Retain Policy-based graph drafts independently of chats

[kikashy]

Start ordinary graph authoring from an exact retained Policy revision or publication, through the manual page or a reviewed chat handoff. The request stays unsent and uses the existing execution/context/Plan/Ask me controls.

Graph drafts and their private Policy sources now survive deletion of the originating chat, refresh and reopening from Library. Draft identity includes its originating chat; saved-source matching uses exact graph bytes. Reviewed saves retain an immutable pending candidate before dispatch and reconcile uncertain private finalization without repeating a public graph write. Helper conversations are acknowledged before navigation. Folder placement follows the scoped draft identity and handles ambiguous legacy assignments without assigning them to multiple drafts.

Validation: focused Go custody/migration/auth/CAS and graph confirmation checks, focused Web/context/Plan/recovery checks, TypeScript, localization and production build. Isolated browser and restart checks pass, including against the combined implementation; exact build/review evidence is recorded in the PR comments. Full CI runs on the PR.

Policy sources are private authoring provenance, not governing adoption, complete coverage or Graph Job authority. New private fields and scoped folder data require the current Desk build; older strict builds may refuse them rather than silently discard history. New UI messages use English fallback in the other locales.

Closes #468. Part of #455.

[kikashy]

Reviewed combined head: 19ee1b1efe16f9f2508e0bf213a56d73affddd74, containing Graph 4fe0e1b and lifecycle 4d60cbb.

Codex review completed for graph custody, source identity, write ordering/recovery, folder/helper ownership and the PolicyPage integration. This is same-vendor review, not a different-vendor attestation.

Resolved findings include: acknowledge helper chat checkpoints before public dispatch/navigation; preserve an immutable pending save candidate and reconcile history without a second public write; scope folder and helper identity to originating chat plus draft ID; distinguish a bare saved-graph workspace from a legacy draft workspace; retain ambiguous legacy placements without assigning both drafts and remove aliases only when every owner is explicitly deleted. Folder v3 is explicit; v1/v2 remain readable. Existing explicit saved-graph placement wins.

Validation: relevant native Go custody/migration/auth/CAS/restore and graph-write checks, 72 focused Web tests plus the final projection regression, and 38 overlap tests after integrating lifecycle. TypeScript, production build and localization checks passed. The only merge conflict was PolicyPage; both interpretation actions, Lifecycle and pending-operation guards remain.

The single combined binary (81e835325013fa758ff23c0e129b0a80b731f4dbe5ae6aab2b8b1032ca91a4f7) carries exact head 19ee1b1 and vcs.modified=false. Both independent isolated browser journeys and process-restart checks pass against it:

• Graph: exact old publication, unsent ordinary chat, originating chat deletion, independent Library reopening, real reviewed save, retained helper/source identity, distinct folder placements for equal draft IDs, exact v3 file roundtrip and unchanged second origin.
• Policy lifecycle: real scheduled effectiveness/expiry, supersession, exact-release withdrawals, lost committed reply/reload with one mutation, and historical unsent Pack handoff.
• Both: actual visible narrow main content/dialogs, revoked-session refusals, persistence after restart, zero model/provider requests and zero browser errors.

Original and combined evidence remain under /tmp/jps-policy-graph-authoring-smoke, /tmp/jps-policy-combined-smoke and /tmp/jps-policy-lifecycle-integrated-smoke. Superseded pre-integration CI was canceled deliberately; current full checks run against the combined head.

No live Desk activation, portable Policy adoption or execution-admission enforcement is claimed. Spec PR212 remains Draft. Private format/downgrade and English locale-fallback limits are documented.

[kikashy]

Delta review: 19ee1b1 → 99dae1e1d0ed6fbb29418a70597f9c266ccd8084 changes only three test fixtures (10 additions, 3 removals). No production source changed.

The Plan test now requires exactly one GET of the private graph draft store before the user's action; runtime/model/write dispatch remains forbidden. Library fixtures provide the unrelated empty private record so existing service-failure/retained-row/retry assertions still run unchanged. The delete-dialog fixture supplies the same QueryClient provider used by the app; its failed-save retention assertions remain intact. All 42 affected tests and TypeScript pass. Same-vendor review found no remaining issue in this delta.

#470 is merged as 36c950d; this PR is now correctly based on integration/v0.13. Git's merge-tree check confirms merging that base with this head produces exactly this head's tree. The prior combined product binary/browser evidence remains applicable; it is not relabeled as a build of the test-only commit. Fresh full CI is running on this head.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation