () => {
     const artifact = makeArtifact({
-      data: { url: 'https://example.com/no-title' },
+      artifactType: 'commit_set',
+      data: {
+        branch: 'feat/x',
+        head: 'abcdef1234567890',
+        additions: 120,
+        deletions: 30,
+        commits: [
+          { sha: 'abcdef1234567890', message: 'feat: add thing' },
+          { sha: '9876543210fedcba', message: 'fix: tweak' },
+        ],
+      },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-link').textContent).toContain('example.com');
+    const card = getByTestId('artifact-card-commit-set');
+    expect(card.textContent).toContain('2 commits');
+    expect(card.textContent).toContain('+120');
+    expect(card.textContent).toContain('-30');
+    expect(card.textContent).toContain('feat/x');
+    expect(card.textContent).toContain('feat: add thing');
+    // short SHAs are shown
+    expect(card.textContent).toContain('abcdef1');
   });
 
-  it('shows hostname in the card', () => {
-    const artifact = makeArtifact({
-      data: { url: 'https://docs.example.com/api' },
-    });
+  it('collapses commit lists longer than five entries', () => {
+    const commits = Array.from({ length: 7 }, (_, i) => ({
+      sha: `sha${i}000000000000000`,
+      message: `commit ${i}`,
+    }));
+    const artifact = makeArtifact({ artifactType: 'commit_set', data: { commits } });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-link').textContent).toContain('docs.example.com');
+    const card = getByTestId('artifact-card-commit-set');
+    expect(card.textContent).toContain('+2 more');
+  });
+
+  it('ignores null / non-object commit entries instead of throwing', () => {
+    // { commits: [null] } passes validateArtifactShape (no required fields) and
+    // must not crash the panel when the renderer dereferences each entry.
+    const commits = [
+      null,
+      { sha: 'abcdef1234567890', message: 'the only real commit' },
+      42,
+      undefined,
+    ];
+    const artifact = makeArtifact({ artifactType: 'commit_set', data: { commits } });
+    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    const card = getByTestId('artifact-card-commit-set');
+    expect(card.textContent).toContain('1 commit');
+    expect(card.textContent).toContain('the only real commit');
   });
 });
 
-// ── Terminal output card ──────────────────────────────────────────────────────
+// ── check shape ──────────────────────────────────────────────────────────────
 
-describe('ArtifactCard — terminal renderer', () => {
-  it('renders artifact-card-terminal when data.stdout is present', () => {
+describe('ArtifactCard — check shape', () => {
+  it('renders artifact-card-check with the status chip, name and counts', () => {
     const artifact = makeArtifact({
-      data: { stdout: 'hello world\n' },
+      artifactType: 'check',
+      data: { name: 'unit-tests', status: 'pass', counts: { passed: 40, failed: 1, skipped: 3 } },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-terminal')).toBeTruthy();
+    const card = getByTestId('artifact-card-check');
+    expect(card.textContent).toContain('pass');
+    expect(card.textContent).toContain('unit-tests');
+    expect(card.textContent).toContain('40 passed');
+    expect(card.textContent).toContain('1 failed');
+    expect(card.textContent).toContain('3 skipped');
   });
 
-  it('renders artifact-card-terminal when data.stderr is present', () => {
+  it('renders a fail status chip', () => {
     const artifact = makeArtifact({
-      data: { stderr: 'error: something failed\n' },
+      artifactType: 'check',
+      data: { name: 'ci', status: 'fail' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-terminal')).toBeTruthy();
+    expect(getByTestId('artifact-card-check').textContent).toContain('fail');
   });
+});
+
+// ── metric shape ─────────────────────────────────────────────────────────────
 
-  it('renders artifact-card-terminal when data.test_output is present', () => {
+describe('ArtifactCard — metric shape', () => {
+  it('renders artifact-card-metric with name, value, unit and target', () => {
     const artifact = makeArtifact({
-      data: { test_output: 'PASS src/foo.test.ts\n' },
+      artifactType: 'metric',
+      data: { name: 'p95-latency', value: 42, unit: 'ms', target: 50 },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-terminal')).toBeTruthy();
+    const card = getByTestId('artifact-card-metric');
+    expect(card.textContent).toContain('p95-latency');
+    expect(card.textContent).toContain('42');
+    expect(card.textContent).toContain('ms');
+    expect(card.textContent).toContain('50');
   });
 
