# AWP I2 Vision Recovery Plan — Real Planning / Goal Management
**Date:** 2026-08-24
**Status:** COMPLETE — provider/model-catalog/reasoning-effort correction live-proved on dogfood
**Reason:** Slice 2 was prematurely declared complete after the implementation substituted deterministic forms/state transitions for the specified model-backed Planner-led conversation.
## Authority
This recovery plan does not redefine the product. It restores the already-approved authority in:
- `docs/VISION.md`;
- `docs/specs/domains/planning.md`;
- `docs/specs/workflows/interactive-planning.md`;
- `docs/specs/ui/planning.md`;
- `docs/plans/AWP-PLANNER-LEADERSHIP-UX.md`;
- `docs/plans/AWP-INCREMENTAL-DELIVERY-PLAN.md`.
When this file conflicts with the earlier I2 completion record, this corrective plan wins until the recovery contract is fully closed.
## Owner-authorized sequencing amendment
On 2026-08-24 the owner explicitly directed AWP to reopen Slice 2, correct its plan/spec drift, and continue toward the original Real Planning vision until completion. This is the explicit governance amendment that authorizes I2 vision-recovery work even though the earlier I1-only sequencing guard has not yet marked GOLIVE acceptance complete.
This exception is narrow: it activates only the I2 Real Planning recovery contract. It does not waive, weaken, fabricate, or pre-accept any I1 GOLIVE criterion, and it does not authorize I3-I9 expansion. Slice 1 execution/auth/durability/publication safety invariants remain binding regression requirements.
### Owner sequencing amendment — 2026-08-24
The owner has explicitly directed: review/fix the plan and specs and continue working toward the original Slice 2 vision until completion. This instruction reopens I2 implementation now, even though the independent I1 GOLIVE owner-proof lane has not yet reached 30/30. The exception is narrow: only the corrected I2 recovery described here is authorized. It does not validate the quarantined form-only implementation, does not mark I1 proof complete, and does not authorize unrelated I3–I9 expansion.
## Drift diagnosis
The prior I2 implementation correctly created useful structured substrate: `PlanningSession`, PlanningProfile, Simple/Expert participation, Plan Index, structured decisions/recommendations, deferrals, readiness, Goal management, connection return, and Start/Schedule/Park.
It did **not** implement the defining interaction loop:
```text
owner message
-> real Planner Agent model invocation
-> planner reply/recommendation/question
-> typed interpretation of the turn
-> durable Planning state mutation
-> next agenda selection
-> repeat
```
The earlier completion checklist failed to include a model invocation/provenance/conversation acceptance gate, so tests could pass while the vision-defining behavior was absent. The earlier P1–P10 high-fi requirement was also treated as a renderer-state map instead of a real pre-implementation design/usability gate.
## Corrected I2 architecture
### Planner is a distinct agent role
The I2 Planner Agent forms/revises a Plan through Planning authority. It is not an Advisor Agent, Execution Agent, or Resolver Agent. It uses the existing Account/Model/Provider and Model Gateway seams; it never reads provider secrets or creates a second token authority.
### Planner model selection
Effective Planner routing is resolved in this order:
```text
PlanningSession explicit override, when present
-> Project Planning interviewer default
-> System Planning interviewer default
-> not configured (visible blocker; never silently borrow execution model)
```
The configuration surface exposes at least:
```text
planning.interviewerAccountId
planning.interviewerModel
```
Changing Project/System defaults affects subsequent Planner turns that do not have a session override. A session override is explicit and visible. Execution/Factory model selection remains a separate configuration/launch concern.
### Turn provenance
Every model-produced Planner turn durably records enough provenance to explain:
```text
PlanningSession / sequence / timestamp
provider/account/model
model invocation identifier when available
input PlanningSession revision
output disposition / affected planning item
status/failure category when the model call fails
```
Conversation text is interaction evidence, not canonical Plan truth. Accepted decisions, findings, risks, deferrals, artifacts, readiness and PlanRevision remain structured authority.
### Planner turn contract
For each user message the Planner must:
1. respond to the current input;
2. interpret whether the current Planning item is resolved, still under discussion, or safely deferred;
3. update structured Planning state only through validated application commands;
4. surface material uncertainty instead of inventing certainty;
5. select the highest-value unresolved next item;
6. lead into that item with a recommendation/brief or one consequential question.
A model may propose a mutation; application validation remains authoritative. A model response cannot bypass OwnerRequired/PolicyRequired authority, readiness rules, launch confirmation, connection policy, or revision checks.
## Recovery completion contract
Slice 2 is **not complete** until all items below are true on canonical `main` and dogfood:
- [x] Binding I2 specs explicitly require the Planner model-backed turn loop, model-routing hierarchy, failure semantics, and turn provenance.
- [x] Project Settings exposes Planner interviewer routing separately from Factory execution configuration.
- [x] System, Project, and Plan/session Planner controls expose provider, account, catalog-backed model, and model-supported reasoning-effort selectors; no free-text-only model configuration remains when a live catalog is available.
- [x] Global System Settings exposes Planner routing defaults as authoritative values inherited by Projects, with Project override/reset provenance.
- [x] Planning workspace exposes the effective Planner routing and an explicit per-session override/reset path.
- [x] Starting Planning can produce the first real Planner response from the configured model without a synthetic hard-coded interview question.
- [x] Subsequent user messages invoke the real configured Planner model and return visible conversational responses.
- [x] Planner responses can resolve/continue/defer the current item through typed, validated state transitions and then advance the structured agenda.
- [x] Simple mode remains low-interruption full planning; Expert mode makes DelegableExpert recommendations normal conversational interview items.
- [x] Planner conversation and structured state survive refresh/restart; accepted Plan truth does not depend on transcript reconstruction.
- [x] Every Planner model turn records provider/account/model/reasoning-effort provenance and input revision; provider-observed reasoning effort is retained when reported, and failures are visible/retryable without losing state.
- [x] Provider/account/model/effort changes do not rewrite historical turn attribution.
- [x] Connection/auth interruption returns to the exact Planning item and conversation state.
- [x] The P1–P10 visual set is re-ratified against the actual conversation-first Planner experience, including real conversation/composer states rather than form-only substitutes.
- [x] Automated tests prove model invocation, routing/config inheritance, stale revision rejection, malformed model output handling, provider failure recovery, persistence/restart, UI conversation, and existing I2 structured invariants.
- [x] A real dogfood Planner turn is executed through the deployed Model Gateway/Subrouter using a catalog-selected provider/account/model/reasoning effort and the response confirms the requested effort.
- [x] Full repository gate passes on debian1/2/3, exact candidate is deployed, and owner-facing Tailscale UI is usable.
- [x] No Slice 1 execution/review/merge invariants regress.
## Post-completion correction — global configuration surface
The owner identified a remaining I2 implementation drift after the initial recovery closure: the typed configuration authority already supported `system -> project -> session`, and the Settings spec explicitly required System and Project scopes, but the live web UI exposed only Project Settings. This made the global Planner default effectively API-only and violated the product rule that configurable defaults must be inspectable/editable at their normal scope.
The corrective acceptance is explicit: `/settings` must provide System-level Planner account/model controls; Project Settings must visibly inherit those values until overridden; Project reset must return to System; the shared mutation client must correctly save both `` and `