FE-1573: Construct and explain a net region from a real conversation

.changeset/calm-ledgers-frame.md

@@ -0,0 +1,5 @@
+---
+"@hashintel/petrinaut": patch
+---
+
+Let hosts label assistant tabs, resolve tool presentation from lifecycle context, signal unseen tab activity, and frame the rendered canvas from automatic tools. Tool calls now render chronologically with preserved result details, Brunch omits internal marker and automatic framing calls, generated reasoning headings are explicitly presented as thinking, an optional working label spans active turns, and the Ledger presents its readable account without internal record metadata. Auto-layout still awaits an inset-aware post-render viewport fit across built-in entry points.

.changeset/validate-arc-transitions.md

@@ -0,0 +1,5 @@
+---
+"@hashintel/petrinaut-core": patch
+---
+
+Reject arc creation when the referenced transition does not exist instead of treating it as an unchanged mutation.

apps/brunch-agent/.pi/extensions/brunch-persona-testing/README.md

@@ -11,7 +11,18 @@ yarn brunch:persona --case inventory-purchasing
 
 Replace the case name with any listed case. `--help` lists launch and resume options without starting services or inference. If the default dev ports are occupied, leave those services alone and select an unused pair, for example `BRUNCH_CHAT_PORT=4332 BRUNCH_PANEL_PORT=4926 yarn brunch:persona --case truck-fleet-maintenance`.
 
-The command uses the app's normal development configuration: `apps/brunch-agent/.env*`, with process environment taking precedence. Google Chrome in `/Applications`, `pi` and `herdr` on PATH, and installed workspace dependencies are required. Both participants use `claude-sonnet-4-6`. Paid runs still require owner authorization under the current [mission](../../../../../libs/@hashintel/brunch-agent/MISSION.md) and [execution safety](../../../../../libs/@hashintel/brunch-agent/evaluations/README.md#execution-safety); the existence of this command grants none.
+The command uses the app's normal development configuration: `apps/brunch-agent/.env*`, with process environment taking precedence. Google Chrome in `/Applications`, `pi` and `herdr` on PATH, and installed workspace dependencies are required. Defaults: Brunch `openai/gpt-5.6-sol` at low reasoning, persona `anthropic/claude-sonnet-4-6` at low reasoning. Override without source edits:
+
+```sh
+yarn brunch:persona --case inventory-purchasing \
+  --brunch-model openai/gpt-5.6-sol --brunch-thinking low \
+  --persona-model anthropic/claude-sonnet-4-6 --persona-thinking medium \
+  --persona-verbosity terse --persona-disclosure reticent
+```
+
+`--persona-verbosity` accepts `terse`, `default`, or `expansive`; `--persona-disclosure` accepts `reticent`, `default`, or `forthcoming`. Each non-default setting overrides only that axis in the situation pack. The default leaves the pack's axis unchanged. Verbosity controls answer length and response effort; disclosure controls how readily relevant knowledge is volunteered. Neither changes the person's other traits, reveals private material, merges the actor with the elicitor, or asks the actor to help the interview succeed. Reticence is not hostility, feigned ignorance, or permission to withhold a directly requested answer.
+
+`--help` lists every flag and exact literal. Each role requires its selected provider's API key: `OPENAI_API_KEY` for OpenAI and `ANTHROPIC_API_KEY` for Anthropic. The defaults therefore require both; an all-OpenAI run does not require Anthropic credentials. The launcher transfers the selected persona credential privately to its Pi pane. Paid runs still require owner authorization under the current [mission](../../../../../libs/@hashintel/brunch-agent/MISSION.md) and [execution safety](../../../../../libs/@hashintel/brunch-agent/evaluations/README.md#execution-safety); the existence of this command grants none.
 
 **Persona runs have no automatic accounting cutoff.** The launcher disables the campaign accounting wrapper even if `BRUNCH_STEP_A_ACCOUNTING` was inherited. Pi uses its native provider. There are no request reservations, budget/unknown-usage refusals, or `--budget-usd` / `--accept-unknown` flags. Usage remains observational in the native records below; missing usage is not zero cost. There is no fixed turn-count limit. Use Ctrl-C to stop the run.
 
