intent.md

AgentXRay: evidence-backed session review

Goal

Help developers review their existing coding-agent logs locally: identify recorded failures, group repeated operations without losing evidence, record human review notes, and reopen review when evidence changes. Product usefulness and GitHub adoption are not established by feature count.

Agreed behavior

• Failure detection describes loaded logs, not final task correctness. Only a later-started call with the same tool and complete arguments can provide automatic recovery evidence.
• Group unresolved failures by complete tool arguments and the call's user turn. A successful result separates groups. Missing arguments stay separate; object key order is ignored, parameter values and array order are preserved.
• Preserve every failure result and its evidence jump. Group membership is not proof of a common cause, serial retries or time wasted.
• OMP-native result states distinguish success/failure/running/cancelled/unknown, preserve original fields and expose source evidence. Arbitrary nested errors and daemon history are not automatically current execution failures.
• Human review notes are separate from automatic outcomes. Notes require evidence, stay in browser localStorage and are invalidated by changed full-result fingerprints; do not silently hide new failures.
• Below 768px use session-list/content navigation; desktop keeps two columns. Keep same-session drafts mounted while opening navigation. Evidence jumps scroll the message pane rather than moving the page navigation.

Acceptance

• Node tests, UI build, lint and generated legacy-file drift checks pass.
• Synthetic browser walkthrough covers event membership, evidence jumps, review save/reload/isolation/staleness, storage failure, narrow-screen navigation and desktop regression.
• Published verification uses synthetic fixtures and aggregate descriptions only. Personal log manifests, raw output, local analysis scripts and browser run artifacts stay in ignored output/.
• Public instructions and screenshots are in docs/diagnostics.md and docs/diagnostics-verification.md; prior detailed local history remains in output/release-1.18.0/intent-history.md on the development machine only.

Release authorization (2026-09-23)

The user explicitly requested commit, publish, then continued improvement. This supersedes the earlier development-only no-commit/no-publish boundary.

1. Release the tested feature set as v1.18.0 via the existing GitHub Release → npm workflow, after CI passes.
2. Verify the npm package/version and GitHub Pages deployment; do not claim publication based only on creating a tag.
3. After release, add a clearly synthetic failure-event walkthrough to the existing hosted demo so visitors can try the new workflow without local logs. Use the existing fixture generator and keep the current default demo session intact.
4. Keep version/lockfile, documented test counts and claims checks consistent. Never publish personal evaluation artifacts or credentials.

The active protect-default ruleset requires a pull request and the test check. The user subsequently authorized autonomous branch/PR creation, publication and roadmap changes. Follow the protected-branch workflow; do not bypass the ruleset.

Hosted diagnostics walkthrough (next increment)

• Add one hand-written synthetic OMP session to the existing sample-log directory and regenerate bundled fixtures with the real backend.
• Keep the existing default demo session and all prior samples. Add a demo-only entry action that opens the diagnostic sample from any current tab or child transcript.
• The sample must produce 7 pending failure records in 2 events: 6 same-argument edit failures and 1 nested search failure; one earlier bash failure has a matching successful retry. A background bash start is not successful completion.
• Display a compact, clearly synthetic walkthrough with the actual counts, evidence/review instructions and a link to local usage. It does not upload notes, add model calls, or simulate live recovery in the static demo.
• Test the raw sample through the real parser and diagnostic rules, and assert the generated fixture matches it. Verify the hosted entry, evidence jump and browser-local review on desktop and narrow screens.
• Update the roadmap around measurable acceptance: public walkthrough first, safe review portability next, then owner dogfooding with explicit review outcomes. No star-count/adoption promise, no fabricated demand rankings, and no date promises.
• Publish through a separate protected PR/Pages deployment after the v1.18.0 release; do not mutate or republish the existing npm version.

Release receipt: PR #48 merged as c882564; v1.18.0 Publish run 35880348489 succeeded. The official npm registry reports latest=1.18.0, and a fresh temporary installation returned that CLI version and served the bundled review UI plus a synthetic OMP result. Registry processing delay was observed before successful installation; no global npm registry configuration was changed.

Hosted walkthrough acceptance: 216 tests pass, including raw-to-bundled fixture parity; regeneration is deterministic. Desktop and 360px browser checks cover the entry from another view/navigation, all six edit evidence links and local review with zero API requests. A height cap fixes the guide hiding the transcript on short screens; 740×360 remains cramped and is documented rather than called full mobile support.

Review portability increment

• Continue the authorized roadmap with a current-session review transfer file, no backend or dependencies. Reject whole-browser scans, cross-directory fuzzy matching and silent overwrites.
• Export only valid, non-stale reviews for currently loaded automatic events. Construct a whitelist of hashed storage keys, evidence fingerprints, human statuses, notes and timestamps; no automatic logs, arguments, paths or session titles. Preview the exact JSON before a user-triggered download and warn that hand-written notes may contain secrets.
• Import a bounded JSON file (1 MiB, at most 500 unique records), validate the exact versioned schema and identifiers before accessing storage. Show all notes and per-record decisions before explicit confirmation. Treat files as untrusted human notes, not authenticated success evidence.
• Only exact current-event identity and full-evidence fingerprint matches with empty local slots may be imported. Distinguish unmatched, stale, already identical and conflicting local records; skip every existing slot, including corrupt/stale local entries. Never alter automatic failure/recovery counts.
• Recheck current evidence and local storage on confirmation. Invalidate previews when the active event set or loaded reviews change. If individual writes fail, report imported/skipped/failed counts accurately, preserve prior successes, never claim an atomic transaction or roll back other tabs.
• Export/import works between browsers or ports with identical platform, configured directory, session/child scope and evidence. Changed configured directory, missing/recovered events and changed transcripts intentionally do not match. This is not whole-history backup, encryption or collaborative conflict merging.
• Test privacy whitelist, limits/schema/version, duplicates, wrong scope, stale fingerprint, conflicts, unreadable storage, write failures, race rechecks and no-write preview; use synthetic browser migration across isolated contexts with zero review network requests.
• Publish as a new minor release through protected PR and the existing Release workflow after all checks pass. Keep private evaluation output ignored. Update claims/test totals, public guidance and roadmap acceptance without claiming productivity gains.

