[salon] After Fountain: exact turn provenance, cross-runtime plan tools and isolated execution graph

[jhgaylor]

Carried over from the archived managoat/salon#9 when the demo suite
was consolidated into this repository. The original repo has been deleted, so
this is the surviving copy.

• Originally opened by @jhgaylor on 2026-09-02 (issue https://github.com/managoat/salon/issues/9)
• Now lives at: apps/salon
• Status: carried over as-is

---

Outcome

Upgrade Salon's plan execution from inferred, prompt-serialized coordination to exact Fountain provenance and provider-neutral agent-native plan tools. Then expose the execution graph and add safe parallelism behind worktree isolation.

This follows the Salon-only plan/review/sequential-execution tracker. Do not block that tracker on this one.

Fountain dependencies

• Conversations: return a durable turn identity when a prompt is accepted BinaryBourbon/fountain#1406 — accepted prompts carry a durable turn identity or caller correlation.
• ACP: send the substituted MCP configuration on session/new BinaryBourbon/fountain#1404 — ACP session/new receives the substituted MCP configuration.
• Runtimes: conversation-authenticated HTTP MCP servers across every ACP runtime BinaryBourbon/fountain#1405 — conversation-authenticated HTTP MCP works across every ACP runtime.

Adjacent platform decisions for later parallelism:

• Decide: what would it take to put two agents on one sandbox — different runtimes, or two of the same BinaryBourbon/fountain#1089 — multiple agents/runtimes on one sandbox and their isolation constraints.
• Tracker: the room — many agents concurrently on one sandbox, with a shared transcript BinaryBourbon/fountain#1043 — the larger “room” model. Salon does not need a Fountain-owned shared transcript, but should not invent an incompatible execution-tree shape.

1. Exact execution provenance after #1406

• Send a stable Salon execution ID as Fountain's prompt correlation ID when starting a plan node.
• Persist the authoritative Fountain turn_id returned for the accepted prompt.
• Replace inferred sequence binding for new executions with exact plan revision → node → execution → conversation → turn linkage.
• Carry the execution/turn ID onto every retained before/after changes record and evidence object.
• Make retries idempotent: a UI/network retry must not run a plan node twice.
• Retain backward compatibility for older sequence-attributed sends and inferred executions.
• Surface exact provenance in the UI and exports.

2. Delete the MCP substitution workaround after #1404

• Configure Salon's MCP server using Fountain's supported single-pass substitution contract.
• Delete server/sandbox.ts#unescaped and its tolerance for $ftn_... / prefixed conversation IDs.
• Add an end-to-end assertion that Salon receives the exact Fountain bearer and conversation ID.
• Verify reattach/token rotation rather than caching a resolved credential.

3. Agent-native plan operations on every runtime after #1405

• Attach Salon's authenticated MCP server for Claude, Codex, Gemini and OpenCode derived agents.
• Add narrow tools: get_plan, propose_plan_patch, report_node_status and attach_node_result.
• Scope every tool call to the authenticated conversation's Salon chat and current plan.
• Agent mutations are proposals unless the current policy explicitly permits the state transition; agents cannot approve their own revisions.
• Use operation IDs and expected plan revisions so retried tool calls are idempotent and conflict-aware.
• Update the room/system prompt to teach the plan protocol consistently across runtimes.
• Remove the structured-response drafting fallback once runtime conformance is proven.

4. Surface Fountain's existing conversation tree

• Add a server-mediated Salon endpoint for the root conversation's Fountain /tree; never broaden the guest proxy to arbitrary owner conversations.
• Sanitize child records and expose only descendants of the chat's root conversation.
• Bind each child conversation to one plan-node execution and show status, model, parent and result in the Plan pane.
• Keep the immutable Fountain tree separate from mutable plan dependencies: one says what ran, the other says what should run.
• Preserve child provenance when the root chat is archived/restored onto a fresh conversation.

5. Safe parallel execution

• Parallelize only dependency-ready nodes explicitly marked safe to run together.
• Give each concurrent execution its own git worktree/path and branch on the shared machine; never run concurrent writers in one checkout.
• Record worktree, branch, starting commit and child conversation on the execution.
• Add an integration node that rebases/merges completed branches in dependency order and surfaces conflicts as plan state.
• Cap fan-out and cost; approval of a plan revision does not imply unlimited recursive spawning.
• Terminate orphaned child conversations and clean their worktrees after results are retained.
• Gate cross-agent/same-sandbox modes on the security and identity decisions in Fountain #1089.

Acceptance test

For every supported runtime, a collaborator can approve a plan revision and run it such that Salon can answer exactly:

• which plan revision and node were authorized;
• who launched it;
• which Fountain turn and child conversation executed it;
• which authenticated plan-tool operations the agent proposed;
• which isolated worktree and branch changed;
• what evidence resulted; and
• whether a retry, reconnect or concurrent node caused duplicate execution or workspace collision.

No answer relies on “it was probably the next user turn.”