R1: replay-backed Flight Recorder

docs/BUILD_LOG.md

@@ -2,6 +2,17 @@
 
 This is a concise chronological record of material implementation work and runtime evidence. It is not a substitute for Git history; it captures intent, verification, and blockers that a commit alone may not explain.
 
+## 2026-07-31 — R1 replay and Flight Recorder accepted
+
+- Implemented the exact schema-v1 `AgentTask`, `AgentWorkspace`, `AgentRun`, `AgentDriver`, `RunEvent`, `RunEnvelope`, `RunRecorder`, and `TaskStore` boundaries behind a checked, credential-free replay driver.
+- Added canonical JSONL serialization, strict sequence and terminal ordering, execution identity checks, project-scoped evidence ownership, bounded evidence metadata, task-intent hashing, opaque local-handle omission, range reads, and extension-owned filesystem persistence.
+- Added a checked seven-event fixture transcript and ten R1 tests. The tests reject sequence gaps/duplicates, late events, command identity mismatches, cross-project evidence, absolute paths, identity drift, noncanonical lines, unsorted redactions, oversized stored evidence, unknown fields, and unbounded task intent. Failed and cancelled runs do not invent a target revision.
+- Renamed the raw event layer from `Chronicle` to **Flight Recorder** before publication because OpenAI now uses Chronicle for screen-derived Codex memory. ADR-005 distinguishes the raw controller ledger from a possible participant-facing Flight Log.
+- Compared current official Codex App Server, ACP, Cline SDK, OpenCode server, and Claude Managed Agents interfaces. ADR-006 selects exact-version Codex App Server over local stdio for the first live spike and ACP as the next portability boundary; no generic agent loop or vendor event union enters the domain contract.
+- Local Windows evidence: `npm run check`, all 37 extension tests, production build, and VSIX packaging passed. Protected PR #11 run `30665384997` then passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`. The packaged Microsoft Store Codex executable was discoverable but returned `Access denied` from the repository shell, so no live adapter success is claimed; its future preflight must require an accessible exact-version CLI and fail closed otherwise.
+
+Evidence: `extension/src/agent/`, `extension/src/recorder/`, `extension/test/flight-recorder.test.ts`, `docs/v0.3/ADR-005-FLIGHT-RECORDER-NAME.md`, `docs/v0.3/ADR-006-CODEX-APP-SERVER-ADAPTER.md`, local command output on 2026-07-31, and protected GitHub Actions run `30665384997` on PR #11.
+
 ## 2026-07-31 — R0 deterministic fixture accepted
 
 - Added the dependency-free `tenant-cache-key` fixture with fixed base, target, and mutated trees; controller-owned harness, oracle, mutation, and known repair; fixed SHA-1 Git identity, timestamps, branch, LF policy, and golden revisions/hashes.

docs/PROJECT_STATE.md

@@ -2,7 +2,7 @@
 
 Last updated: 2026-07-31
 
-## Current branch milestone — R0 deterministic substrate complete
+## Current branch milestone — R1 replay and Flight Recorder complete
 
 Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Control Development**.
 
@@ -15,7 +15,9 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co
 - R0a now implements RFC 8785 canonical JSON, domain-separated SHA-256, UTF-8 path ordering, tree/candidate/manifest hashes, the versioned fixture types, and fail-closed manifest validation. Ten R0a tests pass on this Windows checkout, bringing the extension suite to 23/23.
 - R0b now has a committed dependency-free `tenant-cache-key` fixture, deterministic Git factory, fixed base/target revisions and state-tree hashes, controller-owned mutation/repair/harness/oracle blobs, and a separately downloaded hash-pinned Node `v22.17.0` runtime. On this Windows checkout, base and target checks pass, the mutation fails the declared tenant-isolation check, the known repair returns the exact target tree to green, and cleanup preserves the source repository snapshot.
 - The full local Windows extension suite passes 27/27 with `npm run check`, build, and VSIX packaging. Protected PR #10 run `30663623200` independently reproduced the exact fixture/runtime behavior on Linux and Windows; all five required checks passed, so R0 acceptance is complete.
-- `TrustedFixtureRunner`, `AgentDriver`, Chronicle, semantic extractor, Experience Compiler, Takeover Twin, Evidence Judge, Control Pulse runtime, readiness ledger, and v0.3 cockpit do not exist yet.
+- R1 implements the schema-v1 `AgentDriver` boundary, checked replay driver, canonical task-intent storage, and append-only local Flight Recorder behind injected storage and evidence-ownership interfaces. Ten R1 tests cover deterministic replay, canonical round trips, sequence/execution/identity violations, cross-project evidence, path and size bounds, failed/cancelled honesty, persistence, range reads, and secret/local-handle omission.
+- The full local Windows extension suite passes 37/37 with `npm run check`; the production bundle and VSIX package also pass. Protected PR #11 run `30665384997` independently passed `extension`, `extension-windows`, `contract`, `web`, and `jules-rnd-policy`, so R1 acceptance is complete.
+- The semantic extractor, Experience Compiler, Takeover Twin lifecycle, Evidence Judge, Control Pulse runtime, readiness ledger, and v0.3 cockpit do not exist yet. `TrustedFixtureRunner` exists for the closed R0 fixture substrate.
 - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets.
 - A new implementation audit found five R0 ambiguities: candidate-diff identity, pre-store fixture blobs, runtime identity, check IDs, and Git object format. The normative contract closes them with structured diffs, catalog-owned blobs, standalone Node `v22.17.0`, declared test IDs, and SHA-1 Git initialization; R0a/R0b now implement and verify that complete substrate.
 - A guarded Jules dispatcher and PR policy are defined as a finite R0→R4 queue. They create at most one session after a successful preflight, stop after merged R4, remain inert unless dispatch is explicitly enabled, and keep plan approval on by default. Merges remain manual because the current project tests are not an independent immutable verifier. Full scheduled continuation still requires the dispatcher workflow to be reviewed into the default branch.
@@ -112,7 +114,7 @@ The repository contains no verified evidence that the owner submitted the final
 
 | Input | Impact | Resolution |
 | --- | --- | --- |
-| First external agent adapter is not selected | Live Chronicle integration cannot start, but replay-based R&D can proceed | Run R1 replay first, compare current supported agent APIs, then record the choice in an ADR |
+| The first live adapter is selected but no accessible Codex CLI is configured for this checkout | ADR-006 selects Codex App Server over local stdio, but the Microsoft Store packaged executable discovered here returns `Access denied` when launched from the repository shell | Keep replay R&D independent; the live spike must preflight a separately accessible, exact-version user-installed Codex CLI and fail closed when unavailable |
 | Untrusted-code sandbox backend is not selected | R7 corpus and human pilots cannot execute third-party or arbitrary participant code; R0–R4.5 can validate only finite reviewed fixture states, controller-owned repair, and catalog probes | After the fixture slice, select and verify a Windows-capable backend in a separate ADR; never fall back to direct execution |
 | Technical patch corpus is not assembled | Automatic episode-generation rate cannot be measured | Collect at least 30 consented or open-source test-backed TypeScript patches for R7 |
 | Human participants are not recruited | Takeover and delayed-transfer claims cannot be tested | Complete the technical gate, then recruit for the preregistered pilot |
@@ -133,13 +135,12 @@ No external input blocks the repository-owned fixture R0–R4.5 mechanism in `do
 
 ## Next ordered actions
 
-1. Merge protected PR #10 into `codex/shadow-cockpit-rnd` after the final documentation commit repeats the five required checks.
-2. Implement R1–R3 behind stable contracts: replay AgentDriver plus Chronicle, change-evidence extractor, and safe Takeover Twin lifecycle. R1 should record whether real agent near-miss replay has enough observable checkpoint evidence to justify a versioned contract proposal.
-3. Integrate R4: one compiled recovery episode and deterministic Evidence Judge.
-4. Pass R4.5: one bounded, catalog-only Explain-to-Break Pulse with replay/error fail-closed tests.
-5. Run the 30-patch recovery-plus-probe technical corpus audit before expanding the product surface.
-6. Add the local readiness ledger and minimal cockpit only after the vertical slice is reliable.
-7. Run the preregistered delayed-transfer pilot before making any skill-retention claim.
+1. Implement R2 and R3 behind the accepted contracts: deterministic change-evidence extraction and the safe Takeover Twin lifecycle.
+2. Integrate R4: one compiled recovery episode and deterministic Evidence Judge.
+3. Pass R4.5: one bounded, catalog-only Explain-to-Break Pulse with replay/error fail-closed tests.
+4. Run the 30-patch recovery-plus-probe technical corpus audit before expanding the product surface.
+5. Add the local readiness ledger and minimal cockpit only after the vertical slice is reliable.
+6. Run the preregistered delayed-transfer pilot before making any skill-retention claim.
 
 ## Recent milestone commits
 

docs/v0.3/ADR-001-DUAL-CONTROL.md

@@ -50,7 +50,7 @@ flowchart TB
     end
 
     subgraph RP["Readiness Plane"]
-        C["Run Chronicle"] --> G["Semantic Change Graph"]
+        C["Flight Recorder"] --> G["Semantic Change Graph"]
         G --> X["Experience Compiler"]
         R["Readiness Store"] --> X
         X --> T["Takeover Twin"]
@@ -76,7 +76,7 @@ The normative `AgentTask`, `AgentWorkspace`, `AgentRun`, `AgentDriver`, event-or
 
 The initial spike supports one driver. Multi-agent routing is not required to validate the readiness mechanism.
 
-### 2. Run Chronicle
+### 2. Flight Recorder
 
 An append-only local event log records only observable facts:
 
@@ -88,7 +88,7 @@ An append-only local event log records only observable facts:
 - explicit agent plans or decisions when emitted;
 - merge and rollback events.
 
