Chat Orchestration

Private chat orchestration is API-owned. It selects sources, prepares evidence, enforces focus and policy, and decides when answer text is safe to stream. The canonical requirements live in docs/features/chat/spec.md#chat-orchestration-musts; this page is a support-dev orientation only.

What This Covers

The short checklist engineers should read before changing private chat orchestration.
The current high-level runtime shape for private chat orchestration.
The current context model for exact follow-ups, source switches, and long conversations.
The boundary between connector-agnostic orchestration and provider-specific connector mechanics.
Where to start in Mastra Studio and which developer verification prompts have been useful.

Current Runtime Shape

Mastra packages in apps/api and apps/web stay on the current repo-supported line; AI SDK packages stay on the v6 line.
docs/features/chat/spec.md#chat-orchestration-musts is the canonical short requirement list.
Source selection is more connector-agnostic: domain/capability routing, structured live-query filters, broad activity coverage, source-switch carry-forward, and source-limited document/file prompts all live in shared chat orchestration.
Better Auth social-account labels now flow through shared live-access/source provenance so answers and the Sources panel can disambiguate multiple connected accounts without connector-specific wording or opaque ids.
Intent classification receives a connector-manifest source-label map so product/source labels route to canonical live domains without provider-pair branches.
Private chat uses one shared Mastra Memory factory with exact recent messages, thread-scoped semantic recall, and thread-scoped Observational Memory.
Required multi-domain live evidence now fan-outs through a registered Mastra .parallel() batch workflow after sequential planning, policy, and HITL gates pass; the Studio-visible batch state is owner-bound by Mastra resource id and redacted to runtime/status metadata plus safe aggregate lane diagnostics only.
Current-work and work-prioritization prompts now treat today as a planning horizon for active/open work items instead of filtering assigned work to only items updated that day.
Focused file reads and searchable Library upload eligibility now use one shared document extraction registry/service with parser adapters hidden behind a stable extraction contract.
User-visible answer text is normalized through the shared private assistant terminology processor so internal terms do not leak into streamed or persisted copy.
Role-level model traces stay server-side for audit/replay. Owner thread detail, web BFF responses, realtime events, model replay, and shared snapshots expose only user-safe per-message provider/model provenance.
Evals now cover broad/open-ended live evidence-seeking by connector domain, broad workspace-chat activity, source switches, cross-domain source choice, structured filters, focused sources, tabular paths, and source-limited searchable-file prompts.
Local connector prompt packs now record each connector’s observed indexed-mode state and can be run with --indexed-mode live-only or --indexed-mode indexed-enabled so optional embedding connectors are checked in both retrieval configurations.
Deterministic chat workflow evals now tag optional-indexed connector prompts and can be filtered with --connector-indexed-mode live-only, --connector-indexed-mode indexed-enabled, or --connector-indexed-mode any-indexable.
Owner chat streaming smooths oversized AI SDK UI-message text/reasoning deltas at the API stream boundary with smoothStream({ delayInMs: null, chunking: 'word' }), paces visible code-highlighter input, and drains Markdown renderer catch-up in the web app when parser work would otherwise batch fast deltas into one visible update. Active prose stays on the parsed chat Markdown renderer, with only incomplete trailing inline syntax held back until it can parse cleanly; completed labels for unfinished Markdown links can appear as plain text until the URL closes, avoiding long visible stalls on slow URL tokens without changing the stored answer text.
Open fenced code blocks render through the streaming highlighter, while app-owned paragraph and code-block prose wrappers load through MDC nested async components. Inline citations, source actions, privacy-safe section grounding labels, completed Markdown, and future typed UI parts remain on the canonical chat Markdown/message-part renderer. Renderer catch-up should drain in a few frames when it falls behind or the upstream stream has ended so smoothing does not materially extend response completion.
Long pre-answer server-turn gaps use the existing activity/status row, not assistant answer text, so operational progress stays visible without contaminating the response. Private work notes render in the owner activity rail with safe Working on ... status labels and longer frontend-owned details derived from activity-note codes/params; they still do not expose provider reasoning, raw tool/query/source payloads, backend-authored prose, or browser-faked character streaming. True prose-delta work-note narration requires a separate safe server stream contract.
The smoother splits arrived deltas; it does not intentionally buffer completed text or add a product-owned delay to hide upstream private-provider gaps. The API stream pipe repairs missing text-end chunks and streams sanitized private grounding summary metadata before forwarding finish, so completed answer chrome and footer contributor categories can appear while exact inline citation attribution, persistence, and publish work continue. The same pre-attribution metadata can include stripped checked/listed source inventory for the Sources action; snippets, arbitrary source metadata, citation targets, and used-source status still wait for completed-answer attribution.
Single-block private answers use structural source attribution directly instead of invoking the citation-placement model; multi-block multi-source answers still use placement and downgrade unresolved candidates to checked-only source inventory. Citation placement runs on the private intent-classifier model role with planner fallback, and private stream timing records metadata-only citation-placement start/finish details such as counts, strategy, and duration. Mixed source-backed/general-knowledge answers may include groundingSegments once the completed answer and source attribution are known; the metadata targets rendered markdown blocks and carries only coarse grounding mode plus contributor categories.
Private answer output processors intentionally omit Mastra BatchPartsProcessor because it reduces emission frequency and can hold a timed-out partial text batch until another provider part arrives. Private system-prompt scrubbing uses the Mastra SystemPromptScrubber as a scoped sanitizing output boundary: detected hidden app prompts, developer policy, internal app tool policy, or chain-of-thought are redacted with the private policy placeholder in streamed and final assistant output, while authorized private source evidence remains visible when it is not detected as hidden app policy. Stream timing diagnostics log metadata-only public/private milestones around turn execution, first UI chunk, first visible text delta, UI stream completion, stream persistence, display-part persistence, product-turn finalization, turn-request finalization, and thread-update publish; private diagnostics add preparation progress, source attribution, and citation placement. Use those logs to identify server-side gaps before changing rendering or adding any visible wait-state behavior.
Private latest-assistant regenerate treats the prior assistant provider/model metadata as provenance rather than a model-selection override. Client-supplied provider/model overrides for private regenerate requests still fail closed before assistant output starts, and branch creation uses the Mastra memory-storage clone primitive directly so local observability or semantic-recall store availability cannot block the version path.

