Janady13/missionmatch / internal/modules/ai/planner.go

1package ai 2 3// THE PLANNER. This file generalizes the G6 loop (the one hardcoded fan out over four fixed intents in 4// graph_loop.go) into a data driven planner that answers a COMPOUND cross plane question by SELECTING and 5// running a set of EXISTING closed Registry intents and composing their evidence behind the faithfulness 6// gate. It is the biggest unlock on the ANI roadmap: it turns the single shot keyword router (which drops 7// every compound capture question to RAG narration) into a true multi step reasoner, while the model 8// authors ZERO SQL and ZERO param values. 9// 10// Why this is safe by construction. The model NEVER authors SQL and NEVER supplies a param value. It 11// selects from a CLOSED enum of intent names; the validator asserts every name is in Registry and drops 12// anything else. Every param value comes from the same deterministic extractors graphClassify already uses 13// (bareNAICS, quotedAgency, quotedUUID, heldClearanceCode, quotedUEI, windowMonths, quotedCompartmentList), 14// so the read only guard, the EEO and protected attribute guards, bench suppression, RLS RunInTenantTx, and 15// the frozen engine boundary all apply UNCHANGED on every node (each node runs its existing guarded path). 16// A bench node runs only through the suppressing executor (runBenchIntent), never the raw ExecuteIntent 17// path (which already hard rejects bench intents). The G6 capture composition runs through 18// answerCapturePicture. Every other graph or TAG intent runs through ExecuteIntent. The planner adds NO new 19// query and NO new SQL. Hard caps (maxPlanNodes, no recursion) bound the work; the surviving node set runs 20// in a deterministic order (Registry order, then name) so the composed answer is byte stable. Self 21// consistency samples the plan K times and runs only the stable intent set. The plan trace audit carries 22// only names, kinds, counts, and verdicts, never a value and never PII. 23// 24// Iteration 1 (this file) is planned SELECTION with deterministic binding. Data dependency edges (one 25// node's scalar output binding a downstream node's arg) are a documented iteration 2, explicitly out of 26// scope here so the first planner is maximally safe. 27 28import ( 29 "context" 30 "encoding/json" 31 "sort" 32 "strings" 33 34 "github.com/missionworkforce/missionmatch/internal/platform/inference" 35 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 36) 37 38// PlanNode is one selected intent in a plan: a name that MUST be in the closed Registry, plus the args the 39// validator bound for it from the available params. The model supplies only the Intent name; Args are bound 40// deterministically by the orchestrator, never by the model. 41type PlanNode struct { 42 Intent string 43 Args []any 44} 45 46// Plan is the validated, bounded set of intents to run for one compound question. It carries no SQL and no 47// model authored value; every Intent is a Registry name and every Arg came from a deterministic extractor. 48type Plan struct { 49 Nodes []PlanNode 50} 51 52// maxPlanNodes is the hard cap on how many intents one plan may run. It bounds the work the same way a 53// recursive CTE's depth cap bounds its walk; there is no recursion in the planner. 54const maxPlanNodes = 6 55 56// planSelfConsistencyK is the number of times the plan is sampled before only the stable (majority) intent 57// set runs. It mirrors the low temperature the faithfulness gate already uses, three samples. 58const planSelfConsistencyK = 3 59 60// availableParams is the typed bag of what the question unambiguously carries, extracted by the same 61// deterministic extractors graphClassify uses. The model supplies none of these; every value here came 62// from a regex over the original question. A node binds only from this bag, so the model can never inject a 63// param value. 