-  it('shows first 5 lines of output as preview', () => {
-    const lines = ['line1', 'line2', 'line3', 'line4', 'line5', 'line6'];
+  it('does not stringify a non-scalar value to "[object Object]"', () => {
     const artifact = makeArtifact({
-      data: { stdout: lines.join('\n') },
+      artifactType: 'metric',
+      data: { name: 'latency', value: { current: 42 } },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    const card = getByTestId('artifact-card-terminal');
-    expect(card.textContent).toContain('line1');
-    expect(card.textContent).toContain('line5');
-    // line6 is cut off; the truncation indicator appears
-    expect(card.textContent).toContain('…');
+    const card = getByTestId('artifact-card-metric');
+    expect(card.textContent).toContain('latency');
+    expect(card.textContent).not.toContain('[object Object]');
   });
 });
 
-// ── Markdown card ─────────────────────────────────────────────────────────────
+// ── decision shape ───────────────────────────────────────────────────────────
 
-describe('ArtifactCard — markdown renderer', () => {
-  it('renders artifact-card-markdown when data only has a summary string key', () => {
+describe('ArtifactCard — decision shape', () => {
+  it('renders artifact-card-decision with the recommendation badge and summary', () => {
     const artifact = makeArtifact({
-      data: { summary: 'This PR implements feature X, Y, Z.' },
+      artifactType: 'decision',
+      data: { recommendation: 'approve', summary: 'LGTM', counts: { p0: 0, p1: 2 } },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-markdown')).toBeTruthy();
+    const card = getByTestId('artifact-card-decision');
+    expect(card.textContent).toContain('approve');
+    expect(card.textContent).toContain('LGTM');
+    expect(card.textContent).toContain('2 p1');
   });
 
-  it('shows the summary text', () => {
+  it('renders a request_changes recommendation', () => {
     const artifact = makeArtifact({
-      data: { summary: 'Deployment succeeded on prod.' },
+      artifactType: 'decision',
+      data: { recommendation: 'request_changes' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-markdown').textContent).toContain(
-      'Deployment succeeded on prod.'
+    expect(getByTestId('artifact-card-decision').textContent).toContain('request_changes');
+  });
+
+  it('surfaces the review evidence link for legacy review rows mapped to decision', () => {
+    // Legacy review-history rows carry review_url (not recommendation); the
+    // renderer must keep that link visible instead of a blank card.
+    const artifact = makeArtifact({
+      artifactType: 'decision',
+      data: { review_url: 'https://github.com/o/r/pull/1#review', cycle: 0 },
+    });
+    const { container, getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    const anchor = container.querySelector('a');
+    expect(anchor).not.toBeNull();
+    expect(anchor?.getAttribute('href')).toBe('https://github.com/o/r/pull/1#review');
+    expect(getByTestId('artifact-card-decision').textContent).toContain('review');
+  });
+
+  it('falls back to review_url when data.url is a non-http scheme (link is not dropped)', () => {
+    // A non-http data.url must not shadow a valid review_url/pr_url candidate.
+    const artifact = makeArtifact({
+      artifactType: 'decision',
+      data: { url: 'ftp://example.com/x', review_url: 'https://github.com/o/r/pull/1#review' },
+    });
+    const { container } = render(<ArtifactCard artifact={artifact} />);
+    expect(container.querySelector('a')?.getAttribute('href')).toBe(
+      'https://github.com/o/r/pull/1#review'
     );
   });
 
-  it('does NOT use markdown renderer when summary is one of several keys', () => {
-    // summary + another key → table renderer (all primitives)
+  it('labels the link by the actually-selected URL (data.url wins over review_url)', () => {
     const artifact = makeArtifact({
-      data: { summary: 'text', status: 'ok' },
+      artifactType: 'decision',
+      data: { url: 'https://example.com/a', review_url: 'https://example.com/b' },
     });
-    const { getByTestId, queryByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(queryByTestId('artifact-card-markdown')).toBeNull();
-    expect(getByTestId('artifact-card-table')).toBeTruthy();
+    const { container, getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(container.querySelector('a')?.getAttribute('href')).toBe('https://example.com/a');
+    // data.url was selected, so the label is 'view', not 'review'.
+    expect(getByTestId('artifact-card-decision').textContent).toContain('view');
+    expect(getByTestId('artifact-card-decision').textContent).not.toContain('review');
   });
 });
 
