Persistent coordinator conversations

Where an operator has switched them on, the Project Tracker coordinator keeps each conversation as a thread. A thread survives a reload, signing out and back in, and opening it in another browser or on another machine. It is private to its author until they share it, and the author can delete it.

Conversations appear in two places:

• The coordinator workspace, at /projects/coordinator/<initiative>. Its Chat tab has a Conversations sidebar and the open conversation, or a new draft. The Decision log tab is unchanged.
• The task drawer. Ask coordinator on a task page lists the conversations linked to that task and offers New conversation about PT-123, named with the task's own key. That conversation belongs to the task's initiative, is linked to the task, and starts with PT-123: in the composer. Expand opens it in the workspace.

Anyone who can use the coordinator for an initiative can hold conversations about it: its delegates, and internal members with coordinator access.

Where conversations are off, the workspace and the drawer show the coordinator chat as before, which lasts only until the page reloads (see Turning conversations on).

Privacy and sharing

• Private until shared. A new conversation is visible to its author only. Nobody else finds it in a list or a search, or can open its URL, including other people who use the coordinator for the same initiative. They see "Conversation not available".
• Sharing. The author opens the conversation's actions menu and chooses Share. The dialog offers the active members of the organisation, and adds up to 20 people at a time.
• What the dialog tells you first. It shows the conversation's classification and says that everyone you add can read its full history, including earlier messages.
• All or nothing. Each person must be an active member of the organisation, cleared for the conversation's classification, and able to read everything the conversation draws on: its initiative, projects and tasks. If anyone does not qualify, nobody is added, and the dialog says "Nobody was added. At least one person can't be added: they lack access to something this conversation uses." It names no one and gives no reason, and your selection stays, so you can remove people and try again. If access could not be checked at all, nobody is added either, and "Couldn't confirm access right now" offers Try again.
• Participants read; they do not write. A participant can open the conversation and read its whole history. They cannot send messages, pin, stage suggested actions, or change the conversation. Their composer says "Only the author can send messages in this conversation."
• Removing a participant. The author opens Share again and removes the person from People with access, after a confirmation.
• Access is checked on every read. Each time anyone opens a conversation, Project Tracker re-checks their current access to every initiative, project and task it draws on, and their clearance against the classification. Someone removed from one of its projects, or whose clearance an initiative's new classification exceeds, sees "Conversation not available" from then on, even if it was shared with them.
• The classification starts at the initiative's level when the conversation is created. It can rise as the conversation draws on more sensitive sources, and it never falls.

Reopening a conversation

• A durable URL. Each conversation lives at /projects/coordinator/<initiative>/threads/<thread-id>. A reload, Back and Forward, a bookmark or a shared link, signing out and back in, and another browser all open the same conversation, with its full history.
• The sidebar lists your own conversations (Mine) and the ones shared with you (Shared with me), with an Archived toggle, a search over the titles and messages of the conversations you can read, and Load more. A conversation about another initiative opens under that initiative's URL.
• New conversation opens a draft at /projects/coordinator/<initiative>. The conversation is created when you send its first message, and the URL then becomes the conversation's own, so Back does not return to the empty draft. Its title is the start of that first message, up to 80 characters, and the pencil renames it.
• Archive (in the actions menu) moves a conversation to the archived list, and its composer says "This conversation is archived. Unarchive it to send a message." Unarchive brings it back.
• One unavailable state. An unknown or deleted conversation, one that is not shared with you, and one whose sources you can no longer read all show the same "Conversation not available", with a link back to the conversations. The page never opens a different conversation instead, and the state looks the same in every case, so it says nothing about whether the conversation exists. When access could not be checked, rather than being refused, its author sees "Couldn't confirm access right now" with Try again.

