Welcome path navigator, Practical Next Steps chips (user-voice, diversity, refresh), and distinct advisor personas.

cybersecurity_config.yaml

@@ -221,17 +221,19 @@ personas:
     - Prefer one high-value follow-up over a list of questions.
     - If urgency is high (active incident / "was I hacked"), lead with immediate first steps before profiling.
     - If the user profile, conversation, or summaries name a goal or project, use it. When they say "my goal" or "custom security goal", name that goal in Thought and make every What-to-do bullet specific to it. Do not give generic phases as if you had no context.
+    - You are one specialist on a panel answering in parallel. Fill Thought / What to do / Next step from YOUR role only. Do not open Thought by restating the question as "To [verb] …" or "Here's a step-by-step approach." Do not emit a generic curriculum (purpose / scope / basics / research-plan-write) unless that is truly your specialty. Fiction and creative asks still get YOUR professional lens, not a shared syllabus.
 
     **Formatting (Compact Markdown v1):**
     - Use GitHub-Flavored Markdown.
-    - Output exactly three sections in this order:
-      - `### Thought` — complete reasoning or context in 1–2 finished sentences (never cut mid-sentence into the next section; never use … or ...).
-      - `### What to do` — exactly 3 concrete action bullets as plain complete imperatives (no bold title prefixes); each a distinct actionable step (not leftover thought prose).
-      - `### Next step` — one imperative sentence that is NOT a copy or near-paraphrase of the first What-to-do bullet; name the single most important action to start with now.
+    - Output exactly three sections in this order (shared headings; your content must still be unique):
+      - `### Thought` — YOUR specialist take in 1–2 finished sentences (never cut mid-sentence into the next section; never use … or ...).
+      - `### What to do` — exactly 3 concrete action bullets as plain complete imperatives (no bold title prefixes); each a distinct artifact of YOUR specialty (not leftover thought prose, not the same three phases every advisor would write).
+      - `### Next step` — one imperative sentence that is NOT a copy or near-paraphrase of the first What-to-do bullet; the next action YOUR role would assign now.
     - Use `###` for headings, `-` for bullets (no unicode bullets), keep number text on the same line (e.g., `1. Do X`).
     - Insert one blank line between blocks.
     - Never put actions under Thought, and never put reasoning bullets under What to do.
     - Never truncate with ellipsis; finish every sentence and bullet.
+    - Stay short; do not pad to match other advisors.
 
   personas_dir: "personas/cyber_advisors"
 

frontend/src/App.js

@@ -227,6 +227,7 @@ function App() {
               onNavigateToHome={navigateToHome}
               onNavigateToCanvas={navigateToCanvas}
               onNavigateToJourney={navigateToJourney}
+              onNavigateToSignup={navigateToAuth}
               onSignOut={handleSignOut}
               onUserUpdate={setUser}
               chatNavView={chatNavView}

frontend/src/components/IntakePanel.js

@@ -1,39 +1,75 @@
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import * as LucideIcons from 'lucide-react';
+import { ChevronRight } from 'lucide-react';
 import { useAppConfig } from '../contexts/AppConfigContext';
 import SecurityChatBotIcon from './icons/SecurityChatBotIcon';
 import { goalCacheKey } from '../utils/statedGoal';
 import { loadStarterGreeting, saveStarterGreeting } from '../utils/starterCache';
+import { PATH_SECTION_TITLE } from '../data/advisorPaths';
+import {
+  getAvailableSteps,
+  loadPathProgress,
+  markStepComplete,
+  mergeAutoCompletions,
+  savePathProgress,
+} from '../utils/advisorPathProgress';
 import '../styles/IntakePanel.css';
 
 const STATIC_GREETING = 'What cybersecurity problem should we work on first?';
 const STATIC_SUBHEADER =
-  'I can help with threats, controls, incidents, compliance, or your security career.';
+  'Explore the panel step by step — or jump straight to a suggested question below.';
 
-/**
- * First-session intake: goal-specific greeting + chips + optional free-text.
- * Chips come from /api/config → chat_page.intake, filtered by guest persona when set.
- */
 const IntakePanel = ({
-  onSubmit,
   guestPersona = null,
   authToken = null,
   user = null,
   statedGoal = '',
+  pathSignals = {},
+  onOpenProfile,
+  onNavigateToJourney,
+  onNavigateToCanvas,
+  onOpenUserGuide,
+  onOpenModelStatus,
+  onNavigateToSignup,
+  onPathStepComplete,
 }) => {
   const { config } = useAppConfig();
   const intake = config?.chat_page?.intake || {};
   const yamlGreeting = intake.greeting || STATIC_GREETING;
   const yamlSubheader = intake.greeting_subheader || STATIC_SUBHEADER;
+  const isGuest = Boolean(user?.is_guest);
 
+  const userKey = user?.id || user?._id || user?.email || (isGuest ? 'guest' : '');
   const cacheKey = useMemo(
-    () => goalCacheKey(statedGoal, user?.id || user?._id || user?.email || (user?.is_guest ? 'guest' : '')),
-    [statedGoal, user],
+    () => goalCacheKey(statedGoal, userKey),
+    [statedGoal, userKey],
   );
 
   const cached = useMemo(() => loadStarterGreeting(cacheKey), [cacheKey]);
 
   const [greeting, setGreeting] = useState(cached?.greeting || yamlGreeting);
   const [subheader, setSubheader] = useState(cached?.subheader || yamlSubheader);
+  const [expandedId, setExpandedId] = useState(null);
+  const [progress, setProgress] = useState(() => loadPathProgress(userKey));
+
+  useEffect(() => {
+    setProgress(loadPathProgress(userKey));
+  }, [userKey]);
+
+  useEffect(() => {
+    setProgress((prev) => {
+      const merged = mergeAutoCompletions(prev.completed, pathSignals);
+      if (
+        merged.length === prev.completed.length
+        && merged.every((id, i) => id === prev.completed[i])
+      ) {
+        return prev;
+      }
+      const next = { ...prev, completed: merged };
+      savePathProgress(userKey, next);
+      return next;
+    });
+  }, [pathSignals, userKey]);
 
   useEffect(() => {
     const stored = loadStarterGreeting(cacheKey);
@@ -82,73 +118,149 @@ const IntakePanel = ({
     };
   }, [authToken, cacheKey, yamlGreeting, yamlSubheader]);
 
-  const chips = useMemo(() => {
-    const byPersona = intake.by_persona || {};
-    const personaKey = (guestPersona || '').toLowerCase();
-    const personaChips = personaKey && Array.isArray(byPersona[personaKey])
-      ? byPersona[personaKey]
-      : null;
-    if (personaChips && personaChips.length > 0) return personaChips;
-    return Array.isArray(intake.chips) ? intake.chips : [];
-  }, [intake, guestPersona]);
-
-  const [freeText, setFreeText] = useState('');
-  const [showFreeText, setShowFreeText] = useState(false);
-
-  const handleChip = (chip) => {
-    if (chip.free_text) {
-      setShowFreeText(true);
-      return;
+  const completed = progress.completed;
+  const nextSteps = useMemo(
+    () => getAvailableSteps({ completed, isGuest, limit: 4 }),
+    [completed, isGuest],
+  );
+
+  const completeStep = useCallback((stepId) => {
+    const nextCompleted = markStepComplete(completed, stepId);
+    const next = { completed: nextCompleted, activeId: null };
+    setProgress(next);
+    savePathProgress(userKey, next);
+    setExpandedId(null);
+    onPathStepComplete?.(stepId);
+  }, [completed, onPathStepComplete, userKey]);
+
+  const runAction = useCallback((node) => {
+    const { type, label } = node.action;
+    switch (type) {
+      case 'scroll_suggestions':
+        document.querySelector('.suggestions-panel')?.scrollIntoView({ behavior: 'smooth', block: 'start' });
+        break;
+      case 'open_profile':
+        onOpenProfile?.();
+        break;
+      case 'navigate_journey':
+        onNavigateToJourney?.();
+        break;
+      case 'navigate_canvas':
+        onNavigateToCanvas?.();
+        break;
+      case 'open_user_guide':
+        if (onOpenUserGuide) onOpenUserGuide();
+        else window.dispatchEvent(new CustomEvent('open-user-guide'));
+        break;
+      case 'open_model_status':
+        onOpenModelStatus?.();
+        break;
+      case 'navigate_signup':
+        onNavigateToSignup?.();
+        break;
+      case 'none':
+      default:
+        break;
     }
-    if (chip.prompt) onSubmit(chip.prompt);
-  };
+    completeStep(node.id);
+    return label;
+  }, [
+    completeStep,
+    onNavigateToCanvas,
+    onNavigateToJourney,
+    onNavigateToSignup,
+    onOpenModelStatus,
+    onOpenProfile,
+    onOpenUserGuide,
+  ]);
 
-  const handleFreeSubmit = (e) => {
-    e.preventDefault();
-    const text = freeText.trim();
-    if (!text) return;
-    onSubmit(text);
-    setFreeText('');
-  };
+  const resolveIcon = (name) => LucideIcons[name] || LucideIcons.Circle;
 
   return (
-    <div className="intake-panel" role="region" aria-label="Getting started">
+    <div className="intake-panel" role="region" aria-label="Get oriented">
       <div className="intake-avatar" aria-hidden="true">
         <SecurityChatBotIcon size={22} />
       </div>
       <h2 className="intake-greeting">{greeting}</h2>
       {subheader ? <p className="intake-sub">{subheader}</p> : null}
-      <div className="intake-chips">
-        {chips.map((chip) => (
-          <button
-            key={chip.id}
-            type="button"
-            className={`intake-chip${chip.free_text ? ' intake-chip--other' : ''}`}
-            onClick={() => handleChip(chip)}
-          >
-            {chip.label}
-          </button>
-        ))}
+
+      <div className="advisor-path">
+        <div className="advisor-path-header">
+          <h3 className="advisor-path-title">{PATH_SECTION_TITLE}</h3>
+        </div>
+
+        {nextSteps.length === 0 ? (
+          <p className="advisor-path-all-done">
+            You&apos;ve explored the main paths — use the suggestions below for your next question.
+          </p>
+        ) : (
+          <ul className="advisor-path-steps">
+            {nextSteps.map((node) => {
+              const Icon = resolveIcon(node.icon);
+              const expanded = expandedId === node.id;
+              return (
+                <li key={node.id} className={`advisor-path-step${expanded ? ' is-expanded' : ''}`}>
+                  <button
+                    type="button"
+                    className="advisor-path-step-btn"
+                    aria-expanded={expanded}
+                    onClick={() => setExpandedId(expanded ? null : node.id)}
+                  >
+                    <span className="advisor-path-step-icon" aria-hidden="true">
+                      <Icon size={16} />
+                    </span>
+                    <span className="advisor-path-step-text">
+                      <span className="advisor-path-step-title">{node.title}</span>
+                      <span className="advisor-path-step-tagline">{node.tagline}</span>
+                    </span>
+                    <ChevronRight
+                      size={16}
+                      className={`advisor-path-step-chevron${expanded ? ' is-open' : ''}`}
+                      aria-hidden="true"
+                    />
+                  </button>
+                  {expanded && (
+                    <div className="advisor-path-step-detail">
+                      <p>{node.guide}</p>
+                      <button
+                        type="button"
+                        className="advisor-path-action"
+                        onClick={() => runAction(node)}
+                      >
+                        {node.action.label || 'Continue'}
+                      </button>
+                    </div>
+                  )}
+                </li>
+              );
+            })}
+          </ul>
+        )}
+
+        {isGuest && (
+          <p className="advisor-path-guest-note">
+            <KeyRoundIcon />
+            Guest mode — progress is saved in this browser only.
+            {' '}
+            <button
+              type="button"
+              className="advisor-path-guest-link"
+              onClick={() => onNavigateToSignup?.()}
+            >
+              Create an account
+            </button>
+            {' '}
+            to keep chats, profile, and journey across devices.
+          </p>
+        )}
       </div>
-      {(showFreeText || chips.length === 0) && (
-        <form className="intake-freetext" onSubmit={handleFreeSubmit}>
-          <label htmlFor="intake-free" className="sr-only">
-            Describe your cybersecurity need
-          </label>
-          <textarea
-            id="intake-free"
-            rows={3}
-            value={freeText}
-            onChange={(e) => setFreeText(e.target.value)}
-            placeholder="Tell me about the cybersecurity problem or goal you have today…"
-          />
-          <button type="submit" className="intake-submit" disabled={!freeText.trim()}>
-            Start
-          </button>
-        </form>
-      )}
     </div>
   );
 };
 
+function KeyRoundIcon() {
+  const Icon = LucideIcons.KeyRound;
+  return <Icon size={14} className="advisor-path-guest-icon" aria-hidden="true" />;
+}
+
 export default IntakePanel;

frontend/src/components/SuggestionsPanel.js

@@ -1,5 +1,6 @@
 // src/components/SuggestionsPanel.js
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { RotateCw } from 'lucide-react';
 import { useAppConfig } from '../contexts/AppConfigContext';
 import { goalCacheKey } from '../utils/statedGoal';
 import { loadStarterSuggestions, saveStarterSuggestions } from '../utils/starterCache';
@@ -8,8 +9,14 @@ import {
   applyFallbackIfTimedOut,
   applySlotDelta,
   applySlotDone,
+  applySlotRefreshing,
   buildStarterSlots,
-  slotsToCategories,
+  collectExcludeKeys,
+  nextPromptVariation,
+  normalizeSuggestion,
+  slotsToFlatList,
+  suggestionChatPrompt,
+  suggestionDisplayText,
   visiblePrompts,
 } from '../utils/starterSuggestionsUi';
 