64type availableParams struct { 65 Agency string 66 AgencyOK bool 67 NAICS string 68 NAICSOK bool 69 UUID string 70 UUIDOK bool 71 HeldClearance string 72 HeldOK bool 73 UEI string 74 UEIOK bool 75 WindowMonths int 76 Compartments string 77 CompartmentsOK bool 78} 79 80// extractAvailableParams runs the existing deterministic extractors and returns the typed bag of what the 81// question unambiguously carries. It is pure, deterministic, and touches no database. Every value comes from 82// a regex over the question text, never from the model. WindowMonths defaults to zero so an intent that 83// takes a window applies its own clamp when the question states no months. 84func extractAvailableParams(question string) availableParams { 85 lower := strings.ToLower(question) 86 var a availableParams 87 if agency, ok := quotedAgency(question); ok { 88 a.Agency, a.AgencyOK = agency, true 89 } 90 if naics, ok := bareNAICS(question); ok { 91 a.NAICS, a.NAICSOK = naics, true 92 } 93 if id, ok := quotedUUID(question); ok { 94 a.UUID, a.UUIDOK = id, true 95 } 96 if code, ok := heldClearanceCode(lower); ok { 97 a.HeldClearance, a.HeldOK = code, true 98 } 99 if uei, ok := quotedUEI(question); ok { 100 a.UEI, a.UEIOK = uei, true 101 } 102 a.WindowMonths = windowMonths(question) 103 if list, ok := quotedCompartmentList(question); ok { 104 a.Compartments, a.CompartmentsOK = list, true 105 } 106 return a 107} 108 109// paramSource names the available bag field a Registry param binds from. It is the FIXED lookup table keyed 110// on the EXACT param names the Registry uses (read from tag.go and graph_*.go), so a param binds by its 111// declared name, never by a guess. A param name not in this table never binds, which means its intent is 112// simply never selectable by the planner, the safe default. 113type paramSource string 114 115const ( 116 srcUUID paramSource = "uuid" // a ParamUUID id binds from avail.UUID 117 srcAgency paramSource = "agency" // an agency or agency_prefix ParamText binds from avail.Agency 118 srcNAICS paramSource = "naics" // a naics ParamText binds from avail.NAICS 119 srcHeldClearance paramSource = "held" // a clearance ParamEnum binds from avail.HeldClearance 120 srcUEI paramSource = "uei" // a partner_uei ParamText binds from avail.UEI 121 srcCompartments paramSource = "compartments" // a compartment list ParamText binds from avail.Compartments 122 srcWindowMonths paramSource = "window_months" // a window ParamInt binds from avail.WindowMonths 123 srcClampZero paramSource = "clamp_zero" // a bounded ParamInt the question never states binds zero, the intent's own clamp 124) 125 126// paramBindings maps every Registry param NAME to the available bag field it binds from. The keys are the 127// EXACT names declared in the Registry. A required param whose name is absent here cannot bind, so its 128// intent drops, which is safe (the planner simply never selects an intent it cannot bind honestly). The 129// window and clamp sources differ: a window_months reads the stated window (zero applies the intent clamp), 130// while max_depth and lookback_years always bind zero so the intent applies its own clamp and the planner 131// never invents a recursion depth or a lookback the user did not state. 132var paramBindings = map[string]paramSource{ 133 // UUID id params across the planes. 134 "requirement_id": srcUUID, 135 "slate_id": srcUUID, 136 "start_skill_id": srcUUID, 137 "required_skill_id": srcUUID, 138 "opportunity_id": srcUUID, 139 "skill_id": srcUUID, 140 // Agency text params (the buyer key the market and TAG reads use). 141 "agency": srcAgency, 142 "agency_prefix": srcAgency, 143 "customer_agency": srcAgency, 144 // NAICS text param. 145 "naics": srcNAICS, 146 // Clearance enum params (both bind the held clearance code; the executor re checks each declared allowed 147 // set, so a value out of one intent's vocabulary is rejected at execution, not bound blindly). 148 "held_code": srcHeldClearance, 149 "clearance_level": srcHeldClearance, 150 // Partner UEI text param. 151 "partner_uei": srcUEI, 152 // Compartment list text param. 153 "required_compartments": srcCompartments, 154 // Window and clamp integer params. 