FE-1504: Run the process-model elicitor from the Petrinaut panel on one owned document

[lunelson]

🌟 What is the purpose of this PR?

🔗 Related links

• ...

🚫 Blocked by

• ...

🔍 What does this change?

• ...

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing
• modifies an npm-publishable library and I have added a changeset file(s)
• modifies a Cargo-publishable library and I have amended the version
• modifies a Cargo-publishable library, but it is not yet ready to publish
• modifies a block that will need publishing via GitHub action once merged
• I am unsure / need advice

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change
• are in a state where docs changes are not yet required but will be
  • this is tracked in: Insert Link Here
• require changes to docs which are made as part of this PR
• require changes to docs which are not made in this PR
  • Provide more detail here
• I am unsure / need advice

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph
• affected the execution graph, and the turbo.json's have been updated to reflect this
• I am unsure / need advice

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

1. Checkout the branch / view the deployment
2. Try X
3. Confirm that Y

📹 Demo

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 26, 2026 6:30pm
hashdotdesign-tokens	Ready	Preview	Aug 26, 2026 6:30pm
petrinaut	Ready	Preview	Aug 26, 2026 6:30pm
petrinaut-docs	Ready	Preview	Aug 26, 2026 6:30pm

[lunelson]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-1506: Show captures and completion while a panel elicitation runs #9346 : 2 dependent PRs (#9347 , #9355 )
• FE-1504: Run the process-model elicitor from the Petrinaut panel on one owned document #9345 👈 (View in Graphite)
• FE-1431: Build the plugin authoring surface #9337
• FE-1406: Audit the harness-teaching lineage and propose the fixed-key plugin contract (ADR-0007) #9327
• FE-1497: Build the controller read path and the SDCPN plugin package #9325
• FE-1404: Run condition 3 as the walking skeleton #9322
• FE-1403: Assemble and test the CPS interview guidance #9321
• FE-1402: Define and rehearse the elicitation completion contract #9320
• FE-1407: Catalogue elicitor failures that published measures miss #9319
• FE-1480: Project and realize a CPS model as a Petrinaut SDCPN #9313
• FE-1495: Prevent Brunch TypeScript contracts from drifting #9312
• FE-1494: Keep Brunch strategy and control records coherent #9311
• FE-1437: Move brunch-agent into hashintel/hash with its history #9274
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Changes session/document identity and makes the principal header mandatory on chat, affecting persistence isolation and any clients that omit the header; local capture format v2 adds ownership checks on stored elicitation data.

Overview
Wires the Petrinaut local panel to the SDCPN process-model elicitor (replacing the gherkin path for /api/chat) and introduces a stable UI principal so Brunch can scope conversations and elicitation storage per browser.

The AI SDK transport now requires x-brunch-principal on chat POSTs (CORS preflight allows it), rejects missing/invalid principals, and threads principalKey through initial turns and ask-reply resumes. The Petrinaut demo persists a principal in localStorage and sends it on every chat request via the new @hashintel/brunch-agent-transport-aisdk/headers export.

On the server, resolvePetrinautSessionIdentity derives a hashed Flue session id from principal + panel conversation id while keeping one target document id per principal; elicitation sessions pass optional ownerKey into the local capture store. Target-document JSON moves to format v2 with ownerKey and refuses read/write when the on-disk owner does not match the caller (legacy v1 migrates with ownerKey: null).

Local dev adds yarn dev:brunch (Brunch + real Petrinaut site), a brunch-agent README, and tests covering the dev scripts, session naming, principal header contract, and ownership enforcement.

^{Reviewed by Cursor Bugbot for commit 146d789. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 98 untouched benchmarks

---

_{Comparing ln/fe-1504-panel (146d789) with main (a37f9ae)¹}

Footnotes

1. No successful run was found on ln/fe-1431-plugin-authoring-cycle (807cb52) during the generation of this report, so main (a37f9ae) was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