Portability acceptance: 17 new transfer tests and 103 focused tests pass. Browser tests exercised an actual 2-record download/import into an isolated browser, a different-origin restore, stale and cross-tab preview invalidation, no-overwrite conflicts, schema/size rejection, literal HTML notes and partial write failure/retry. Prepare v1.19.0 and verify the actual registry package and Pages deployment after protected checks, without mutating the prior v1.18.0 release.

Follow-up evidence candidates (approved 2026-09-24)

• Add two explainable candidate relations, not semantic recovery: same tool with only top-level i differing; or a later explicit edit/write of the same recorded file in the same call-origin user turn.
• Candidates must have a recorded result and a call started after the event's last pending failure. Exclude pre-existing parallel calls, same-signature repeats, orphan/missing arguments and unrecognized modification tools. Record order, not wall-clock guessing, determines "later".
• Same-file tools are edit, Edit, write, Write, MultiEdit; support path/file_path only when unambiguous. Compare paths literally; require absolute paths or identical explicit absolute working directories for relative paths. Preserve cwd/workdir/working_directory distinctions. No filesystem resolution, symlink guessing, command parsing, cross-turn same-file links or cross-session/child joins.
• Only-i candidates may cross user turns within the currently viewed transcript; label their call turn. Compare every other argument value, not just a text preview. Do not strip i from the original automatic recovery rules.
• Each candidate shows the exact relation, call/result positions, five-state result status with its source fields, an output excerpt and a jump to the original result. Running/unknown/cancelled never display as successful verification. Show five initially, with all remaining candidates reachable and no silent success-only filtering.
• Failure/event/recovery counts and event membership must remain byte-for-byte equivalent on the frozen 15-session/2,024-result audit. Candidate success does not close an event, prove causality or certify the task.
• New/changed candidate evidence invalidates human review fingerprints for affected events; storage keys remain stable. Events with no candidates retain the previous fingerprint input to avoid unrelated invalidation. Transfer still contains only hashes and human notes, not raw candidate evidence.
• Validate synthetic counterexamples and the frozen real-log prefixes; preserve raw logs privately, output only sample numbers, relation/status counts and line numbers. Real data previously inspected is regression evidence, not a blind accuracy or time-saving benchmark.
• Update the isolated walkthrough and documentation. Do not introduce dependencies, model calls, new APIs, automatic commands, arbitrary error parsing, or change platform adapters.

Acceptance results: 255 tests and 125 focused checks pass. The frozen 15-session/2,024-result regression retains every original failure/event member and all counts. Strict matching finds three only-i candidates (failure/running/success); no same-file candidate qualifies in that real set because paths lack explicit directory context or turns differ. Synthetic same-file and five-state browser checks, load-more, result jumps and candidate-triggered review staleness pass. Prepare v1.20.0 via the authorized protected PR/release workflow, verify registry installation and public Pages before claiming release completion; do not publish private logs or raw evaluation artifacts.

Automatic session health (approved 2026-09-24)

• Default to an automatic factual report, not a human-review queue. Show every diagnostic event regardless of saved manual labels. No user tagging, model invocation, account or network call is required.
• Summarize existing failure records, exact-argument recovery evidence, remaining events, repeated unresolved operations and unique follow-up result states. Candidate success is not automatic recovery; totals use documented units rather than a health score.
• Independently summarize each recorded tool call's last result in this transcript: success, failure, running, cancelled, unknown, or no recorded result. Calls/results link only by recorded ID and order. Orphan results and ambiguous/reused or missing call IDs are reported separately, never guessed. These are last-recorded states, not live process status or proof that a session ended.
• Surface running/unknown/no-result call evidence with original call/result navigation, including sessions without detected failures. Never call absence of detected failures task success.
• Keep manual notes and transfer as an explicit optional mode. Do not read/hash review storage before opt-in, delete saved notes, or allow its failures/labels to affect the automatic view. Switching back restores all automatic events.
• Preserve diagnostic rules, platform adapters, candidate matching and existing review fingerprints. Only add a derived summary and presentation changes.
• Add deterministic offline transformation tests with the same base data/rubric: append/remove success, alter command/cwd/i, insert pre-started parallel calls, pending/cancelled/unknown results, and verify exact expected outcomes plus complete evidence membership. Test shared candidate deduplication, ambiguous IDs, no-result/orphan records and input immutability.
• Validate against synthetic UI plus unchanged frozen-log failure/event outputs. Test metrics are known-case coverage and invariants, not human time saved or real-world accuracy. Publish no raw logs or automatic human labels.

Modification / verification chronology (2026-09-24)

Continue the automatic-health worktree toward an execution-evidence product rather than adding another generic dashboard. User authorized autonomous improvement and roadmap changes; manual tagging is not a prerequisite.

• Recognize explicit edit, Edit, write, Write, MultiEdit calls with one unambiguous recorded path/file_path. Only a uniquely paired successful result is a completed modification-tool record; it does not prove bytes changed. Failed/running/unknown/no-result mutation calls remain visible in coverage counts. Patch/shell-embedded modifications are not parsed or guessed.
• Recognize only simple direct shell invocations of common test runners (pytest, python[3] -m pytest, node --test) and package-script conventions (npm test, npm run test/build/lint/typecheck, equivalent direct pnpm/yarn forms). Label runner vs script-name evidence separately; script bodies and actual coverage are not known. Reject compound commands, substitutions, quotes/redirection, help/watch/list-only modes and directory-changing flags. Count unrecognized shell commands explicitly.
• Compare call/result record order, not wall-clock guesses. A verification call must begin after a modification result to count as later. A prior result must finish before the modification call to count as prior; overlapping/in-flight checks are separate, never post-change validation. Keep the latest recorded state, including failures/cancelled/unknown/missing results; do not cherry-pick a passed check.
• Timeline is within the viewed transcript, not a proof of file coverage. Matching explicit absolute working directories is stronger scope evidence; missing directory context is labelled unknown. Known-different/conflicting directory contexts are excluded from the relation and counted. Do not resolve files, infer implicit cd, or assume the initial session cwd remains current.
• Surface the actionable fact “a check succeeded, then a modification tool succeeded, and no later recognized check is recorded” with both source jumps; do not say “bug”, “task failed”, “tests cover the file” or “ready to ship”. Every check and modification has access to its original call/result evidence. No verification is executed.
• Preserve all automatic diagnostics/candidate/review-fingerprint semantics. Reuse conservative unique-ID pairing for health and chronology; ambiguous/orphan IDs do not supply success evidence. Keep manual storage opt-in.
• Add deterministic temporal transformations (check→edit vs edit→check, overlap, failure after earlier success, delete/missing results, cwd mismatch) and frozen real-log coverage checks. Record recognized/excluded categories and keep production claims bounded by actual data. Do not upload private logs or add model calls/dependencies.