-The Chronicle must not fabricate rationale or depend on private model reasoning traces.
+The Flight Recorder must not fabricate rationale or depend on private model reasoning traces.
 
 Raw terminal output, absolute paths, secrets, and unbounded repository content are not automatically persisted.
 
@@ -199,14 +199,14 @@ After recovery episodes validate the mechanism, the next router experiment is sp
 - PureFlow is no longer positioned as “AI that waits to be asked.” Autonomous agents are a first-class build plane.
 - Mentor explanations and Focus Reps become legacy v0.1 capabilities, not the v0.3 thesis.
 - No new quiz, comprehension score, or manual coding gate should be implemented unless it is part of a complete control episode.
-- The first code milestone is an agent adapter plus Chronicle and Takeover Twin spike, not UI polish.
+- The first code milestone is an agent adapter plus Flight Recorder and Takeover Twin spike, not UI polish.
 - Product claims must use `target`, `hypothesis`, or `pilot result` until delayed transfer is measured.
 - `Shadow Workspace` must not be used as a PureFlow name because Cursor already owns that term in this category.
 
 ## Action items
 
 1. Implement the smallest observable `AgentDriver` for one existing runtime.
-2. Capture a normalized Chronicle for at least ten representative test-backed patches.
+2. Capture a normalized Flight Recorder stream for at least ten representative test-backed patches.
 3. Build a deterministic standalone sanitized twin that applies one change-derived mutation and exposes a failing test without sharing source Git objects.
 4. Validate that the Evidence Judge reproduces expert-labeled outcomes.
 5. Run the technical and human pilots in [`EXPERIMENTS.md`](EXPERIMENTS.md).

docs/v0.3/ADR-004-EPISTEMIC-CHECKPOINTS.md

@@ -112,7 +112,7 @@ PureFlow may later add a local **Flight Log**, but it must not equate activity w
 
 ### Costs and risks
 
-- useful trigger precision requires a Chronicle and stable evidence model;
+- useful trigger precision requires a Flight Recorder and stable evidence model;
 - model-generated falsifiers can be invalid and must be rejected before execution;
 - even good pulses can become annoying, so attention budget and opt-out rate are release metrics;
 - achievements can distort behavior and remain out of the technical MVP.

docs/v0.3/ADR-005-FLIGHT-RECORDER-NAME.md

@@ -0,0 +1,51 @@
+# ADR-005: Name the Observable Run Ledger Flight Recorder
+
+- **Status:** Accepted
+- **Date:** 2026-07-31
+- **Decision owners:** PureFlow project
+
+## Context
+
+The original v0.3 documents called PureFlow's normalized, append-only agent-run ledger `Chronicle`. OpenAI now uses [Chronicle](https://learn.chatgpt.com/docs/customization/chronicle) for an opt-in Codex feature that derives memories from recent screen context. That product has different data, privacy, and lifecycle semantics from PureFlow's project-local run evidence.
+
+Keeping the name would create avoidable ambiguity in user copy, integration code, issue searches, and security discussions. This is also the cheapest point to correct it: R0 is merged, while R1 has not published a wire format or persisted user data.
+
+## Decision
+
+The product component is named **Flight Recorder**.
+
+- Documentation uses `Flight Recorder` for the controller-local observable run ledger.
+- TypeScript uses the compact domain names `RunEnvelope`, `RunEvent`, and `RunRecorder`.
+- Extension-owned JSONL is stored under the `recorder/` namespace.
+- Vendor adapters emit normalized `RunEnvelope` values and never expose their native event unions downstream.
+- The optional future `Flight Log` from ADR-004 remains a participant-facing summary of verified control episodes. It is not the raw Flight Recorder.
+
+The schema remains version `1`. No persisted or public field contained the old component name, and no R1 data has shipped. This ADR changes terminology and code symbols, not the event meaning.
+
+## Consequences
+
+### Benefits
+
+- the name expresses the autopilot analogy: normal automation continues while bounded evidence exists for diagnosis and takeover;
+- it avoids collision with Codex screen-memory features;
+- `RunEnvelope` and `RunRecorder` remain vendor-neutral and concise in code;
+- raw operational evidence stays visibly separate from any user-facing readiness history.
+
+### Costs
+
+- existing R&D documents and the uncommitted R1 spike must be renamed together;
+- future migrations must still version any actual schema or storage change, even if the product label remains stable.
+
+## Rejected alternatives
+
+### Keep Chronicle and clarify it in prose
+
+Rejected. The ambiguity would recur in every integration and support conversation.
+
+### Flight Log for both layers
+
+Rejected. A raw append-only event source and a curated participant history have different visibility and retention rules.
+
+### Event Store
+
+Rejected as the product name. It is technically accurate but loses the control-and-recovery metaphor that differentiates the architecture.