-// ── Structured table card ─────────────────────────────────────────────────────
+// ── note shape ───────────────────────────────────────────────────────────────
+
+describe('ArtifactCard — note shape', () => {
+  it('renders artifact-card-note with the text', () => {
+    const artifact = makeArtifact({
+      artifactType: 'note',
+      data: { text: 'Running the test suite now.' },
+    });
+    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(getByTestId('artifact-card-note').textContent).toContain('Running the test suite now.');
+  });
 
-describe('ArtifactCard — table renderer', () => {
-  it('renders artifact-card-table when data has flat primitive key-value pairs', () => {
+  it('falls back to data.summary when data.text is absent (legacy compat)', () => {
     const artifact = makeArtifact({
-      data: { status: 'ok', count: 42, flag: true },
+      artifactType: 'note',
+      data: { summary: 'Legacy status line.' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-table')).toBeTruthy();
+    expect(getByTestId('artifact-card-note').textContent).toContain('Legacy status line.');
   });
+});
 
-  it('shows all key-value pairs in the table', () => {
+// ── default renderer ─────────────────────────────────────────────────────────
+
+describe('ArtifactCard — default renderer', () => {
+  it('renders artifact-card-generic for an unknown shape', () => {
     const artifact = makeArtifact({
-      data: { environment: 'production', version: '1.2.3' },
+      artifactType: 'something_new',
+      data: { any: 'value', nested: { x: 1 } },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    const card = getByTestId('artifact-card-table');
-    expect(card.textContent).toContain('environment');
-    expect(card.textContent).toContain('production');
-    expect(card.textContent).toContain('version');
-    expect(card.textContent).toContain('1.2.3');
+    const card = getByTestId('artifact-card-generic');
+    expect(card.textContent).toContain('something_new');
   });
 
-  it('renders boolean values', () => {
+  it('default renderer works for an empty data payload', () => {
+    const artifact = makeArtifact({ artifactType: 'something_new', data: {} });
+    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(getByTestId('artifact-card-generic')).toBeTruthy();
+  });
+});
+
+// ── legacy type normalization ────────────────────────────────────────────────
+//
+// Until the backend producer + DB migration land, rows carry pre-shape types
+// (progress/result/pr/review). The UI maps them to shapes at the render boundary
+// so they keep rendering correctly instead of falling through to GenericCard.
+
+describe('ArtifactCard — legacy type normalization', () => {
+  it('renders a legacy "pr" artifact as a link row', () => {
     const artifact = makeArtifact({
-      data: { success: true, failed: false },
+      artifactType: 'pr',
+      data: { pr_url: 'https://github.com/o/r/pull/5', number: 5, kind: 'pr' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    const card = getByTestId('artifact-card-table');
-    expect(card.textContent).toContain('true');
-    expect(card.textContent).toContain('false');
+    expect(getByTestId('artifact-card-link').textContent).toContain('Pull Request #5');
   });
 
-  it('shows null values as "null"', () => {
+  it('renders a legacy "progress" artifact as a note line', () => {
     const artifact = makeArtifact({
-      data: { missing: null },
+      artifactType: 'progress',
+      data: { summary: 'Running the test suite.' },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-table').textContent).toContain('null');
+    expect(getByTestId('artifact-card-note').textContent).toContain('Running the test suite.');
   });
 
-  it('does NOT use table renderer when data has nested objects', () => {
+  it('renders a legacy "result" artifact without a URL as a decision', () => {
     const artifact = makeArtifact({
-      data: { nested: { key: 'value' } },
+      artifactType: 'result',
+      data: { summary: 'Shipped to production.' },
     });
-    const { getByTestId, queryByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(queryByTestId('artifact-card-table')).toBeNull();
-    // Falls through to generic
-    expect(getByTestId('artifact-card-generic')).toBeTruthy();
+    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(getByTestId('artifact-card-decision').textContent).toContain('Shipped to production.');
   });
-});
 
-// ── Generic fallback ──────────────────────────────────────────────────────────
+  it('renders a mixed QA "result" (pr_url + summary) as a decision, preserving the summary', () => {
+    // The full-stack QA workflow writes { pr_url, summary, test_output, ... }; it
+    // must not collapse to a bare link that hides the QA summary.
+    const artifact = makeArtifact({
+      artifactType: 'result',
+      data: {
+        summary: 'QA passed: backend + browser golden path exercised.',
+        pr_url: 'https://github.com/o/r/pull/9',
+        test_output: 'all green',
+        ui_changed: true,
+      },
+    });
+    const { container, getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    const card = getByTestId('artifact-card-decision');
+    expect(card.textContent).toContain('QA passed');
+    // The PR link is still reachable as the decision's evidence link.
+    expect(card.textContent).not.toContain('Pull Request');
+    expect(container.querySelector('a')?.getAttribute('href')).toBe(
+      'https://github.com/o/r/pull/9'
+    );
+  });
 
-describe('ArtifactCard — generic renderer', () => {
-  it('renders artifact-card-generic for unrecognised data shapes', () => {
+  it('renders a legacy "result" artifact carrying pr_url as a link', () => {
     const artifact = makeArtifact({
-      data: { nested: { deep: 'value' }, arr: [1, 2, 3] },
+      artifactType: 'result',
+      data: { pr_url: 'https://github.com/o/r/pull/9', kind: 'pr', number: 9 },
     });
     const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-generic')).toBeTruthy();
+    expect(getByTestId('artifact-card-link').textContent).toContain('Pull Request #9');
   });
 
-  it('shows artifactType badge on the generic card', () => {
+  it('renders a legacy merge-audit "result" (merged_pr_url) as a link, not an empty card', () => {
+    // The post-approval merge template writes { merged_pr_url, merged_at, approval_source };
+    // the merged PR URL must render instead of a bare decision badge.
     const artifact = makeArtifact({
-      artifactType: 'custom_event',
-      data: { nested: { x: 1 } },
+      artifactType: 'result',
+      data: {
+        merged_pr_url: 'https://github.com/o/r/pull/42',
+        merged_at: '2026-08-02T00:00:00Z',
+        approval_source: 'human',
+      },
     });
-    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-    expect(getByTestId('artifact-card-generic').textContent).toContain('custom_event');
+    const { container, getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(getByTestId('artifact-card-link')).toBeTruthy();
+    expect(container.querySelector('a')?.getAttribute('href')).toBe(
+      'https://github.com/o/r/pull/42'
+    );
   });
-});
 
-// ── Type badge visible on all renderers ──────────────────────────────────────
-
-describe('ArtifactCard — type badge always visible', () => {
-  const cases: Array<{ desc: string; data: Record<string, unknown>; testId: string }> = [
-    {
-      desc: 'PR renderer',
-      data: { url: 'https://github.com/o/r/pull/1' },
-      testId: 'artifact-card-pr',
-    },
-    {
-      desc: 'commit-ref renderer',
-      data: { url: 'https://github.com/o/r/commit/abc1234' },
-      testId: 'artifact-card-commit-ref',
-    },
-    {
-      desc: 'link renderer',
-      data: { url: 'https://example.com' },
-      testId: 'artifact-card-link',
-    },
-    {
-      desc: 'terminal renderer',
-      data: { stdout: 'output' },
-      testId: 'artifact-card-terminal',
-    },
-    { desc: 'markdown renderer', data: { summary: 'text' }, testId: 'artifact-card-markdown' },
-    { desc: 'table renderer', data: { k: 'v' }, testId: 'artifact-card-table' },
-  ];
-
-  for (const { desc, data, testId } of cases) {
-    it(`shows artifactType badge on the ${desc}`, () => {
-      const artifact = makeArtifact({ artifactType: 'my_type', data });
-      const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
-      expect(getByTestId(testId).textContent).toContain('my_type');
+  it('renders a legacy "review" artifact as a decision with the review link', () => {
+    const artifact = makeArtifact({
+      artifactType: 'review',
+      data: { review_url: 'https://github.com/o/r/pull/1#review', cycle: 0 },
     });
-  }
+    const { container, getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(getByTestId('artifact-card-decision')).toBeTruthy();
+    expect(container.querySelector('a')?.getAttribute('href')).toBe(
+      'https://github.com/o/r/pull/1#review'
+    );
+  });
+
+  it('falls through to the default renderer for a truly unknown legacy type', () => {
+    const artifact = makeArtifact({
+      artifactType: 'mystery_type',
+      data: { foo: 'bar' },
+    });
+    const { getByTestId } = render(<ArtifactCard artifact={artifact} />);
+    expect(getByTestId('artifact-card-generic')).toBeTruthy();
+  });
 });