Real-log coverage refinement: the initial direct-only classifier recognized zero checks because logged shell commands are predominantly compound. Support a bounded, non-executing lexer for literal command segments with quotes, &&, ;, newline and simple pipelines/redirections. Direct checks and a sole literal absolute cd ... && check may use the whole-call outcome; other recognized fragments are explicitly labelled "command contains a check; whether this fragment ran/passed is unknown", regardless of wrapper exit code. Reject substitutions, heredocs, shell control syntax and quoted executable names. Quoted strings in echo/python arguments must never become executable segments. Do not treat compound snippets as proven verification or infer their working directory. This replaces blanket compound exclusion, not the no-guessing/coverage boundary.

Validation: 290 tests pass, including 200 fixed health transformations and 120 temporal transformations without human labels. The frozen 15-session/2,024-result set retains exact v1.20 diagnostic output. It yields 59 check-containing calls, all with unknown fragment outcome; no check-coverage or task-success claim is made. Explicit edit/write tools return successfully 240 times; 112 have later check-containing calls and 128 do not. Browser checks cover default zero review-storage reads, optional-note preservation, live missing-result resolution, before/overlap/after chronology, source navigation and 390px rendering. Prepare the combined increment as v1.21.0 through the authorized protected PR/release path after final gates; keep the continuing project goal active, and do not claim real productivity or adoption from this release.

Explicit Codex process evidence (2026-09-24)

• Real frozen Codex logs contain 60 exec_command background-start envelopes and 53 write_stdin calls. Improve the missing cross-call lifecycle evidence instead of adding generic metrics. No SDK, new API or execution is needed.
• Parse only recognized Codex wrapper headers before Output/Final output, on exec_command/write_stdin (including functions.* names). Do not interpret matching text in stdout or outputs of read tools. Require an unambiguous numeric process ID and unique call IDs within the loaded transcript; no cross-session/child joins.
• Link write_stdin session_id to a single recorded launcher only after that launch result. Preserve every polling call/result, whether input was sent, and terminal exit code. A reused process ID, overlapping polls, mismatching wrapper ID, malformed/error result or conflicting terminal sequence cannot certify completion.
• Show process lifecycle separately from per-tool-call last states: polling is not another launch. Never rewrite historical call results, existing failure/event/recovery rules or human review fingerprints. A process's last running observation is not a live status query.
• Verification chronology may use a uniquely associated terminal result, but must retain the original launch index/time. A check started before a modification and finished through a later poll remains overlapping, not post-change verification. Compound shell fragments still have unknown check outcomes. Input sent to a running process weakens check certainty; it is not silently treated as a clean test run.
• Add deterministic counterexamples and real frozen-log relationship checks before publication. Keep detailed process IDs, log text and commands private; public examples/screenshots are synthetic. Whole-process exit code is not subcommand coverage or task correctness.

Validation results: the frozen corpus has 60 Codex starts and 53 uniquely linked polls: 48 successful process exits, 1 failed exit and 11 last-recorded running starts. All prior per-call health and failure/candidate/recovery outputs remain identical. The implementation adds 23 tests including 40 fixed terminal transformations and generated-demo/raw-parser parity. Synthetic browser checks cover terminal-result jumps, original-start overlap semantics, unlinked poll counts, live completion and 390px layout. Prepare v1.22.0 through the previously authorized protected PR/release workflow after final checks; no private evidence or logs are published.

Offline evidence CLI (2026-09-24)

• The next product increment makes existing evidence usable by agents, local automation and CI without starting a dashboard. Prefer a local inspect command over a new MCP service/hook/runtime dependency; no execution, network, recursive discovery or log upload.
• agentxray inspect --platform omp|codex|claude-code <file> [--json] [--fail-on pending-failures] inspects exactly one explicitly supplied regular UTF-8 JSONL file (maximum 64 MiB). No auto-detection or directory scans. Read a fixed-sized snapshot and reject changed file metadata, malformed lines, invalid UTF-8 and wrong/empty formats. Preserve original physical line positions.
• Use the same normalizers and diagnostic source as the UI. Generate a CommonJS build from the TypeScript rule source using the existing build toolchain, package it and enforce generated drift in tests. Include rule hash and adapter hash in versioned deterministic reports; no copied rule implementation or TypeScript runtime requirement in installed packages.
• Report only whitelisted aggregate facts and source references (physical line plus normalized message index, one-based). Default reports omit file names, paths, prompts, outputs, command arguments, raw call/process IDs, private tool names and user notes. Input/content hashes still reveal equality, so this is minimized evidence, not guaranteed anonymization.
• Report failure events, source membership, follow-up relations, call-result gaps, process launch/poll/terminal links and modification/check chronology. Preserve unknown and scope limits. Known adapter loss of tool-call/result identity or error markers must be counted as coverage issues and prevent a successful exit, not quietly certify a partial report.
• Exit 0 means a complete report was produced, not task success. Exit 1 means invalid input, runtime/read error or incomplete adapter coverage. Exit 2 is reserved for an explicitly requested pending-failures policy. Stdout JSON stays parseable; human-safe errors go to stderr without dumping original input or paths. Never treat absence of recognized failures/checks as task correctness.
• Verify UI/CLI rule parity, deterministic bytes, every source reference, sensitive-content omission, error policy, no server/network startup, no HOME/fixture mutation, packaged-artifact operation and frozen real-log counts. Prior browser data and original sessions stay untouched. Add documented automation examples and an explicit contract, not claims of autonomous truth.