155 "window_months": srcWindowMonths, 156 "max_depth": srcClampZero, 157 "lookback_years": srcClampZero, 158} 159 160// bindIntentArgs supplies, for each of the intent's Params in order, the matching available value by the 161// param NAME through the fixed paramBindings table. It returns (args, true) ONLY when every required param 162// is available, else (nil, false) so the node is dropped. The model supplies no value here: each arg comes 163// from the available bag (a deterministic extractor) or, for a bounded integer the question never states, 164// the intent's own clamp (zero). An intent with no params binds an empty arg list and always succeeds. 165func bindIntentArgs(intent QueryIntent, avail availableParams) ([]any, bool) { 166 if len(intent.Params) == 0 { 167 return nil, true 168 } 169 args := make([]any, 0, len(intent.Params)) 170 for _, p := range intent.Params { 171 src, known := paramBindings[p.Name] 172 if !known { 173 return nil, false // an unmapped param name can never bind: the intent drops, the safe default 174 } 175 switch src { 176 case srcUUID: 177 if !avail.UUIDOK { 178 return nil, false 179 } 180 args = append(args, avail.UUID) 181 case srcAgency: 182 if !avail.AgencyOK { 183 return nil, false 184 } 185 args = append(args, avail.Agency) 186 case srcNAICS: 187 if !avail.NAICSOK { 188 return nil, false 189 } 190 args = append(args, avail.NAICS) 191 case srcHeldClearance: 192 if !avail.HeldOK { 193 return nil, false 194 } 195 args = append(args, avail.HeldClearance) 196 case srcUEI: 197 if !avail.UEIOK { 198 return nil, false 199 } 200 args = append(args, avail.UEI) 201 case srcCompartments: 202 if !avail.CompartmentsOK { 203 return nil, false 204 } 205 args = append(args, avail.Compartments) 206 case srcWindowMonths: 207 // A stated window binds; an unstated window binds zero so the intent applies its own clamp. Either 208 // way the value is the deterministic extractor's, never the model's. 209 args = append(args, avail.WindowMonths) 210 case srcClampZero: 211 // A bounded recursion depth or lookback the question never states binds zero, the intent's own 212 // clamp, so the planner never invents a depth or a lookback. 213 args = append(args, 0) 214 default: 215 return nil, false 216 } 217 } 218 return args, true 219} 220 221// proposePlan asks the inference plane to SELECT the relevant intent names for a compound question. The 222// prompt lists every Registry intent NAME with its one line Description and required param names, states 223// which params are AVAILABLE for this question, and instructs the model to return ONLY a JSON array of 224// intent names from that list, at most maxPlanNodes, no prose, no SQL, no new names. It parses the JSON 225// array and DISCARDS any element that is not an exact IntentByName hit (the closed enum check). On any plane 226// error or unparseable output it returns an EMPTY selection (the caller falls back to RAG), never a guess. 227// With a nil client (the no plane posture) it returns empty so the planner degrades to RAG. 228func (o *Orchestrator) proposePlan(ctx context.Context, question string, avail availableParams) ([]string, error) { 229 if o.client == nil { 230 return nil, nil // no plane: the planner degrades to RAG, never a guess 231 } 232 system := "You are a query PLANNER for a cleared workforce intelligence platform. You select which of a " + 233 "FIXED set of named, read only intents to run to answer a compound question. You author NO SQL and " + 234 "supply NO parameter values: you return ONLY intent names from the list below, the ones that are both " + 235 "relevant to the question AND bindable from the AVAILABLE parameters. Return a JSON array of intent " + 236 "name strings, at most " + itoa(maxPlanNodes) + ", no prose, no SQL, no names that are not in the list. " + 237 "If no intent is relevant and bindable, return an empty array." 238 prompt := "AVAILABLE PARAMETERS: " + describeAvail(avail) + "\n\nINTENTS:\n" + registryCatalog() + 239 "\n\nQUESTION: " + question + "\n\nReturn ONLY the JSON array of intent names." 