Replies, interruptions and Retry

• Streaming. A reply appears as it is written, and the composer is disabled until it settles ("A reply is in progress"). After the last words, "Updating conversation memory" shows while the coordinator refreshes the conversation's summary, until the reply is final.
• Closing the tab does not stop a reply. Once a reply has started, closing the tab, reloading or losing the connection leaves it running: the server finishes it and stores it, and reopening the conversation shows the text saved so far, then the finished answer. If the server stops before the reply finishes, for example at its time limit, the reply is marked Interrupted with the text saved until then.
• Reconnecting. After a dropped connection or a reload, the page checks the reply every 2 seconds until it is complete, failed or interrupted, and the composer stays disabled meanwhile. If the reply is still not settled after 6 minutes, the page says "Still working — refresh to check again", with a Refresh button.
• States. A message that is not complete carries a text badge: Partial, Interrupted or Failed.
• Retry. When the newest reply failed or was interrupted, its author can Retry it. Retry is a new attempt at the same question: you do not retype it, it adds no second copy of your message, and the earlier attempt can no longer change.

Pins

• The author can pin complete messages, up to 20 per conversation, with the pin control on each message, and unpin them the same way.
• The Pinned panel lists the pins by role, message number and time. Selecting one scrolls to that message, loading up to three pages of older history to reach it.
• Later replies in the conversation draw on its pinned messages, within a fixed size limit, and each reply's Context used disclosure shows which pinned messages it used.
• Participants see the pins but cannot change them.

Deleting a conversation

The author deletes a conversation from its actions menu. The confirmation says four things:

1. It is removed now, for you and for everyone it is shared with.
2. Actions promoted from it keep their own records.
3. Conversations copied from it, or that cited it, are erased with it.
4. Backup copies expire under the platform's verified backup bound.

What that means in practice:

• Copies and citing conversations go too (PLT-1897, PLT-1901). Deleting a conversation also erases every conversation copied from it and every conversation that cited it, whoever wrote them. The dialog says so in general terms: it gives no count and names no conversation and no person.
• Promoted actions stay. A task or change that someone created by promoting one of its suggested actions keeps its own record.
• You can delete only what you can open. A conversation its author can no longer open, for example after losing access to a project it drew on, shows "Conversation not available" like any other, without a Delete control. It cannot be deleted from the workspace.
• Erasure on request. Once governed erasure (PLT-1809) ships, an administrator erases such a conversation on request.
• Backups. A deleted conversation's content can remain in database backups until they expire. Neither the dialog nor this page names a period: that waits until the platform's backup bound has been verified (INF-753).

After a delete, the workspace opens a new draft, and the drawer returns to the task's list.

Turning conversations on: the mode switch

Two Project Tracker environment variables decide where conversations are kept. Project Tracker reads both at run time, not when it is built.

Variable	Values	Meaning
COORDINATOR_THREADS_MODE	off (the default), read-only, on	An unset value is off. An unknown value is also off, and is logged once.
COORDINATOR_THREADS_TENANT_IDS	optional, comma-separated tenant ids	When set, only the listed tenants get the configured mode, and every other tenant is off. This is how a small cohort is enrolled first.

What each mode does for a tenant:

• off. The workspace and the task drawer show the coordinator chat as it was, and conversations are not kept. Every thread route answers 404, except GET /api/coordinator/threads/settings.
• read-only. Conversations can be listed, searched, opened and read. Anything that adds content or widens access is refused: creating, renaming, archiving or unarchiving, sharing, pinning, linking a task, sending, retrying, and staging a suggested action. The composer says "Conversations are read-only right now." Deleting, removing a participant, unpinning and unlinking a task stay available, because they only remove.
• on. Everything on this page.

Switching a tenant off, or leaving it out of the cohort, deletes nothing: when the tenant is switched back on, its conversations reappear at the same URLs.

The workspace and the drawer read the tenant's mode from GET /api/coordinator/threads/settings, which answers in every mode with { "data": { "mode": "on" } } (or off, or read-only). If that read fails, the page shows an error with Try again instead of falling back to the old chat, so a tenant that is on never loses its conversations without noticing. The drawer reads the mode the first time it opens on a page.

Switching production on, and choosing its cohort, is a rollout decision (INF-753).

The thread API

The routes behind these screens live under /api/coordinator/threads in Project Tracker. They are listed in Project Tracker § Coordinator conversation threads, and documented in the generated Project Tracker API reference.