feat(settings): add session summaries toggle and guidance skill

[michellemxm]

Problem

The session summary feature (chat right-panel intent summaries) shipped its backend in PR #2855 and its panel UI in #3169, but there was no user-facing way to turn it on. The session_summary.enabled config existed only as a file-edit — a user would have to hand-edit config.json to enable a feature that is deliberately off by default.

Why it matters

Summarizing spends tokens on a turn the user did not explicitly ask to pay for, so the feature must stay opt-in. An opt-in with no UI is effectively undiscoverable: the panel ships dark for everyone, and the only path to enable it is undocumented config surgery. This is the third and final staged PR that makes the feature reachable.

Fix (symptom → root cause → change)

Symptom: no control to enable session summaries. Root cause: the config key was never surfaced in the dashboard and was not in the editable-config allowlist, so even a PATCH would be rejected. Change:

• Editable-config allowlist — add "session_summary.enabled": {"type": "bool"} to _EDITABLE_CONFIG in dashboard/handlers/core.py. Only the boolean enable is editable; the cadence/cap fields (min_user_turns, max_intents, …) stay config-file-only as power-user knobs.
• Settings toggle — a new row in Settings → Chat → Sessions (website/src/pages/settings/ChatPanel.tsx), wired to patchConfig('session_summary.enabled', …) following the existing server-config toggle pattern (prevent-sleep / knowledge). Copy states plainly that enabling costs tokens on turns that change the session, and that unchanged sessions are served free from cache.
• Guidance skill — a new guidance-only, stateless builtin skill src/kiro_crew/builtin_skills/session-summaries/SKILL.md that explains the panel, its cost model, and how to make a session summarize well. It does not enable the feature or trigger generation, and holds no runtime-written frontmatter (a builtin skill is re-synced by rmtree+copytree on upgrade).
• i18n — 3 new strings (session_summaries, its description, failed_to_save_session_summaries) in en.manual.json and all 11 translation catalogs; en-XA pseudolocale regenerated.
• Settings registry — settingsRegistry.gen.ts regenerated so the toggle is searchable in the command palette.
• Docs — noted the new builtin skill in docs/system-specs/modules/memory-skills-hooks.md.

Tests

No new dedicated test — the toggle reuses the shared SettingsToggle + server-config-PATCH path already covered by SettingsChatPanelCoverage, and the new config key is exercised by the parametrized editable-config PATCH tests. Locking gates that pass on this change:

• Backend: flake8 / isort / black / mypy on the changed file; targeted pytest for test_config_api.py, test_config_loader.py, test_portability.py (352 passed).
• Frontend: tsc -b, eslint, full i18n:check (16/16) + i18n:render, ChatPanel + full i18n vitest (incl. catalogParity / zhStyle / hiStyle), and the settings-registry generator test (confirms the checked-in file matches live extraction).

Manual verification

Rendered the Settings → Chat → Sessions panel via the repo's built SPA behind a stubbed-/api/** loopback server + Playwright (the same serveDist + stubDashboardApi harness the other capture scripts use) — no gateway, so it sidesteps the local isolated-gateway limitation. Verified the new row appears last in the Sessions card, renders the token-cost copy, and shows both the off and enabled toggle states.

Screenshots

Session summaries toggle in the Sessions card — off (default) and enabled:

Notes

• I dropped the toggle's configKey prop: it tripped the i18n strict gate (configKey isn't in the jsx-attributes exemption list, unlike path), and adding that exemption is a base-rule change this PR should not own. Sibling toggles in the same section omit it too. Cost: no command-palette deep-link to this specific row. A follow-up PR can add the exemption if the deep-link is wanted.
• Generate-on-demand button and multi-session rollup are explicitly deferred in the staging plan; not part of this PR.

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of b22889a4b47f763970559c57b661479c0b13aaed and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] b22889a

False positive or not applicable? A repository writer can comment:
/ai-review override gpt b22889a4b47f763970559c57b661479c0b13aaed: <one-sentence reason>

[github-actions]

Design Review (Fable 5) — ✅ PASS

Advisory design-level review of b22889a4b47f763970559c57b661479c0b13aaed — updated in place on each push; does not block merge.

Design-Verdict: PASS

Additive, opt-in, fully reversible surfacing of an already-shipped feature — allowlist entry, toggle, and guidance skill each sit at the right layer.

[DESIGN-REVIEWED] b22889a

[github-actions]

UX Review (Fable 5) — 🟡 CONCERNS

Advisory UX-level review of b22889a4b47f763970559c57b661479c0b13aaed — updated in place on each push; does not block merge.

UX-Verdict: CONCERNS

The skill tells the agent to "point them there," but the toggle ships without the deep-link hook and never says where summaries appear.

Watch

• Missing configKey on the new toggle breaks the pointing loop this PR itself creates. SettingsToggle label={…session_summaries} (ChatPanel.tsx:608) writes session_summary.enabled via api.patchConfig but passes no configKey, so a <SettingRef> chip — exactly how the agent honors the skill's "Point them there rather than editing config by hand" — silently degrades to a CLI popover instead of jumping to the control. Every user who asks the agent to enable it hits this; friction, persistent until fixed. Fix: add configKey="session_summary.enabled".
• Enabling produces no pointer to where the result lives. Description reads "Summarize each session by intent. Uses tokens on turns that change the session" — the key name (…in_the_right_pa) shows "in the right panel" was drafted then dropped. A user toggles it on, sees nothing change, and must discover the side-panel tab on their own. Once-per-user, comprehension friction. Fix: restore the location — "Summarize each session by intent in the chat side panel."

Suggestions

• session_summaries label: use "Session Summaries" — every sibling in the Sessions card (screenshot sessions-card-off.png: "Restore Sessions", "Tail-only Fork", "History Expanded") is Title Case; the newcomer is the only sentence-case row.
• The summary panel's existing off-state ("Session summaries are off") now has a real destination this PR created — add a link/SettingRef to Settings → Chat → Sessions next to off_body so the surfaced fact offers its next step.

[UX-REVIEWED] b22889a

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed b22889a4b47f763970559c57b661479c0b13aaed — this comment is updated in place on each push.

Review details

The mechanism is fully verified: the new SettingsToggle at ChatPanel.tsx:608 omits configKey, extractStringProp(props, 'configKey') therefore reads nothing, and the generated settingsRegistry.gen.ts entry (chat.session-summaries) carries no configKey — so resolveSettingRef (SETTINGS_REGISTRY.find(e => e.configKey === configKey)) misses and falls through to mode: 'file'. This is a real violation of the explicit website/AGENTS.md "must not wait for a pointer" rule, which states this is the only gate for the missing case. It is not an AUTOSDE blocking: true rule, not a crash/security/data-loss, and its user-visible effect is latent until a SettingRef targets the key (none does today), so it is advisory, not blocking. The fix is in-diff.

No blocking findings; one advisory.

FINDING — website/src/pages/settings/ChatPanel.tsx:608 — the new config-writing SettingsToggle omits configKey, so the generated registry entry lacks it and a <SettingRef configKey="session_summary.enabled"> would silently degrade to a CLI/file popover instead of deep-linking to the toggle (the review-only rule in website/AGENTS.md) → Fix: add configKey="session_summary.enabled" to the toggle and regenerate (npm run gen:settings).

[OPUS-REVIEWED] b22889a

Verdict parsed from the review's SHA-scoped output markers for commit b22889a4b47f763970559c57b661479c0b13aaed.

False positive or not applicable? A repository writer can comment:
/ai-review override fable b22889a4b47f763970559c57b661479c0b13aaed: <one-sentence reason>