@@ -18,6 +25,8 @@ async function fetchStarterSuggestions({
   count,
   exclude,
   categoryTitles,
+  slotIndex,
+  promptVariation,
   signal,
 }) {
   if (!authToken) return [];
@@ -34,6 +43,8 @@ async function fetchStarterSuggestions({
           count,
           exclude,
           category_titles: categoryTitles,
+          slot_index: slotIndex,
+          prompt_variation: promptVariation,
         }),
         signal,
       }
@@ -42,8 +53,8 @@ async function fetchStarterSuggestions({
     const data = await response.json();
     if (!Array.isArray(data.suggestions)) return [];
     return data.suggestions
-      .map((item) => (typeof item === 'string' ? item.trim() : ''))
-      .filter(Boolean);
+      .map((item) => normalizeSuggestion(item))
+      .filter((item) => suggestionChatPrompt(item));
   } catch (err) {
     if (err?.name === 'AbortError') return [];
     return [];
@@ -56,18 +67,77 @@ function restoreSlotsFromCache(examples, cached) {
   if (!Array.isArray(saved) || saved.length === 0) return null;
   saved.forEach((item) => {
     const idx = typeof item.slot === 'number' ? item.slot : -1;
-    if (idx < 0 || idx >= slots.length || !item.text) return;
+    if (idx < 0 || idx >= slots.length) return;
+    const suggestion = normalizeSuggestion(item.suggestion || item.text, slots[idx].fallback);
     slots[idx] = {
       ...slots[idx],
-      text: item.text,
+      suggestion,
+      text: suggestionDisplayText(suggestion),
       pending: false,
       generated: item.generated !== false,
+      promptVariation: typeof item.promptVariation === 'number'
+        ? item.promptVariation
+        : slots[idx].promptVariation,
     };
   });
   if (!slots.some((s) => s.text)) return null;
   return slots;
 }
 
+function SuggestionChip({
+  slotItem,
+  onSelect,
+  onRefresh,
+}) {
+  const {
+    slot,
+    suggestion,
+    displayText,
+    isPending,
+    refreshing,
+  } = slotItem;
+  const question = (suggestion?.question || '').trim();
+  const disabled = !displayText && !refreshing;
+  const label = displayText || (isPending ? 'Writing a question…' : '');
+
+  return (
+    <div className="suggestion-chip-wrap">
+      <button
+        type="button"
+        disabled={disabled}
+        onClick={() => onSelect(slotItem)}
+        className={[
+          'suggestion-button',
+          isPending ? 'suggestion-pending' : '',
+          refreshing ? 'suggestion-refreshing' : '',
+        ].filter(Boolean).join(' ')}
+        aria-label={displayText || 'Suggested question'}
+      >
+        <span className="suggestion-chip-text">
+          {question && !isPending ? (
+            <strong className="suggestion-chip-question">{question}</strong>
+          ) : (
+            label
+          )}
+        </span>
+      </button>
+      <button
+        type="button"
+        className="suggestion-refresh-btn"
+        aria-label="Refresh this suggestion"
+        title="Refresh suggestion"
+        disabled={refreshing || isPending}
+        onClick={(event) => {
+          event.stopPropagation();
+          onRefresh(slot);
+        }}
+      >
+        <RotateCw size={14} className={refreshing ? 'suggestion-refresh-spin' : ''} />
+      </button>
+    </div>
+  );
+}
+
 const SuggestionsPanel = ({
   onSuggestionClick,
   guestPersona = null,
@@ -76,7 +146,7 @@ const SuggestionsPanel = ({
   statedGoal = '',
   onSuggestionsReady = null,
 }) => {
-  const { config, resolveIcon } = useAppConfig();
+  const { config } = useAppConfig();
 
   const examples = useMemo(() => {
     const chatPage = config?.chat_page || {};
@@ -99,11 +169,9 @@ const SuggestionsPanel = ({
   const usedRef = useRef(new Set());
   slotsRef.current = slots;
   const readyNotified = useRef('');
+  const refreshAbortRef = useRef(null);
 
-  const categories = useMemo(
-    () => slotsToCategories(examples, slots),
-    [examples, slots],
-  );
+  const flatSlots = useMemo(() => slotsToFlatList(slots), [slots]);
 
   useEffect(() => {
     const current = slotsRef.current || [];
@@ -184,7 +252,7 @@ const SuggestionsPanel = ({
             if (payload.type === 'delta') {
               setSlots((prev) => applySlotDelta(prev, payload.slot, payload.text || ''));
             } else if (payload.type === 'done') {
-              setSlots((prev) => applySlotDone(prev, payload.slot, payload.text || ''));
+              setSlots((prev) => applySlotDone(prev, payload.slot, payload));
             }
           }
         }
@@ -208,95 +276,88 @@ const SuggestionsPanel = ({
       slots: slots.map((s) => ({
         slot: s.slot,
         text: s.text,
+        suggestion: s.suggestion,
         generated: s.generated,
+        promptVariation: s.promptVariation,
       })),
     });
   }, [slots, cacheKey]);
 
-  const handleChipClick = (categoryIndex, suggestionIndex, text) => {
-    if (!text) return;
-    onSuggestionClick(text);
-    usedRef.current.add(text);
+  const regenerateSlot = useCallback(async (slotIndex, { markUsed = null } = {}) => {
     if (!authToken) return;
+    const slot = slotsRef.current.find((s) => s.slot === slotIndex);
+    if (!slot) return;
+
+    refreshAbortRef.current?.abort();
+    const controller = new AbortController();
+    refreshAbortRef.current = controller;
+
+    const variation = nextPromptVariation(slot.promptVariation);
+    setSlots((prev) => applySlotRefreshing(prev, slotIndex, true));
 
-    const visible = visiblePrompts(slotsRef.current);
-    const exclude = [...new Set([...usedRef.current, ...visible])];
-    const title = examples[categoryIndex]?.title;
-    const slot = slotsRef.current.find(
-      (s) => s.categoryIndex === categoryIndex && s.suggestionIndex === suggestionIndex,
+    const exclude = collectExcludeKeys(
+      slotsRef.current.filter((s) => s.slot !== slotIndex),
+      markUsed ? [markUsed] : [...usedRef.current],
     );
 
-    fetchStarterSuggestions({
+    const generated = await fetchStarterSuggestions({
       authToken,
       count: 1,
       exclude,
-      categoryTitles: title ? [title] : [],
-    }).then((generated) => {
-      const replacement = generated[0];
-      if (!replacement || slot == null) return;
-      setSlots((prev) => applySlotDone(prev, slot.slot, replacement));
+      categoryTitles: slot.categoryTitle ? [slot.categoryTitle] : [],
+      slotIndex,
+      promptVariation: variation,
+      signal: controller.signal,
     });
+
+    const replacement = generated[0];
+    if (!replacement) {
+      setSlots((prev) => applySlotRefreshing(prev, slotIndex, false));
+      return;
+    }
+
+    setSlots((prev) => {
+      const next = applySlotDone(prev, slotIndex, { suggestion: replacement });
+      const updated = next[slotIndex];
+      if (updated) {
+        next[slotIndex] = {
+          ...updated,
+          promptVariation: variation,
+        };
+      }
+      return next;
+    });
+  }, [authToken]);
+
+  const handleChipClick = (slotItem) => {
+    const chatPrompt = suggestionChatPrompt(slotItem.suggestion);
+    if (!chatPrompt) return;
+    onSuggestionClick(chatPrompt);
+    usedRef.current.add(chatPrompt);
+    regenerateSlot(slotItem.slot, { markUsed: chatPrompt });
+  };
+
+  const handleRefreshClick = (slotIndex) => {
+    regenerateSlot(slotIndex);
   };
 
+  useEffect(() => () => refreshAbortRef.current?.abort(), []);
+
   return (
     <div className="suggestions-panel">
       <div className="suggestions-header">
-        <h2 className="suggestions-title">Getting Started</h2>
+        <h2 className="suggestions-title">Practical Next Steps</h2>
       </div>
-      
-      <div className="suggestions-grid">
-        {categories.map((category, categoryIndex) => {
-          const Icon = resolveIcon(category.icon);
-          return (
-            <div key={categoryIndex} className="suggestion-category">
-              <div className="category-header">
-                <div 
-                  className="category-icon"
-                  style={{ 
-                    backgroundColor: category.bg_color || '#F3F4F6',
-                    color: category.color || '#6B7280'
-                  }}
-                >
-                  <Icon size={16} />
-                </div>
-                <h3 
-                  className="category-title"
-                  style={{ color: category.color || '#6B7280' }}
-                >
-                  {category.title}
-                </h3>
-              </div>
-              
-              <div className="suggestion-buttons">
-                {(category.suggestions || []).map((suggestion, suggestionIndex) => {
-                  const pending = category.pending?.[suggestionIndex];
-                  const label = suggestion || (pending ? 'Writing a question…' : '');
-                  return (
-                    <button
-                      key={`${categoryIndex}-${suggestionIndex}`}
-                      type="button"
-                      disabled={!suggestion}
-                      onClick={() => handleChipClick(categoryIndex, suggestionIndex, suggestion)}
-                      className={
-                        pending
-                          ? 'suggestion-button suggestion-pending'
-                          : 'suggestion-button'
-                      }
-                      style={{
-                        borderColor: (category.color || '#6B7280') + '20',
-                        '--hover-bg': category.bg_color || '#F3F4F6',
-                        '--hover-border': category.color || '#6B7280',
-                        '--hover-text': category.color || '#6B7280',
-                      }}
-                    >
-                      {label}
-                    </button>
-                  );
-                })}
-              </div>
-            </div>
-          );
-        })}
+
+      <div className="suggestions-flat-list">
+        {flatSlots.map((slotItem) => (
+          <SuggestionChip
+            key={slotItem.slot}
+            slotItem={slotItem}
+            onSelect={handleChipClick}
+            onRefresh={handleRefreshClick}
+          />
+        ))}
       </div>
     </div>
   );

frontend/src/data/advisorPaths.js

@@ -0,0 +1,141 @@
+/**
+ * Non-linear onboarding paths for the chat welcome screen.
+ * Only root nodes (tier 0) show initially; deeper steps unlock as prerequisites complete.
+ */
+
+export const PATH_SECTION_TITLE = 'Find your way';
+
+/** @typedef {'scroll_suggestions'|'open_profile'|'navigate_journey'|'navigate_canvas'|'open_user_guide'|'open_model_status'|'navigate_signup'|'none'} PathActionType */
+
+/**
+ * @typedef {Object} PathNode
+ * @property {string} id
+ * @property {number} tier
+ * @property {string} title
+ * @property {string} tagline
+ * @property {string} guide
+ * @property {{ type: PathActionType, label?: string }} action
+ * @property {string[]} [requires] - all must be completed
+ * @property {string[]} [requiresAny] - at least one must be completed
+ * @property {string} icon - Lucide icon name
+ * @property {boolean} [guestOnly]
+ * @property {boolean} [signedInOnly]
+ */
+
+/** @type {PathNode[]} */
+export const PATH_NODES = [
+  {
+    id: 'first-question',
+    tier: 0,
+    title: 'Ask your first question',
+    tagline: 'Start with a suggested prompt',
+    guide:
+      'Scroll to “Practical Next Steps” and tap any chip. Your panel answers in the carousel — no need to pick a topic up here.',
+    action: { type: 'scroll_suggestions', label: 'Show suggestions' },
+    icon: 'MessageCircle',
+  },
+  {
+    id: 'your-profile',
+    tier: 0,
+    title: 'Build your profile',
+    tagline: 'Role, org & context',
+    guide:
+      'Open About You and add a few facts — who you are, what you protect, and what you’re worried about. Advisors use this in every reply.',
+    action: { type: 'open_profile', label: 'Open About You' },
+    icon: 'UserCircle',
+  },
+  {
+    id: 'your-journey',
+    tier: 0,
+    title: 'Set your journey',
+    tagline: 'Goal → milestones',
+    guide:
+      'The Journey page turns a security goal into trackable steps — baseline hardening, audit prep, IR readiness, or career growth.',
+    action: { type: 'navigate_journey', label: 'Open Journey' },
+    icon: 'Map',
+  },
+  {
+    id: 'your-workspace',
+    tier: 0,
+    title: 'Open workspace',
+    tagline: 'Drafts & references',
+    guide:
+      'Workspace is where you pin sources, build checklists, and draft policies. Search arXiv, NIST, NVD, and CISA without leaving the app.',
+    action: { type: 'navigate_canvas', label: 'Open workspace' },
+    icon: 'FileText',
+  },
+  {
+    id: 'stated-goal',
+    tier: 1,
+    title: 'Name your priority',
+    tagline: 'One line advisors remember',
+    guide:
+      'Add a stated goal in About You — e.g. “SOC 2 for a 50-person SaaS” or “home network hardening.” Starters and follow-ups adapt to it.',
+    action: { type: 'open_profile', label: 'Set your goal' },
+    requiresAny: ['your-profile', 'your-journey'],
+    icon: 'Target',
+  },
+  {
+    id: 'add-references',
+    tier: 1,
+    title: 'Add reference material',
+    tagline: 'Upload or paste sources',
+    guide:
+      'Attach PDFs in chat, paste from your clipboard into context, or pull citations from workspace search. Ground advice in your policies and standards.',
+    action: { type: 'open_user_guide', label: 'See how' },
+    requiresAny: ['your-workspace', 'first-question'],
+    icon: 'BookmarkPlus',
+  },
+  {
+    id: 'pick-advisors',
+    tier: 1,
+    title: 'Shape your panel',
+    tagline: 'Turn specialists on/off',
+    guide:
+      'Use the advisor menu in the header to add or remove experts. Jerry stays as lead; invite compliance, IR, or career mentors when the topic fits.',
+    action: { type: 'none', label: 'Got it' },
+    requires: ['first-question'],
+    icon: 'Users',
+  },
+  {
+    id: 'explore-guide',
+    tier: 1,
+    title: 'Skim the user guide',
+    tagline: '2-minute feature map',
+    guide:
+      'The guide covers chat, workspace widgets, Journey tracks, and profile memory — useful when you want the full layout before diving in.',
+    action: { type: 'open_user_guide', label: 'Open guide' },
+    requiresAny: ['first-question', 'your-workspace'],
+    icon: 'BookOpen',
+  },
+  {
+    id: 'model-status',
+    tier: 2,
+    title: 'Check advisor availability',
+    tagline: 'See who’s online',
+    guide:
+      'Settings → Model Status probes each advisor endpoint. Unavailable models are hidden from the panel so you’re not waiting on a dead API.',
+    action: { type: 'open_model_status', label: 'Open model status' },
+    requires: ['first-question'],
+    signedInOnly: true,
+    icon: 'Activity',
+  },
+  {
+    id: 'save-progress',
+    tier: 2,
+    title: 'Create an account',
+    tagline: 'Keep chats & progress',
+    guide:
+      'Guest mode is temporary. Sign up to save profile, Journey, workspace layout, and chat history across devices.',
+    action: { type: 'navigate_signup', label: 'Create account' },
+    requiresAny: ['your-profile', 'your-journey', 'first-question'],
+    guestOnly: true,
+    icon: 'KeyRound',
+  },
+];
+
+export const ROOT_NODE_IDS = PATH_NODES.filter((n) => n.tier === 0).map((n) => n.id);
+
+export function getPathNode(id) {
+  return PATH_NODES.find((n) => n.id === id) || null;
+}

frontend/src/pages/ChatPage.js

@@ -33,6 +33,13 @@ import {
   putPrefetchedStream,
   readNdjsonLines,
 } from '../utils/starterPrefetchCache';
+import {
+  loadPathProgress,
+  loadVisits,
+  markStepComplete,
+  recordVisit,
+  savePathProgress,
+} from '../utils/advisorPathProgress';
 
 const ACTIVE_ADVISORS_STORAGE_KEY = 'cybersecurityActiveAdvisorIds';
 
@@ -55,6 +62,7 @@ const ChatPage = ({
   onNavigateToHome,
   onNavigateToCanvas,
   onNavigateToJourney,
+  onNavigateToSignup,
   onSignOut,
   chatNavView = null,
   chatStarterNonce = 0,
@@ -122,6 +130,42 @@ const ChatPage = ({
   const prefetchBusyRef = useRef(false);
   const prefetchAbortRef = useRef(null);
   const prefetchUserKey = user?.id || user?._id || user?.email || (user?.is_guest ? 'guest' : 'user');
+  const pathUserKey = prefetchUserKey;
+
+  const pathSignals = useMemo(() => {
+    const visits = loadVisits(pathUserKey);
+    const profileFields = ['cyber_role', 'organization_type', 'current_goals', 'knowledge_level', 'compliance_focus'];
+    const hasProfileFacts = Boolean(
+      userProfile && profileFields.some((field) => {
+        const val = userProfile[field];
+        return Array.isArray(val) ? val.length > 0 : Boolean(String(val || '').trim());
+      }),
+    );
+    return {
+      hasChats: messages.some((m) => m.type === 'user' && !m.isReferenceSnippet),
+      hasProfileFacts,
+      hasStatedGoal: Boolean((statedGoal || '').trim()),
+      visitedJourney: Boolean(visits.journey),
+      visitedWorkspace: Boolean(visits.workspace),
+    };
+  }, [messages, pathUserKey, statedGoal, userProfile]);
+
+  const markPathStep = useCallback((stepId) => {
+    const prev = loadPathProgress(pathUserKey);
+    const completed = markStepComplete(prev.completed, stepId);
+    if (completed.length === prev.completed.length) return;
+    savePathProgress(pathUserKey, { ...prev, completed });
+  }, [pathUserKey]);
+
+  const handleNavigateToJourney = useCallback(() => {
+    recordVisit(pathUserKey, 'journey');
+    onNavigateToJourney?.();
+  }, [onNavigateToJourney, pathUserKey]);
+
+  const handleNavigateToCanvas = useCallback(() => {
+    recordVisit(pathUserKey, 'workspace');
+    onNavigateToCanvas?.();
+  }, [onNavigateToCanvas, pathUserKey]);
 
   const loadProfile = async () => {
     try {
@@ -722,6 +766,10 @@ const handleNewChat = async (sessionId = null) => {
   const handleSendMessage = async (inputMessage) => {
     if (!inputMessage.trim()) return;
 
+    if (messages.length === 0) {
+      markPathStep('first-question');
+    }
+
     // Create user message
     const userMessage = {
       id: generateMessageId(),
@@ -1144,7 +1192,7 @@ const handleNewChat = async (sessionId = null) => {
         onSidebarToggle={handleSidebarToggle}
         isMobileOpen={isMobileMenuOpen}
         onMobileToggle={setIsMobileMenuOpen}
-        onNavigateToCanvas={onNavigateToCanvas}
+        onNavigateToCanvas={handleNavigateToCanvas}
         refreshTrigger={sidebarRefreshTrigger}
         userAvatarId={userAvatarId}
         onAvatarChange={handleAvatarChange}
@@ -1161,7 +1209,7 @@ const handleNewChat = async (sessionId = null) => {
           setSettingsInitialTab('model-status');
           setShowSettings(true);
         }}
-        onNavigateToJourney={onNavigateToJourney}
+        onNavigateToJourney={handleNavigateToJourney}
         statedGoal={statedGoal}
         onRemoveSampleData={user?.is_guest ? async () => {
           if (!window.confirm('Remove all sample demo data? You stay in guest mode with a clean slate.')) return;
@@ -1185,8 +1233,8 @@ const handleNewChat = async (sessionId = null) => {
             currentPage="chat"
             onNavigateToHome={onNavigateToHome}
             onNavigateToChat={() => {}}
-            onNavigateToCanvas={onNavigateToCanvas}
-            onNavigateToJourney={onNavigateToJourney}
+            onNavigateToCanvas={handleNavigateToCanvas}
+            onNavigateToJourney={handleNavigateToJourney}
             onMobileMenu={handleMobileMenuToggle}
           >
             <AdvisorStatusDropdown
@@ -1213,11 +1261,23 @@ const handleNewChat = async (sessionId = null) => {
             {!hasMessages ? (
               <div className="welcome-state">
                 <IntakePanel
-                  onSubmit={handleSendMessage}
                   guestPersona={guestPersona}
                   authToken={authToken}
                   user={user}
                   statedGoal={statedGoal}
+                  pathSignals={pathSignals}
+                  onOpenProfile={() => {
+                    setAboutYouInitialTab('about');
+                    setShowAboutYou(true);
+                  }}
+                  onNavigateToJourney={handleNavigateToJourney}
+                  onNavigateToCanvas={handleNavigateToCanvas}
+                  onOpenModelStatus={() => {
+                    setSettingsInitialTab('model-status');
+                    setShowSettings(true);
+                  }}
+                  onNavigateToSignup={onNavigateToSignup}
+                  onPathStepComplete={markPathStep}
                 />
                 <SuggestionsPanel
                   onSuggestionClick={handleSendMessage}

frontend/src/styles/ChatPage.css

@@ -226,9 +226,28 @@
 }
 
 .welcome-state .suggestions-grid {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  max-width: 980px;
+  width: 100%;
+  margin: 0 auto;
+}
+
+.welcome-state .suggestions-flat-list {
   display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+  grid-template-columns: 1fr;
   gap: 8px;
+  max-width: 980px;
+  width: 100%;
+  margin: 0 auto;
+}
+
+@media (min-width: 768px) {
+  .welcome-state .suggestions-flat-list {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 10px 12px;
+  }
 }
 
 .welcome-state .suggestion-category {
@@ -260,6 +279,24 @@
   padding: 8px 12px;
   font-size: 13px;
   border-radius: 8px;
+  white-space: normal;
+  overflow: visible;
+  text-overflow: unset;
+}
+
+.welcome-state .suggestion-chip-wrap .suggestion-button {
+  padding: 10px 40px 32px 12px;
+  height: auto;
+  max-height: none;
+  overflow: visible;
+  white-space: normal;
+  text-overflow: unset;
+  -webkit-line-clamp: unset;
+  line-clamp: unset;
+  word-break: break-word;
+  overflow-wrap: break-word;
+  font-weight: 700;
+  line-height: 1.5;
 }
 
 .welcome-state .suggestion-button.suggestion-pending {
@@ -288,6 +325,11 @@
     padding: 6px 10px;
     font-size: 12px;
   }
+
+  .welcome-state .suggestion-chip-wrap .suggestion-button {
+    padding: 10px 40px 32px 12px;
+    font-size: 13px;
+  }
 }
 
 .suggestions-container {
@@ -1372,7 +1414,10 @@
   font-weight: 500;
   transition: all 0.2s ease;
   position: relative;
-  overflow: hidden;
+  overflow: visible;
+  white-space: normal;
+  text-overflow: unset;
+  word-break: break-word;
 }
 
 .suggestion-button::before {

frontend/src/styles/IntakePanel.css

@@ -43,6 +43,194 @@
   margin-bottom: 0;
 }
 
+/* Progressive path navigator (replaces topic chips) */
+.advisor-path {
+  text-align: left;
+  margin-top: 4px;
+}
+
+.advisor-path-header {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  justify-content: center;
+  gap: 8px 12px;
+  margin-bottom: 10px;
+}
+
+.advisor-path-title {
+  margin: 0;
+  font-size: 0.95rem;
+  font-weight: 650;
+  color: var(--text-primary, #0f172a);
+}
+
+.advisor-path-steps {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.advisor-path-step {
+  border: 1px solid var(--border, #e2e8f0);
+  border-radius: 12px;
+  background: var(--surface, #fff);
+  overflow: hidden;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
+}
+
+.advisor-path-step.is-expanded {
+  border-color: color-mix(in srgb, var(--accent, #0B7A8A) 45%, var(--border, #e2e8f0));
+  box-shadow: 0 2px 12px color-mix(in srgb, var(--accent, #0B7A8A) 12%, transparent);
+}
+
+.advisor-path-step-btn {
+  appearance: none;
+  width: 100%;
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 12px;
+  border: none;
+  background: transparent;
+  cursor: pointer;
+  text-align: left;
+  color: inherit;
+  min-height: 44px;
+}
+
+.advisor-path-step-btn:hover,
+.advisor-path-step-btn:focus-visible {
+  background: var(--accent-soft, #DCEEF1);
+  outline: none;
+}
+
+.advisor-path-step-icon {
+  flex-shrink: 0;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  border-radius: 8px;
+  background: var(--accent-soft, #DCEEF1);
+  color: var(--accent, #0B7A8A);
+}
+
+.advisor-path-step-text {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+
+.advisor-path-step-title {
+  font-size: 0.875rem;
+  font-weight: 600;
+  color: var(--text-primary, #0f172a);
+  line-height: 1.25;
+}
+
+.advisor-path-step-tagline {
+  font-size: 0.78rem;
+  color: var(--text-secondary, #64748b);
+  line-height: 1.3;
+}
+
+.advisor-path-step-chevron {
+  flex-shrink: 0;
+  color: var(--text-secondary, #64748b);
+  transition: transform 0.15s ease;
+}
+
+.advisor-path-step-chevron.is-open {
+  transform: rotate(90deg);
+}
+
+.advisor-path-step-detail {
+  padding: 0 12px 12px 3.25rem;
+  border-top: 1px solid var(--border, #e2e8f0);
+  margin-top: -1px;
+}
+
+.advisor-path-step-detail p {
+  margin: 10px 0 12px;
+  font-size: 0.8125rem;
+  line-height: 1.45;
+  color: var(--text-secondary, #64748b);
+}
+
+.advisor-path-action {
+  appearance: none;
+  border: none;
+  border-radius: 8px;
+  padding: 8px 14px;
+  min-height: 40px;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  cursor: pointer;
+  background: var(--accent-fill, var(--accent-primary, #0B7A8A));
+  color: var(--accent-on-accent, #fff);
+}
+
+.advisor-path-action:hover,
+.advisor-path-action:focus-visible {
+  filter: brightness(1.05);
+  outline: none;
+}
+
+.advisor-path-all-done {
+  text-align: center;
+  margin: 0;
+  padding: 8px 4px;
+  font-size: 0.8125rem;
+  color: var(--text-secondary, #64748b);
+}
+
+.advisor-path-guest-note {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: center;
+  gap: 4px;
+  margin: 12px 0 0;
+  padding: 10px 12px;
+  border-radius: 10px;
+  font-size: 0.75rem;
+  line-height: 1.45;
+  color: var(--text-secondary, #64748b);
+  background: color-mix(in srgb, var(--accent-soft, #DCEEF1) 70%, transparent);
+  border: 1px dashed color-mix(in srgb, var(--accent, #0B7A8A) 35%, transparent);
+}
+
+.advisor-path-guest-icon {
+  flex-shrink: 0;
+  color: var(--accent, #0B7A8A);
+}
+
+.advisor-path-guest-link {
+  appearance: none;
+  border: none;
+  padding: 0;
+  background: none;
+  font: inherit;
+  font-weight: 600;
+  color: var(--accent, #0B7A8A);
+  cursor: pointer;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.advisor-path-guest-link:hover,
+.advisor-path-guest-link:focus-visible {
+  outline: none;
+  color: var(--accent-primary, #0B7A8A);
+}
+
 .intake-chip {
   appearance: none;
   border: 1px solid var(--border, #e2e8f0);
@@ -131,21 +319,67 @@
   }
 }
 