240 out, err := o.client.Generate(ctx, inference.GenerateRequest{System: system, Prompt: prompt, MaxTokens: 200, Temperature: 0.1}) 241 if err != nil { 242 return nil, nil // a plane error returns an empty selection so the caller falls back to RAG, never a guess 243 } 244 names := parseIntentNames(out.Text) 245 // The closed enum check: keep only names that are an exact registered intent, cap at maxPlanNodes. The 246 // model can never introduce an intent the platform did not author. 247 kept := make([]string, 0, len(names)) 248 seen := map[string]bool{} 249 for _, n := range names { 250 n = strings.TrimSpace(n) 251 if n == "" || seen[n] { 252 continue 253 } 254 if _, ok := IntentByName(n); !ok { 255 continue // not a Registry name: dropped (the closed enum check) 256 } 257 seen[n] = true 258 kept = append(kept, n) 259 if len(kept) >= maxPlanNodes { 260 break 261 } 262 } 263 return kept, nil 264} 265 266// validatePlan turns a proposed name list into a bounded, ordered, fully bound Plan. For each registered 267// name (in deterministic Registry order, then name) it looks up the intent, binds its args, and keeps the 268// node ONLY if it binds. A name not in the Registry, or one whose required params are not available, never 269// reaches the runner. The result is byte stable on a re run: the same proposed set yields the same ordered 270// Plan. 271func validatePlan(names []string, avail availableParams) Plan { 272 want := map[string]bool{} 273 for _, n := range names { 274 want[n] = true 275 } 276 var nodes []PlanNode 277 // Walk the Registry in its declared order so the surviving set is deterministically ordered, then sort 278 // the survivors by name as the documented tiebreaker (Registry order is already total, so the name sort is 279 // a stable, explicit secondary key the plan can be reasoned about by). 280 for _, intent := range Registry { 281 if !want[intent.Name] { 282 continue 283 } 284 args, ok := bindIntentArgs(intent, avail) 285 if !ok { 286 continue // unbindable: dropped, never reaches the runner 287 } 288 nodes = append(nodes, PlanNode{Intent: intent.Name, Args: args}) 289 if len(nodes) >= maxPlanNodes { 290 break 291 } 292 } 293 sort.SliceStable(nodes, func(i, j int) bool { return nodes[i].Intent < nodes[j].Intent }) 294 return Plan{Nodes: nodes} 295} 296 297// proposeFn is the proposer signature, injected so the unit tests can drive self consistency with a stub and 298// no live plane. proposeStablePlan calls it k times. 299type proposeFn func(ctx context.Context, question string, avail availableParams) ([]string, error) 300 301// proposeStablePlan samples the plan k times and runs only the STABLE intent set: the nodes that appear in a 302// MAJORITY of the k validated plans, in the deterministic order. If the plans disagree entirely (no majority 303// node), it returns an empty plan so the caller falls back to the deterministic single intent or RAG path. 304// The proposer is injected so the tests drive it with a stub and no live plane. 305func proposeStablePlan(ctx context.Context, question string, avail availableParams, k int, propose proposeFn) Plan { 306 if k < 1 { 307 k = 1 308 } 309 counts := map[string]int{} 310 for i := 0; i < k; i++ { 311 names, err := propose(ctx, question, avail) 312 if err != nil { 313 continue 314 } 315 plan := validatePlan(names, avail) 316 // Count each node once per validated plan (the plan already deduplicates names). 317 for _, node := range plan.Nodes { 318 counts[node.Intent]++ 319 } 320 } 321 majority := (k / 2) + 1 322 stable := make([]string, 0, len(counts)) 323 for name, c := range counts { 324 if c >= majority { 325 stable = append(stable, name) 326 } 327 } 328 if len(stable) == 0 { 329 return Plan{} // no majority node: fall back to the deterministic single intent or RAG path 330 } 331 return validatePlan(stable, avail) 332} 333 334// describeAvail renders the available parameter KINDS (never the values) for the proposer prompt and is also 335// the shape the audit records. It tells the model which slots can bind without ever revealing a value (a 336// requirement id, an agency name, a UEI), so a value can never leak into the prompt or the audit. 