Mastra Studio Starting Point

Start with private-turn-preparation-workflow. That is the product private-chat entrypoint before answer streaming.

Useful Studio entries:

private-turn-preparation-workflow - focus, evidence, HITL, and synthesis preparation.
privateEvidenceIntentClassifierAgent - first live/indexed/tabular/source-domain classification, including manifest-derived source-label mapping.
private-evidence-preparation-workflow - indexed/live/tabular evidence setup.
private-live-evidence-loop-workflow - live-domain planning, policy/HITL gating, and final evidence output.
private-live-evidence-batch-workflow - required live-domain fan-out after gates pass; Studio should show private-live-evidence-batch-N-lane-M .parallel() groups followed by private-live-evidence-batch-N-merge steps.
focused-private-turn-preparation-workflow - focused files/folders/library handling.
privateSynthesisAgent - final private answer generation.
privateResearchAgent - indexed document/file evidence answers.
eval-chat-* workflows - visible production quality gates, not product runtime.

Useful code entrypoints:

apps/api/src/chats/chatTurnExecutionPlan.ts
apps/api/src/chats/privateEvidenceIntent.ts
apps/api/src/chats/privateTurnOrchestration.ts
apps/api/src/mastra/agents/privateChatMemory.ts
apps/api/src/mastra/tools/canonicalLiveTools.ts
apps/api/src/mastra/evals/scenarios/

Requirements Snapshot

The canonical checklist is docs/features/chat/spec.md#chat-orchestration-musts.

