Activate governed additive planner

[paullizer]

Summary

• activate validated high-confidence planner proposals through the existing durable capability-choice lifecycle
• enable governed assist planning by default, while preserving explicit off and shadow controls
• provide Admin guidance and tooltips for every planner setting, including clear Off/Shadow/Assist definitions
• add responsive sliders for timeout, completion budget, and capabilities per plan, plus a bounded candidate-plan dropdown
• add recursive server-authored additive bundles with deterministic precedence, exact closure binding, provenance v2, and fail-closed authorization drift handling
• harden trusted resume context, current-turn external query minimization, exact lease ownership, process-loss reconciliation, and correlated partial/safety output
• update documentation, release notes, and application version 0.250.073

Admin controls

• Assist: recommended normal operation; validated plans become approval choices
• Shadow: planner evaluation only; no user-visible proposal or execution change
• Off: bypass planner model calls
• Planner model source: selected chat model or configured global endpoint/model IDs
• Timeout slider: 1-20 seconds, 10 seconds recommended
• Completion budget slider: 64-1200 tokens, 600 recommended
• Candidate plans dropdown: 1-6, 3 recommended
• Capabilities per plan slider: 1-8, 4 recommended

Behavior

• each eligible new turn first asks the configured planner model for direct, propose, or clarify
• a validated high-confidence propose result becomes one server-authored approval card; after approval, the chosen tools execute and their evidence returns to the final response model
• only current read-only built-ins and governed Phase 8B agents can materialize
• selected mandates, explicit declines, current authorization, and material deterministic recommendations remain authoritative
• browser payloads cannot inject server-only capability context, discovery references, minimized queries, leases, or execution identity
• clarify and prior-turn external-query context remain deferred to Phase 10C

Validation

• ./.venv/Scripts/python.exe scripts/run_phase9_orchestration_quality_gates.py
• 291 passed, 7 expected environment-gated skips
• committed changed-line XSS scan passed for four Admin/backend files
• committed changed-line Broken Access Control scan passed for two backend files
• JavaScript syntax, Python compilation, editor diagnostics, and whitespace checks passed
• exact public_archive_three_year live planner probe returned strict-schema propose, recommended deep_research, and offered web_search as an alternative in 3.536 seconds
• final independent high/medium review found no blocking, high, or medium findings

Documentation

• updated CHAT_CAPABILITY_MODEL_PLANNER.md
• updated CHAT_TURN_ORCHESTRATION.md
• updated release notes for v0.250.073

Refs #1021

[paullizer]

Phase 10B choice-card UX follow-up is pushed in d46e1f90 as version 0.250.074.

• Replaced uneven, badge-heavy actions with equal-width selectable plan cards, concise descriptions, compact time/cost summaries, and a corner Recommended ribbon.
• Multi-capability plans show an Includes checklist but remain one server-authored plan. The browser still submits exactly one persisted option_id; a card click immediately decides and resumes. Continue remains a full-width secondary path.
• Preserved inert DOM text rendering, keyboard operation, 44px actions, and responsive desktop/mobile behavior.

Validation:

• Real-module Playwright choice-card suite: 6 passed at desktop and mobile viewports.
• Cumulative Phase 9/10A/10B gate: 296 passed, 3 skipped.
• Full gate BAC: 11 files passed; XSS: 12 files passed.
• JavaScript/Python syntax, editor diagnostics, local-asset scan, and whitespace checks passed.

[paullizer]

Capability-choice compact lifecycle follow-up is pushed in dd763318 as version 0.250.075.

• Once a decision is saved, the expanded chooser is replaced immediately by one compact summary containing the selected plan, included capabilities, and Saved/Running/Completed state.
• Persisted pending resumes and failed resumes retain compact Resume/Retry actions. A decision-save failure keeps the original chooser available.
• The compact modifier opts out of the chat row's flex stretching, preventing the resolved card from retaining the adjacent message height.

Validation:

• Real-module Playwright desktop/mobile suite: 6 passed.
• Completed card: below 100px and below 40% of expanded chooser height at both tested viewports.
• Cumulative Phase 9/10A/10B gate: 296 passed, 3 skipped.
• Full gate BAC: 11 files passed; XSS: 12 files passed.
• JavaScript/Python syntax, diagnostics, local-asset/sink scans, and whitespace checks passed.