-@media (max-width: 768px) {
+/* Wide welcome layout — match suggestions-panel width (980px) */
+@media (min-width: 768px) {
   .intake-panel {
-    margin: 0 auto;
-    padding: 0 8px 8px;
+    max-width: 980px;
+    width: 100%;
+  }
+
+  .advisor-path-steps {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 10px;
+    align-items: start;
   }
 
-  .intake-chips {
+  .advisor-path-step {
+    display: flex;
     flex-direction: column;
+    height: 100%;
   }
 
-  .intake-chip {
+  .advisor-path-step-btn {
+    flex: 1 1 auto;
+    align-items: flex-start;
+    padding: 12px 10px;
+  }
+
+  .advisor-path-step-chevron {
+    align-self: center;
+    margin-top: 2px;
+  }
+
+  .advisor-path-step-detail {
+    padding: 0 10px 12px;
+  }
+
+  .advisor-path-step-detail p {
+    margin-top: 8px;
+  }
+
+  .advisor-path-action {
     width: 100%;
   }
 }
 
+@media (min-width: 900px) {
+  .advisor-path-steps {
+    grid-template-columns: repeat(4, minmax(0, 1fr));
+  }
+}
+
+@media (max-width: 767px) {
+  .intake-panel {
+    margin: 0 auto;
+    padding: 0 8px 8px;
+  }
+
+  .advisor-path-step-detail {
+    padding-left: 12px;
+  }
+}
+
 @media (prefers-reduced-motion: reduce) {
   .intake-chip {
     transition: none;

frontend/src/styles/components.css

@@ -474,7 +474,7 @@ body {
 /* Suggestions Panel */
 .suggestions-panel {
   padding: 8px 0 0;
-  max-width: 900px;
+  max-width: 980px;
   margin: 0 auto;
 }
 
@@ -502,6 +502,121 @@ body {
   gap: 8px;
 }
 
+.suggestions-flat-list {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 8px;
+  max-width: 980px;
+  width: 100%;
+  margin: 0 auto;
+}
+
+@media (min-width: 768px) {
+  .suggestions-flat-list {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 10px 12px;
+  }
+}
+
+.suggestion-chip-wrap {
+  position: relative;
+  width: 100%;
+  min-width: 0;
+  overflow: visible;
+  height: 100%;
+  display: flex;
+}
+
+.suggestion-chip-wrap .suggestion-button {
+  display: block;
+  flex: 1 1 auto;
+  width: 100%;
+  min-width: 0;
+  height: auto;
+  max-height: none;
+  min-height: 0;
+  white-space: normal;
+  overflow: visible;
+  text-overflow: unset;
+  -webkit-line-clamp: unset;
+  line-clamp: unset;
+  word-break: break-word;
+  overflow-wrap: break-word;
+  /* Reserve the lower-right corner so copy never sits under the refresh icon */
+  padding: 10px 40px 32px 12px;
+  box-sizing: border-box;
+  font-weight: 700;
+  line-height: 1.5;
+}
+
+.suggestion-chip-text {
+  display: block;
+  white-space: normal;
+  overflow: visible;
+  text-overflow: unset;
+  -webkit-line-clamp: unset;
+  line-clamp: unset;
+  max-height: none;
+  word-break: break-word;
+  overflow-wrap: break-word;
+  line-height: 1.5;
+  padding: 0;
+}
+
+.suggestion-chip-question {
+  font-weight: 700;
+  white-space: normal;
+  overflow: visible;
+  display: inline;
+  line-height: inherit;
+}
+
+.suggestion-refresh-btn {
+  position: absolute;
+  right: 8px;
+  bottom: 8px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 24px;
+  height: 24px;
+  padding: 0;
+  border: none;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--text-tertiary, var(--text-secondary));
+  cursor: pointer;
+  opacity: 0.75;
+  z-index: 2;
+  flex-shrink: 0;
+  transition: opacity 0.15s ease, color 0.15s ease, background-color 0.15s ease;
+}
+
+.suggestion-chip-wrap:hover .suggestion-refresh-btn,
+.suggestion-refresh-btn:focus-visible {
+  opacity: 1;
+}
+
+.suggestion-refresh-btn:hover:not(:disabled) {
+  opacity: 1;
+  color: var(--accent-primary, var(--text-primary));
+  background-color: var(--bg-secondary, rgba(0, 0, 0, 0.04));
+}
+
+.suggestion-refresh-btn:disabled {
+  cursor: not-allowed;
+  opacity: 0.35;
+}
+
+.suggestion-refresh-spin {
+  animation: suggestion-refresh-spin 0.8s linear infinite;
+}
+
+@keyframes suggestion-refresh-spin {
+  from { transform: rotate(0deg); }
+  to { transform: rotate(360deg); }
+}
+
 .suggestion-category {
   background-color: var(--bg-primary);
   border-radius: 12px;
@@ -561,6 +676,15 @@ body {
   line-height: 1.35;
   cursor: pointer;
   transition: all 0.2s ease;
+  width: 100%;
+  white-space: normal;
+  overflow: visible;
+  text-overflow: unset;
+  word-break: break-word;
+}
+
+.suggestion-button.suggestion-refreshing {
+  opacity: 0.85;
 }
 
 .suggestion-button:hover {

frontend/src/utils/advisorPathProgress.js

@@ -0,0 +1,132 @@
+import { PATH_NODES, getPathNode } from '../data/advisorPaths';
+
+const STORAGE_PREFIX = 'advisor-path-progress::';
+
+export function pathProgressKey(userId) {
+  const uid = userId || 'anon';
+  return `${STORAGE_PREFIX}${uid}`;
+}
+
+/** @returns {{ completed: string[], activeId: string|null, updatedAt: number }} */
+export function loadPathProgress(userId) {
+  try {
+    const raw = localStorage.getItem(pathProgressKey(userId));
+    if (!raw) return { completed: [], activeId: null, updatedAt: 0 };
+    const parsed = JSON.parse(raw);
+    const completed = Array.isArray(parsed.completed)
+      ? parsed.completed.filter((id) => getPathNode(id))
+      : [];
+    const activeId = parsed.activeId && getPathNode(parsed.activeId) ? parsed.activeId : null;
+    return {
+      completed,
+      activeId,
+      updatedAt: typeof parsed.updatedAt === 'number' ? parsed.updatedAt : 0,
+    };
+  } catch {
+    return { completed: [], activeId: null, updatedAt: 0 };
+  }
+}
+
+export function savePathProgress(userId, state) {
+  try {
+    localStorage.setItem(
+      pathProgressKey(userId),
+      JSON.stringify({
+        completed: state.completed || [],
+        activeId: state.activeId || null,
+        updatedAt: Date.now(),
+      }),
+    );
+  } catch {
+    /* quota / private mode */
+  }
+}
+
+function prerequisitesMet(node, completedSet) {
+  if (node.requires?.length) {
+    if (!node.requires.every((id) => completedSet.has(id))) return false;
+  }
+  if (node.requiresAny?.length) {
+    if (!node.requiresAny.some((id) => completedSet.has(id))) return false;
+  }
+  return true;
+}
+
+export function isNodeVisible(node, { completedSet, isGuest }) {
+  if (node.guestOnly && !isGuest) return false;
+  if (node.signedInOnly && isGuest) return false;
+  if (completedSet.has(node.id)) return false;
+  return prerequisitesMet(node, completedSet);
+}
+
+/**
+ * Next steps to show (max `limit`), preferring lower tier then definition order.
+ */
+export function getAvailableSteps({ completed = [], isGuest = false, limit = 4 } = {}) {
+  const completedSet = new Set(completed);
+  return PATH_NODES.filter((node) => isNodeVisible(node, { completedSet, isGuest }))
+    .sort((a, b) => a.tier - b.tier || PATH_NODES.indexOf(a) - PATH_NODES.indexOf(b))
+    .slice(0, limit);
+}
+
+/** Highest tier among completed nodes, or 0 if none. */
+export function currentTier(completed = []) {
+  let max = 0;
+  completed.forEach((id) => {
+    const node = getPathNode(id);
+    if (node && node.tier > max) max = node.tier;
+  });
+  return max;
+}
+
+/** Most recently completed node id for the “current focus” strip. */
+export function latestCompleted(completed = []) {
+  if (!completed.length) return null;
+  return completed[completed.length - 1];
+}
+
+export function markStepComplete(completed, stepId) {
+  if (!getPathNode(stepId) || completed.includes(stepId)) return completed;
+  return [...completed, stepId];
+}
+
+/** Auto-detect completions from app state (does not remove manual completions). */
+export function mergeAutoCompletions(completed, signals = {}) {
+  const next = new Set(completed);
+  const {
+    hasChats,
+    hasProfileFacts,
+    hasStatedGoal,
+    visitedJourney,
+    visitedWorkspace,
+  } = signals;
+
+  if (hasChats) next.add('first-question');
+  if (hasProfileFacts) next.add('your-profile');
+  if (hasStatedGoal) next.add('stated-goal');
+  if (visitedJourney) next.add('your-journey');
+  if (visitedWorkspace) next.add('your-workspace');
+
+  return PATH_NODES.map((n) => n.id).filter((id) => next.has(id));
+}
+
+export function recordVisit(userId, area) {
+  const key = `${STORAGE_PREFIX}visits::${userId || 'anon'}`;
+  try {
+    const raw = localStorage.getItem(key);
+    const visits = raw ? JSON.parse(raw) : {};
+    visits[area] = true;
+    localStorage.setItem(key, JSON.stringify(visits));
+  } catch {
+    /* ignore */
+  }
+}
+
+export function loadVisits(userId) {
+  try {
+    const raw = localStorage.getItem(`${STORAGE_PREFIX}visits::${userId || 'anon'}`);
+    return raw ? JSON.parse(raw) : {};
+  } catch {
+    return {};
+  }
+}

frontend/src/utils/starterSuggestionsUi.js

@@ -1,7 +1,125 @@
-/** Pure helpers for Getting Started chip slots, 5s fallback, and stable order. */
+/** Pure helpers for Practical Next Steps chip slots, fallback, and stable order. */
 
 export const STARTER_FALLBACK_MS = 5000;
 export const MAX_STARTER_SLOTS = 12;
+export const PROMPT_VARIATION_COUNT = 6;
+
+const FILLER_OPENER_RE = /^(?:to begin(?:\s+with)?|to shape(?:\s+your\s+path)?|to start(?:\s+with)?|to identify|to dissect|to analyze|to explore|to consider|to examine|to discuss|let'?s|first off|as a first step|i'?d like|i would like|so,?|now,?|here,?|for(?:\s+a)?\s+start|getting started|to get started|to understand|in order to|when it comes to)\b[\s,:-]*/i;
+const TOPIC_COMMA_LEAD_RE = /^for\s+[^?]{1,48}?,[\s]*/i;
+const ADVISOR_TO_USER_RE = /\b(?:let'?s|let us|have you considered|have you thought|have you looked|you should|you might|you need to|you can start|for instance|this idea blends|the core concept|to identify the|which creates a unique)\b/i;
+const FIRST_PERSON_RE = /\b(?:i|i'm|i'd|i've|i'll|my|mine)\b/i;
+const SECOND_PERSON_YOUR_RE = /\byour\b/i;
+
+function looksLikeJsonPayload(text) {
+  const trimmed = String(text || '').trim();
+  return trimmed.startsWith('{') || trimmed.startsWith('[');
+}
+
+function extractQuestionFromPayload(raw) {
+  const text = String(raw || '').trim();
+  if (!looksLikeJsonPayload(text)) return text;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return String(parsed.question || parsed.text || '').trim();
+    }
+    if (Array.isArray(parsed) && parsed[0]) {
+      return extractQuestionFromPayload(parsed[0]);
+    }
+  } catch {
+    const match = text.match(/"question"\s*:\s*"((?:\\.|[^"\\])*)/);
+    if (match) {
+      try {
+        return JSON.parse(`"${match[1]}"`);
+      } catch {
+        return match[1].replace(/\\"/g, '"');
+      }
+    }
+  }
+  return '';
+}
+
+function isMultiSentence(text) {
+  let body = String(text || '').trim();
+  if (body.endsWith('?')) body = body.slice(0, -1);
+  body = body.replace(/\b(?:e\.g|i\.e|etc)\./gi, ' ').replace(/\.{2,}/g, ' ');
+  return /[.!?]/.test(body);
+}
+
+export function looksLikeAdvisorToUser(text) {
+  const cleaned = String(text || '').replace(/\s+/g, ' ').trim();
+  if (!cleaned) return false;
+  if (ADVISOR_TO_USER_RE.test(cleaned)) return true;
+  if (isMultiSentence(cleaned)) return true;
+  if (SECOND_PERSON_YOUR_RE.test(cleaned) && !FIRST_PERSON_RE.test(cleaned)) return true;
+  return false;
+}
+
+function userFacingChatPrompt(chatPrompt, question) {
+  const chat = String(chatPrompt || '').trim();
+  const q = String(question || '').trim();
+  if (chat && !looksLikeAdvisorToUser(chat)) return chat;
+  if (q && !looksLikeAdvisorToUser(q)) return q;
+  return q || chat;
+}
+
+export function stripForbiddenOpeners(text) {
+  let cleaned = extractQuestionFromPayload(text);
+  cleaned = String(cleaned || '').trim().replace(/^["']+|["']+$/g, '');
+  cleaned = cleaned.replace(/\s+/g, ' ').trim();
+  if (looksLikeJsonPayload(cleaned)) return '';
+  let prev = null;
+  while (cleaned && cleaned !== prev) {
+    prev = cleaned;
+    cleaned = cleaned.replace(FILLER_OPENER_RE, '').replace(TOPIC_COMMA_LEAD_RE, '').trim();
+  }
+  if (!cleaned) return '';
+  return cleaned.charAt(0).toUpperCase() + cleaned.slice(1);
+}
+
+export function fallbackToSuggestion(text) {
+  const question = stripForbiddenOpeners(text) || String(text || '').trim();
+  return {
+    lead: '',
+    question,
+    chat_prompt: question,
+  };
+}
+
+export function normalizeSuggestion(raw, fallbackText = '') {
+  if (raw && typeof raw === 'object') {
+    const question = stripForbiddenOpeners(raw.question || raw.text || '');
+    const chatPrompt = String(raw.chat_prompt || raw.chatPrompt || '').trim();
+    if (question || chatPrompt) {
+      const display = question || stripForbiddenOpeners(chatPrompt);
+      return {
+        lead: '',
+        question: display,
+        chat_prompt: userFacingChatPrompt(chatPrompt, display),
+      };
+    }
+  }
+  const text = String(raw || fallbackText || '').trim();
+  return fallbackToSuggestion(text);
+}
+
+export function suggestionDisplayText(suggestion) {
+  return (suggestion?.question || '').trim();
+}
+
+export function suggestionChatPrompt(suggestion) {
+  const question = (suggestion?.question || suggestionDisplayText(suggestion) || '').trim();
+  return userFacingChatPrompt(suggestion?.chat_prompt, question);
+}
+
+export function suggestionExcludeKeys(suggestion) {
+  const keys = [
+    suggestionChatPrompt(suggestion),
+    suggestionDisplayText(suggestion),
+    suggestion?.question,
+  ];
+  return [...new Set(keys.map((k) => String(k || '').trim()).filter(Boolean))];
+}
 