Preserve mode, auth, focus, HITL, tool policy, and privacy before evidence search or model output.
Select connector sources by domain, capability, availability, and policy, not prompt keywords or provider-pair branches.
Do not add semantic keyword lists, stopword lists, phrase regexes, or prompt-word cleanup as chat orchestration fixes. Use structured classifier/planner output, schemas, capability contracts, explicit UI/focus state, or eval/scorer seams; keep deterministic parsing limited to structural facts such as ids, enum values, manifest labels, resource kinds, parsed dates, and quoted names.
Search likely source(s) first, but keep checking other eligible sources when needed for a complete answer.
Cross-reference live, indexed, and tabular evidence through shared connector-agnostic orchestration.
Treat example prompts and mocked fixture rows as regression coverage only; production orchestration and Mastra runtime prompts must generalize across unknown wording, tenant data, provider mixes, and connector availability.
Carry label/category/folder/project/status/priority/type/component constraints as structured live-query filters; provider adapters translate supported fields to native provider syntax or metadata filters.
Stream truthful activity quickly, and stream answer text early only when accuracy is not sacrificed.
HITL-resumed answers should continue through the normal active-turn stream after the input decision is accepted; peer tabs should see the request clear by realtime and attach to the resumed stream instead of waiting for final history. Pending HITL may render a temporary display-only work-note row after navigation, refresh, or accepted-decision stream handoff only when the latest user turn has no assistant row yet, but it must not persist an assistant placeholder or replay that row to the model. Do not add polling loops to discover HITL state or resumed active turns; use Feathers events plus snapshot recovery.
Pace large assistant text/code deltas through the existing UI-message stream contract instead of flattening source, reasoning, citation, or future typed parts into text-only output.
Keep smoothing honest: split oversized deltas when they arrive, but do not add artificial response delay or placeholder prose to hide upstream private-provider or orchestration gaps.
Use stream timing diagnostics before optimizing perceived latency. The diagnostic payload must stay metadata-only: ids, status codes, counts, durations, and safe phase names are acceptable; prompts, source snippets, raw queries, model text, and connector result bodies are not.
Do not add Mastra token-batching processors to user-visible private answer streams unless a future measured performance problem justifies the UX tradeoff and browser/server probes prove it does not reintroduce bursty output.
Do not run LLM-backed output detectors per streamed private answer delta when they are non-sanitizing. Run that class of check on the completed assistant message before persistence, or add a separate low-latency streaming guardrail with an explicit sanitizing strategy.
Keep active-turn status separate from answer content: planning/progress rows may remain visible while the server turn is running, but they must not be emitted as assistant text or persisted answer parts.
Keep private work-note copy frontend-owned and code-driven. It can be more descriptive than the compact status row, but it must remain a safe owner activity rail/timeline trail rather than cleaned chain-of-thought or raw provider/tool/source output.
Keep exact recent context available for pronouns, follow-ups, and terse source switches.
Treat short open-ended activity/day/status prompts as fresh broad coverage unless they are actually referential; current prompt and current time window win over stale prior query text. A named source group like Slack, email, calendar, or work items constrains the coverage domain without turning the recap into a targeted provider content search.
Treat current-work and work-prioritization prompts as planning questions. If work-item live access is available, active/open assigned work remains relevant even if it was not updated today; only explicit updated/created/due/completed wording should turn that into a work-item date filter. Do not open clarification HITL that asks the user to restate the same broad focus when eligible private sources can support a best-judgment answer.
Treat Observational Memory and semantic recall as additive thread-scoped private-chat context tools, not replacements for exact recent context.
Use embeddings/indexed retrieval to improve discovery and live-query routing when available.
For connectors with optional indexed embeddings, run prompt-pack and eval coverage in both live-only and indexed-enabled states; the run should prove the no-index live path and the indexed-first/freshness-fallback path without copying local provider facts into committed fixtures.
Honor explicit source limits: when a user asks for answers only from searchable files, indexed documents, or focused source content, stay on indexed/tabular evidence instead of opening unrelated live connectors.
Treat explicitly named source groups as the requested scope. Source-choice HITL can narrow underspecified broad private retrieval, but it must not convert an explicit source request or explicit all-connected-sources request into a narrower source set. If the user explicitly asks to choose which source types should count, the structured source-choice form should win over generic detail clarification. Submitted clarification must shape current-turn source-domain classification and tool selection before retrieval starts, while raw optional details stay untrusted and do not become answer-style instructions or later replay. Freeform HITL fields need brief, relevant copy that says why the answer is paused and what input belongs there. If the user has turned off Ask clarifying questions, or the current flow resolves shared isHitlAllowed to false such as Automation-launched unattended chat, optional source-choice and bounded detail-clarification prompts should not open; the runtime should use relevant authorized connected source groups or available context by server-owned best judgment.
Preserve human-salient source metadata and participant roles; connected account identity is access context, not evidence of authors, recipients, counterparties, organizers, attendees, owners, or assignees. Conversation counterpart labels must come from normalized item-level participant fields, not sender or account inference.
Use Better Auth social-account labels as source provenance when useful to disambiguate multiple connected accounts. They are not participant evidence and should be carried through shared source contracts, not one connector’s answer wording.
Distinguish used, checked, and listed sources.
Disclose source coverage gaps and separate general knowledge from private evidence.
Keep internal orchestration terms out of user-visible copy: say source results, source information, requested input, and coverage gaps instead of grounding data, grounded findings, HITL, source-choice, workspace-chat, or generic workspace chat. Chat-message evidence should name the visible provider/source, such as Slack, Teams, a channel, direct messages, or this source.
Support HITL information-request forms without losing focus, source scope, or pending-turn state.
Never let a normal completed answer silently cut off; interrupted or truncated responses need explicit state and recovery.
Gate orchestration changes with evals for routing, focus, sources, context, HITL, streaming, citations, and answer quality.

