Plan a bounded Parallel Work Graph

Loads the exact stored deployment owned by the authenticated agent, then creates a tenant-bound graph and explicit branch rows through the governed planner. The stored deployment contract is authoritative for its agent/deployment binding, enabled state, model policy, action classes, consequences, receipts, approval controls, context, merge, and budgets. Planning enforces at most 20 branches, five collaboration rounds, 50 USDC per graph, and five USDC per branch. It does not automatically execute branches.

Callers may submit only the documented request fields. policy, budget, context_mode, and merge_strategy are whitelisted narrowing inputs: they may preserve or reduce stored authority but cannot force-enable parallel work, add allowed actions, remove blocked actions, disable consequences/receipts/approval, widen context or budgets, or change a policy with no safe narrowing order. Unknown overrides and non-empty model_policy are rejected. Caller deployment, deployment_plan, and tenant_config objects are never request authority. Every branch context-source request is intersected with the deployment boundary, and an invalid or out-of-bound source rejects the full plan before any graph or branch row persists. Execute-mode planning additionally requires effective context_mode: none; micro_ecf or full_ecf returns parallel_context_authority_unavailable before any persistence. Dry-run planning may retain non-none context as non-executing metadata only, performs no dispatch, and grants no runtime context-source or provider authority. Non-empty caller target aliases invocation_target, capability_id, and target_capability_id are rejected before review or persistence. The only accepted dispatch_mode is execute; persisted dispatch metadata is server-owned, pinned to execute, and carries no caller-selected invocation target.

Shared context defaults to disabled. A request for policy.shared_context_mode: shadow is accepted only when FLEET_SHARED_CONTEXT_SHADOW_ENABLED normalizes to true and the authenticating agent ID exactly matches the comma-delimited FLEET_SHARED_CONTEXT_SHADOW_AGENT_IDS allowlist. The allowlist permits at most 32 unique, non-empty, non-wildcard IDs, each at most 128 characters; malformed configuration fails closed. Shadow mode is observational, grants no authority, and cannot become execution input.