# I2 Real Planning slice — durable progress

**Started:** 2026-08-24
**Status:** COMPLETE — provider/model catalog/reasoning-effort correction live-proved and durable
**Branch:** `impl/i2-real-planning-20260824`
**Base:** started at `origin/main@e2013dc`; continuously rebased onto current `origin/main`
**Owner goal:** make the second AWP slice fully visible and usable.

**CORRECTION 2026-08-24:** REOPENED. The previous completion claim was invalid because the model-backed Planner Agent / interview loop required by the Vision and binding I2 workflow was not implemented. See `docs/plans/AWP-I2-VISION-RECOVERY-PLAN.md`.

## Authority

Primary increment authority: `docs/plans/AWP-INCREMENTAL-DELIVERY-PLAN.md` I2.
Behavior authority: `docs/specs/domains/planning.md`, `docs/specs/workflows/project-onboarding.md`, `docs/specs/workflows/interactive-planning.md`, `docs/specs/workflows/connection-onboarding.md`, `docs/specs/ui/planning.md`, `docs/specs/domains/goals.md`, and approved D1-D6 Planning UX decisions.

The P1-P10 Planning high-fi set was not present when this slice started. The first work item is therefore to materialize that approved design faithfully and use the same implementation as the owner-visible acceptance surface, rather than inventing a parallel planner UI.

## Superseded completion contract

The checklist below records what the premature implementation completed; it is **not sufficient for I2 completion**. The binding recovery contract is in `docs/plans/AWP-I2-VISION-RECOVERY-PLAN.md`.


- [x] Project onboarding can create/reconcile ProjectVision, Goals, profile/defaults and hand into Planning.
- [x] Full Goal create/edit/status/criteria/readiness works from owner UI.
- [x] Durable PlanningSession/Profile/Workflow state exists and survives refresh/restart.
- [x] Simple and Expert participation modes work without changing authority semantics.
- [x] Plan Index exposes DEFINE / DESIGN / SPECIFY / DELIVER / LAUNCH and dynamic item state.
- [x] Recommendation/decision state is structured and inspectable; delegated technical choices stay visible.
- [x] Deferral records blocking point/consequence/revisit state.
- [x] Quality/CI/delivery/execution recommendations and effective plan are visible.
- [x] ConnectionRequirement defer/return flow preserves exact planning context.
- [x] Readiness uses Ready / Ready with deferred gaps / Blocked, not fake percentages.
- [x] Ready-to-launch supports Start now / Schedule / Park with durable state and preflight revalidation.
- [x] Planning routes restore exact active item after refresh/back navigation.
- [x] P1-P10 representative states and responsive layouts are implemented in the actual UI.
- [x] Tests cover domain/application/persistence/HTTP/UI behavior and restart recovery.
- [x] Full repository check passes on an allowed build host (debian1/2/3), not the workstation.
- [x] Exact candidate is deployed to the dogfood environment without regressing Slice 1.
- [x] Owner-facing Tailscale URL is reachable and second-slice flows can be used interactively.
- [x] Landed on canonical main with final durable evidence recorded here.

