The conversational canvas at `/canvas` is a richer surface for multi-step agent runs than the flat chat drawer. A canvas run is a tree of nodes — every tool the agent calls, every human-approve gate, every branch, every reduce step is a node with parent + status. You see the run advance node-by-node and intervene on the ones that matter.
## Auto-plan from goal (D264)
When you create a canvas run, type a natural-language goal — "find every confidential doc older than one year and either archive or escalate to a partner." Then click **Auto-plan from goal (Claude)** on the canvas detail page. Claude Opus 4.6 receives the goal + the MCP tool catalog and returns a structured tree of pending nodes covering tool-calls, branch predicates, and human-approve gates. Every node lands as `pending` — **the LLM cannot cause a side effect, only suggest one.** Review each node, edit any input you don't trust, and click Advance to run the tool-calls one at a time.
Auto-plan is only available on a fresh run with zero nodes (so re-running is explicit — clear nodes and re-plan). Three failure paths surface inline: `llm-failed` (transient model error), `validation-error` (LLM produced an unparseable plan or invalid cross-references), `no-active-tenant`.
## The four node kinds
- **tool-call** — invokes an MCP tool. Click **Advance — run {toolName}** to execute. Schema-mismatch on input + handler-throws fail the node with an inline error so you can edit + retry. Captures input, output, and the resulting audit-event ids. - **human-approve** — the run paused for an admin decision. Cascade automatically flips this from `pending` to `waiting-on-human` when the upstream tool-call completes. Approve continues; Reject collapses the descendant subtree. - **branch** — evaluates a predicate against the parent tool-call's output. Three operator kinds: `truthy` (path resolves to non-empty value), `eq` (path equals a literal), `neq` (inverse). Activates the matching subtree, recursively skips the other. - **reduce** — fan-in from multiple parents. Declares its parents in `input.parentNodeIds` (1-20 named). When EVERY named parent reaches `done` or `skipped`, the reducer activates. Three reducer kinds: `concat` (collect outputs in declared order), `count` (count of done parents), `first-truthy` (first parent with a truthy output).
## How cascade works
When a tool-call completes successfully:
- `human-approve` children flip pending → waiting-on-human (signals the gate is reached). - `branch` children evaluate against the parent's output, activate the matching subtree, recursively skip the other. - `tool-call` children stay pending — operator clicks Advance to run them. - `reduce` children check whether all their named parents are now terminal; if yes, the reducer applies + the reduce node marks done + cascade fires for its own children.
## When to use a canvas instead of the chat drawer
Use a canvas when the workflow has more than one consequential write, when you want to gate at least one of those writes for admin approval, when the agent will fan out into parallel queries that converge later, or when you want to break a multi-step goal into reviewable chunks. Use the chat drawer for read-only Q&A, single-tool actions, and quick lookups where a tree-of-nodes is overkill.
## Audit posture
Every node and every status flip lands on the hash-chained audit log via 11 event types: `canvas-run.created`, `.plan-revised`, `.auto-planned`, `.advanced`, `.node-started`, `.node-completed`, `.node-paused`, `.node-approved`, `.node-rejected`, `.node-failed`, `.cancelled`. `/audit?eventType=canvas-run.node-approved` answers "every consequential decision an admin signed off on this quarter" in one query.
## Permissions
Only the run creator can advance + add nodes to their own runs. Only owner / admin can approve or reject a human-approve node — contributors can author the run but can't bless their own writes when a gate is reached. Cancel is the run creator only. Tools the agent invokes via Advance use the run creator's actorId for deny-wins ACL — there is no agent-bypass.