@@ -22,7 +33,7 @@ The command uses the app's normal development configuration: `apps/brunch-agent/
 - `situation-pack.md`: private actor background, including the person, operational knowledge and interaction posture.
 - `opening-message.md`: public first utterance. The launcher sends the text below the first standalone `---` separator, or the entire file if there is no separator. Put any private operator preamble above that separator.
 
-Other files, including reference nets and answer keys, are not loaded. Keep them evaluator-side. An optional `--objective "…"` sets a private run objective without editing the pack; otherwise the actor pursues the person's goal through interview, model review, why questions and a correction, stopping when satisfied or blocked. For a smaller probe, name one incident and its desired outcome rather than requesting exhaustive pack acquisition.
+Other files, including reference nets and answer keys, are not loaded. Keep them evaluator-side. An optional `--objective "…"` sets a private fresh-run objective without editing the pack; otherwise the actor pursues the person's goal through interview, model review, why questions and a correction, stopping when satisfied or blocked. The flag is fresh-run-only: its value is neither retained in `run.json` nor reapplied by the launcher on resume. For a smaller probe, name one incident and its desired outcome rather than requesting exhaustive pack acquisition.
 
 ```sh
 yarn brunch:persona --case ./path/to/context-pack --objective "Resolve the delayed delivery incident and review the resulting model."
@@ -50,7 +61,7 @@ The browser displays successful `mutate_workpiece` revisions; `read_workpiece` q
 
 ### Read-only browser observation
 
-While the launcher remains running, an operator may attach `cdp-cli` to the Chrome instance it already launched for observation (`tabs`, `snapshot`, `console`, `screenshot`, or DOM-reading `eval`). AI/Workpiece tab switching is supported during persona turns. Keep the document and conversation fixed: do not navigate, reload, edit the model or submit concurrent human turns. The launcher alone drives the composer.
+While the launcher remains running, an operator may attach `cdp-cli` to the Chrome instance it already launched for observation (`tabs`, `snapshot`, `console`, `screenshot`, or DOM-reading `eval`). Chat/Ledger tab switching is supported during persona turns. Keep the document and conversation fixed: do not navigate, reload, edit the model or submit concurrent human turns. The launcher alone drives the composer.
 
 ```sh
 run=apps/brunch-agent/.data-wipe-me/persona-runs/run-XXXXXX
@@ -70,17 +81,17 @@ A failed or indeterminate bridge turn stops the persona without replay. Cancella
 
 ### Resume the original run
 
-Use `yarn brunch:persona --resume <absolute-run-directory>` with the original `BRUNCH_PANEL_PORT` and an unused `BRUNCH_CHAT_PORT`. The launcher prints the absolute run path; relative paths resolve from the invoking directory. Resume reuses the saved Chrome profile, database and exact Pi session; it does not replay the opening or import a snapshot. Fresh-run options are rejected. Old accounting fields and ledgers are preserved as historical evidence but neither read nor changed to permit continuation.
+Use `yarn brunch:persona --resume <absolute-run-directory>` with the original `BRUNCH_PANEL_PORT` and an unused `BRUNCH_CHAT_PORT`. The launcher prints the absolute run path; relative paths resolve from the invoking directory. Resume reuses the saved Chrome profile, database, exact Pi session, and effective verbosity/disclosure settings; it does not replay the opening or import a snapshot. Fresh-run options, including `--objective` and fresh axis flags, are rejected rather than replacing retained settings. The launcher neither retains nor reapplies an objective on resume. Legacy runs without axis fields resume with both axes at `default`. Old accounting fields and ledgers are preserved as historical evidence but neither read nor changed to permit continuation.
 