## Current state

- 2026-08-24: authoritative next increment identified as I2 Real Planning / Goal Management.
- 2026-08-24: isolated worktree created from current `origin/main@e2013dc`.
- 2026-08-24: no existing production PlanningSession/PlanningProfile implementation found; only I1 narrow Plan primitives exist.
- 2026-08-24: implemented the first I2 vertical slice: PlanningSession/Profile domain model, persistence schema/repositories, Planning application service, onboarding/goal/planning HTTP surface, Simple/Expert planner UI, account return flow, Start/Schedule/Park controls, and I2 project integration.
- 2026-08-24: full workspace `pnpm typecheck` passes on allowed build host `debian2` for this checkpoint.
- 2026-08-24: rebased the initial I2 vertical slice onto `origin/main@b08196a` so the approved Projects collection replaces the deleted legacy surface.
- 2026-08-24: deepened I2 with explicit ProjectVision alignment, owner-attributed structured deferrals (including later production gates), profile override with retained accepted state, derived Goal readiness, full Goal edit fields, connection return confirmation, browser-local schedule timezone, and transactional Planning event/audit/outbox evidence.
- 2026-08-24: generated PostgreSQL migration `0020_odd_sleepwalker.sql` for `planning_sessions`, `project_planning_defaults`, and Goal readiness columns.
- 2026-08-24: repeated full workspace `pnpm typecheck` on `debian2`; green after all changes above.
- 2026-08-24: rebased through the current canonical baseline `origin/main@144bfe6`, including the I1 Settings and dogfood deployment fixes.
- 2026-08-24: materialized the required P1–P10 acceptance set in the production Planning renderer; `docs/mockups/i2/README.md` maps every state to the live route instead of maintaining a parallel mock UI.
- 2026-08-24: focused I2 gate on `debian2` is green: 7 files / 19 tests covering domain readiness/agenda, HTTP routes, persistence/restart, schema, Projects onboarding, legacy-form exclusion, and P1–P10 UI states.
- 2026-08-24: exact-tree full `pnpm check` is green on `debian2`: 64 test files passed, 5 skipped; 279 tests passed, 9 skipped; architecture 6/6; dependency-cruiser 122 modules / 228 dependencies with zero violations; Prettier clean.
- 2026-08-24: rebased onto canonical `origin/main@6ce0b77` after the concurrent I1 auth/startup hardening; exact-head full `pnpm check` is green on `debian2`: 65 test files passed, 5 skipped; 281 tests passed, 9 skipped; architecture 6/6; dependency-cruiser 122 modules / 228 dependencies with zero violations; Prettier clean.
- 2026-08-24: deployed exact I2 source candidate `4530a3c` to debian3 dogfood; source parity matched all 566 tracked files. PostgreSQL is healthy at migrations 21/21 with `planning_sessions` and `project_planning_defaults` present. Dogfood PostgreSQL/control-plane/web services are active and execution tables remain empty (0 FactoryRuns / 0 AgentRuns / 0 ChangeSets).
- 2026-08-24: owner endpoint `https://debian3.taild2daa0.ts.net/` is reachable over Tailscale HTTPS (303 to `/login`), `/login` is 200, and the deployed `/planning.css` is 200 with the I2 Planning workspace asset. No plaintext owner password is present in automation environments, so authenticated live mutation was not fabricated; equivalent authenticated Planning flows are covered by the green HTTP/UI/restart gates.
- 2026-08-24: deployment exposed a reproducibility defect: non-interactive SSH lacked `mise` on PATH. `infra/dogfood/deploy-debian3.sh` now uses explicit `/home/user/.local/bin/mise` by default (overrideable via `AWP_MISE_BIN`); deployment-boundary regression is green 5/5 and `bash -n` passes.
- 2026-08-24: I2 implementation and deployment repair fast-forwarded canonical `main` through `960e3ab`; concurrent main then advanced to `543709a` with newly published Subrouter/model-gateway digest locks. I2 rebased/fast-forwarded to that exact main and the full `pnpm check` remained green on `debian2` (65 passed files / 281 passed tests, 5 files / 9 tests skipped, architecture 6/6, zero dependency violations, Prettier clean).
- 2026-08-24: canonical `main@543709a` was redeployed to debian3. Running Subrouter and model-gateway images exactly match the new digest locks, dogfood PostgreSQL/control-plane/web are healthy, migrations are 21/21 with no drift, tracked source parity is exact, and FactoryRun/AgentRun/ChangeSet/PlanningSession retained counts remain `0|0|0|0`.
- 2026-08-24: final owner surface is `https://debian3.taild2daa0.ts.net/`: root redirects to `/login`, `/login` returns 200, and `/planning.css` returns 200 with the I2 Planning workspace asset. Slice 2 is landed, deployed, and owner-visible; no real FactoryRun or publication authority was exercised during this cutover.

## Remaining path

Complete. Slice 2 now implements and live-proves the original model-backed, conversation-first Real Planning vision.

## Vision-recovery checkpoint — 2026-08-24

The reopened Slice 2 recovery is complete: the model-backed Planner is implemented, source-green, deployed, and proven against a real owner-authorized Codex account on dogfood.