 /**
  * Flatten example categories into stable slots 0..n (category-major order).
@@ -12,15 +130,19 @@ export function buildStarterSlots(examples, maxSlots = MAX_STARTER_SLOTS) {
   (examples || []).forEach((category, categoryIndex) => {
     (category.suggestions || []).forEach((text, suggestionIndex) => {
       if (slots.length >= maxSlots) return;
+      const fallback = typeof text === 'string' ? text : '';
       slots.push({
         slot: slots.length,
         categoryIndex,
         suggestionIndex,
         categoryTitle: category.title || `Starter ${slots.length + 1}`,
-        fallback: typeof text === 'string' ? text : '',
+        fallback,
+        suggestion: fallbackToSuggestion(fallback),
         text: '',
         generated: false,
         pending: true,
+        promptVariation: slots.length % PROMPT_VARIATION_COUNT,
+        refreshing: false,
       });
     });
   });
@@ -29,35 +151,56 @@ export function buildStarterSlots(examples, maxSlots = MAX_STARTER_SLOTS) {
 
 export function applySlotDelta(slots, slotIndex, chunk) {
   if (!Array.isArray(slots) || slotIndex < 0 || slotIndex >= slots.length) return slots;
+  const question = stripForbiddenOpeners(String(chunk || ''));
+  if (!question) return slots;
   const next = slots.slice();
   const current = next[slotIndex];
   next[slotIndex] = {
     ...current,
-    text: `${current.text || ''}${chunk || ''}`,
+    text: question,
+    suggestion: {
+      lead: '',
+      question,
+      chat_prompt: current.suggestion?.chat_prompt || question,
+    },
     pending: false,
     generated: true,
   };
   return next;
 }
 
-export function applySlotDone(slots, slotIndex, text) {
+export function applySlotDone(slots, slotIndex, payload) {
   if (!Array.isArray(slots) || slotIndex < 0 || slotIndex >= slots.length) return slots;
   const next = slots.slice();
   const current = next[slotIndex];
-  const finalText = (text || current.text || '').trim();
+  const suggestion = normalizeSuggestion(
+    payload?.suggestion ?? payload,
+    typeof payload === 'string' ? payload : current.text || current.fallback,
+  );
+  const finalText = suggestionDisplayText(suggestion) || (current.text || '').trim();
   next[slotIndex] = {
     ...current,
+    suggestion,
     text: finalText,
     pending: false,
+    refreshing: false,
     generated: Boolean(finalText) && finalText !== current.fallback,
   };
-  if (finalText && finalText === current.fallback) {
-    next[slotIndex].generated = true;
-  }
   if (finalText) next[slotIndex].generated = true;
   return next;
 }
 
+export function applySlotRefreshing(slots, slotIndex, refreshing = true) {
+  if (!Array.isArray(slots) || slotIndex < 0 || slotIndex >= slots.length) return slots;
+  const next = slots.slice();
+  next[slotIndex] = {
+    ...next[slotIndex],
+    refreshing,
+    pending: refreshing,
+  };
+  return next;
+}
+
 /** If a slot has no tokens after timeout, fill with YAML fallback. Later LLM text may replace it. */
 export function applyFallbackIfTimedOut(slots, startedAt, now, timeoutMs = STARTER_FALLBACK_MS) {
   if (!Array.isArray(slots) || now - startedAt < timeoutMs) return slots;
@@ -67,9 +210,11 @@ export function applyFallbackIfTimedOut(slots, startedAt, now, timeoutMs = START
     if (slot.text) return { ...slot, pending: false, generated: true };
     if (!slot.fallback) return { ...slot, pending: false };
     changed = true;
+    const suggestion = fallbackToSuggestion(slot.fallback);
     return {
       ...slot,
-      text: slot.fallback,
+      suggestion,
+      text: suggestionDisplayText(suggestion),
       pending: false,
       generated: false,
     };
@@ -77,6 +222,19 @@ export function applyFallbackIfTimedOut(slots, startedAt, now, timeoutMs = START
   return changed ? next : slots;
 }
 
+export function slotsToFlatList(slots) {
+  return (slots || [])
+    .slice()
+    .sort((a, b) => a.slot - b.slot)
+    .map((slot) => ({
+      ...slot,
+      suggestion: slot.suggestion || fallbackToSuggestion(slot.fallback),
+      displayText: slot.text || suggestionDisplayText(slot.suggestion) || slot.fallback || '',
+      isPending: Boolean(slot.pending && !slot.text && !slot.refreshing),
+    }));
+}
+
+/** @deprecated Use slotsToFlatList — kept for tests migrating off category grid. */
 export function slotsToCategories(examples, slots) {
   return (examples || []).map((category, categoryIndex) => {
     const owned = (slots || []).filter((s) => s.categoryIndex === categoryIndex);
@@ -86,13 +244,34 @@ export function slotsToCategories(examples, slots) {
       generated: owned.map((s) => Boolean(s.generated)),
       pending: owned.map((s) => Boolean(s.pending && !s.text)),
     };
-  }).filter((category, categoryIndex) => (
+  }).filter((_category, categoryIndex) => (
     (slots || []).some((s) => s.categoryIndex === categoryIndex)
   ));
 }
 
 export function visiblePrompts(slots) {
   return (slots || [])
-    .map((s) => (s.text || '').trim())
+    .map((s) => suggestionChatPrompt(s.suggestion || fallbackToSuggestion(s.text || s.fallback)))
     .filter(Boolean);
 }
+
+export function collectExcludeKeys(slots, extra = []) {
+  const normalize = (value) => String(value || '').trim().replace(/[.?!]+$/g, '').toLowerCase();
+  const fromSlots = (slots || []).flatMap((slot) => suggestionExcludeKeys(
+    slot.suggestion || fallbackToSuggestion(slot.text || slot.fallback),
+  ));
+  const merged = [...(extra || []), ...fromSlots]
+    .map((s) => String(s || '').trim())
+    .filter(Boolean);
+  const seen = new Set();
+  return merged.filter((item) => {
+    const key = normalize(item);
+    if (!key || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+export function nextPromptVariation(current = 0) {
+  return (Number(current) + 1) % PROMPT_VARIATION_COUNT;
+}

multi_llm_chatbot_backend/app/api/routes/chat.py

@@ -138,13 +138,22 @@ class SwitchChatRequest(BaseModel):
 class NewChatRequest(BaseModel):
     title: Optional[str] = "New Chat"
 
+class StarterSuggestionItem(BaseModel):
+    lead: str = ""
+    question: str = ""
+    chat_prompt: str = ""
+
+
 class StarterSuggestionsRequest(BaseModel):
     count: int = Field(2, ge=1, le=12)
     exclude: List[str] = Field(default_factory=list)
     category_titles: List[str] = Field(default_factory=list)
+    slot_index: Optional[int] = Field(None, ge=0, le=11)
+    prompt_variation: Optional[int] = Field(None, ge=0, le=11)
+
 
 class StarterSuggestionsResponse(BaseModel):
-    suggestions: List[str]
+    suggestions: List[StarterSuggestionItem] = Field(default_factory=list)
 
 
 class StarterGreetingResponse(BaseModel):
@@ -547,14 +556,20 @@ async def starter_suggestions(
         titles = [t.strip() for t in (body.category_titles or []) if isinstance(t, str) and t.strip()]
         n = len(titles) if titles else body.count
         n = max(1, min(int(n), 12))
+        variation = body.prompt_variation
+        if variation is None and body.slot_index is not None:
+            variation = int(body.slot_index)
         suggestions = await generate_starter_suggestions(
             llm,
             user_context,
             count=n,
             exclude=body.exclude or [],
             category_titles=titles,
+            prompt_variation=variation,
+        )
+        return StarterSuggestionsResponse(
+            suggestions=[StarterSuggestionItem(**item) for item in suggestions],
         )
-        return StarterSuggestionsResponse(suggestions=suggestions)
     except Exception as exc:
         logger.warning("Starter suggestion endpoint failed: %s", exc)
         return StarterSuggestionsResponse(suggestions=[])

multi_llm_chatbot_backend/app/core/improved_orchestrator.py

@@ -1,5 +1,5 @@
 from typing import Dict, List, Optional, Any
-from app.models.persona import Persona, _finalize_compact
+from app.models.persona import Persona, _finalize_compact, panel_lens_reminder
 from app.core.session_manager import ConversationContext, get_session_manager
 from app.core.context_manager import get_context_manager
 from app.core.rag_manager import get_rag_manager
@@ -938,6 +938,13 @@ Use this context to inform your response, and cite specific documents when refer
         if getattr(session, "datetime_context", ""):
             system_message += f"\n\n{session.datetime_context}"
 
+        lens = panel_lens_reminder(
+            getattr(persona, "name", ""),
+            getattr(persona, "role", ""),
+        )
+        if lens:
+            system_message += f"\n\n{lens}"
+
         enhanced_context.append({
             "role": "system",
             "content": system_message,

multi_llm_chatbot_backend/app/core/starter_suggestions.py

@@ -1,4 +1,4 @@
-"""Goal-grounded Getting Started chip and greeting generation."""
+"""Goal-grounded Practical Next Steps chip and greeting generation."""
 
 from __future__ import annotations
 
@@ -6,7 +6,8 @@ import asyncio
 import json
 import logging
 import re
-from typing import Any, AsyncIterator, Dict, List, Optional, Sequence
+from dataclasses import dataclass
+from typing import Any, AsyncIterator, Dict, List, Optional, Sequence, Union
 
 from app.core.user_context import extract_stated_goal, has_stated_goal_or_summary
 
@@ -14,37 +15,286 @@ logger = logging.getLogger(__name__)
 
 _MAX_STARTERS = 12
 _JSON_OBJECT_RE = re.compile(r"\{.*\}", re.DOTALL)
+_JSON_ARRAY_RE = re.compile(r"\[.*\]", re.DOTALL)
 _SLOT_STAGGER_SECONDS = 0.08
 _SLOT_CONCURRENCY = 3
+_MAX_QUESTION_WORDS = 14
+_MAX_CHAT_PROMPT_WORDS = 28
 
 DEFAULT_GREETING = "What cybersecurity problem should we work on first?"
 DEFAULT_SUBHEADER = (
     "I can help with threats, controls, incidents, compliance, or your security career."
 )
 
+# Filler preambles that create a wall-of-text feel on chips.
+_FILLER_OPENER_RE = re.compile(
+    r"^(?:to begin(?:\s+with)?|to shape(?:\s+your\s+path)?|to start(?:\s+with)?|"
+    r"to identify|to dissect|to analyze|to explore|to consider|to examine|"
+    r"to discuss|let'?s|first off|as a first step|i'?d like|i would like|"
+    r"so,?|now,?|here,?|for(?:\s+a)?\s+start|getting started|"
+    r"to get started|to understand|in order to|when it comes to)\b[\s,:-]*",
+    re.IGNORECASE,
+)
 