Acceptance: 332 tests pass, including 19 CLI/contract cases. Packed tarball inspection runs without node_modules/frontend source. The 15 frozen sessions reproduce 2,024 result records, 142 failures, 141 pending records, 76 events and 60 process launches with UI-rule parity; all 2,493 report references are valid. Known Claude adapter loss is explicitly incomplete rather than green. Stage only code, shared generated rules, synthetic tests and public documentation, not private artifacts. Publish v1.23.0 through the authorized protected PR workflow after final gates; validate actual registry installation before claiming release success. The ongoing product goal remains active.

Continuing boundaries

Effectiveness pilot (user requested)

• Test the hypothesis that evidence reports improve a coding agent's recovery work, not just report generation. Freeze 6 deterministic task definitions and hidden acceptance cases before model trials; 3 treatment arms × 2 repeats = 36 paired runs.
• Same pinned local OMP model selector mify/deepseek/deepseek-flash, thinking low, same prompt/tools/workspace initial content/budgets. A gets raw log access, B additionally gets a non-diagnostic mechanical recent-record summary, C additionally gets the current inspect report. All arms may read the same raw file. B and C share a byte budget, not a falsely claimed exact token match; record actual input/output/cache token use.
• Synthetic tasks are motivated by observed real failure classes: stale earlier success, background failure, repeated edit failure, alternate correction, expected negative result and pipeline-masked failure. No private logs are sent to the model. This is a pilot, not held-out real-world evaluation or a significance/promotion claim.
• Model can only read allowlisted synthetic files, write solution.js, run fixed public cases and submit done/blocked. No shell, network, arbitrary file reads or access to hidden tests. Candidate code is evaluated in a time-bounded restricted child VM with no provided imports/process access; this is not a general hostile-code execution service.
• Hidden tests live outside trial workspaces and execute only after agent completion; the model never sees hidden results. No tests may be edited. Grade final success, false completion, changes on already-correct tasks, tool calls, repeated failed tool actions, model usage and wall time. Provider cost=0 is not assumed to mean free.
• Freeze task/runner/report hashes and randomized block order before trials, log every result, preserve unsuccessful/timeout runs and never reclassify or rerun failures selectively. Infrastructure smoke tests are separate. Stop if model routing differs or tool isolation fails.
• Do not change production heuristics based on the pilot mid-run. Report paired outcomes vs both controls, uncertainty and sample limitations even if no advantage appears. No published accuracy/productivity/adoption claim from this convenience corpus.
• Before treatment trials, validate all references and initial classifications. Compare JSON objects structurally, not by key order. Repeated failures require the same semantic tool arguments and source hash, ignoring OMP's injected intent text. The preliminary manifest is preserved separately; the final manifest is frozen after these preflight corrections, before any treatment outcome exists.
• Any missing agent_end, nonzero runner exit, provider error, model mismatch or tool-isolation failure stops the schedule and is retained as invalid, never silently retried/excluded. Normal completion without a submission remains in the denominator. Hidden acceptance grades final code; missing finish and budget stops are reported separately. Use descriptive matched differences only: six hand-designed task clusters are insufficient for population-level significance claims.

Pilot result (2026-09-24): all 36 trials valid, each arm passes 12/12 hidden acceptances with zero explicit false completions and zero writes on already-correct tasks. C's mean cumulative token usage is 14,072.58 versus A's 18,099.58 (−22.25%) and B's 12,508.83 (+12.50%). This shows no completion advantage and no unique efficiency advantage over mechanical context. Do not turn the raw-control reduction into an accuracy or monetary-savings claim. All 179 actual tool calls match allowlisted receipts; frozen hashes remain unchanged. Five experiment selftests and 332 product tests pass. Preserve the negative/null comparison in experiments/effectiveness-pilot/RESULTS.md; the real-world usefulness goal remains unproven. No production heuristics, release or new feature direction changed during this experiment.

Prospective real-task study (approved 2026-09-24)

• Adopt the user's selected prospective design, not reconstruction of historical workspaces. Before a new ordinary OMP task starts, automatically capture its prompt, current-branch history and Git working-tree bytes locally in an allowlisted repository. Capture tracked files including uncommitted changes and nonignored untracked files; preserve deletions and executable bits. Reject unstable reads, symlinks/submodules, secret-like filenames and excessive size instead of silently claiming a complete snapshot. Ignored files, dependency installations, external services and arbitrary environment variables are not captured.
• Store private snapshots and an append-only intake journal under ignored output/prospective-study/. Enable a narrowly scoped OMP extension without changing existing extensions or system rules. Capture failure must not block normal work, but must leave an exclusion receipt. No retrospective intake, silent retries, hidden user grading or model calls in capture. The benchmark-building task itself and synthetic smoke fixtures are not real-study samples.
• Freeze task-specific executable acceptance outside model workspaces, public checks, writable paths, a locally available Docker image ID, fixed model/budgets and arm order before any treatment run. Missing independent acceptance or environment readiness leaves a candidate pending, never passed. Ordinary repository regression tests alone do not certify an arbitrary user request. No automatic claim that a Chinese prompt has an inferred correct oracle.
• Prepare identical isolated A/raw, B/mechanical recent-record summary and C/current AgentXRay report workspaces. Keep B as the first explicit ordinary-summary baseline; do not relabel it a strong model-generated summary. Record all preprocessing time and context bytes separately and count model usage including any future summary generation. The primary contrast remains C versus B, with A secondary. Unequal summary lengths and clustered tasks remain limitations.
• Use existing Docker with no network, no host HOME/credentials/socket, a pinned image, dropped capabilities, bounded resources and read-only root for candidate checks. No general shell tools or automatic execution of history. Hidden checks run only after submission, on copies independent from public-test side effects. Do not alter source worktrees or original sessions.
• Model constraint (user correction): do not use local inference models. Future model trials use the existing remote OMP provider, with one frozen selector and identical budgets across arms. The local Ollama synthetic connectivity probe is not study evidence; do not issue further local-model requests or change the shared Ollama service.
• Privacy gate (user approved consistent substitution + scanning): originals remain local-private. Permit only task-scoped, sanitized copies through the existing remote OMP provider after the following local gates; never send originals or the replacement map. No local inference, broad HOME scan or new provider. The previous synthetic model pilot remains separate.
• Require an explicit minimal file allowlist for each task. Use one injective replacement table across its task text, history, selected code, commands and local oracle/reference fixtures. Preserve JSON types and record ordering; refuse unhandled encodings, ambiguous transformations, path collisions and reserved-placeholder collisions. Recognize common credentials, personal email, private addresses/home paths and additional locally identified private terms. Gitleaks uses a fixed default-rules configuration and empty ignore list; input-controlled ignore files/comments/environment cannot disable the scan. Missing/failed scanner or residual recognized data blocks the export. Pattern scanning is not a guarantee of anonymity or removal of proprietary business information.
• Acceptance is delegated to the agent: derive executable cases from the actual request before any treatment outcomes exist, retain their requirement/provenance, and freeze them outside model workspaces. Export requires per-case JSON outcomes, declared initial pass/fail expectation and an independently authored frozen reference patch. Initial public checks must run successfully; original versus sanitized hidden-case identities/results must agree; the reference must pass all the same cases on both sides. Compare complete diagnostic coverage/events/process/chronology evidence excluding only source bytes/hash. Failure/timeout/coverage loss refuses the sample instead of weakening the gate.
• Build A/B/C solely from the same sanitized history and source copy. Keep hidden cases, reference code, raw scan findings, original hashes and substitution maps outside the outward payload. Seal the exact payload inventory, verify again on access and reject added/changed files. A gets no B/C supplement; public-check outputs and any future model-tool responses also need the disclosure gate before transport. This increment does not silently connect an unrestricted remote runner.
• Acceptance for this increment: synthetic tests demonstrate dirty/untracked/deleted-byte capture, stable hashes, race/path guards, independent three-arm restoration, frozen external oracle, isolated public/hidden execution, tamper refusal, audit receipts and automatic OMP-hook capture. Report actual real captured/eligible/evaluated counts, including zero. Infrastructure smoke success is not evidence of productivity. Preserve the prior frozen pilot unchanged; no product CLI/UI changes, new npm dependencies or release.

