Define low-volume telemetry event schemas

Cargo.toml

@@ -54,6 +54,9 @@ dialoguer = "0.12.0"
 toml_edit = "0.25.11"
 url = "2.5.8"
 symposium-install = { version = "0.1.0", path = "symposium-install", features = ["clap"] }
+uuid = { version = "1.26.0", features = ["v4", "serde"] }
+hmac = "0.12.1"
+getrandom = "0.4.2"
 
 
 [dev-dependencies]

md/design/module-structure.md

@@ -154,10 +154,12 @@ Builtin dispatch currently only acts on `SessionStart`, where `handle_session_st
 
 Manages `state.toml` in the config directory. Deserializes through `RawState` and validates into the runtime `State`. Tracks the semver of the binary that last touched the directory (for future migration hooks) and the timestamp of the last update check (to throttle crates.io queries to once per 24 hours). `ensure_current()` is called on startup to silently stamp the current version. `should_check_for_update()` / `record_update_check()` gate the auto-update flow.
 
-### `telemetry.rs` — opt-in usage telemetry
+### `telemetry/` — opt-in usage telemetry
 
 Implements the local, opt-in [telemetry](./telemetry.md) event log under `<config-dir>/telemetry/`, one JSONL file per UTC day. Off by default; gated by `[telemetry] enabled`. A `TelemetryEvent` is an `at` timestamp plus a kind-tagged `EventKind` (`session_start` / `user_prompt` / `tool_use`), serialized one per line. `record` / `record_kind` append an event; `roll_off` deletes files older than `RETENTION_DAYS` (30); `read_events` / `recent_events` read them back; `usage` + `status_text` back `telemetry status`; `recent_events` backs `telemetry show`. Events are anonymous by construction — no prompt text, command lines, or file paths. Every write path is best-effort — failures are logged and swallowed so a hook is never broken. The recording entry points are not yet called from the hook pipeline, so no events are produced today even when telemetry is enabled.
 
+The replacement recording contract is being built behind private `schema`, `identity`, and `state` submodules before it is connected to production callers. Within `schema`, `mod.rs` owns shared row primitives and version dispatch, `macros.rs` owns strict versioned-row boilerplate while each row module keeps its validation rules, `name.rs` owns validation shared by public name types, `agent.rs` owns agent vocabulary and agent-originated rows, `command.rs` owns eligible built-in and public plugin-command coordinates and exhaustively maps parsed CLI commands into the recorded built-in set, `extension.rs` owns validated public extension coordinates and vocabulary shared across event kinds, and `resolution.rs` owns resolution summaries and shared resolution vocabulary. Package-resolution vocabulary and validated public coordinates live in `resolution/package.rs`; `resolution/extension.rs` owns the strict recursive node vocabulary, the validated path wrapper that enforces whole-path depth, leaf-count, and encoded-size limits, and the versioned row that derives `extension_subject` from its target and path. Timestamped rows validate during deserialization that `day` is the UTC calendar day containing `at`; the later archive reader separately validates that the row belongs to its daily file. Private state binds its key and identifier-window or return-cohort anchor into distinct identity scopes. Each identifier domain accepts only its contract-selected scope. Row constructors take a bound recording context, derive identifiers from their own source fields, and take their day from the context: package resolution derives `package_subject` from its coordinate, agent configuration derives `agent_subject` from its agent, command derives `command_subject` from its coordinate, and a full resolution reuses one context for its summary, package, and extension rows. Session start extends that context with a return-cohort scope and derives its timestamp, both subjects, and `cohort_day` from one bound session transition. Within `state`, `mod.rs` owns the versioned private-state file shape, while `state/lifecycle.rs` owns the identifier-window transition for every recording plus return-cohort and identifier-reset transitions. A completed recording transition is a single-use value; a session transition extends it with the return-cohort selection. Binding either transition against unchanged anchors exposes only the identity scopes valid for that operation. The persistence layer will require a successful-write token for that binding so the contract's persist-before-derive order is structural rather than only documented. Their tests remain beside the responsibility they exercise.
+
 ### `report.rs` — structured report layer
 
 Provides user-facing output for all commands via a custom tracing layer. Commands emit `tracing::info!` or `tracing::debug!` events with a `report = %ReportEvent::Variant { ... }` field; the `ReportLayer` intercepts these and renders them based on mode: