feat: consolidate TraceDecay V2 PR8-PR13 delivery - #421
Draft
ScriptedAlchemy wants to merge 6525 commits into
Draft
feat: consolidate TraceDecay V2 PR8-PR13 delivery#421ScriptedAlchemy wants to merge 6525 commits into
ScriptedAlchemy wants to merge 6525 commits into
Conversation
|
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
July 10, 2026 05:54
e50f8f5 to
4f5ab66
Compare
Owner
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 986f25cca6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
4 times, most recently
from
July 11, 2026 16:52
5862bd6 to
53502de
Compare
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
4 times, most recently
from
July 23, 2026 17:06
642a33a to
5f2f610
Compare
ScriptedAlchemy
changed the title
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
July 24, 2026 17:16
76dee0f to
0258866
Compare
ScriptedAlchemy
added a commit
that referenced
this pull request
Jul 27, 2026
Record the 2026-07-27 audit in the authoritative V2 status files. Three delivered claims (Plan 16 worktree/store identity, Plan 38 cursor repair, Plans 18/23 end-to-end sanitization) lost their tests in 9e3ca9f. Filed as verification-coverage corrections, not retractions: the assertion is missing, the behavior is not withdrawn. Also record the six instances of gates attesting to something they never checked, the libtest empty-filter asymmetry that hides them, the six product defects fixed tonight with their SHAs, and Plan 11's corrected open-gap list including two items the widened accessibility matrix surfaced. None of tonight's commits has CI validation: PR #421 has been conflicting since 05:13 UTC, so no CI has run since 01:24 UTC. Every fix is recorded as locally verified only.
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
August 1, 2026 18:32
062285a to
b73f8bf
Compare
This was referenced Aug 3, 2026
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
August 7, 2026 08:32
ef68e05 to
f92b7f9
Compare
ScriptedAlchemy
added a commit
that referenced
this pull request
Aug 7, 2026
Record the 2026-07-27 audit in the authoritative V2 status files. Three delivered claims (Plan 16 worktree/store identity, Plan 38 cursor repair, Plans 18/23 end-to-end sanitization) lost their tests in 9e3ca9f. Filed as verification-coverage corrections, not retractions: the assertion is missing, the behavior is not withdrawn. Also record the six instances of gates attesting to something they never checked, the libtest empty-filter asymmetry that hides them, the six product defects fixed tonight with their SHAs, and Plan 11's corrected open-gap list including two items the widened accessibility matrix surfaced. None of tonight's commits has CI validation: PR #421 has been conflicting since 05:13 UTC, so no CI has run since 01:24 UTC. Every fix is recorded as locally verified only.
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
2 times, most recently
from
August 7, 2026 21:43
1486ceb to
f44f5c5
Compare
Route the stray sha256 hex re-roll through canonical_text::sha256_hex, the three hand-rolled UTF-8 byte-budget truncation loops through utf8_prefix_at_or_before/truncate_utf8, the two clamp-to-char-boundary copies through chunks::snap_down, and the URI validation trio duplicated across tracedecay-lsp and lsp_runtime through a shared gateway export. The gateway grows a strict_file_url / strict_file_uri_path split because the two copies were not identical: document URIs validate at the URL level (UNC hosts are valid URLs on every platform), while the path-producing form additionally converts platform-locally. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Delete five dead pub entry points and the APPLICATION_SURFACE_OPERATIONS compatibility alias, collapse the two invoker validation branches onto one iterator, replace the hand-maintained callable-code allowlist with a single HttpPageProjection authority, collapse the agent_cmd telescoping overload chains onto ComponentSetApplyContext, overlap the independent code-index search and memory reads in handle_context with tokio::join, and bundle the five cloned projection handles in schedule_saved_generation_inner into one Arc'd context. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replace the annotation-emitter mock suite with assertions folded into the real extractor integration tests (strengthening two assertions that only re-checked mock inputs), drop the never-instantiated RecordingEffect double, gate the test-transport-only advisory imports so both feature configurations build warning-free, and fix a fixture whose language: None violated the committed SanitizedCodeFileV1 contract. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The closeout ledger claimed codex/final-v2-closeout was the current branch; work resumed on codex/tracedecay-total-redesign-plan and the closeout pointer is now a strict ancestor (38 commits behind, 0 ahead). The pinned coordinator content hash had drifted before the ledger was written — the invariant is now stated as worktree-matches-HEAD plus the owning change, not a hardcoded hash. Status header extended through the 08-13 late window (automation hardening wave and the PR #421 review wave). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…plan' into codex/tracedecay-total-redesign-plan
Mark the github_runtime stack lane done with its landed commits and verified journey evidence, handing the dark signal-variant decision to the daemon lane. Stamp Plan 39 superseded-by-landing - the Grafeo graph-db boundary shipped without its checklist being ticked - and point the RC recovery plan's 55 untouched checkboxes at NEXT.md as the live remainder. Record the doctor domain-symbol-extraction gap as a tracked non-blocking decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A new analysis tool reporting Rust source files present on disk that no mod declaration reaches from any cargo target root — files the code graph indexes as healthy-looking symbols while the compiler never parses them (the defect class behind the seven orphaned daemon files removed earlier). Walks each workspace crate from its own roots following mod and #[path] declarations via tree-sitter, honours cargo-shear ignored-paths, treats cfg-gated modules as mounted, and names the nearest mounted parent plus the exact mod line to add per finding. Grep, ast-grep search, and this audit now share one working-tree walk so they agree on what a project file is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The ten primitive-surface bindings gained typed schemas in d2b094c; verified at HEAD the TypeScript client suite is 34/34 with the complete-operation assertion unweakened and the canonical generator byte-identical. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Pure rustfmt reflow (verified: each file equals rustfmt of its HEAD content) on files from the PR #421 review-wave commits. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
recover_matching_append_intent write-through republished a matching incomplete intent, then cleared it after truncation — and the caller immediately rewrote byte-identical intent content with a second atomic publication, fsync, and readback. Retain the republished intent and resume the append under it; the identity-present and missing-spool early returns now guard against ever exiting with a stranded intent. Unblocks visible_append_intent_is_write_through_republished_before_clear. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Four retrieval leaf modules privately re-implemented the documented shared validate_identifier (remote/recovery byte-for-byte with 512 inlined; callable_code and symbol_graph via unbounded validate_text clones whose sibling validate_query re-added the bound with a different problem code; grep_analysis a fourth copy). All route through identity::validate_identifier via shared retrieval::validate_bounded_text and node-depth helpers; the InvalidRange/InvalidIdentifier split for over-long queries is unified on InvalidIdentifier — no caller, SDK, or test pinned InvalidRange for query length on these surfaces. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Skill writer skipped on session-evidence unavailability, but the application terminal only accepted those reasons for the reflector, so scheduler ticks failed closed. Search also races the verified graph and omits node_id, so MCP smoke now takes the occurrence from find_exact_symbol. SDK installed-package conformance starts the daemon before init to match sole-daemon ownership.
