Plan artifact: evidence-checked multi-component design plans

[SmartAI]

What

The agent can now maintain a plan of record for multi-component designs, enforced by the loop rather than trusted on prose:

• update_plan tool — full-snapshot plan (goal, components, interfaces). Validation: unique label-safe ids, every component held by an interface (or an explicit free-floating reason) with a connected interface graph, no silent drops (removing unfinished work requires a stated abandon reason), and evidence-checked done: a component can only be marked done after a gate-passed run declared it via the new COMPONENT block and ran its planned checks verbatim.
• Required volume check per component — every buildable component must carry {"kind": "volume", "range_mm3": [lo, hi], "target": id} with hi <= 1.5x lo. Volume is the cheapest topology detector; deriving it from intent before building is what actually catches sealed cavities and eaten floors (see Why).
• Loop enforcement — stopping with unfinished components injects one deterministic follow-up (never twice without an intervening run); a plan with interfaces is unfinished until one gate-passed run declares all components together (where clearances are actually measured); with an active plan the CAD budget is per component bucket under a 3x global ceiling.
• Probe runs — COMPONENT = "probe" marks diagnostics: they never advance the plan, never displace the deliverable in the viewer/script/artifact store, never become the conversation's verification badge, and only drain the global ceiling.
• Harness — COMPONENT block parse + echo, target on hole checks (per-child census), new hole_internal kind, max_mm on clearance (touching is now assertable), and a floating flag on children with no touching/interpenetrating partner.
• UI — live plan card (components, statuses, abandon reasons, interfaces) and a plan-check chip for injected nudges.

Simple single-part requests are untouched: no plan, byte-identical behavior.

Why

Live stress tests of complex assemblies showed the loop building well but verifying blind: a gearbox base whose "open top" was accidentally sealed by a full-slab flange passed the gate, all self-authored checks, and every view (the lid occluded it), and the agent confidently reported it correct. A plate-stack run also shipped a top plate touching nothing.

The plan artifact closes this structurally: per-component builds are verified where defects are visible, progress claims require gate evidence, interfaces are first-class and must be measured, and the volume requirement forces the agent to do the arithmetic its feature-level checks skip. In live verification the same prompt that previously produced the sealed housing now yields an open one — the agent derives the expected volume first and models accordingly, and the measured volumes match the derivation exactly.

Notes for review

• Plan snapshots live in the update_plan tool result (details.plan), not a custom message role: tool results are already persisted/replayed, and the compaction cut now never passes the newest accepted plan. Deviation rationale is in the commit messages.
• Budget attribution parses COMPONENT client-side (the abort happens before the harness runs); the harness echo remains the only trust anchor for evidence — a lying declaration can waste budget but cannot fake progress.
• _resolve_target also matches the result's own label so a solo component run satisfies the same targeted checks as the assembly run (the evidence rule requires byte-identical checks in both).
• py-tests: 24 new tests in test_plan_component.py; one pinned normalization expectation in test_checks.py updated (hole specs now carry target). No golden.json changes (new measurement keys are additive).
• Tested: 311 vitest + 128 py-tests green, typecheck green, e2e battery green including the new plan-flow.spec.ts (fake LLM); live-verified end-to-end with a real model on the gearbox assembly.

🤖 Generated with Claude Code