Wire intent→coordinator DocResolver confirm cards→action_executor kinds for comment, reopen, pending-supplements query, and real submit-review execution.
- 5 independent flags (MULTI_INTENT_U11_LIVE_REVIEW/FINAL/PROPOSAL, U12_LIVE_SWITCH/RESTART), default OFF; no full rollout
- DocGovLiveActionKeys/RunControlLiveActionKeys become flag-driven functions; baseline keys unchanged
- DocGovOwner routes review.approve/reject, final.approve/reject, proposal.decide to real engine with slot-driven reason/approve parsing and idempotent receipts
- RunControlOwner routes workflow.switch -> ActivateWorkflow and run.restart -> fresh CreateAndStart run
- policy: 7 keys promoted from TierFull to TierConfirm (real execution still gated per-key)
- tests: default-off isolation, per-key independence, live state advance reviewing->approving, dry-run zero-advance when flag off
DocGov (and other summary-keyed adapters) resolve doc_id from step slots
or safe_summary; authorizeDecision omitted both, so U11 confirm failed
closed with PLAN_ACTION_FORBIDDEN despite a bound resource version.
Mutate/docgov live Authorize requires ExpectedResourceVersion; populate it
(and frame slots) when HandleTurn drafts confirm-class steps so confirm
no longer fails closed with PLAN_ACTION_VERSION_CONFLICT.
Bring I2 rollout reports onto the U9–U12 branch; keep FEATURE-MATRIX
out of this merge (managed via docs apply on local_dev). Tighten
ActiveSegmentProposer to PlanTier ≥ auto_read per Track I3.
Connect LLM segment proposals into HandleTurn, replace U10–U12 dry-run stubs
with production owners (blackboard supplement, docgov claim/submit, workflow
run/resume) when flags are on, and update policy/sysadmin maturity metadata.
Replace FakeActionOwner with QueryOwner+QueryGuard at the composition
root; DispatchEligible reuses claim/execute/recover so confirm stays
zero-write before dispatch and default tier remains legacy.
Rules that already split skip the LLM. Independent flags stay off by
default and do not raise MULTI_INTENT_PLAN_TIER.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register dry-run adapters via BuildOwnerMux when independent flags are on;
U9 stub fail-closes on malformed/timeout/out-of-bounds without raising PlanTier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize empty TEXT[] binds, isolate step-changed aggregates from plan
revision uniqueness, propagate AdvanceEligible errors, and emit
taskrun.completed to the registered notify consumer so finalize no longer
rolls back live receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist ComboNeedsConfirm plans at confirm tier without executing writes, then run task.run via OwnerMux and a stable idempotency key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Confirmation stays a command receipt; FakeActionOwner now fail-closes on revoke and resource version drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Append awaiting/step/completed envelopes in the command UoW and project them without changing dispatcher leases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add the app/intentflow skeleton so HITL state, error codes, REST shapes, and BatchActionPolicy live outside intent and default to the legacy tier.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen