feat(bundle): traces bundle assembles one session's durable evidence directory

[drewstone]

What

traces bundle --harness claude-code --session <id|path> --cwd <repo> --out <dir>: assembles one coding session's complete evidence directory — the input contract for downstream consumers (first: the supervisor-lab research-comms pipeline).

Layout: session/ (transcript byte-for-byte + subagents dir; absent subagents recorded as fact, missing transcript fails loud) · derived/ (session-index with ledger-context join, deterministic analyze report at $0, evidence.jsonl with bundle-relative paths, OTLP export) · ledger/ (.evolve slices windowed to the session span ±15min — pad recorded in provenance; unparseable-ts rows counted, never silently dropped) · repo/git-log.txt for the window · manifest.json written last with sha256+bytes per file, provenance, absences, and a knownLimits block.

Ships the flat-.evolve-convention indexer fix in the same branch (handoff-*.md / progress.md / current.json now indexed).

Proof

• 49 test files / 644 tests green (4 new bundle tests: full assembly + sha256 recompute, absent-subagents, missing-transcript reject, non-empty-out reject); typecheck, build, source/package checks clean.
• Real-path smoke on an actual session: 12 files, 6 ledger slices, 2 recorded absences; all 12 manifest sha256s independently recomputed and matched; honest windowing verified (0 in-window ledger rows for a session predating them — recorded, not fabricated).
• Independent adversarial verifier: clean, zero discrepancies.
• merge-tree clean into main.

Named follow-ups

Release as 0.12.0 rides the repo's release automation (the --otlp shim deprecation notes "removed in 0.12"). Open-PR capture is deliberately absent (no network calls) and recorded in every manifest's knownLimits; a --with-prs opt-in can come later.

[tangletools]

✅ Auto-approved drewstone PR — d0a2c0f2

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-08T05:15:38Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	2 (2 low)
Heuristic	0.0s
Duplication	0.0s
Interrogation	279.8s (2 bridge agents)
Total	279.8s

💰 Value — sound

New traces bundle command assembles a content-addressed evidence directory by composing existing primitives plus genuinely-new windowing/manifest logic — no existing equivalent, no better design found.

• What it does: Adds traces bundle --session <id|path> --cwd <repo> --out <dir> (src/bundle.ts:344) which assembles one session's durable evidence directory: session/ (raw transcript byte-for-byte + subagents dir, absent recorded as fact), derived/ (session-index, deterministic report.md, evidence.jsonl, OTLP spans — all via existing primitives), ledger/ (.evolve experiments/skill-runs JSONL windowed to s
• Goals it achieves: Give downstream consumers (first: supervisor-lab research-comms) a single durable, self-describing directory they can cite long after live stores rotate. The manifest makes every later claim checkable against exact bytes (sha256 per file); recorded absences + knownLimits make the boundary explicit instead of discovered; the transcript is the required anchor (fails loud if missing). Read from the c
• Assessment: Good change on its merits, built in the grain of the codebase. It composes existing primitives (runTraceInvestigation, buildPolicyEvidenceRecord, buildSessionIndexFromRows, findContextRoot, sessionReportSource) instead of reimplementing them; the sessionReportSource extraction is a clean dedup that cli.ts now consumes too. The new logic (windowed verbatim JSONL slicing with counted unparseable row
• Better / existing approach: none — this is the right approach. I searched for existing bundle/evidence-pack functionality (grep for bundle|Bundle|assembleSession across src/; examined runTraceImprovement at improvement.ts:847 and writeTraceImprovementArtifacts at improvement.ts:825). The closest analog, improve, writes only analysis artifacts (result.json/evidence.jsonl/report.md/traces.otlp.jsonl) with no raw transcript,
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":"queue_timeout","admission":{"active":20,"queued":0,"maxActive":20,"maxQueue":48}}}

🎯 Usefulness — sound

A coherent, well-fitted capability that composes existing infrastructure into a durable, verifiable session evidence directory — wired into CLI and library surface correctly, reuses shared primitives, handles failure regimes comprehensively, and fills a gap no existing command covers.

• Integration: Fully reachable: CLI dispatch at cli.ts:1685, cmdBundle at cli.ts:773, --session/--cwd/--out flags plumbed through parseArgs at cli.ts:228, --current support via CURRENT_SESSION_COMMANDS at cli.ts:325, library export via index.ts:91 (export * from './bundle.js'). Reuses resolveSelectedSession (cli.ts:412) shared with cmdEvidence/cmdIndex. No programmatic callers yet — normal for a capability landi
• Fit with existing patterns: Follows the codebase's grain exactly: module-per-feature (bundle.ts), thin CLI shell over library function pattern (matching cmdEvidence, cmdIndex, cmdImprove), reuses existing primitives (parseSession, runTraceInvestigation, buildPolicyEvidenceRecord, buildSessionIndexFromRows, findContextRoot, sessionReportSource). The schemaVersion/kind/provenance manifest shape matches TraceInvestigationResult
• Real-world viability: Error paths comprehensively handled: missing transcript throws before any directory creation (bundle.ts:350-358); non-empty out dir rejects (bundle.ts:367-371); null cwd → findContextRoot returns null cleanly (session-index.ts:185); missing subagents/ledger/git → recorded as absent (bundle.ts:379-384, 424-442, 447-461); unparseable ledger rows counted not dropped (bundle.ts:166-190); git log failu
• Model: opencode/deepseek/deepseek-v4-pro
• Bridge attempts: 3
• Bridge warning: opencode/zai-coding-plan/glm-5.2: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":"queue_timeout","admission":{"active":20,"queued":1,"maxActive":20,"maxQueue":48}}}; opencode/kimi-for-coding/k2p7: Bridge returned 503: {"error":{"message":"cli-bridge admission timed out after 30000ms","type":"admission_rejected","reason":

🔎 Heuristic Signals

🟡 Cruft: console debug added src/cli.ts

• console.log(

🟡 Cruft: magic number added src/bundle.ts

+const SESSION_WINDOW_PAD_MS = 15 * 60 * 1000

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260808T052225Z}