feat(cat): a local model's Cat can act

[catomean]

ADR-0008 D2 — both halves. The browser holds the model, the server holds the rules.

/api/cat/local-complete was 52 lines that called saveMessages and nothing else. A model running on the user's own hardware could do nothing — and worse, its exec_action block was stored verbatim, so the user read "Creating that now…" for something nothing would ever create. ADR-0006 D8 made the prompt honest about that limit. This makes the limit untrue, which is the better fix.

The capability was one file away, behind no decision at all

runExecActions was module-private inside chat-orchestrator. That is the whole reason the local route had no executor — not a policy, not a risk assessment, just a function nobody had moved. It is now services/cat/exec-actions.ts and both paths call the one copy, so the gates cannot diverge because there is nothing to diverge from.

actionsVia goes 'none' → 'prose', and not 'tools': the server makes no inference call here, so there is no round trip to put definitions in, and 'tools' means the prose catalogue was dropped because definitions replace it — claiming it would leave Cat with no verb at all.

Why this PR was drafted mid-review

The server half alone was a regression I was about to ship. The client posted the reply fire-and-forget — void fetch(...).catch(() => {}) — discarded the results, and rendered the raw stream. And flipping actionsVia to 'prose' is precisely what makes local models start emitting those blocks. Shipping only the server would have made raw JSON in the chat bubble more common, not less, while the action ran invisibly.

So the browser half is here too. runLocalTurn streams a pass into the bubble, posts it, settles the bubble to the parsed text so the envelope never stays on screen, emits a chip per action, feeds the outcome back, and lets the model write its reply last — knowing what happened instead of guessing. It is a separate module rather than more of a 565-line hook, so it tests without React, a model, or a server.

The chips cost nothing to add, because #986 already derives their words from the action registry: a local create_project reads "Created project" exactly as on the hosted path.

Why a client-driven loop is not a new privilege

Every action executes for the authenticated user's own actor through CatActionExecutor, so a forged block can do only what that user could already do by calling the API directly — same permission checks, spend caps, confirmation flow and cat_action_log row. The client controls the text, never the authority.

One rule above all: a generated reply is posted exactly once. The server executes on every post, so a second post of the same text is a duplicate payment or a duplicate project. intermediate is decided before the post and never revisited; the final pass always persists. The test asserts that property directly.

The gate was written to fail, and did

actions-via-wiring.test.ts said: "If this route ever grows one, this test should fail and be rewritten — that is the point." It failed on both assertions at the first edit. The rewrite keeps the invariant that survived both decisions — the prompt's claim and the route's capability are one fact — and now pins the linkage: if runExecActions ever leaves local-complete, claiming anything but 'none' fails.

Verified

• 3119 tests green, 0 lint errors
• Server, 7 mutants caught: executor removed · raw reply stored · mid-loop step written to history · ceiling lifted · missing actor papered over · 'tools' claimed · pending reported as completed
• Client, 8 mutants caught: reply posted twice · every pass persisting · outcome never fed back · pending described as done · envelope left on screen · real bound removed · chip ids colliding · failed rendering as completed

Mutation testing corrected me once here: my first "unbounded loop" mutant widened the for condition and escaped, because the real bound lives in pass < MAX_LOCAL_PASSES - 1 inside willLoop and the for is defence in depth. The mutant that removes the real bound is caught.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HJRuvHJEBd8t7iRA9Sb1iw