Current Context Model

Mastra Memory is the canonical transcript store. The API also passes a bounded recent visible context into private orchestration so classifier and planner decisions can resolve exact follow-ups without broadening. This is what keeps a terse source switch like Check Jira scoped to the prior subject and time window instead of becoming a generic Jira listing.

Conversation-only transformations are distinct from referential retrieval. If a user asks to draft, rewrite, format, summarize, or make a checklist that preserves facts already visible in the thread, orchestration should use the sanitized recent conversation context without querying the connector again—even when focus is locked. It must keep sparse wording literal instead of inventing an antecedent, completion state, test result, owner, date, cause, or qualifier. Focus still constrains authority, and explicit refresh/search/latest/verification wording re-enables bounded retrieval inside that focus. This paired rule prevents a generic drafting prompt from becoming an empty provider search while preserving freshness when the user actually asks for it.

Private chat agents now use one shared Mastra Memory factory with bounded exact recent messages, thread-scoped semantic recall, and thread-scoped Observational Memory retrieval. OM is expected to help longer conversations by compressing older same-thread history and letting the agent recall raw messages behind observations when needed.

OM is additive only. Exact recent context remains required for pronouns, source switches, focus enforcement, and current-turn orchestration correctness. Resource-scoped OM remains deferred until a separate product/security decision. Raw OM stream/debug parts stay internal unless they are deliberately mapped to app-owned safe status codes.

Current evidence is integration and guardrail evidence: shared memory construction, thread scope, explicit private models, and stream-part filtering are covered. Do not claim measured answer-quality lift from OM until a long-thread before/after eval or Studio experiment proves it.

Connector-Agnostic Boundary

Shared chat orchestration owns source selection, terse source-switch carry-forward, context preservation, indexed/live/tabular coordination, HITL gating, focus enforcement, source usage semantics, and eval expectations.

Shared orchestration also owns connector-agnostic participant-role semantics. The connected account used to add a connector may be relevant to access and “my” scope, but it must not be treated as the author, recipient, counterpart, organizer, attendee, owner, or assignee unless the item-level source fields say so.

Shared source contracts own account provenance. Provider adapters should attach the already-resolved Better Auth social-account label from live-access context when available; grounding/source builders and synthesis guidance decide how to present it safely across mail, workspace chat, calendar, contacts, work items, files, and future domains. Provider names, Jira sites, Slack workspaces, calendars, mailboxes, URLs, projects, and connector ids are not substitutes for connected-account labels.

Shared orchestration owns the structured live-query filter contract for labels/categories, folders, projects, statuses, priorities, item types, and components. Provider adapters only translate the supported filters into provider-native query syntax or post-query metadata filtering.

Shared orchestration also owns explicit source-limit enforcement. A request to answer only from searchable files, indexed documents, or focused source content is an evidence-scope boundary; live mail, calendar, workspace chat, and work-item tools should remain unavailable for that turn unless the user separately asks for current provider state.

Intent classification is given the canonical source-label inventory derived from connector manifests. If a user names one source group or connector product, the turn should stay on that canonical domain unless the user also asks across other sources. Broad recaps inside that named source, such as What was discussed in Slack today?, still use shared broad source-coverage intent through the canonical live-query contract so provider query text does not become a brittle search for answer-format words. Provider adapters translate the structured intent to native API parameters; they do not each maintain prompt-word lists to rediscover broadness. A follow-up like Summarize yesterday's Slack activity after a broad workplace summary should route only to workspace chat and should not open Mail Search, work-item search, or source-choice HITL.

Provider adapters own provider mechanics: API calls, scopes, pagination, rate limits, provider query syntax, and provider-native identity resolution needed to populate canonical fields. For example, direct-message counterpart labels should be normalized into shared participant fields by the provider adapter when the provider explicitly supplies them. Do not add orchestration branches such as if Jira then ... unless the branch lives inside the provider adapter or an accepted provider capability contract.

Document Extraction And Upload

Canonical requirements remain in docs/features/chat/spec.md and docs/features/connectors/spec.md.

API file parsing is centralized under apps/api/src/fileExtraction/. Callers ask the document extraction service for a purpose such as embedding-text, focused-chat-text, or tabular-analysis; they do not call parser packages directly. The registry owns extension/MIME support, max-byte policy, upload eligibility, skip reasons, and adapter selection.

Current adapter split:

officeParser is used behind an adapter for broad Office/OpenDocument/RTF coverage.
Mammoth remains the DOCX raw-text adapter where its focused DOCX behavior is the better fit.
pdf-parse provides PDF.js-backed PDF extraction.
SheetJS remains canonical for spreadsheet and tabular SQL conversion so XLSX/CSV-style analysis does not regress.
Plain text, Markdown, CSV/TSV, JSON, XML, and HTML use simple text/markup/data adapters with the same normalization contract.

Chat focused-file reads use this service when provider bytes or provider-native exports are available. Download/open/list actions stay separate from parseability: a file can be listed or downloaded without being readable for chat. When extraction is skipped or fails, chat must surface a coverage gap instead of implying the file was read.

Library upload follows the same policy. If a local/device format can be extracted for indexing, it is allowed for searchable Library upload unless it is hard-blocked by security, size, or provider-write constraints. Unsupported files are rejected before provider upload with clear copy. If provider upload succeeds and indexed ingestion later skips extraction or fails, the inline Library contents row uses not-indexed / Not indexed rather than a generic upload failure. If indexed ingestion is intentionally off for the connector, upload is not offered and any old uploaded row is suppressed from Library attention.

Currently supported local searchable-upload formats are .txt, .log, .md, .markdown, .rtf, .csv, .tsv, .json, .xml, .html, .htm, .pdf, .docx, .pptx, .xlsx, .xls, .xlsm, .xlsb, .odt, .ods, and .odp. Google Docs, Sheets, and Slides are supported for connector/chat ingestion through provider export, while local upload uses equivalent device formats.

Deferred parser targets are legacy binary Word/PowerPoint (.doc, .ppt), macro-enabled Word/PowerPoint (.docm, .pptm), images and scanned PDFs requiring OCR, Parquet direct upload/extraction, and any type that fails fixture validation, package safety review, or Bun/Node runtime checks.

Developer Verification Prompt Patterns

Use real local data through agent-browser, but keep discovered facts out of production prompts and routing logic.

For new or changed connector implementations, start with Connector Provider Changes and Local Connector Prompt Packs before browser verification. Those pages cover the prompt-template intake, live-query rollout, deterministic evals, real-provider smoke, prompt-pack checks, and when indexed storage should be added after a measured live-query gap.

Test natural prompts first. A prompt that names the exact feature under review, such as connected account or source provenance, is not enough; first use wording a real user would type and verify the answer includes the needed clarity on its own.
Focus a file, then ask: Summarize this, Summarize this file, What should I know from this before next week?, and an absent-topic negative prompt.
Focus two files, then ask for comparison and a pronoun follow-up such as Which of these needs attention first?
All-scope source-limited documents: Based only on searchable workplace files, what risks or follow-ups should a manager check next week? and Based only on searchable workplace files, do they mention <absent topic>?
Broad live activity: Summarize yesterday's workplace activity, Catch me up on today's Slack conversations, How was <person>'s day yesterday?, and What changed yesterday across messages, calendar, and work items?
Current-work prioritization: What active work should I prioritize today? and What should I work on today across messages and work items? Verify active/open assigned work is still considered even when it was not updated today, while message/calendar evidence remains bounded to the requested day when appropriate.
Source switch: ask about one domain first, then Check Jira, Check email, or Which are in progress? and verify the prior subject/time scope carries only when the follow-up is truly referential.
Source discovery: ask natural lookup prompts such as List PDF files in Google Drive, Where are PDF files located in OneDrive?, Find the email about the renewal, or Find the Slack message about the deploy. Verify the turn uses the matching source’s live/list/search capability, preserves source labels and locations/participants/dates when available, and says which source was checked when no match is found.
File inventory follow-up: after a file-type listing such as List PDF files in Google Drive, ask a terse follow-up such as What else do you see? or What other files do you see?. Verify the turn stays on the prior file connector, drops stale file-type filters unless the current prompt repeats them, samples shared top-level locations when available, and phrases the result as bounded coverage rather than a complete file inventory. If one sampled location fails while others return files, the answer should still show the available bounded list and disclose the unchecked location. Local prompt-pack follow-up cases use same-thread setup prompts when run with --include-follow-ups, so saved chats show both the setup answer and the follow-up answer.
Listed-file content follow-up: start with a natural broad inventory prompt, then ask what one exact displayed title says using ordinary or misspelled wording. Verify the saved provider/account/item identity is reused, the query text is the exact title rather than the sentence, unrelated file providers/accounts are not queried, and an inaccessible target is not replaced by a different same-title item. Include a duplicate-title fixture so distinct identities are preserved instead of one arbitrary file winning.
Focused transcript transformation: after two grounded focused answers, reload and ask for a concise draft/checklist that preserves the decision, owner, or open question already visible in the thread. Verify no connector/indexed tool runs, the focus lock stays visible, and the answer uses prior facts. Then explicitly ask to verify the latest source state and prove retrieval resumes inside the same focus.
Optional indexed mode passes: for file connectors that support indexed embeddings, prepare one local state with indexed mode off and one with indexed mode on, regenerate the pack after each state change, then run bun run chat:prompt-pack:run:local -- --domain file-resource --indexed-mode live-only --limit 3 and bun run chat:prompt-pack:run:local -- --domain file-resource --indexed-mode indexed-enabled --limit 3. The runner filters the state captured in the pack; it does not toggle connector modes because disabling indexed mode can delete indexed artifacts.
Named source after broad search: ask a broad activity question, then Summarize yesterday's Slack activity or the equivalent for another connected source. Verify server logs show only the named source’s canonical domain and no unrelated HITL request opens.
Multi-account source clarity: ask latest/reminder/recent prompts across mail, workspace chat, calendar, contacts, or work items when multiple accounts of a connector type may be connected. Do not ask for the account in the first prompt; the answer should still include connected-account provenance when omitting it would be ambiguous. The Sources panel should show the same account label, while participant claims still come from item fields such as sender, recipient, organizer, attendee, assignee, owner, or counterpart. Do not accept a provider/site/workspace/url/project value as an account label.
Mail account clarity: What is my latest email?, Which account or recipient was that sent to?, and Any reminders I received yesterday? Answers should use visible sender/recipient/provider/source-account provenance when helpful, not opaque connector ids or account-based recipient inference. The first prompt should not explicitly request the connected account; that is the behavior under test.
Structured filters: ask for labels/categories/projects/statuses/priorities/components in mail or work items and verify the planner carries them as structured filters, not provider-specific prompt text.