Disclosure validation: 22 prospective-study tests and 332 product tests pass. The gate rejects unsupported input, altered diagnostic relations, mismatching per-case outcomes, failed references and changed payloads; absolute path placeholders retain scope classification. Three unchanged real OMP prefixes pass local transformation/diagnostic checks (45/44/27 distinct replaced values, zero residual scanner findings), but have not passed workspace/oracle admission and are not authorized exports or prospective trial samples. This round uses no remote or local models. User authorization for gated sanitized copies is recorded; the remaining work is connecting a restricted remote runner and obtaining qualifying prospective tasks, not asking again for the same policy approval. Do not claim real usefulness from these infrastructure results.

README story refresh (approved)

• Audience: developers using existing CLI coding agents, not operators seeking hosted production tracing. One-sentence value: inspect execution and verification evidence in the logs already on disk, without instrumenting the agent or making a model call for inspection.
• Lead with concrete recorded scenarios (a check passes before an edit; a background process later fails; repeated failures retain source evidence), then the shortest demo/install path. Primary proof is the existing synthetic chronology UI screenshot and a reproducible inspect excerpt, not an invented benchmark. First successful action: open the hosted synthetic walkthrough or launch the local dashboard; agents/scripts can inspect one explicit supported log.
• Reorganize README.md and README.zh-CN.md together. Move long feature/API/configuration/usage detail into bilingual reference documents; preserve useful information and repair relative links. Keep explicit links to roadmap, test evidence and experimental limitations. Published inspection remains local; optional rewrite calls and separately invoked research runners must not be hidden behind an absolute no-egress claim.
• Visual theme: the project's dark execution timeline, with source-linked nodes and a dashed unknown result. Palette: background #0d1117, foreground #e6edf3, cyan #58c4dc, amber #e3b341, muted #8b949e. Typography: system sans for title, system mono for recorded sequence; large type and modest radius, no generated raster art, animation or decorative stock imagery. Use deterministic SVG for the simple title/timeline; keep all essential claims, commands and limitations in Markdown. Reuse an existing genuine synthetic UI screenshot with an adjacent readable explanation.
• Acceptance: synchronized bilingual reading order, executable inspect output agrees with stated counts, linked reference/API detail remains reachable, claims receipts reflect moved sections and changed visual, no broken local links/images/anchors. Preview full READMEs at approximately 900px content width and 360px viewport in light/dark surroundings; inspect screenshots for clipping, unreadable essential labels and horizontal page overflow. Preserve prior user changes, no product behavior change, no release or automatic productivity/adoption claim.

README validation receipt: English 362→126 lines, Chinese 310→126, with full usage/reference content moved to docs/usage.md and docs/usage.zh-CN.md; all 33 English API rows preserved byte-for-byte. Actual inspect output reproduces 8 historical failures, 7 pending records, 2 events and 1 matching recovery. Sixteen automatic claims pass, including 332 product tests and generated-file drift checks; two existing manual deployment/settings claims are not certified by this local run. Ninety-six local links/anchors and both README asset audits pass. Eight Chromium previews (two languages × light/dark × 898px desktop content or 360px mobile viewport) have no horizontal page overflow or missing local images; SVG text bounds fit its viewBox. Essential scenario details are in Markdown because the real UI screenshot remains dense on mobile. This is a GitHub-like local Markdown preview, not a published GitHub rendering or physical-device test. Receipts are under ignored output/readme-refresh and screenshots under output/playwright/readme-refresh. Lint passes with existing warnings; no production runtime behavior or release changed.

Restricted remote execution (continuation approved)