337func describeAvail(avail availableParams) string { 338 kinds := availableKinds(avail) 339 if len(kinds) == 0 { 340 return "none" 341 } 342 return strings.Join(kinds, ", ") 343} 344 345// availableKinds returns the sorted list of param KIND names the question carries (never the values). It is 346// the proposer prompt's available list and the audit's available_kinds field; it holds no value and no PII. 347func availableKinds(avail availableParams) []string { 348 var kinds []string 349 if avail.UUIDOK { 350 kinds = append(kinds, "uuid") 351 } 352 if avail.AgencyOK { 353 kinds = append(kinds, "agency") 354 } 355 if avail.NAICSOK { 356 kinds = append(kinds, "naics") 357 } 358 if avail.HeldOK { 359 kinds = append(kinds, "held_clearance") 360 } 361 if avail.UEIOK { 362 kinds = append(kinds, "uei") 363 } 364 if avail.CompartmentsOK { 365 kinds = append(kinds, "compartments") 366 } 367 if avail.WindowMonths > 0 { 368 kinds = append(kinds, "window_months") 369 } 370 sort.Strings(kinds) 371 return kinds 372} 373 374// registryCatalog lists every Registry intent NAME, its one line Description, and its required param names 375// for the proposer prompt, in Registry order. The model sees only names, descriptions, and param names, the 376// closed menu it selects from; it never sees SQL. 377func registryCatalog() string { 378 var b strings.Builder 379 for _, it := range Registry { 380 b.WriteString("- ") 381 b.WriteString(it.Name) 382 if len(it.Params) > 0 { 383 names := make([]string, len(it.Params)) 384 for i, p := range it.Params { 385 names[i] = p.Name 386 } 387 b.WriteString(" (params: ") 388 b.WriteString(strings.Join(names, ", ")) 389 b.WriteString(")") 390 } else { 391 b.WriteString(" (no params)") 392 } 393 b.WriteString(": ") 394 b.WriteString(it.Description) 395 b.WriteString("\n") 396 } 397 return b.String() 398} 399 400// parseIntentNames parses the model's output into a list of candidate intent names. It accepts a bare JSON 401// array of strings (the instructed shape) and tolerates surrounding prose by extracting the first bracketed 402// array. On any parse failure it returns nil, so proposePlan returns an empty selection and the caller falls 403// back to RAG. 404func parseIntentNames(text string) []string { 405 text = strings.TrimSpace(text) 406 start := strings.IndexByte(text, '[') 407 end := strings.LastIndexByte(text, ']') 408 if start < 0 || end < 0 || end <= start { 409 return nil 410 } 411 var names []string 412 if err := json.Unmarshal([]byte(text[start:end+1]), &names); err != nil { 413 return nil 414 } 415 return names 416} 417 418// itoa is a tiny no dependency integer to string for the prompt; strconv would do but this keeps the prompt 419// builder self contained and avoids an import for one cap value. 420func itoa(n int) string { 421 if n == 0 { 422 return "0" 423 } 424 neg := n < 0 425 if neg { 426 n = -n 427 } 428 var buf [20]byte 429 i := len(buf) 430 for n > 0 { 431 i-- 432 buf[i] = byte('0' + n%10) 433 n /= 10 434 } 435 if neg { 436 i-- 437 buf[i] = '-' 438 } 439 return string(buf[i:]) 440} 441 442// runPlan executes each surviving node through its CORRECT existing path, collects the union of rendered 443// evidence, and returns the union, the suppressed cell count across bench nodes, and the ordered names that 444// actually ran. A bench intent runs through the suppressing executor (runBenchIntent) rendered with 445// RenderCount, so a suppressed cell is the sentinel and never a raw sub k number; the G6 capture composition 446// runs through answerCapturePicture; every other graph or TAG intent runs through ExecuteIntent rendered 447// with renderTable. A node that errors is dropped from the union with a logged note (the plan degrades, 448// never hangs). The planner adds no new query: every node is an existing guarded path. 449func (o *Orchestrator) runPlan(ctx context.Context, plan Plan) (evidence []string, suppressed int, ran []string, err error) { 450 k := ConfiguredSuppressionThreshold() 451 for _, node := range plan.Nodes { 452 switch { 453 case node.Intent == IntentCapturePictureForRequirement: 454 // The G6 capture composition is itself a person touching bench