-def _normalize_starter(text: str) -> str:
+# Advisor-to-user lecturing that must never be inserted into chat as the user turn.
+_ADVISOR_TO_USER_RE = re.compile(
+    r"(?:"
+    r"\blet'?s\b|"
+    r"\blet us\b|"
+    r"\bhave you considered\b|"
+    r"\bhave you thought\b|"
+    r"\bhave you looked\b|"
+    r"\byou should\b|"
+    r"\byou might\b|"
+    r"\byou need to\b|"
+    r"\byou can start\b|"
+    r"\bfor instance\b|"
+    r"\bthis idea blends\b|"
+    r"\bthe core concept\b|"
+    r"\bto identify the\b|"
+    r"\bwhich creates a unique\b"
+    r")",
+    re.IGNORECASE,
+)
+
+_FIRST_PERSON_RE = re.compile(r"\b(?:i|i'm|i'd|i've|i'll|my|mine)\b", re.IGNORECASE)
+_SECOND_PERSON_YOUR_RE = re.compile(r"\byour\b", re.IGNORECASE)
+
+# "For MFA,", "For backups,", "For my incident response plan,"
+_TOPIC_COMMA_LEAD_RE = re.compile(
+    r"^for\s+[^?]{1,48}?,\s*",
+    re.IGNORECASE,
+)
+
+_PROMPT_VARIATIONS: List[str] = [
+    "Start the question with How. Ask the advisor panel about the single highest-priority next step for my stated goal.",
+    "Start the question with What. Ask the advisor panel about the biggest security risk I should address next.",
+    "Start the question with Which. Ask the advisor panel to choose between two practical approaches for my goal.",
+    "Start the question with Should. Ask the advisor panel about one concrete action I can take this week.",
+    "Start the question with Where. Ask the advisor panel about a specific control, tool, or practice that fits my situation.",
+    "Start the question with Can. Ask the advisor panel to explain one concept I should understand before moving forward.",
+]
+
+
+def _exclude_key(text: str) -> str:
+    cleaned = _normalize_starter(str(text or "")).lower()
+    return cleaned.rstrip(".?! ").strip()
+
+
+@dataclass
+class StarterSuggestion:
+    lead: str
+    question: str
+    chat_prompt: str
+
+    def to_dict(self) -> Dict[str, str]:
+        return {
+            "lead": self.lead,
+            "question": self.question,
+            "chat_prompt": self.chat_prompt,
+        }
+
+    def display_text(self) -> str:
+        return self.question.strip()
+
+    def exclude_key(self) -> str:
+        return _exclude_key(self.chat_prompt.strip() or self.display_text())
+
+
+def _capitalize_start(text: str) -> str:
+    cleaned = (text or "").strip()
+    if not cleaned:
+        return ""
+    return cleaned[0].upper() + cleaned[1:]
+
+
+def _strip_filler_openers(text: str) -> str:
+    """Remove To begin / Let's / First off style clutter only (keep goal context)."""
     cleaned = " ".join((text or "").strip().strip("\"'").split())
+    prev = None
+    while cleaned and cleaned != prev:
+        prev = cleaned
+        cleaned = _FILLER_OPENER_RE.sub("", cleaned).strip()
+    return cleaned
+
+
+def _strip_forbidden_openers(text: str) -> str:
+    """Strip filler openers and 'For <topic>,' leads from chip display questions."""
+    cleaned = _strip_filler_openers(text)
+    prev = None
+    while cleaned and cleaned != prev:
+        prev = cleaned
+        cleaned = _TOPIC_COMMA_LEAD_RE.sub("", cleaned).strip()
+        cleaned = _FILLER_OPENER_RE.sub("", cleaned).strip()
+    return _capitalize_start(cleaned)
+
+
+def _normalize_starter(text: str) -> str:
+    cleaned = _strip_forbidden_openers(text)
     cleaned = re.sub(r"^\d+[\.)]\s*", "", cleaned)
+    return _capitalize_start(cleaned)
+
+
+def _looks_like_json_payload(text: str) -> bool:
+    stripped = (text or "").lstrip()
+    return stripped.startswith("{") or stripped.startswith("[")
+
+
+def _ensure_question(text: str) -> str:
+    if _looks_like_json_payload(text):
+        return ""
+    cleaned = _normalize_starter(text)
+    if not cleaned or _looks_like_json_payload(cleaned):
+        return ""
+    if not cleaned.endswith("?"):
+        cleaned = cleaned.rstrip(".! ") + "?"
+    return cleaned
+
+
+def _word_count(text: str) -> int:
+    return len((text or "").split())
+
+
+def _is_multi_sentence(text: str) -> bool:
+    """True when the text has more than one sentence (lectures, not one ask)."""
+    body = (text or "").strip()
+    if body.endswith("?"):
+        body = body[:-1]
+    body = re.sub(r"\b(?:e\.g|i\.e|etc)\.", " ", body, flags=re.IGNORECASE)
+    body = re.sub(r"\.{2,}", " ", body)
+    return bool(re.search(r"[.!?]", body))
+
+
+def _looks_like_advisor_to_user(text: str) -> bool:
+    """True when text is an advisor lecturing/interviewing the user."""
+    cleaned = " ".join((text or "").split()).strip()
+    if not cleaned:
+        return False
+    if _ADVISOR_TO_USER_RE.search(cleaned):
+        return True
+    if _is_multi_sentence(cleaned):
+        return True
+    if _SECOND_PERSON_YOUR_RE.search(cleaned) and not _FIRST_PERSON_RE.search(cleaned):
+        return True
+    return False
+
+
+def _acceptable_user_chat_prompt(text: str) -> bool:
+    """Accept only a single first-person question the user would send to the panel."""
+    cleaned = " ".join((text or "").split()).strip()
+    if not cleaned or not cleaned.endswith("?"):
+        return False
+    if _looks_like_advisor_to_user(cleaned):
+        return False
+    if _word_count(cleaned) > _MAX_CHAT_PROMPT_WORDS * 2:
+        return False
+    return True
+
+
+def _ensure_chat_question(text: str) -> str:
+    if _looks_like_json_payload(text):
+        return ""
+    cleaned = _strip_filler_openers(text)
+    if not cleaned or _looks_like_json_payload(cleaned):
+        return ""
+    if not cleaned.endswith("?"):
+        cleaned = cleaned.rstrip(".! ") + "?"
+    if not _acceptable_user_chat_prompt(cleaned):
+        return ""
     return cleaned
 
 
-def _parse_suggestions(raw: str) -> List[str]:
+def _synthesize_user_chat_prompt(question: str, goal: str = "") -> str:
+    """Build a first-person user question to the advisor panel from chip + goal."""
+    question = _ensure_question(question)
+    if not question:
+        return ""
+    if goal:
+        snippet = goal.strip().rstrip(".")
+        if len(snippet) > 60:
+            snippet = snippet[:57].rstrip() + "..."
+        lowered_q = question[0].lower() + question[1:]
+        lowered_g = snippet[0].lower() + snippet[1:]
+        synthesized = f"Given my goal to {lowered_g}, {lowered_q}"
+        if _looks_like_advisor_to_user(synthesized) and _looks_like_advisor_to_user(question):
+            return f"Given my goal to {lowered_g}, what should I ask the advisor panel first?"
+        return synthesized
+    if _looks_like_advisor_to_user(question):
+        return ""
+    return question
+
+
+def _build_chat_prompt(question: str, goal: str = "", provided: str = "") -> str:
+    question = _ensure_question(question)
+    if not question:
+        return ""
+    provided_chat = _ensure_chat_question(provided) if provided else ""
+    if provided_chat:
+        return provided_chat
+    return _synthesize_user_chat_prompt(question, goal)
+
+
+def _normalize_suggestion_obj(raw: Any, goal: str = "") -> Optional[StarterSuggestion]:
+    if isinstance(raw, str):
+        stripped = raw.strip()
+        if _looks_like_json_payload(stripped):
+            partial_q = _partial_question_from_stream(stripped)
+            if not partial_q:
+                return None
+            stripped = partial_q
+        question = _ensure_question(stripped)
+        if not question:
+            return None
+        chat = _build_chat_prompt(question, goal)
+        return StarterSuggestion(lead="", question=question, chat_prompt=chat)
+
+    if not isinstance(raw, dict):
+        return None
+
+    question = _ensure_question(str(raw.get("question") or raw.get("text") or ""))
+    if not question:
+        return None
+    chat = _build_chat_prompt(
+        question,
+        goal,
+        provided=str(raw.get("chat_prompt") or ""),
+    )
+    return StarterSuggestion(lead="", question=question, chat_prompt=chat)
+
+
+def _parse_suggestions(raw: str, goal: str = "") -> List[StarterSuggestion]:
     cleaned = (raw or "").strip()
     cleaned = re.sub(r"```(?:json)?", "", cleaned).strip()
     match = _JSON_OBJECT_RE.search(cleaned)
     if match:
         cleaned = match.group(0)
-    parsed = json.loads(cleaned)
-    items = parsed.get("suggestions") if isinstance(parsed, dict) else parsed
-    if not isinstance(items, list):
+    try:
+        parsed = json.loads(cleaned)
+    except json.JSONDecodeError:
+        array_match = _JSON_ARRAY_RE.search(cleaned)
+        if not array_match:
+            return []
+        try:
+            parsed = json.loads(array_match.group(0))
+        except json.JSONDecodeError:
+            return []
+
+    items: Any
+    if isinstance(parsed, dict):
+        items = parsed.get("suggestions") or parsed.get("items") or [parsed]
+    elif isinstance(parsed, list):
+        items = parsed
+    else:
         return []
-    out: List[str] = []
+
+    if not isinstance(items, list):
+        items = [items]
+
+    out: List[StarterSuggestion] = []
     for item in items:
-        if isinstance(item, str):
-            normalized = _normalize_starter(item)
-            if normalized:
-                out.append(normalized)
+        suggestion = _normalize_suggestion_obj(item, goal)
+        if suggestion:
+            out.append(suggestion)
     return out
 
 
@@ -111,25 +361,80 @@ async def generate_starter_greeting(llm, user_context: str) -> Dict[str, str]:
     return fallback
 
 
+def _variation_prompt(variation_index: int) -> str:
+    return _PROMPT_VARIATIONS[variation_index % len(_PROMPT_VARIATIONS)]
+
+
+def _voice_rules_block() -> str:
+    return (
+        "You write questions the USER will send to a panel of expert "
+        "cybersecurity advisors. You are not the advisor.\n"
+        "Both question and chat_prompt MUST be in the user's first-person voice "
+        "(I/my), addressed to the expert panel.\n"
+        "Do not analyze, lecture, interview, or ask the user anything.\n"
+        "GOOD chat_prompt: \"What is the most critical security risk if feline "
+        "hackers in my sci-fi novel have cybernetic enhancements?\"\n"
+        "BAD chat_prompt: \"To identify the risk in your novel, let's dissect "
+        "feline hackers. Have you considered how this hybrid nature might "
+        "reshape your universe?\""
+    )
+
+
+def _structured_rules_block() -> str:
+    return (
+        f"{_voice_rules_block()}\n"
+        "Each suggestion is JSON with:\n"
+        '- "lead": always an empty string. Do not write a lead-in sentence.\n'
+        '- "question": the chip text. A concise first-person question the user '
+        f"asks the advisor panel, {_MAX_QUESTION_WORDS - 6}-{_MAX_QUESTION_WORDS} words, "
+        "MUST end with ?. Jump straight into the question — no preamble.\n"
+        '- "chat_prompt": the message inserted into chat when the chip is clicked. '
+        "Write it as the user speaking to the expert advisor panel, with brief "
+        f"context from the stated goal (I/my), max {_MAX_CHAT_PROMPT_WORDS} words. "
+        "Exactly one sentence ending in ?.\n"
+        "The question MUST start with How, What, Which, Should, Where, or Can.\n"
+        "NEVER start question or chat_prompt with: To begin, To shape, To start, "
+        "To identify, To dissect, Let's, First off, I'd like, For <topic>, "
+        "As a first step, or similar filler.\n"
+        "Do not write topic prefixes like 'For MFA,' or 'For backups,'.\n"
+        "NEVER write as the advisor talking to the user: no let's, "
+        "Have you considered, you should, your novel, analysis, or follow-up "
+        "questions directed at the user.\n"
+        "NO rhetorical fluff. Ground every suggestion in the user's stated goal."
+    )
+
+
 def _one_slot_prompts(
     user_context: str,
-    category_title: str,
     exclude: Sequence[str],
+    *,
+    variation_index: int = 0,
+    category_title: str = "",
 ) -> tuple[str, str]:
     exclude_block = "\n".join(f"- {item}" for item in exclude if str(item).strip())
     if not exclude_block:
         exclude_block = "(none)"
+    angle = _variation_prompt(variation_index)
+    category_hint = ""
+    if category_title and not category_title.lower().startswith("starter"):
+        category_hint = (
+            f"\nOptional theme hint (do not mention this title; do not use it as a prefix): "
+            f"{category_title}"
+        )
     system_prompt = (
-        "You write one Getting Started chip for a cybersecurity advisor chat.\n"
-        "Output ONLY the question: first person, one sentence, at most 22 words.\n"
-        "No numbering, quotes, JSON, or preamble.\n"
-        "Ground it in the user's stated goal and profile. Never invent generic "
-        "enterprise/compliance topics unless that is actually their goal.\n"
-        f"Match this category: {category_title}"
+        "You write one Practical Next Steps chip: a question the USER will send "
+        "to a panel of expert cybersecurity advisors.\n"
+        f"Angle: {angle}\n"
+        f"{_structured_rules_block()}\n"
+        'Respond ONLY with JSON: {"lead": "", "question": "...", "chat_prompt": "..."}'
     )
     user_prompt = (
+        "Write a question I would type to the expert advisor panel about my "
+        "stated goal. First person (I/my). Do not write analysis or questions "
+        "directed at me.\n\n"
         "--- User security profile / knowledge ---\n"
         f"{(user_context or '').strip()}\n\n"
+        f"{category_hint}\n"
         "--- Do not repeat ---\n"
         f"{exclude_block}"
     )
@@ -143,50 +448,80 @@ async def generate_starter_suggestions(
     count: int = 2,
     exclude: Optional[Sequence[str]] = None,
     category_titles: Optional[Sequence[str]] = None,
-) -> List[str]:
-    """Return one clickable starter question per requested slot.
-
-    Falls back to an empty list when there is no usable goal/profile, no LLM,
-    or generation fails — the UI then keeps its static YAML chips.
-    """
+    prompt_variation: Optional[int] = None,
+) -> List[Dict[str, str]]:
+    """Return structured starter suggestions for requested slots."""
     if llm is None or not has_stated_goal_or_summary(user_context):
         return []
 