Completed recovery evidence:

- binding specs/plan now require the real model-backed Planner interview loop and explicitly separate Planner routing from Factory execution routing;
- Planner routing is `PlanningSession override -> Project default -> System default -> visible configuration blocker`, with immutable historical account/model/provider/input-revision provenance;
- Project Settings exposes `planning.interviewerAccountId` and `planning.interviewerModel`; Planning exposes effective routing plus explicit session override/reset;
- the primary Planning interaction is the Planner conversation/composer; deterministic structured resolve/defer controls remain secondary shortcuts rather than the interview substitute;
- Planning-purpose Model Gateway capabilities retain their own PlanningSession/turn identity without weakening Attempt-scoped execution routing;
- migration `0021_narrow_viper.sql` durably adds Planner override and turn history to `planning_sessions`;
- focused recovery gate on debian2: 4 files / 18 tests PASS, including explicit provider-outage recovery, malformed-output recovery, stale-revision rejection, PostgreSQL restart/provenance, conversation UI, Planner Settings UI, and scope authority;
- exact-head full repository gate before live cutover: 67 passed files / 288 passed tests, 5 files / 9 tests skipped, architecture 6/6, dependency-cruiser 124 modules / 234 dependencies with zero violations, build/typecheck/lint/Prettier all PASS;
- canonical `main@c742c012ab3260400f5af6e6771abd85bf1c5d4b` was deployed through the serialized canonical-main transaction to debian3;
- dogfood health after cutover: PostgreSQL 22/22 migrations, pending `0`, drift `[]`, source SHA `c742c012ab3260400f5af6e6771abd85bf1c5d4b`, tree `0ffe0b404c033afc75028843a357336496d63885`;
- deployed Model Gateway is `ghcr.io/platform-modules/awp-model-gateway@sha256:ad697974d5afa7e0bd2c9805eb1d126c11cd25066453f37b39db515b78ffce14`; Subrouter is `ghcr.io/platform-modules/awp-subrouter@sha256:d93baf4d5964a9c31af18b35415c5b27571d19520239e50bb348150613df5ad2`; both are Ready;
- dogfood still has `0` FactoryRuns, `0` AgentRuns, `0` ChangeSets and `0` PlanningSessions; no execution/publication authority was exercised by this recovery deployment;
- Tailscale Serve remains HTTPS `443 -> http://127.0.0.1:4173`; web/control listeners remain loopback-only; local root redirects to `/login` and `planning.css` is live;
- live authoritative configuration registry contains `planning.interviewerAccountId` and `planning.interviewerModel`.

### Live owner/account boundary resolved

The owner-authorized Codex OAuth account `chatgpt@alex.org.il` is now present and `auth_valid=true` in the live K3s Subrouter. No workstation/Systray/Overdeck credential was copied. The connected account was used only through canonical Subrouter/Model Gateway routing.

The final live proof then uncovered and repaired two deployment/provider defects that source-only tests had missed:

1. the host control plane could not resolve Kubernetes service DNS for Model Gateway; dogfood now resolves and persists the Model Gateway ClusterIP exactly as it already does for Subrouter/Fabro;
2. Codex requires Responses `input` to be a list and `stream=true`; the Planner adapter now uses list-form user input and reconstructs output/provenance from SSE events.

Real dogfood evidence:

- PlanningSession `4341b402-c139-4599-9bd1-10632da1e86e` completed a real Planner turn via `provider:model-gateway`, account `chatgpt@alex.org.il`, model `gpt-5.6-luna`, response `resp_05cbd5dd5f90339b016a8c7af47be887d2ae2228afb532285f`, resolving `intent -> vision-alignment`;
- after a real control-plane restart the exact transcript/override/provenance survived; FactoryRun/AgentRun/ChangeSet counts remained zero;
- the same persisted session then successfully continued after a recorded retryable malformed-output turn, producing response `resp_0d60fb3985bb9172016a8c7b5df36c87d2b4def8b1bf57c323` and advancing `vision-alignment -> scope`;
- Project-level Planner defaults were set on the dedicated proof Project; new session `d250ad47-8350-4861-9c2f-92a8f2b9a6d0` resolved interviewer provenance from `source: project` and produced its first real response `resp_05fe2d6168ad4b1c016a8c7befe7fc87d2845cafc621b6033b`;
- Tailscale Serve remains HTTPS `443 -> http://127.0.0.1:4173`, while web/control listeners remain loopback-only.

