feat(orchestrator): S5 Tasks with choices, Gantt, estimates and burn charts

Requirement 001 phase 6, S5:

- Tasks tab: every pending ask, rule request, operator row and choice
  card shows under "waits on Operator"; a choice request goes out on a
  fixed channel button, post and call with an agent multi-select, and a
  click on an option sends a passkey-signed answer the agent checks with
  operator_message. The unsigned /api/decisions/<id>/choose route is
  gone, and a decision, choice answer or choice recipient whose name
  holds "*" is refused, so a signed answer never reaches every agent.
- Gantt view: one bar per task from start to end (running to now), one
  arrow per explicit, branch-base and queue-order edge, hatched forecast
  bars (always, points only, real only) from the median duration or
  points times median hours per point.
- rasci.py set --after/--drop-after stores task dependencies and refuses
  unknown tasks and cycles.
- Estimation toggle (No estimate default, Story points) is stored in the
  hub settings; burndown and burnup per whole register, list filter or
  one agent or line, counting tasks or summing complexity with the
  unestimated tasks as their own line.
- New skill kvb-org-queue-estimate: "Request estimates" (story points
  mode, passkey-signed board action) or the skill sends exactly one
  newsletter listing every unestimated task with its RASCI parties; a
  party name that is no plain name shows as "unnamed party".
- Business value per task or in bulk is stored only with a verified
  passkey assertion over the exact ids and values; WSJF uses it instead
  of the median. The task list sorts by every decision-50 mode both ways.
- e2e: the walk's pending ask lives an hour instead of 60 s, and the
  CDP and BiDi drivers retry removing the browser profile while the
  browser exits (ENOTEMPTY).

Evidence: make test 709 OK, ruff and markdownlint clean
(/tmp/s5-make-test-fix-2.log); e2e 26 OK in Chromium and Firefox
(/tmp/s5-e2e-fix-2.log); MEDUSA 50 files, an independent skeptic
rejected four holes (unsigned choose route, unsigned estimates request,
free-text party names, "*" recipients incl. normalizer bypasses), all
fixed and re-verified, the 8 remaining pattern hits accepted, rescan 0
open.

🎯 Fix: 92 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/kvb_orchestrator/asking.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import time
 
+from .choosing import EVERYONE, answer_text
 from .errors import Conflict, Missing, ToolError
 from .fields import (
     COMMAND_LIMIT,
@@ -35,7 +36,13 @@ def ask_row(ask: dict, names: dict[str, str]) -> dict:
 
 
 def decision_state(decision: dict) -> dict:
-    return {key: decision[key] for key in ("id", "status", "choice", "decided")}
+    """Returns:
+        The status and choice, with the id and text of the operator's
+        passkey-signed answer when a click chose it, else None for both.
+    """
+    message = decision.get("message")
+    answer = None if message is None else answer_text(decision, decision["choice"])
+    return {**{key: decision[key] for key in ("id", "status", "choice", "decided")}, "message": message, "answer": answer}
 
 
 def decision_row(decision: dict) -> dict:
@@ -87,20 +94,7 @@ class Asking:
             if not changed:
                 raise Conflict(ask_state(decided, time.time()))
             return ask_state(decided, time.time())
-        if kind_name != "decisions" or verb != "choose":
-            raise Missing(verb)
-        payload = decode(body)
-        expect(payload, ("label",))
-        label = field(payload, "label")
-        record = self.decisions.get(item_id)
-        if record is None:
-            raise Missing(item_id)
-        if label not in [option["label"] for option in record["options"]]:
-            raise ToolError(f"label must be one of the options of decision {item_id}")
-        decided, changed = self.decisions.decide(item_id, {"status": "decided", "choice": label})
-        if not changed:
-            raise Conflict(decision_state(decided))
-        return decision_state(decided)
+        raise Missing(verb)
 
     def decision_request(self, arguments: dict) -> dict:
         expect(arguments, ("question", "options", "agent", "recommended"))
@@ -114,7 +108,10 @@ class Asking:
         recommended = arguments["recommended"]
         if not isinstance(recommended, str) or recommended.strip() not in ["", *(option["label"] for option in parsed)]:
             raise ToolError("recommended must be one of the option labels or an empty string")
-        fields = {"question": question, "options": parsed, "agent": field(arguments, "agent").strip(), "recommended": recommended.strip()}
+        asker = field(arguments, "agent").strip()
+        if EVERYONE in asker:
+            raise ToolError(f"agent names the asking agent, never a name with {EVERYONE}")
+        fields = {"question": question, "options": parsed, "agent": asker, "recommended": recommended.strip()}
         record = self.decisions.add({**fields, "status": "pending", "choice": None, "decided": None, "created_ts": time.time()})
         self.automate("decision", record)
         return {"id": record["id"], "status": record["status"], "url": self.url()}