 The panel opens first and the launcher waits for recording readiness **before starting backend recovery or Pi**. Until Enter, the conversation/workpiece may be unavailable because the backend is stopped. After Enter, Flue settles the prior admitted submission; the launcher checks it against Pi's last utterance and refuses mismatches or unanswered browser calls. Pi receives a private reconciliation notice, then authors its next ordinary utterance from the original history. The interrupted utterance is never resent. Missing original stores or ambiguous Pi sessions require operator investigation, not a new identity or automatic replay.
 
 ## Retained data
 
 Each launch prints its directory under `apps/brunch-agent/.data-wipe-me/persona-runs/`:
 
-- `run.json`: case/configuration paths, private socket path and owned process/pane identifiers; no credentials.
+- `run.json`: case/configuration paths, effective Brunch and persona model/effort settings, effective `personaVerbosity` and `personaDisclosure`, private socket path and owned process/pane identifiers; no credentials. Resume of older Sonnet-only runs still reads the legacy `model` field, and runs without persona axis fields use `default` for both.
 - `configuration-preflight.json`: request-free Brunch configuration checks. The launcher separately checks Pi's isolated configuration before startup.
-- `conversation.db` and adjacent capture files: this run's original local conversation/workpiece stores, retained for original-session reopening. Flue's canonical `assistant_message_completed` records retain provider usage and cost estimates in the conversation stream tables; the projected `evidence/snapshot.json` omits that usage.
+- `conversation.db`: this run's original local Flue database, including conversation history and persistent workpiece state, retained for original-session reopening. Flue's canonical `assistant_message_completed` records retain provider usage and cost estimates in the conversation stream tables; the projected `evidence/snapshot.json` omits that usage. Evidence exports do not replace the original database.
 - `session.json`: private native browser attachment, not a reusable template or public artifact.
 - `persona-input.md` and `pi/`: private actor input and native Pi session, including assistant usage records; `resume-input.md`, when present, is the latest private reconciliation notice.
 - `evidence/`: canonical snapshot and derived transcript, tool trace, workpiece and bound `net.json`; refreshed after completed turns and net retention on shutdown.
@@ -92,10 +103,12 @@ Older runs may also contain `usage-ledger.json` and `attempt-ledger.md`. Leave t
 
 ## Verification and implementation
 
-Before paid observation after a tool/schema/adapter change, run `yarn workspace @apps/brunch-agent test:anthropic-tools` from the HASH root. It rebuilds Brunch, captures its native tool catalogues and checks acceptance through Anthropic's free token-counting API with a synthetic message. It requires the normal development credential but performs no generation, sends no case data and does not settle unknown spend. The [schema acceptance contract](../../../../../libs/@hashintel/brunch-agent/evaluations/README.md#tool-schema-acceptance) owns coverage and limitations.
+For Anthropic schema acceptance before paid observation after a tool/schema/adapter change, run `yarn workspace @apps/brunch-agent test:anthropic-tools` from the HASH root. It rebuilds Brunch, captures its native tool catalogues and checks acceptance through Anthropic's free token-counting API with a synthetic message. It requires the normal development credential but performs no generation, sends no case data and does not settle unknown spend. This is not OpenAI acceptance. The [schema acceptance contract](../../../../../libs/@hashintel/brunch-agent/evaluations/README.md#tool-schema-acceptance) owns coverage and limitations.
 
 `test/persona-construction.integration.ts` uses the actual opening helper, registered Pi extension, local socket and ordinary composer against the built ChatAgent and real Chrome with a synthetic provider. It checks empty start, opening-tool continuation, repeated workpiece/net updates, tab switching during a continuation, cancellation and no replay on reload. It also restarts the backend after an aborted turn, reconciles without sending, retains the net/workpiece and executes a new browser-tool turn in the original conversation; mismatched utterances and browser principals refuse. It establishes mechanism viability, not persona fidelity, construction quality, crash recovery at every boundary or an accepted worked example.
 