• Connect the existing OMP remote selector mify/deepseek/deepseek-flash, thinking low; no local inference, new provider or extra npm dependency. Freeze OMP version, runner hashes, model, prompt, task snapshot and budgets before outcomes. Two repetitions of A/raw, B/mechanical and C/inspect, sequential balanced arm order; all arms use the same sanitized workspace/history, tool API and task.
• Run OMP in fresh temporary directories with all default tools/extensions/skills/rules/session persistence disabled. Enable only a bounded bench tool: read allowlisted files/history, write declared files, run the frozen public check in networkless Docker and submit done/blocked. No shell, directory escape, raw capture read, alternate supplement access or oracle tool. Recheck the disclosure gate and inspect all tool responses before returning them to the remote model.
• Forty executed tool calls and a 300-second OMP limit per trial; parent termination at 315 seconds and forced kill at 320. Public Docker checks have owned labels for cleanup if the OMP process dies. Record budget stops, missing submissions, provider errors, routing/tool mismatches and disclosure failures; retain invalid/interrupted attempts, stop the schedule and never selectively retry. A resume only reuses audited complete receipts from an unchanged frozen manifest.
• Seal the transformed hidden oracle and commands in private gate metadata. After OMP exits, grade final sanitized code on a separate Docker copy without model feedback. Compare final witness case IDs to the frozen acceptance. Record hidden passes, explicit false completion, changes/writes on initially correct tasks, tool calls, model usage by field and elapsed time. Include gate/supplement preprocessing timing separately; no dollar claim from zero provider cost metadata.
• Validate the full remote chain on a newly labelled synthetic multi-file infrastructure task, not on private real data or previously solved real tasks. Enable capture only for new OMP tasks in AgentXRay, without modifying existing extensions. Captures without pre-frozen independent acceptance stay pending. Report actual real-task counts, including zero; the infrastructure-building task is excluded and no automatic claim of productivity follows from a successful smoke run.

Remote integration receipt: six valid synthetic runs pass their four hidden cases each; 38 actual bench calls match allowlisted receipts. Independent reevaluation agrees, and resumption reuses all six saved runs with unchanged model-event files and no new model calls. Two native OMP probes verify explicit and default extension loading, each capturing 262 files and recording end observation; both are infrastructure-only. The forwarding extension is installed without changing the existing extension. Capture is enabled for new OMP sessions at this repository root (infrastructureProbe: false); there are no predefined contracts and no real admitted/evaluated tasks at this checkpoint. Do not imply an unattended evaluator is grading arbitrary prompts.

The capture smoke exposed a real lint integration failure: Biome discovers the frozen copy of its root configuration under output. A single !!output exclusion mirrors the already-ignored artifact directory, leaves all 69 previously checked source files in scope and preserves snapshots unchanged. The regression reproduces failure without the exclusion. Final validation: 29 experiment tests and 332 product tests pass; lint exits zero with its existing warnings. Evidence is in experiments/prospective-study/REMOTE.md and ignored local receipts. Continue against qualifying real tasks under the approved policy without asking for each operational step; no usefulness/adoption claim or new release follows from this smoke.

Layered agent CLI (approved 2026-09-27)

• Keep CLI as the integration surface, not MCP. Preserve the existing full successful inspect --json report and text mode, diagnostic rules, report schemaVersion and exit policy. Add inspect --summary --json for bounded source references and aggregate facts, with explicit omitted counts rather than silent truncation; full source/engine hashes remain available. Summary shortens output, not analysis cost, and is not a task-success score.
• Add agentxray evidence --platform ... FILE --sha256 HASH --line N [--offset N] [--max-bytes N] [--json]. It always emits JSON and requires explicit file/platform, the original report's source hash and a one-based physical line. Read one stable snapshot, validate format, check hash before any raw output, and return at most 4096 content bytes by default (4–16384 configurable), with UTF-8-safe byte pagination, explicit truncation/next offset and total line bytes. Never discover sessions or execute history. Line contents exclude LF separators but preserve CR and BOM; raw evidence may contain secrets or untrusted instructions and must not be auto-uploaded or executed. A raw physical record may contain multiple normalized messages.
• Structure JSON-mode failures as {schemaVersion:1,kind:"error",error:{code,message}} on stdout with exit 1, no raw paths/input/stack. Keep concise stderr diagnostics for humans. This deliberately changes formerly empty JSON stdout on failures; success full-report bytes and exit meanings stay stable. Coverage-incomplete reports retain their data and complete:false, exit 1, and add a separate structured stderr diagnostic rather than changing the existing successful/full report schema.
• Summary/evidence have explicit kind discriminators; consumers check kind/schema/complete before using them. Evidence complete is adapter identity coverage, not semantic completeness or task correctness. --summary requires --json; summary reference lists retain up to five unique line/message references per failures/gaps/processes/chronology/coverage category and advertise total/shown/truncated. No automatic session selection, service, broad scans, dependencies, changes to experiment protocols or default transmission of raw evidence.
• Validate full-report byte parity, summary totals and reference bounds, structured failures regardless of flag order, coverage incompleteness, path/privacy handling, hash mismatch/changed snapshots, CRLF/BOM/Unicode pagination, oversized lines/invalid ranges, no network/writes and installed-package operation. Compare output bytes on the same committed synthetic input; do not claim token/time savings or effectiveness without a controlled model study. No commit/release until requested.

Layered CLI acceptance: 35 focused CLI tests and 348 product tests pass; 16 automatic claims pass (two pre-existing manual remote-state claims not rerun). Full JSON on the committed OMP walkthrough remains byte-for-byte identical to the pre-edit baseline (5,446 bytes); summary is 3,559 bytes, 34.65% fewer output bytes for that input, not a measured token/CPU/time benefit. Packed source build runs without node_modules, returns summary and bounded 64-byte evidence with nextOffset=64, and rejects a mismatching hash with SOURCE_HASH_MISMATCH. UTF-8, BOM/CRLF, coverage gaps, safe structured errors, snapshot changes and no-network/write checks pass. Lint passes with existing 91 warnings/159 informational diagnostics. Local receipts are in ignored output/layered-cli; documented additions remain explicitly unreleased and no experiment outcomes were rerun or retuned.

Full versus layered CLI experiment (approved 2026-09-27)