The delivery settlement contract landed in 1493553, but its transport boundaries were only proven on the delivered happy path. Add journeys for the terminal drops: a peer that disconnects between admission and the response write, and a client cancellation of an in-flight Work request. Both must settle a typed drop rather than strand the attempt as unknown. Hook replay identity was covered only by calling the receipt function twice. Drive a real three-pass replay instead: an unacknowledged pass re-offers the identical record identities, and an acknowledged record is never redelivered. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The canonical projection reducer is provider-neutral except for three decisions: whether a record may omit its native record id, which namespace session-location metadata keys take, and whether provider compatibility fields are appended to message metadata. Each was an inline string comparison, so the reducer read as provider-aware throughout and no single place answered what is provider-specific about the projection. Move all three onto a provider descriptor with named capability functions, and characterize each branch first so the projection output stays byte-identical for every input. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The retention drop pass deletes projection-durable raw rows that summary lineage still names, so the registered render path aborted expansion and description of any summary older than the drop window with a misleading SummarySourceNotOwnedBySession. An absent raw row now degrades that source to RetentionExpired and the render continues; the anchor resolver recovers the dropped locator from the projected lineage and refuses to do so when the row is actually present. Rows that are present but foreign still fail the ownership check, which stays decidable because the source loader fetches by store_id alone. Describe keeps its published shape: LcmDescribeSourceOverviewV1 is a generated SDK contract gated by scripts/check-sdk-codegen.sh and mapped in src/daemon/retained_owner/lcm/output.rs, so a dropped source is reported with no raw metadata rather than carrying a new hydration field. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The dashboard Work journey stopped at its verified task root: a task with no accepted attempt, whose only truthful answer is zero sources. The question a user opens a task to ask -- who worked on this, in which provider session -- was never driven on either published mount. This runs one real pinned provider through the production spawn path, observes the accepted-attempt relation, imports the provider transcript, and grades the TaskId-rooted read on the daemon mount and the dashboard mount, in all four temporal modes, across a physical daemon restart. The provider-qualified session is decoded through the canonical identity so an elided default provider cannot be mistaken for an unqualified one. TaskSession hydration is owned by the activated evaluated federated query authority, which this fixture does not activate, so its absence is graded as the typed unavailable omission on both mounts rather than a fabricated empty session. Two fixture facts the journey needed: a physical daemon restart that republishes its authority record, and a dashboard stdout pipe that stays drained -- dropping the read end turned the server's next log write into SIGPIPE and killed the mount mid-journey.
Feedback test-results already ships typed schemas; the installed-package denylist still treated that operation as unauthorized and failed packed SDK conformance against a same-commit daemon.
The combined-review backend fixture still asserted the retired approval-gated contract. The agentic curation cutover removed the human approval gate and combined review dispatches with apply=true so terminal effects commit automatically; the fixture now asserts the live contract. Suite 9/9. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Provider variation in authoritative LCM summarization was spread across three mechanisms at three depths: a `match provider` in the generator, a chain of `provider ==` predicates interleaved through the shared 512-row evidence scan, and a `provider = 'claude'` literal buried in the pairing SQL. Adding a host meant editing all three, and the scan's branch order was load-bearing without saying so. Each host now registers one capability instead. A native-summary recognizer owns its recognition predicate, its corroboration query, and its route label; a summarizer capability owns on-demand generation. Both are const registries in the house `TRANSCRIPT_CAPTURE_KERNELS` shape, so the scan loop no longer names a provider -- it decodes a row once and offers it to whatever recognizers are registered. Behavior is unchanged, including precedence. The recognizer order is now written out with the reason it matters: Codex reads raw provider metadata that never decodes as a canonical envelope, so its arm has to run before envelope decoding can reject the row. Envelope decoding became best-effort rather than a row-skipping gate to preserve that. The Claude pairing query now binds the scanned provider instead of hardcoding the literal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three fixture facts the journey uncovered, each of which had been silently shaping what the dashboard mount could be tested for: The product selection has to be the one the whole journey's events are admitted under. profile_owned_no_git covers exactly the events that named no relation scope, so once a settled provider attempt publishes repository-scoped Work events, every read under the no-Git selection is refused outright -- a partially folded graph is a falsified graph. The journey now uses the repository-relation selection throughout. tracedecay dashboard is a launcher, not a server: it asks the daemon to host the dashboard, prints the bound URL, and exits. Process liveness therefore says nothing about reachability, so the fixture polls the bound address instead, and reports the launcher's own stderr when it never comes up. A daemon that has just restarted is still binding its project runtime, so the graded reads poll past the typed warming window rather than sleeping past it. The durability pass is graded on the daemon mount alone, and the reason is recorded in the journey: because the dashboard is hosted inside the daemon, a restart takes it down, and relaunching against the new daemon reports a fresh bound URL -- a different port -- that never accepts a connection within a 60s poll.
