FE-1793: Scope destructive model-edit approval to one conversation

[kostandinang]

🌟 What is the purpose of this PR?

Require approval before Brunch performs destructive model edits, and provide a fresh-conversation action that resets this authority without deleting the model or saved history.

🔗 Related links

• FE-1793 (internal)
• Conversation presentation #9829
• Experiment lifecycle #9857

🚫 Blocked by

• Conversation presentation #9829, branch ka/fe-1793-conversation-ui.

Stack: main → #9829 → this PR → #9857 → #9836. Voice steering #9826 is independent. This layer includes the consent, floating-minimize and Voice recovery fixes from presentation.

🔍 What does this change?

• Keep the approval coordinator, widget, host mutation executor, input-selective interactive-tool registry, tests and documentation in one review.
• Offer Allow, Always allow and Deny. Deny withholds that call and tells Brunch nothing changed; later calls in the same response wait for the decision, then run.
• Scope Always allow to the current mounted conversation, until leaving/reloading. Stop cancels pending approval; historical rendering cannot grant authority. Revalidate the model after a delayed decision.
• Let ordinary Brunch start a fresh persisted conversation while preserving the model and old history. Reset approval authority. Prepared fixtures may still disallow clearing.
• Do not add experiment follow-up or change stock auto-layout approval behavior. No petrinaut-core changes.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

• Adds a patch changeset for @hashintel/petrinaut's input-selective interactive-tool API.

📜 Does this require a change to the docs?

• Approval scope and fresh-conversation behavior are documented in the assistant guide.

🕸️ Does this require a change to the Turbo Graph?

• No execution-graph changes.

⚠️ Known issues

• See the current PR checks for CI on the main-based head. Earlier website and Playwright integration runs failed before tests because Docker could not pull the MinIO images (unauthorized: access to the requested resource is not authorized); this is not a result for the current head.
• No real provider or microphone tests were run. Permission UI and host mutation execution use deterministic local tests.

🐾 Next steps

Review as a complete permission feature. Experiment lifecycle follows but does not supply approval authority. The history-fixture fix is retained.

🛡 What tests cover this?

• Main-based permissions tree: all 18 Turborepo build, type-check and lint tasks passed. Both complete unit suites passed separately.
• Petrinaut: 173 files / 1,515 tests passed. Website: 63 files / 892 tests passed.
• Approval widget, ephemeral authority, cancellation, destructive-batch execution, model revalidation, registry selection and fresh-conversation persistence are covered by existing tests retained with this layer.
• Before the main-based separation, the actual approval widget was rendered in a standalone local browser preview. Desktop and 390px screenshots were inspected; scope text and all three actions fit without clipping or horizontal overflow. Deny and Always allow returned the expected decisions without submitting a tool result. The rendered component sources remain unchanged; this was not a new browser run on the current head.
• Formatting and git diff --check passed.

❓ How to test this?

1. Run turbo run build test:unit lint:tsc lint:eslint --filter @hashintel/petrinaut --filter @apps/petrinaut-website.
2. Run the brunch-mutation-approval, brunch-petrinaut-tools, registry and local-storage-demo-app test files.
3. Check that destructive edits wait for a decision, Deny withholds only that call, and Always allow does not survive a new conversation or reload.
4. Check that Clear AI chat starts a new conversation without replacing the model or claiming to delete old history.

📹 Demo

Controlled fixture using the production approval widget; no model is invoked and no mutation is executed.

Approval interaction

pr-9856-approval-interaction.mp4

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Sep 30, 2026 8:17pm UTC
petrinaut	Ready	Preview	Sep 30, 2026 8:17pm UTC
petrinaut-docs	Ready	Preview	Sep 30, 2026 8:17pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Sep 30, 2026 8:17pm UTC

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[lunelson]

Thanks — all threads addressed. Per-call Deny is fine as documented.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6334ad6. Configure here.}