intent and already composed. Run it 455 // through its existing path and fold its deterministic answer into the union as one evidence line. 456 id, idErr := benchIDArg(node.Args) 457 if idErr != nil { 458 continue // a malformed id drops the node, the plan degrades 459 } 460 resp, cErr := o.answerCapturePicture(ctx, id) 461 if cErr != nil || resp == nil || resp.Refused { 462 continue 463 } 464 evidence = append(evidence, "capture_picture_for_requirement: "+resp.Answer) 465 ran = append(ran, node.Intent) 466 case IsBenchIntent(node.Intent): 467 // A bench intent runs through the suppressing executor. The bench plane reads RLS protected person 468 // data, so it REQUIRES a resolved authenticated tenant context (the same gate answerBench enforces); 469 // without one the node drops rather than relying only on the RLS empty result fail safe. Every cell 470 // renders through RenderCount, so a suppressed cell is the sentinel and no sub k number reaches the 471 // union. 472 if !guardTenantForBench(ctx) { 473 continue 474 } 475 labels, cells, bErr := o.runBenchIntent(ctx, node.Intent, node.Args, k) 476 if bErr != nil { 477 continue // the node drops, the plan degrades, never hangs 478 } 479 columns := []string{"bucket", "headcount"} 480 rows := make([][]any, len(cells)) 481 for i, c := range cells { 482 if c.Suppressed { 483 suppressed++ 484 } 485 rows[i] = []any{labels[i], RenderCount(c)} 486 } 487 evidence = append(evidence, node.Intent+": "+renderTable(node.Intent, columns, rows)) 488 ran = append(ran, node.Intent) 489 default: 490 // Every other graph or TAG intent runs through ExecuteIntent (re guarded, RLS scoped) and renders 491 // with the existing deterministic table rendering. 492 intent, ok := IntentByName(node.Intent) 493 if !ok { 494 continue 495 } 496 res, eErr := ExecuteIntent(ctx, o.db, intent, node.Args) 497 if eErr != nil { 498 continue // the node drops, the plan degrades, never hangs 499 } 500 evidence = append(evidence, node.Intent+": "+renderTable(intent.Description, res.Columns, res.Rows)) 501 ran = append(ran, node.Intent) 502 } 503 } 504 return evidence, suppressed, ran, nil 505} 506 507// AnswerPlan answers a COMPOUND cross plane question by planning over the closed Registry. It runs the EEO 508// and protected attribute guards FIRST (refuse on either), extracts the available params, gets the stable 509// plan (sampled planSelfConsistencyK times, only the majority intent set), and falls back to AnswerRAG 510// unchanged when the plan is empty (so a non compound or unbindable question is byte for byte unchanged). 511// Otherwise it runs the plan, narrates ONE answer over the union of node evidence through o.generate (state 512// only what the union supports, report a suppressed bench count as withheld and never guess a number for it, 513// never compute a match score), and o.finalize behind the faithfulness gate. It emits the counts only 514// aedt.ai.plan_answered audit: the ordered ran intent NAMES, the available param KINDS (never values), the 515// node count, the suppressed count, the faithfulness verdict, and the self consistency outcome. The audit 516// carries NO param value, NO candidate id, NO raw count, NO requirement id, NO answer text, and NO question. 517func (o *Orchestrator) AnswerPlan(ctx context.Context, question string) (*Response, error) { 518 if ForbidEEO(question) != nil || MentionsProtectedAttribute(question) { 519 return o.refuse(ctx, RoutePlan, "the question references prohibited demographic data"), nil 520 } 521 avail := extractAvailableParams(question) 522 plan := proposeStablePlan(ctx, question, avail, planSelfConsistencyK, o.proposePlan) 523 consistency := "stable" 524 if len(plan.Nodes) == 0 { 525 // No stable plan: a non compound or unbindable question is unchanged, it falls back to RAG. 526 return o.AnswerRAG(ctx, question, 8) 527 } 528 evidence, suppressed, ran, err := o.runPlan(ctx, plan) 529 if err != nil { 530 return nil, err 531 } 532 if len(evidence) == 0 { 533 // Every node dropped (errors or empty results): degrade to RAG rather than narrate over nothing. 534 return o.AnswerRAG(ctx, question, 8) 535 } 536 deterministic := renderPlanUnion(ran, evidence) 537 model, genErr := o.generate(ctx, 538 "State ONE integrated answer using ONLY the listed evidence lines as evidence, one line per intent that ran. "+ 539 "State only what the union of the evidence supports. A headcount shown as "+SuppressionSentinel+" was "+ 540 "withheld to protect individuals: say it was withheld and NEVER guess or state a number for it. Never "+ 541 "compute a match score and never assign a band. Do not invent an agency, a UEI, a dollar figure, a "+ 542 "recompete, or a count the evidence does not contain.", 543 "QUESTION: "+question+"\n\nEVIDENCE:\n"+strings.Join(evidence, "\n")) 544 resp := o.finalize(ctx, RoutePlan, model, genErr, deterministic, evidence) 545 // Counts only plan trace audit: the ordered ran names (the closed set, not PII), the available param KINDS 546 // (not values), the node count, the suppressed cell count, the faithfulness verdict, and the self 547 // consistency outcome. NO param value, NO candidate id, NO raw count, NO requirement id, NO answer text, 548 // NO question. 549 o.audit(ctx, "aedt.ai.plan_answered", map[string]any{ 550 "route": RoutePlan, 551 "intents": ran, 552 "available_kinds": availableKinds(avail), 553 "nodes": len(plan.Nodes), 554 "suppressed": suppressed, 555 "faithful": resp.Faithful, 556 "rationale_source": resp.RationaleSource, 557 "self_consistency": consistency, 558 }) 559 return resp, nil 560} 561 562// renderPlanUnion builds the deterministic union answer the planner ships when the model prose is withheld: 563// one line per intent that ran, in the deterministic plan order, each line already its node's suppressed 564// safe rendering. It names no candidate and computes no score; every bench count it contains already came 565// through RenderCount, so the deterministic fallback is itself suppression safe. 566func renderPlanUnion(ran []string, evidence []string) string { 567 var b strings.Builder 568 b.WriteString("Integrated plan answer across the planes. ") 569 b.WriteString(strings.Join(evidence, " ")) 570 return b.String() 571} 572 573// benchPlaneWords are the conservative bench plane signal: a question that names one of these is asking about 574// the caller's own bench (the suppressed person touching plane). Pairing a bench word with a market word is 575// the compound signal that routes to the planner. 576var benchPlaneWords = []string{"bench", "our staff", "our people", "who can staff", "clearance coverage", "structural gap"} 577 578// marketPlaneWords are the conservative market plane signal: a question that names one of these is asking 579// about the public market plane (agencies, awards, incumbents, recompetes, competitors, forecasts). 580var marketPlaneWords = []string{"market", "incumbent", "competitor", "recompete", "award", "agency", "forecast", "vendor", "teaming", "buying pattern", "spend"} 581 582// isCompoundQuestion is the CONSERVATIVE compound signal: a question is compound when it names a bench plane 583// word AND a market plane word (it spans two planes), so the single shot keyword router cannot answer it with 584// one intent. It is deliberately narrow: when unsure it returns false so the question falls through to the 585// existing single shot path and a working route is never regressed. It never refuses; the EEO guards run in 586// AnswerPlan. 587func isCompoundQuestion(question string) bool { 588 q := strings.ToLower(question) 589 return containsAny(q, benchPlaneWords) && containsAny(q, marketPlaneWords) 590} 591 592// guardTenantForBench reports whether the context carries a resolved authenticated tenant, the gate a bench 593// node needs before it runs a person touching read. The runner drops a bench node without one so the plan 594// path keeps the same auth posture answerBench enforces, rather than relying only on the RLS empty result 595// fail safe. The G6 capture composition checks the same gate inside answerCapturePicture. 596func guardTenantForBench(ctx context.Context) bool { 597 _, ok := tenant.OrgFromContext(ctx) 598 return ok 599} 600