During developer browser verification, watch both the assistant answer and server logs. Treat hallucination, stale prior-query carry-forward, internal terminology, missing source metadata, concatenated/malformed source labels, unexpected HITL from an unrelated source, or hidden coverage gaps as failures.

Local Eval Mode Filters

Use these for deterministic connector-orchestration checks when a change can affect optional-indexed file connectors. The filter selects committed synthetic eval rows tagged with a connector indexed-mode state; it does not toggle any real connector setting.

cd apps/api
bun run scripts/runChatWorkflowEvals.ts --connector-indexed-mode live-only
bun run scripts/runChatWorkflowEvals.ts --connector-indexed-mode indexed-enabled

Persisted Mastra dataset experiments support the same filter when a run needs Studio-reviewable dataset versions and experiment history:

cd apps/api
bun run scripts/runChatEvalExperiments.ts --connector-indexed-mode live-only
bun run scripts/runChatEvalExperiments.ts --connector-indexed-mode indexed-enabled

Use the prompt-pack --indexed-mode filter for browser-backed local connector data, and use the eval --connector-indexed-mode filter for committed neutral fixtures. Prompt packs are real local smoke; deterministic evals are the regression gate.

Canonical Sources

docs/features/chat/spec.md#chat-orchestration-musts
docs/features/chat/stories/chat-orchestration-implementation.stories.md
docs/features/chat/tests/assistant-orchestration.feature
docs/features/chat/tests/chat-sources-and-citations.feature
.agents/skills/private-chat-orchestration/SKILL.md
.agents/skills/connector-chat-verification/SKILL.md
apps/api/AGENTS.md
apps/api/src/chats/chatTurnExecutionPlan.ts
apps/api/src/chats/privateEvidenceIntent.ts
apps/api/src/chats/privateTurnOrchestration.ts
apps/api/src/chats/privateRecentConversationContext.ts
apps/api/src/connectors/liveAccessProviderContracts.ts
apps/api/src/connectors/liveAccessGroundingInstructions.ts
apps/api/src/fileExtraction/
apps/api/src/mastra/agents/privateChatMemory.ts
apps/api/src/mastra/evals/datasets/chatEvalDatasetFilters.ts
apps/api/scripts/runChatWorkflowEvals.ts
apps/api/scripts/runChatEvalExperiments.ts
apps/api/src/mastra/tools/canonicalLiveTools.ts
apps/api/src/mastra/tools/connectorResourceContent.ts
apps/api/src/uploads/providerUploadService.ts
packages/contracts/src/uploads/uploadFilePolicy.ts
packages/types/embedding-policy.json
apps/meltano/src/services/text_extraction.py
apps/api/src/mastra/evals/scenarios/live-connectors-multi/
apps/api/src/mastra/evals/scenarios/live-work-items-source-switch/
apps/api/src/mastra/evals/scenarios/cross-reference-domain-matrix/