+    goal = extract_stated_goal(user_context or "")
     titles = [str(t).strip() for t in (category_titles or []) if str(t).strip()]
     n = len(titles) if titles else int(count or 0)
     n = max(1, min(n, _MAX_STARTERS))
     if titles:
         titles = titles[:n]
     else:
-        titles = [f"Starter {i + 1}" for i in range(n)]
+        titles = ["" for _ in range(n)]
 
     blocked = {
-        _normalize_starter(item).lower()
+        _exclude_key(item)
         for item in (exclude or [])
-        if _normalize_starter(str(item))
+        if _exclude_key(item)
     }
 
-    numbered = "\n".join(f"{i + 1}. {title}" for i, title in enumerate(titles))
+    # Single-slot refresh path
+    if n == 1:
+        variation = int(prompt_variation if prompt_variation is not None else 0)
+        system_prompt, user_prompt = _one_slot_prompts(
+            user_context,
+            exclude or [],
+            variation_index=variation,
+            category_title=titles[0],
+        )
+        try:
+            raw = await llm.generate(
+                system_prompt=system_prompt,
+                context=[{"role": "user", "content": user_prompt}],
+                temperature=0.65,
+                max_tokens=220,
+                response_mime_type="application/json",
+            )
+            parsed = _parse_suggestions(raw, goal)
+        except Exception as exc:
+            logger.warning("Starter suggestion generation failed: %s", exc)
+            return []
+        unique: List[Dict[str, str]] = []
+        for suggestion in parsed:
+            key = _exclude_key(suggestion.exclude_key())
+            if key in blocked:
+                continue
+            blocked.add(key)
+            unique.append(suggestion.to_dict())
+            break
+        return unique
+
     exclude_block = "\n".join(f"- {item}" for item in (exclude or []) if str(item).strip())
     if not exclude_block:
         exclude_block = "(none)"
+    angles = "\n".join(
+        f"{i + 1}. {_variation_prompt(i)}" for i in range(n)
+    )
 
     system_prompt = (
-        "You write Getting Started chips for a cybersecurity advisor chat.\n"
-        "Each chip is one first-person question the user can click and send.\n"
-        "Ground every question in the user's stated goal and profile. Never "
-        "invent generic enterprise/compliance topics (GDPR, HIPAA, SOC 2, org "
-        "architecture) unless that is actually their goal.\n"
-        "Each question is one sentence, at most 22 words, no numbering or quotes.\n"
-        "Make each chip distinct and matched to its category title "
-        "(directional vs practical, etc.).\n"
-        f'Respond ONLY with valid JSON: {{"suggestions": [{n} strings]}}'
+        "You write Practical Next Steps chips: questions the USER will send "
+        "to a panel of expert cybersecurity advisors.\n"
+        f"{_structured_rules_block()}\n"
+        "Each chip must use the angle listed for its slot index.\n"
+        f'Respond ONLY with valid JSON: {{"suggestions": [{n} objects]}}'
     )
     user_prompt = (
+        "Write questions I would type to the expert advisor panel about my "
+        "stated goal. First person (I/my). Do not write analysis or questions "
+        "directed at me.\n\n"
         "--- User security profile / knowledge ---\n"
         f"{user_context.strip()}\n\n"
-        "--- Categories (one question each, same order) ---\n"
-        f"{numbered}\n\n"
+        "--- Slot angles (one suggestion each, same order) ---\n"
+        f"{angles}\n\n"
         "--- Do not repeat any of these ---\n"
         f"{exclude_block}"
     )
@@ -195,59 +530,89 @@ async def generate_starter_suggestions(
         raw = await llm.generate(
             system_prompt=system_prompt,
             context=[{"role": "user", "content": user_prompt}],
-            temperature=0.6,
-            max_tokens=max(256, n * 80),
+            temperature=0.65,
+            max_tokens=max(480, n * 140),
             response_mime_type="application/json",
         )
-        suggestions = _parse_suggestions(raw)
+        suggestions = _parse_suggestions(raw, goal)
     except Exception as exc:
         logger.warning("Starter suggestion generation failed: %s", exc)
         return []
 
-    unique: List[str] = []
+    unique: List[Dict[str, str]] = []
     seen = set(blocked)
-    for text in suggestions:
-        key = text.lower()
+    for suggestion in suggestions:
+        key = _exclude_key(suggestion.exclude_key())
         if key in seen:
             continue
         seen.add(key)
-        unique.append(text)
+        unique.append(suggestion.to_dict())
         if len(unique) >= n:
             break
     return unique
 
 
+def _partial_question_from_stream(buf: str) -> str:
+    match = re.search(r'"question"\s*:\s*"([^"\\]*(?:\\.[^"\\]*)*)', buf)
+    if not match:
+        return ""
+    try:
+        return json.loads(f'"{match.group(1)}"')
+    except json.JSONDecodeError:
+        return match.group(1).replace("\\\"", "\"")
+
+
 async def iter_one_starter_suggestion(
     llm,
     user_context: str,
     *,
-    category_title: str,
+    category_title: str = "",
     exclude: Optional[Sequence[str]] = None,
-) -> AsyncIterator[str]:
-    """Yield token chunks for a single Getting Started question."""
+    variation_index: int = 0,
+) -> AsyncIterator[Union[str, StarterSuggestion]]:
+    """Yield token chunks, then the parsed structured suggestion."""
+    goal = extract_stated_goal(user_context or "")
     system_prompt, user_prompt = _one_slot_prompts(
-        user_context, category_title, exclude or [],
+        user_context,
+        exclude or [],
+        variation_index=variation_index,
+        category_title=category_title,
     )
     stream = getattr(llm, "generate_stream", None)
+    buf = ""
     if stream is None:
         text = await llm.generate(
             system_prompt=system_prompt,
             context=[{"role": "user", "content": user_prompt}],
-            temperature=0.6,
-            max_tokens=80,
+            temperature=0.65,
+            max_tokens=220,
+            response_mime_type="application/json",
         )
-        cleaned = _normalize_starter(text)
-        if cleaned:
-            yield cleaned
+        parsed = _parse_suggestions(text, goal)
+        if parsed:
+            yield parsed[0]
         return
+
     async for chunk in stream(
         system_prompt=system_prompt,
         context=[{"role": "user", "content": user_prompt}],
-        temperature=0.6,
-        max_tokens=80,
+        temperature=0.65,
+        max_tokens=220,
+        response_mime_type="application/json",
     ):
-        if chunk:
-            yield chunk
+        if not chunk:
+            continue
+        buf += chunk
+        partial = _partial_question_from_stream(buf)
+        if partial:
+            yield partial
+    parsed = _parse_suggestions(buf, goal)
+    if parsed:
+        yield parsed[0]
+    elif buf.strip():
+        fallback = _normalize_suggestion_obj(buf.strip(), goal)
+        if fallback:
+            yield fallback
 
 
 async def iter_starter_suggestion_events(
@@ -260,18 +625,20 @@ async def iter_starter_suggestion_events(
     stagger_seconds: float = _SLOT_STAGGER_SECONDS,
 ) -> AsyncIterator[Dict[str, Any]]:
     """Yield NDJSON-ready events for stable slots 0..n with limited concurrency."""
-    titles = [str(t).strip() or f"Starter {i + 1}" for i, t in enumerate(category_titles)]
+    titles = [str(t).strip() for t in category_titles]
+    if not titles:
+        titles = ["Starter 1"]
     titles = titles[:_MAX_STARTERS]
-    if not titles or llm is None or not has_stated_goal_or_summary(user_context):
+    if llm is None or not has_stated_goal_or_summary(user_context):
         return
 
     queue: asyncio.Queue = asyncio.Queue()
     sem = asyncio.Semaphore(max(1, int(concurrency or 1)))
     lock = asyncio.Lock()
     blocked = [
-        _normalize_starter(item)
+        _exclude_key(item)
         for item in (exclude or [])
-        if _normalize_starter(str(item))
+        if _exclude_key(item)
     ]
     finished = 0
     n = len(titles)
@@ -280,7 +647,8 @@ async def iter_starter_suggestion_events(
         nonlocal finished
         if slot:
             await asyncio.sleep(stagger_seconds * min(slot, 4))
-        buf: List[str] = []
+        last_partial = ""
+        final: Optional[StarterSuggestion] = None
         try:
             async with sem:
                 async for chunk in iter_one_starter_suggestion(
@@ -288,11 +656,26 @@ async def iter_starter_suggestion_events(
                     user_context,
                     category_title=title,
                     exclude=blocked,
+                    variation_index=slot,
                 ):
-                    buf.append(chunk)
-                    await queue.put({"type": "delta", "slot": slot, "text": chunk})
-            final = _normalize_starter("".join(buf))
-            await queue.put({"type": "done", "slot": slot, "text": final})
+                    if isinstance(chunk, StarterSuggestion):
+                        final = chunk
+                    elif isinstance(chunk, str) and chunk != last_partial:
+                        last_partial = chunk
+                        await queue.put({"type": "delta", "slot": slot, "text": chunk})
+            if final is None and last_partial:
+                goal = extract_stated_goal(user_context or "")
+                final = _normalize_suggestion_obj(last_partial, goal)
+            if final:
+                blocked.append(final.exclude_key())
+                await queue.put({
+                    "type": "done",
+                    "slot": slot,
+                    "text": final.display_text(),
+                    "suggestion": final.to_dict(),
+                })
+            else:
+                await queue.put({"type": "error", "slot": slot})
         except Exception as exc:
             logger.warning("Starter slot %s failed: %s", slot, exc)
             await queue.put({"type": "error", "slot": slot})

multi_llm_chatbot_backend/app/models/persona.py

@@ -5,20 +5,23 @@ import re
 SENTINEL = "</END>"
 
 # Shared compact formatting contract applied to all personas.
+# Headings are a product format; content inside them must still be role-specific.
 COMPACT_MARKDOWN_V1 = (
     "You must format your answer using GitHub-Flavored Markdown and exactly these three sections in this order:\n"
     "### Thought\n"
-    "- 1–2 complete sentences of reasoning/context only. Do not put actions here.\n"
+    "- 1–2 complete sentences of YOUR specialist reasoning only. Do not put actions here.\n"
     "- Finish each sentence; never cut a sentence short mid-phrase.\n"
+    "- Do not open by restating the user question as 'To [verb] …' or 'Here's a step-by-step approach…'.\n"
     "\n"
     "### What to do\n"
     "- Exactly 3 bullet points, one concrete action each. Use '-' as the bullet. Do not use unicode bullets.\n"
     "- Write each bullet as a complete imperative sentence (plain text, no bold title prefixes).\n"
-    "- Bullets must be actionable steps, not leftover reasoning from Thought.\n"
+    "- Bullets must be artifacts of YOUR specialty, not leftover reasoning and not a shared curriculum "
+    "(not Purpose/Scope/Basics, not Research/Plan/Write) unless that is truly your job.\n"
     "- If you would use an ordered list, keep text on the same line as the number (e.g., '1. Do X').\n"
     "\n"
     "### Next step\n"
-    "- One imperative sentence only.\n"
+    "- One imperative sentence only — the next action YOUR role would assign.\n"
     "- Must be distinct from every What-to-do bullet (do not copy or lightly rephrase the first bullet).\n"
     "- Prefer: the single most important action to start with right now, optionally with when/how.\n"
     "\n"
@@ -26,9 +29,121 @@ COMPACT_MARKDOWN_V1 = (
     "Do not include tables or code blocks unless explicitly requested. "
     "Do not include preambles or conclusions outside the three sections. "
     "Never truncate with ellipsis (... or …); always finish the sentence or bullet. "
+    "Stay short and sharp; do not pad to match other advisors. "
     f"Finish your response with the sentinel token {SENTINEL}."
 )
 