All I2 recovery criteria are now satisfied.

## Post-completion global Settings correction — 2026-08-24

COMPLETE. Owner review correctly identified that the I2 Settings spec required System and Project Planner interviewer configuration, while the live UI exposed only Project Settings. Backend inheritance existed, but the System Settings human control surface was missing and the Project Planner-account `<select>` could not save because the client mutation handler only read `<input>`.

Corrected implementation:

- `/settings` is the global System Settings page;
- `planning.interviewerAccountId` and `planning.interviewerModel` are editable there as System defaults;
- Project Settings displays inherited System provenance, supports explicit Project override, and `Reset to inherited` returns to System;
- PlanningSession override remains the third, most-specific layer;
- navigation exposes System Settings and Project Settings separately;
- one shared configuration client handles System/Project scope plus text, select, and toggle controls;
- API regression proves the precedence chain `System -> Project override -> reset -> System`;
- deployed `801a4e616d15a9d3400578077f730b02486c15e4` was executed against the live registry and rendered both System Planner controls, while the existing proof Project still resolved its Project-level `chatgpt@alex.org.il / gpt-5.6-luna` override;
- global Planner values remain intentionally unset until the owner chooses defaults in `/settings`; no implicit global behavior change was made.

## Post-completion provider/model/effort correction — 2026-08-24

REOPENED after owner review. The live provider exposes a real model catalog and per-model supported reasoning levels, but I2 UI/configuration had reduced the selection to account + free-text model and omitted explicit provider and reasoning effort. This is both an acceptance-spec gap and an implementation drift from the broader Accounts/Models/Providers domain.

Live Codex catalog evidence currently includes selectable `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5.6-luna`, `gpt-5.5`, `gpt-5.4`, and `gpt-5.4-mini`; catalog entries advertise their own default/supported reasoning levels. A direct dogfood probe confirmed `reasoning: { effort: "high" }` is accepted and the completed response records `reasoning.effort: "high"`.

Corrective completion requires live catalog-backed Provider -> Account -> Model -> Reasoning effort selection at System, Project, and Plan/session scope; durable effort provenance; provider/account and model/effort validation; regression/full gate; exact-main deployment; and one real Planner turn whose requested effort is confirmed by the live provider response.
## Provider/model/effort correction closure — 2026-08-24

The reopened correction is complete on the functional candidate `main@764afee76c430ce582cb713cc45902d38255e3eb` (tree `d5e7c223a19f79788b47cdb52a1d8be322d11e6b`). The exact-tree gate on debian2 passed with 330 tests / 77 files, architecture 6/6, zero dependency violations, and clean typecheck/lint/build/format.

Dogfood recovered from the initial configuration-definition mismatch through a versioned built-in-definition upgrade: `planning.interviewerModel` moved from schema v1 to v2 while preserving the existing account/model overrides; `planning.interviewerProviderId` and `planning.interviewerReasoningEffort` were registered at v1. Same-version definition drift remains fail-closed.

The proof Project `2cf632f2-d1f0-46bc-a885-d9fc086d018f` resolves all four routing dimensions from Project scope: `codex / chatgpt@alex.org.il / gpt-5.6-luna / high`. The live GPT-5.6-Luna catalog advertises default `medium` and supports `low / medium / high / xhigh / max`, so the proof exercised an explicit non-default effort.

PlanningSession `600b182a-475e-4584-b9a3-298e69b2cfca` retained two retryable malformed-output turns and then completed response `resp_07408f24335e78b1016a8ca4a01fc087d2aa23be3ab8ee9d20`. The successful turn records requested effort `high` and provider-observed effort `high`, plus immutable provider/account/model/invocation/input-revision provenance, resolved `intent`, and advanced to `vision-alignment`. After control-plane restart the session returned unchanged at revision 4. FactoryRun/AgentRun/ChangeSet counts remained `0/0/0`.

The resulting UI contract is now concrete rather than free text: System Settings, Project Settings, and the per-Plan interviewer override all use catalog-backed Provider -> Account -> Model -> Reasoning effort controls. The active Planner gateway enforces Provider support before invocation.