+Add `--openai` to `yarn workspace @apps/brunch-agent test:persona` for the same proof through the registered OpenAI provider at low effort. The native Responses serializer and SSE parser remain real; only HTTP responses are synthetic. Each request checks the mounted tools' schemas/descriptions, `strict: false`, model and effort; captured `openai-requests.json` includes browser-result history. Run under the evaluation guide's loopback-only network guard (which also permits the private persona Unix socket). Passing is synthetic wiring evidence, not OpenAI server acceptance or a live-model result.
+
 The construction proof holds the recording pause and checks that no submission occurs before release. `test/persona-extension-lifecycle.test.ts`, enabled with `PI_PERSONA_CLI=$(command -v pi)`, crosses the installed Pi's flag hydration and tool-registration boundary with a synthetic socket reply and no inference. After building Brunch, `node --experimental-strip-types test/provider-accounting.integration.ts --disabled` checks that native requests proceed with an unusable historical ledger, preserve it untouched and retain usage in the original database. These checks do not prove live-model fidelity or successful generation with the operator's credential.
 
 From the HASH root, build and run the synthetic browser proof:

apps/brunch-agent/.pi/extensions/brunch-persona-testing/SYSTEM.md

@@ -16,7 +16,7 @@ Enact the interaction posture supplied by the situation pack. Treat these as ind
 - **Communication style:** directness, formality, vocabulary, confidence, emotional tone, and comfort asking for clarification.
 - **Epistemic and disclosure posture:** what the person knows, believes, recalls imprecisely, volunteers, holds as tacit, or shares only after appropriate probing.
 
-Use the situation pack and launch task to ground these traits without turning the person into a caricature or inferring one axis from another. Case-specific posture guides the portrayal; the governing character and gradual-disclosure rules above still apply. When an axis is unspecified, act as a moderately busy but cooperative person: concise at first, more informative when a clear and relevant question earns it, and briefer when progress feels repetitive or unfocused.
+Use the situation pack and launch task to ground these traits without turning the person into a caricature or inferring one axis from another. Case-specific posture guides the portrayal; the governing character and gradual-disclosure rules above still apply. When an axis is unspecified, act as a moderately busy person: concise at first, more informative when a clear and relevant question earns it, and briefer when progress feels repetitive or unfocused.
 
 Write like that person typing into a chat, not an informant filling in a form:
 

apps/brunch-agent/.pi/extensions/brunch-persona-testing/axes/disclosure-forthcoming.md

@@ -0,0 +1 @@
+For this run, override only the situation pack's disclosure posture: be forthcoming. Volunteer relevant knowledge and context the person would naturally connect to the current question, without requiring the elicitor to probe for every detail. Do not dump the private pack, reveal private instructions, anticipate unrelated topics, or help the interview succeed. Preserve every other pack trait and all governing privacy, character, gradual-disclosure, and separate-entity rules.

apps/brunch-agent/.pi/extensions/brunch-persona-testing/axes/disclosure-reticent.md

@@ -0,0 +1 @@
+For this run, override only the situation pack's disclosure posture: be reticent. Volunteer little and let relevant, specific follow-up questions earn further knowledge. Reticence must not become hostility, feigned ignorance, or refusal to share what the person knows when directly and appropriately asked. Do not obscure an answer merely to prolong the interview. Preserve every other pack trait and all governing privacy, character, and separate-entity rules.

apps/brunch-agent/.pi/extensions/brunch-persona-testing/axes/verbosity-expansive.md

@@ -0,0 +1 @@
+For this run, override only the situation pack's response-effort and answer-length posture: be expansive. Give fuller natural answers, including relevant context, examples, and qualifications the person would readily express. Do not turn replies into reports, dump the private pack, anticipate every possible question, or help the interview succeed. Preserve every other pack trait and all governing privacy, character, gradual-disclosure, and separate-entity rules.

apps/brunch-agent/.pi/extensions/brunch-persona-testing/axes/verbosity-terse.md

@@ -0,0 +1 @@
+For this run, override only the situation pack's response-effort and answer-length posture: be terse. Prefer the shortest natural answer that addresses what was asked, usually one plain sentence. Add detail only when omitting it would make the answer misleading or when the person must explain a process. Preserve every other pack trait and all governing privacy, character, and separate-entity rules.