• No product/interface changes this round. Compare supplying the actual current full inspect JSON upfront against supplying the current summary upfront, with identical model, task, tools, budget and acceptance. Both may explicitly request the full report, summary, hash-checked evidence or original synthetic log; this tests initial-context policy under equal capabilities, not denial of raw evidence to one arm. Do not force evidence reads just to create a treatment effect.
• Reuse all six existing effectiveness-pilot tasks unchanged: four initially broken, two initially correct, two repetitions per arm = 24 sequential runs. Deterministic shuffled task blocks, seed 20260927, alternate arm order and reverse it on repeat. These are previously inspected synthetic convenience tasks with a known completion ceiling, not fresh real production work or an independent held-out dataset. Freeze the protocol, full dependency hashes, task/log/acceptance hashes and order before any treatment trials. Preserve earlier pilot artifacts untouched.
• Pin the existing remote OMP selector mify/deepseek/deepseek-flash, thinking low, 12 executed tool calls, 90-second agent limit, parent termination at 105 seconds and forced kill at 110. Fresh workspaces/conversations; bench only, no shell, filesystem discovery or network tool. No local inference, private logs, hidden feedback or human scoring. The separate synthetic smoke verifies the actual new CLI, including expansion and hash rejection, before the treatment run.
• Measure hidden acceptance, explicit false completion, initially correct writes/harm, log reads, full-report fallback, evidence calls/pages/truncation/errors, repeated semantic failures, every tool's returned bytes and elapsed time, provider input/output/cache/total/reasoning usage, initial CLI generation, model/tool runtime and end-to-end time including setup and final acceptance separately. Zero provider cost metadata is not dollars saved. Full/summary treatment text is generated by spawning the actual CLI, and evidence actions invoke it rather than copying an implementation.
• Invalid transport/model/tool/usage/corrupt receipts stop the schedule; preserve and report every incomplete/failed trial without selective retry. Normal budget stops/missing finish remain observed outcomes when transport can be audited. Resume only sealed valid saved results after validating frozen dependencies and artifacts. Report paired wins/losses/ties per task/repeat and descriptive total differences, no population significance or noninferiority claim from six clusters. If neither arm uses evidence, say expansion cost/benefit is not identified. Do not implement event packs unless the records justify that next step.

Layered comparison result: all 24 synthetic trials valid, both arms 12/12 hidden passes, zero false completions or changes on four initially correct instances per arm. Full versus layered cumulative tokens total 168,491 versus 167,393 (−0.65%); initial report bytes total 54,224 versus 37,462 (−30.91%). Tools 56 versus 58; mean end-to-end 6.77 s versus 11.86 s, median 6.97 s versus 7.27 s. Neither arm requested evidence, another report or the raw log. One layered trial rewrote and retested after public success; longer model-process delays are observed but their cause is not established. No overall efficiency or pagination benefit proven, no justification for implementing event bundles from these observations. Preserve the outcome in experiments/layered-comparison/RESULTS.md. Audit matches all 114 tool calls/results, regrades all hidden cases, verifies 47 frozen source files and reuses 24 sealed trials with zero new model calls. Six experiment selftests and 348 product tests pass. Prior product edits remain unchanged and uncommitted; no real-task or release claim.

Invocation-policy pilot (approved 2026-09-27)

• Compare three policies without product changes: baseline has file/read/write/test/finish tools and raw synthetic history but no AgentXRay; upfront gets a current summary plus optional inspect/evidence tools; ondemand starts without a report and may choose inspect/evidence. The two enabled arms share tool schemas; baseline intentionally has fewer capabilities, and its shorter schema is part of the practical integration cost, not perfectly equal prompt length.
• Use six newly authored deterministic recovery cases (four broken, two already correct), not the prior ceiling corpus. All requirements, code, public test cases and workspace/source/suite hashes are visible to every arm. Final done requires both passing hidden behavior and a successful public check for the final source and identical public-suite hash. A recorded current-hash success is reusable, or every arm may rerun the same public check; history access is never mandatory. Public test receipts in synthetic histories come from actual evaluator runs; launcher/poll wrappers and scenario chronology are labelled simulations, not captured production incidents.
• Freeze task definitions, independent hidden cases, source/suite identities, public-check receipts, model/tool prompts, executable dependency hashes and balanced three-arm order before treatment outcomes. Six tasks × two repetitions × three arms = 36 sequential trials; model mify/deepseek/deepseek-flash, thinking low, 20 calls/120 seconds, 135/140-second parent termination. No local models, private logs, new dependencies, post-outcome task changes, selective retry or inferred task-success labels. Prior product changes and experiment artifacts remain untouched.
• Acceptance records behavioral pass, current verification evidence and combined task pass separately, explicit false completion, unnecessary writes on already-correct code, repeated matching-public-check calls, total tool/model/CLI/byte cost and missing/invalid trials. Test repetition is defined narrowly in this deterministic frozen environment; it is not a general claim that rerunning tests wastes time. Hidden tests never feed back to the model. Compare each tool-enabled arm against baseline first and ondemand against upfront second, with paired task/repeat rows and descriptive uncertainty only.
• This remains a synthetic recovery/verification-decision experiment, not prospective owner work or a held-out population benchmark. No automatic feature/trigger policy is implemented. If history or CLI is unused or baseline performs as well at less cost, preserve that result and do not claim success. Structured references/summaries report facts only. No commit or release in this round.

Invocation-policy result: 36 valid trials, all three arms pass 12/12 behavioral and exact-source verification acceptances, no false completions or correct-code modifications. Cumulative tokens baseline/upfront/ondemand: 175,340 / 217,450 / 167,521; upfront is +24.02% versus baseline, ondemand −4.46% versus baseline but makes zero AgentXRay calls (as does upfront beyond the initial supplied report). Tools are 68 per arm; public checks 8/12/9; raw-history reads 4/0/3; exact-match repeated checks 1/4/2. Seven trials reuse recorded verification without a new check. Mean end-to-end 11.93/11.18/10.36 seconds; no causal latency or price claim. Recommend keeping the CLI optional and not adding mandatory reports, event bundles or a speculative trigger. Eight experiment selftests and 348 product tests pass. Audit reexecutes 29 public checks and all hidden cases, matches 204 calls/results, verifies 51 frozen source hashes and resumes 36 sealed trials with zero new model calls. Results are in experiments/invocation-policy/RESULTS.md; no real production tasks, product changes, commit or release are claimed.

Single-session forensic workflow (approved 2026-09-27)

• Validate the current tool's native advantage: tracing recorded execution, not improving code-generation completion. Use the largest-by-frozen-byte-count Codex session in the existing 2026-09-24 audit manifest, without selecting by outcomes. Preserve the frozen prefix/hash; this is a previously studied real session, not a held-out or prospective production task. No private raw log or command is sent to a model or published.
• Freeze three factual questions before report inspection: latest launched background process and its last recorded state; latest uniquely associated nonzero terminal process; earliest uniquely associated successful terminal process. No qualifying target is a valid no-match result. Require launch/call-result/terminal-poll line evidence and explicit ambiguity instead of assuming an orphan poll or reused ID belongs to a process. Never equate process exit with task correctness or live process state.
• Baseline is a local native-JSON raw-record pass with explicit wrapper parsing and ID/order joins, independent of AgentXRay normalizers/rules. Tool path uses existing summary/full inspect and explicit evidence CLI, with all evidence pages reassembled and compared to the snapshot. Compare factual answers and line support; if uncertainty or supported wrapper differences prevent agreement, report that gap rather than relabeling it correct. The baseline is a competent scripted investigation, not an intentionally expensive full-log dump to an LLM.
• Count full raw bytes scanned, baseline compact finding bytes, CLI response bytes/pages, unique requested raw record bytes, command stages and measured local duration separately. Include implementation effort as an unmeasured limitation: no human timing or model productivity claim. Report record retrieval amplification, manual association/extra requests and missing fields as possible workflow blockers; do not implement features automatically.
• Existing product/experiment code remains unchanged. Add only a reproducible forensic method/result note and local ignored audit scripts/receipts. Verify selected data hashes before and after, retain all three selectors including absences, no background logged commands executed, no model calls, no commit/release.

Forensic checkpoint: selected codex-2, 4,333,237 bytes / 771 records. Independent raw JSON/header/ID/order joins and AgentXRay agree on all three frozen questions and all 36 process lifecycles: 28 recorded successes, eight last-recorded running, 30 associated polls, no unlinked polls. Last launch chain 683→684→689→690 ends code 0; earliest confirmed success 47→48→61→62 ends code 0; no uniquely associated nonzero terminal process exists in this snapshot. Eight supporting physical records reassemble exactly through 11 default evidence pages. Summary/full/evidence emit 74,442 bytes across 13 invocations but read at least 56,332,081 input bytes; competent baseline emits 738 answer bytes after its scan, so no raw-baseline savings or human-time claim. Existing 16-KiB pages reduce evidence calls to eight; full+evidence uses nine invocations and 68,188 output bytes. The concrete obstacles are summary sampling missing latest targets, oversized raw result payloads, repeated full-file validation and caller-side process selection. Documented in docs/session-forensics.md; no product feature or model experiment was added, private logs remain local, and no genuine productivity advantage is asserted.

README forensic-case update (approved 2026-09-27)

• Keep the existing visual layout, SVG and synthetic UI screenshot. Change only bilingual positioning, a compact real-session case after quick start, question-led usage guidance and the evidence-limit paragraph. Audience: developers investigating existing coding-agent sessions; value: trace recorded execution back to supporting source evidence, not certify task success.
• Quote only the verified single Codex snapshot: 4,333,237 bytes (4.33 MB), 771 physical records, 36 matching process chains, 28 recorded successes and eight last-recorded running states; three preselected questions agree with independent raw parsing. Call out previously studied/private snapshot, no public raw reproduction, no live-state/accuracy/productivity claim. The adjacent screenshot is unrelated synthetic demonstration data, not an image of this private case.
• For overview suggest summary; for latest/all/no-match investigations suggest full JSON; for source verification suggest explicit hash/line evidence. Keep summary/evidence labelled source-only/unreleased. Shorten homepage experimental detail into a clear not-yet-established claim plus links; keep negative results discoverable. Add the real-case claim as manual/private-evidence verification in claims.json, never a fake automated CI check.
• Verify case numbers against local receipts, bilingual semantic consistency, local links/anchors and existing automatic claims. Preview existing visuals and added text at about 900px content and 360px viewport using local GitHub-like rendering. Do not edit product code, original logs, experimental results, images or other existing changes; no commit/push/release.

README forensic-update verification: both READMEs are 142 lines with unchanged assets; the new case and question-led guide follow quick start. All 106 local links/anchors and both asset audits pass. Sixteen automated claims pass (including 348 product tests); three claims remain explicitly manual, including the newly documented private real-session case, whose numbers were separately checked against existing local results/crosscheck receipts. Eight local Chromium previews (two languages, two themes, 898px content/360px viewport) show no horizontal page overflow or missing local images. Lint passes with existing warnings. Receipts are under output/readme-forensics and screenshots under output/playwright/readme-forensics. This is not a GitHub-published rendering or public reproduction of the private case; no product/image changes, commit or release.

Release v1.24.0 (authorized 2026-09-27)

• Publish the layered CLI, structured JSON errors and updated bilingual forensic positioning through a protected PR and the existing GitHub Release/npm workflow. Include referenced public experiment protocols/results in Git, but keep experiments, private logs/maps, local config and output out of npm.
• Highlight the JSON failure-channel migration: inspect --json errors now emit an error object rather than empty stdout; successful full report shape and diagnostic semantics remain compatible, with the new package version in engine metadata. Raw evidence expansion is explicit and potentially sensitive, not sanitized by default.
• Align source/current documentation with the release; preserve historical experiment receipts and statements as historical. Do not rerun/tune frozen model trials because package/source hashes advance. No effectiveness, cost-saving or population-accuracy claims.
• Build and run 348 product tests, focused CLI checks, lint, claims and package smoke. Merge only after required checks pass, tag the verified merge, and confirm official npm latest plus a fresh install, summary/evidence/error contracts and served assets before claiming publication complete.

Patch release v1.23.1 (user authorized)

• Publish the merged evidence-first bilingual README and documentation as a patch release. No new installed runtime feature, platform or productivity claim. Research protocols and scripts remain repository-only; the npm file allowlist continues to exclude experiments and all private output/configuration.

• Update package and lockfile versions together, build the shipped UI/shared artifacts, run product tests and lint, inspect and install the packed package with isolated HOME and synthetic inputs. Merge through a protected release PR, then publish a GitHub Release to trigger the existing npm/provenance workflow.

• Completion requires the official npm registry to report the new version, a fresh temporary install to return the expected CLI version and synthetic inspect counts, and the release workflow to succeed. Do not infer publication from a tag alone or mutate an existing npm version.

• No new platform, dependency, model call, account, telemetry, cloud log storage or automatic command execution.

• No automatic human judgments of real sessions, relaxed argument matching or fabricated accuracy/productivity/adoption claims.

• No changes to the frozen legacy UI, unrelated repository infrastructure or user's running services.

• Narrow-screen checks do not certify physical devices, software keyboards or all analytics/Trace/library screens.