Every observation on the live ingest path ran INSERT ... ON CONFLICT DO NOTHING and then unconditionally SELECTed the row back to compare it field by field. On a fresh insert that read can only echo the parameters just written: both tables are insert-only (immutable update/delete triggers) and the read shares the connection and transaction with the write, so the comparison had no way to fail. Use the affected-row count to tell an insert from a conflict. Only a conflict can hide a durable row that disagrees with this derivation, so the read-back comparison - the actual replay contract - now runs on that branch alone. verify_effect keeps its unconditional whole-set check for observations replayed at or below the projection checkpoint. Provider-usage rows now decode their envelope, scope, and source range once per observation via ProviderUsageContext instead of once per path, and verify only the ordinals whose insert actually conflicted. Cover the three cases the branch split creates: fresh insert persists the derived tuple, identical replay converges, and a divergent durable row is still rejected as a provenance collision. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The plugin bundle is the roster agents actually read, and a tool nothing references is a tool nothing calls. Add the mount audit to the Cursor mcpAllowlist, the code-health auditor agent, the audit-safety, check-health and clean-dead-code commands, and the code-health and reviewing-changes skills — alongside dead_code and unused_imports, whose findings it precedes: a file no build root reaches is dead wholesale, and every symbol in it reads as live to the other three tools. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The README workflow groups and the USER-GUIDE code-quality table are where a reader learns the tool exists at all, and the Rust probe matrix is where it gets exercised against real repositories. Describe it by what it answers rather than by one ecosystem's mechanism, so the entry stays true as more ecosystems gain a reachability model. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
BREAKING CHANGE: cursor transcript records now write their session-location
metadata under `cursor_session_*` like every other provider. The previous
`cursor_event_*` namespace existed only so readers of already-persisted
metadata resolved the same keys — a persisted-shape compatibility exception
the V2 fresh-store cutover forbids. There is no dual-read fallback: readers
resolve the canonical key only, and an old store fails typed at admission
through the existing reset-required machinery, which this change does not
touch.
Because the namespace is now provider-uniform, `metadata_namespace` and its
cursor constants carry no decision and are gone; the reducer formats
`{provider}_session` at its one call site and the descriptor honestly
documents two provider-shaped decisions instead of three.
Also renames the misnamed "compatibility metadata hook": appending
`tool_calls`/`tool_events`/`tool_use_id` is live V2 normalization of cursor
records into the cross-provider shape, not legacy support. The type, the
selector, and the cursor implementation are now `ToolMetadataNormalizer`,
`tool_metadata_normalizer`, and `normalize_cursor_tool_metadata`.
The canonical_projection characterization tests that pinned `cursor_event`
are re-pinned to `cursor_session`. That is an intentional behavior change
under the cutover mandate, not a test repair.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…tal-redesign-plan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This draft PR is the consolidated delivery branch for TraceDecay V2 PR8 through PR13.
The branch also contains the supporting rusqlite runtime cutover, worktree-aware incremental indexing, storage retention/Doctor integration, and direct product tests required by the canonical V2 plans.
Verification
cargo check --all-featurescargo test --all-featurescargo clippy --workspace --all-targets --all-features -- -D warningscargo fmt --all -- --checkCurrent status: implementation is still being consolidated from the shared checkout and CI is red. This PR remains draft until the working tree is committed, broad verification is stable, and the historical conventional-commit blocker is resolved. It must not be merged in its current state.
Safety boundaries
GitHub review ingestion is read-only. Semantic indexing never blocks exact/lexical/graph retrieval and publishes only complete compatible generations. Local coordination logs, private transcript evidence, secrets, and ad hoc artifacts are excluded from commits.