# CORREX — BACKLOG (live unbuilt work only)

> **Rules.** This file is *only* outstanding work. Shipped code lives in `RETRO.md` (Pending live-QA →
> Landed). When you ship something: move it straight to `RETRO.md` under *Pending live-QA*, don't leave it
> here. After shipping, draft its QA: `/qa-plan <commits|spec>` → `docs/qa/QA-<feature>.md`.
> Pointers (commits, spec §) are point-in-time — verify against current code before acting.

---

## ★ Active epic — Plan-generation pipeline · `docs/plans/plan-pipeline-spec.md`

Turns a freestyle prompt into a confirmed `ExecutionPlan` via bounded **multi-candidate generation →
deterministic lint → structured critique → tournament → operator selection**. For the founding constraint
(local models are weak planners): narrow every model call, deterministic Kotlin joints, operator is the
terminal verifier. Generalizes today's degenerate N=1 freestyle planning. Slice 1 (lint) shipped → RETRO.

- [ ] **Slice 2 — multi-candidate round-1 + templates** (§4): `PlanTemplate` library, template-select +
      slot-fill, GBNF-constrained, N₁=3 high-temp → `PlanCandidateGeneratedEvent`.
- [ ] **Slice 3 — critique + aggregate** (§6/§7): one-shot GBNF critic per survivor →
      `CritiqueFinding{stageId,severity,finding,suggestedChange}` (first consumer of the role-rel §6 schema);
      deterministic dedupe/contradiction-drop/severity-sort → `DefectList` → `PlanCritiqueCompletedEvent`.
- [ ] **Slice 4 — round-2 + tournament + operator selection** (§8/§9): N₂=2 low-temp regen from best
      survivor + DefectList; deterministic ranking; top-2 → operator at the approval gate (**this is the TUI
      plan-comparison view**). Reject-both → `PlanGenerationFailedEvent`.
- [ ] **Slice 5 — preference-pair logging** (§10): `PreferencePairRecordedEvent` (winner/loser/context),
      Bradley–Terry data for the future learned ranker (§12, deferred).
- [ ] **Slice 1b — plan file/symbol grounding**: extend the lint to ground the compiled plan's file paths
      (reuse `BriefReferenceExtractor` + `worldProbe`, record per invariant #9) and symbols (needs the index
      from "symbol grounding" below).

Caveats: `PlanConfirmedEvent` does **not** exist — extend `ExecutionPlanLockedEvent` with a candidate ref.
Module home: new `:core:planning`. Spec §11 — never execute a stage, auto-confirm, LLM-aggregate/rank,
mutate a candidate in place, or exceed 2 gen rounds / 1 critique round. Defect dedup: pin + version it.

## Ready to build (unblocked)

- [ ] **architect contradiction-check** (role-rel §4) — L3 over decision journal + ADRs →
      `PossibleContradictionFlag` (display-only in v1).
- [ ] **symbol grounding** (role-rel §3) — needs a real symbol index (file-path grounding done); also
      unblocks plan-lint Slice 1b symbol resolution. (`ctx.py` subprocess vs in-process tree-sitter — the
      replay story prefers in-process + versioned.)
- [ ] **tier-2 stats polish** (obs §3) — session-completion summary pane (basic pane shipped).
- [ ] **full Go↔Kotlin per-event render matrix** (TUI §2) — golden-fixture tests asserting a render for
      every event type (partially covered today).
- [ ] **approval ergonomics audit** (TUI §3) — single-key y/n/e for T0–T2, mandatory confirm T3+, queued
      approvals as a navigable list (never modal-stacked). Verify against current band impl.
- [ ] **render markdown in chat turns** (TUI) — currently ignored.
- [ ] **session list / resume view** (TUI) — no way to see a prior session after server restart + reopen;
      `GET /sessions` data exists server-side.
- [ ] **research follow-ups** (§D): batch fetch-approval at source-list level (not per-URL); dedicated
      `SourceFetched`/`LowQualityExtraction` events (quality+sha currently in `ToolExecutionCompleted`
      metadata); dynamic per-session egress allowlist; **web approval client** (third client on the Ktor
      bus, behind WireGuard/Tailscale, never public); fresh-machine runtime install (copy `research.toml` +
      `prompts/` + `schemas/` + config entries into `~/.config/correx`).
- [ ] **low-sev hardening** (§G): turnId prefix collision — `startsWith("repomap:$repoRoot")` collides
      `/repo` vs `/repo2`; fix = trailing `:` in 3 places (ProjectMemoryService write+check,
      L3RepoKnowledgeRetriever). Narration lane lag — drop queued pause narrations once their approval
      resolves. WorkspaceStateProbe fingerprint — hashes `path|mtime|size` without newline separators
      (cosmetic, deterministic).
- [ ] **gamedev/Godot** (§I): `.cs` in `RepoMapIndexer` SYMBOL_PATTERNS (if the repo is Godot Mono; `.gd`
      + `.md` shipped `81a21bf`/`f521ac8`); structural `.tscn`/`.tres` validator (node-tree-aware diff).

## Blocked / sequenced (don't start yet)

- [ ] **`CritiqueFinding` schema** (role-rel §6) — lands with Slice 3 (its first consumer); no consumer
      until then. **`CriticCalibrationProjection`** (= addenda A3) — after Slice 3 *runs*; needs runtime
      critique/outcome history (`CritiqueOutcomeCorrelatedEvent`) to exist first.
- [ ] **dynamic plan-derived diff manifest** (role-rel §2) — allowed files from the `impl_plan` artifact;
      refinement over the shipped static per-stage `writes=[globs]`.
- [ ] **§5.2 command-card LLM annotation layer** (TUI) — deferred by spec until layer 1 is used.
- [ ] **idea board → profile promotion** — deferred hook; auto-captured ideas promote into
      `.correx/project.toml`.
- [ ] **freestyle follow-ups** (§H): graph re-routing by preemptive steering (mid-execution input can't
      re-route the compiled graph yet); child-session `SubagentRunner` (seam exists; sequential only);
      post-lock `ApprovalDecisionResolvedEvent.userSteering` → L0 promotion.
- [ ] **scene editing + event-log fine-tuning dataset** (§I, far future) — ⚠️ fine-tuning is on CLAUDE.md's
      not-implemented list; needs an explicit epic + operator de-listing, not an incidental add.

## Won't build / deferred-by-design (don't re-litigate)

- 🚫 **obs tier-3 Prometheus/Grafana export** — spec says "deferred indefinitely."
- 🚫 **plan checkpointing** (addenda A2) — superseded: `verifyProduces` + `ManifestContainmentRule` +
      validation already reconcile execution vs the compiled plan; only net-new bit fed a consumer (A3) that
      isn't ready. Revisit only if a positive per-stage checkpoint event gains a real consumer.
- 🚫 **research non-responsibilities** — no headless browser, no LLM-based extraction, no public approval
      endpoint.
- ⚠️ **architect ADR shape** (`alternativesConsidered` required non-empty, role-rel §4) — conflicts with
      the standing "don't raise alternatives unless real cost/breakage" preference in `architect.md`.
- ⚠️ **`PreemptRedirectEvent` producer** (QA bug #6) — B3 hard re-route unreachable from the TUI; skipped
      by design. Build only if the hard-reroute path is actually wanted.

---

## Ops notes (bite repeatedly)

- Config copies of `examples/*` in `~/.config/correx` go **stale silently** (e.g. a missing
  `inject_artifact_kinds` → invented artifact kinds). Re-sync after editing repo examples.
- **Do not rebuild jars while the server JVM is running** — lazy classloading breaks
  (`NoClassDefFoundError`). Stop the server first.