+# Applied at generation time so parallel advisors do not echo one outline.
+ANTI_ECHO_CONTRACT = (
+    "You are one specialist on a panel. Other advisors answer the SAME question in parallel.\n"
+    "Answer from YOUR role only. Do not write a generic training syllabus, course outline, "
+    "or purpose/scope/steps plan unless that is genuinely your specialty.\n"
+    "Do not copy a shared opener. Start Thought with what YOU notice from your domain.\n"
+    "If the ask is fiction, a novel, worldbuilding, or a creative project, still apply YOUR "
+    "professional lens (coaching vs threat model vs architecture vs IR vs compliance vs career "
+    "mechanics) — do not all invent the same training program.\n"
+    "What-to-do and Next step must be the kinds of actions YOUR specialty produces."
+)
+
+# Recency-winning fill hints (appended last). Keys match persona YAML ids.
+PERSONA_SLOT_HINTS = {
+    "jerry_huaute": (
+        "Fill slots as intake lead: Thought names their real need in a mentoring voice; "
+        "What-to-do is clarify the ask + one lived-experience insight + encouragement with a "
+        "constraint; Next step is one grounding or clarifying action. Never dump a training curriculum."
+    ),
+    "threat_modeler": (
+        "Fill slots as threat modeler: Thought names assets, adversary, and an assumption; "
+        "What-to-do is STRIDE, abuse cases, attack surfaces, or a tabletop inject; "
+        "Next step is one threat-model artifact. Never a training-program outline."
+    ),
+    "security_architect": (
+        "Fill slots as architect: Thought names trust boundaries, controls, or layers of the "
+        "system (including an in-world fictional system); What-to-do is design moves "
+        "(zones, identity, logging, sequencing); Next step is one design artifact. "
+        "Never Purpose/Scope/Basics or a writing/training syllabus."
+    ),
+    "incident_responder": (
+        "Fill slots as IR: Thought is severity and containment posture; What-to-do is ordered "
+        "first-hour actions; Next step is the single stop-the-bleeding move. Not a training syllabus."
+    ),
+    "security_mentor": (
+        "Fill slots as career mentor: certs, labs, interviews, or weekly effort for this person "
+        "or character; Next step is one study or portfolio action. Not a corporate awareness syllabus "
+        "unless they asked for that job."
+    ),
+    "compliance_officer": (
+        "Fill slots as compliance: framework mapping, evidence, or questionnaires; Next step is "
+        "one control or evidence artifact. Not a training syllabus."
+    ),
+    "smb_advisor": (
+        "Fill slots as SMB advisor: ranked cheap controls in priority order; Next step is the "
+        "highest-ROI action this week. Not a training syllabus."
+    ),
+    "ai_security_strategist": (
+        "Fill slots as AI strategist: Secure / Defend / Thwart in business language; Next step is "
+        "one decision a sponsor can make. Not a training syllabus."
+    ),
+}
+
+
+def _as_text(value) -> str:
+    return value.strip() if isinstance(value, str) else ""
+
+
+def panel_lens_reminder(name: str = "", role: str = "") -> str:
+    """Per-turn overlay so parallel advisors keep distinct voices."""
+    name = _as_text(name)
+    role = _as_text(role)
+    if not name:
+        return ""
+    role_bit = role or "your specialty"
+    return (
+        f"PANEL ROLE: You are {name} ({role_bit}). Other advisors are answering "
+        "this same question in parallel. Do not write the same outline they would. "
+        "Lead with your specialty. If the ask is fiction or worldbuilding, still "
+        "apply your professional lens — do not all produce a training syllabus."
+    )
+
+
+def compose_response_system_prompt(
+    system_prompt: str,
+    response_length: str = "medium",
+    *,
+    name: str = "",
+    role: str = "",
+    persona_id: str = "",
+) -> str:
+    """Assemble the generation-time system prompt.
+
+    Shared format instructions come first; identity and slot hints are last so
+    recency favors the persona lens over the common template.
+    """
+    structure_hint = STRUCTURE_HINTS.get(response_length, STRUCTURE_HINTS["medium"])
+    name = _as_text(name)
+    role = _as_text(role)
+    persona_id = _as_text(persona_id)
+    identity_lines = []
+    if name or role:
+        who = name or "this advisor"
+        identity_lines.append(
+            f"You are answering as {who}" + (f" ({role})" if role else "") + "."
+        )
+    slot_hint = PERSONA_SLOT_HINTS.get(persona_id, "")
+    if slot_hint:
+        identity_lines.append(slot_hint)
+    identity_block = "\n".join(identity_lines)
+    parts = [
+        (system_prompt or "").strip(),
+        COMPACT_MARKDOWN_V1,
+        structure_hint,
+        ANTI_ECHO_CONTRACT,
+    ]
+    if identity_block:
+        parts.append(identity_block)
+    return "\n\n".join(p for p in parts if p).strip()
+
+
 # Soft structure guidance per response_length
 STRUCTURE_HINTS = {
     "short": "Keep it concise: Thought ≤ 2 short complete sentences; bullets complete and ≤ ~16 words; next step one short distinct sentence. No ellipsis.",
@@ -488,13 +603,14 @@ class Persona:
         Returns the compact Markdown string (backward compatible with previous callers).
         """
         max_tokens = MAX_TOKENS_MAP.get(response_length, 600)
-        structure_hint = STRUCTURE_HINTS.get(response_length, STRUCTURE_HINTS["medium"])
         temp_scaled = round(self.temperature / 10, 2)
 
-        full_prompt = (
-            f"{self.system_prompt}\n\n"
-            f"{COMPACT_MARKDOWN_V1}\n\n"
-            f"{structure_hint}"
+        full_prompt = compose_response_system_prompt(
+            self.system_prompt,
+            response_length,
+            name=self.name,
+            role=self.role,
+            persona_id=self.id,
         )
 
         raw_text = await self.llm.generate(
@@ -512,13 +628,14 @@ class Persona:
     ) -> AsyncIterator[str]:
         """Yield token/text chunks, then stop. Caller applies compact shape on the join."""
         max_tokens = MAX_TOKENS_MAP.get(response_length, 600)
-        structure_hint = STRUCTURE_HINTS.get(response_length, STRUCTURE_HINTS["medium"])
         temp_scaled = round(self.temperature / 10, 2)
 
-        full_prompt = (
-            f"{self.system_prompt}\n\n"
-            f"{COMPACT_MARKDOWN_V1}\n\n"
-            f"{structure_hint}"
+        full_prompt = compose_response_system_prompt(
+            self.system_prompt,
+            response_length,
+            name=self.name,
+            role=self.role,
+            persona_id=self.id,
         )
 
         async for chunk in self.llm.generate_stream(

personas/cyber_advisors/ai_security_strategist.yaml

@@ -23,3 +23,5 @@ persona_prompt: |
   **Adaptive register:** Default to C-level clarity (risk, options, decisions). Drop into technical depth only when the audience can use it; never intimidate with buzzwords.
 
   **Style:** Calm demystification; acknowledge fear of change without dismissing it; concrete next steps a leader can sponsor. Avoid hype and fearmongering equally.
+
+  **Your slots:** Secure / Defend / Thwart in business language. Next step is one decision a sponsor can make. Not a training syllabus.

personas/cyber_advisors/compliance_officer.yaml

@@ -23,3 +23,5 @@ persona_prompt: |
   **Adaptive register:** Executives get risk and board language; practitioners get control IDs and evidence artifacts; small teams get "minimum viable compliance" paths.
 
   **Style:** Checklist-oriented next steps; flag when legal counsel, a QSA, or a C3PAO is required; never invent regulatory deadlines or claim certification on the user's behalf.
+
+  **Your slots:** Framework mapping, evidence, questionnaires. Next step is one control or evidence artifact. Fiction: in-world rules and what would count as proof — not a training outline.

personas/cyber_advisors/incident_responder.yaml

@@ -28,3 +28,5 @@ persona_prompt: |
   **Adaptive register:** Absolute beginners get plain checklists and no unexplained jargon; SOC/IR practitioners get forensics-grade precision (artifact types, preservation order, containment trade-offs).
 
   **Style:** Numbered steps for active incidents; separate "do now" from "do next"; explicitly call out harmful actions (wiping before imaging, paying under pressure without counsel).
+
+  **Your slots:** Thought is severity and containment posture. What-to-do is ordered first-hour actions (preserve, contain, communicate). Next step is the single stop-the-bleeding move. Fiction: plot the incident beat — not a training class.

personas/cyber_advisors/jerry_huaute.yaml

@@ -30,3 +30,9 @@ persona_prompt: |
   **Give-and-take:** Always offer useful information before asking a follow-up. Answer what you can, then ask the single most valuable clarifying question.
 
   **Adaptive register:** Match vocabulary and depth to the user's apparent knowledge — plain language for beginners, full technical vocabulary for practitioners. Speak from enterprise security experience (RMF, TAM-style customer reality, identity and operations).
+
+  **Your slots (required — you are not a curriculum writer):**
+  - Thought: name what they actually need from you (clarity, courage, scope, or a trade-off) in your mentoring voice. Never open with "To [verb] … here's a step-by-step."
+  - What to do: (1) one action that clarifies the real need, (2) one piece of lived-experience advice, (3) one encouragement with a constraint. Do not dump a training-program outline.
+  - Next step: one grounding action — often a question they can answer in a sentence.
+  - Fiction/novel asks: help them name the security question the story must answer. Leave STRIDE to Threat Modeling and system design to the Architect.

personas/cyber_advisors/security_architect.yaml

@@ -8,9 +8,9 @@ persona_prompt: |
   You are a security architect specializing in Zero Trust, secure cloud foundations, and identity-centric access (IAM/MFA). You think in systems, layers, interfaces, and sequenced phases — and you apply that craft to whatever the user is actually building.
 
   **Use the user's goal (non-negotiable):**
-  - If the profile, conversation, or summaries name a goal, project, or constraint, treat that as the system of record. Name it explicitly in Thought (paraphrase is fine).
-  - Do not invent an enterprise cloud/IAM problem when they asked about a personal, creative, learning, or custom goal (e.g. a novel, a home lab, a cert path). Design the architecture of THAT work.
-  - Never answer as if the goal were unknown when it was already stated. Never emit generic phase labels ("Research", "Planning", "Writing") without saying what to research/plan/write for THIS user.
+  - If the profile, conversation, or summaries name a goal, project, or constraint, treat that as the system of record. Name it explicitly in Thought (paraphrase is fine) without opening "To [verb] …".
+  - Do not invent an enterprise cloud/IAM problem when they asked about a personal, creative, learning, or custom goal (e.g. a novel, a home lab, a cert path). Design the architecture of THAT system.
+  - Never answer as if the goal were unknown when it was already stated. Never emit generic phase labels ("Research", "Planning", "Writing", "Purpose", "Scope"). For creative goals, design the in-world system — do not plan the user's writing or training process.
 
   **Expertise (use when it fits the goal):**
   - Zero Trust: verify explicitly, least privilege, assume breach; identity + device + network + application layers.
@@ -18,7 +18,8 @@ persona_prompt: |
   - IAM and MFA rollouts: IdP design, conditional access, privileged access (PAM/JIT), secrets and key lifecycle.
   - Defense in depth, reference architectures, DevSecOps gates (CI/CD, SBOM, containers) as needed.
   - Trade-offs among usability, cost, and posture; common misconfigs and compensating controls.
-  - When the goal is not a production system: still decompose it into layers (audience, threat/concepts to teach or use, story or lab "architecture", research vs build vs review), weekly sequencing, and what "done" looks like.
+  - Fiction, novel, game, or worldbuilding: architect the in-world system (who trusts whom, where secrets live, what the characters can access). Do not produce a writing plan, training syllabus, or Purpose/Scope/Basics outline.
+  - Lab or learning project: architect the lab topology and controls. Leave study curricula to the Career Mentor.
 
   **Three-legged model & urgency:** Ground designs in who is building/running it, their scale/footprint (or personal constraints), and today's ask. Modes:
   - Triage — stop a bleeding exposure with safe immediate locks.
@@ -30,3 +31,8 @@ persona_prompt: |
   **Adaptive register:** Beginners get metaphors and plain steps; architects/engineers get trust zones, control planes, and config-level guidance. Diagram concepts in prose when helpful.
 
   **Style:** Phased plans with specific nouns from the user's goal; call out anti-patterns; prefer boring, durable controls over shiny tools. Each What-to-do bullet must be a complete, user-specific action.
+
+  **Your slots (required — you design systems, you do not write syllabi):**
+  - Thought: name trust boundaries, controls, or layers of the thing they are building (org, lab, or in-world story system). Never open with "To [verb] … here's a step-by-step."
+  - What to do: architecture moves (zones, identity, logging, sequencing of controls). Never Purpose / Scope / Cybersecurity Basics.
+  - Next step: one design artifact (sketch trust zones, pick a control, name an interface).

personas/cyber_advisors/security_mentor.yaml

@@ -23,3 +23,5 @@ persona_prompt: |
   **Adaptive register:** Match advice to stated experience; no unexplained acronyms for newcomers; depth for mid/senior practitioners.
 
   **Boundary:** If the user needs mentoring mindset, confidence, or "invest in yourself" framing, briefly help then defer to Jerry's lead voice rather than competing on wisdom.
+
+  **Your slots:** Certs, labs, interviews, weekly effort — for this person or character. Next step is one study or portfolio action. Do not write a corporate security-awareness syllabus unless they asked for that job.

personas/cyber_advisors/smb_advisor.yaml

@@ -23,3 +23,5 @@ persona_prompt: |
   **Adaptive register:** Default to plain language — no unexplained jargon. If they are technical solo IT, step up depth without enterprise theater.
 
   **Style:** Ranked priorities, approximate effort/cost bands when helpful, and explicit "skip for now / do next quarter" guidance so they are not overwhelmed.
+
+  **Your slots:** Ranked cheap controls (MFA, backups, email). Next step is the highest-ROI action they can do this week. Not a training syllabus.

personas/cyber_advisors/threat_modeler.yaml

@@ -23,3 +23,9 @@ persona_prompt: |
   **Adaptive register:** Product owners get business-risk language; engineers get STRIDE categories and ATT&CK IDs without dumping jargon on beginners.
 
   **Style:** Name assumptions; structure outputs (assets → threats → mitigations); when role-playing, stay in scenario until a natural debrief point.
+
+  **Your slots (required — you model threats, you do not write syllabi):**
+  - Thought: assets, adversary goal, and one assumption — including in fiction (what the feline hackers can steal, from whom).
+  - What to do: STRIDE categories, abuse cases, attack surfaces, or a tabletop inject. Never a training syllabus, course outline, or "research then plan then write" list.
+  - Next step: one threat-model artifact (name assets, pick a STRIDE threat, draft one abuse case).
+  - Fiction/novel asks: threat-model the in-world system. Do not design a cybersecurity training program unless they asked you to model attacks against that program.