correx/BACKLOG.md

CORREX — BACKLOG (live unbuilt work only)

Rules. This file is only outstanding work. Shipped code lives in RETRO.md (Pending live-QA → Landed). When you ship something: move it straight to RETRO.md under Pending live-QA, don't leave it here. After shipping, draft its QA: /qa-plan <commits|spec> → docs/qa/QA-<feature>.md. Pointers (commits, spec §) are point-in-time — verify against current code before acting.

---

★ Active epic — Plan-generation pipeline · docs/plans/plan-pipeline-spec.md

Turns a freestyle prompt into a confirmed ExecutionPlan via bounded multi-candidate generation → deterministic lint → structured critique → tournament → operator selection. For the founding constraint (local models are weak planners): narrow every model call, deterministic Kotlin joints, operator is the terminal verifier. Generalizes today's degenerate N=1 freestyle planning. Slice 1 (lint) shipped → RETRO.

• Slice 2 — multi-candidate round-1 + templates (§4): PlanTemplate library, template-select + slot-fill, GBNF-constrained, N₁=3 high-temp → PlanCandidateGeneratedEvent.
• Slice 3 — critique + aggregate (§6/§7): one-shot GBNF critic per survivor → CritiqueFinding{stageId,severity,finding,suggestedChange} (first consumer of the role-rel §6 schema); deterministic dedupe/contradiction-drop/severity-sort → DefectList → PlanCritiqueCompletedEvent.
• Slice 4 — round-2 + tournament + operator selection (§8/§9): N₂=2 low-temp regen from best survivor + DefectList; deterministic ranking; top-2 → operator at the approval gate (this is the TUI plan-comparison view). Reject-both → PlanGenerationFailedEvent.
• Slice 5 — preference-pair logging (§10): PreferencePairRecordedEvent (winner/loser/context), Bradley–Terry data for the future learned ranker (§12, deferred).
• Slice 1b — plan file/symbol grounding: extend the lint to ground the compiled plan's file paths (reuse BriefReferenceExtractor + worldProbe, record per invariant #9) and symbols (needs the index from "symbol grounding" below).

Caveats: PlanConfirmedEvent does not exist — extend ExecutionPlanLockedEvent with a candidate ref. Module home: new :core:planning. Spec §11 — never execute a stage, auto-confirm, LLM-aggregate/rank, mutate a candidate in place, or exceed 2 gen rounds / 1 critique round. Defect dedup: pin + version it.

Ready to build (unblocked)

• architect contradiction-check (role-rel §4) — L3 over decision journal + ADRs → PossibleContradictionFlag (display-only in v1).
• symbol grounding (role-rel §3) — needs a real symbol index (file-path grounding done); also unblocks plan-lint Slice 1b symbol resolution. (ctx.py subprocess vs in-process tree-sitter — the replay story prefers in-process + versioned.)
• tier-2 stats polish (obs §3) — session-completion summary pane (basic pane shipped).
• full Go↔Kotlin per-event render matrix (TUI §2) — golden-fixture tests asserting a render for every event type (partially covered today).
• approval ergonomics audit (TUI §3) — single-key y/n/e for T0–T2, mandatory confirm T3+, queued approvals as a navigable list (never modal-stacked). Verify against current band impl.
• render markdown in chat turns (TUI) — currently ignored.
• session list / resume view (TUI) — no way to see a prior session after server restart + reopen; GET /sessions data exists server-side.
• research follow-ups (§D): batch fetch-approval at source-list level (not per-URL); dedicated SourceFetched/LowQualityExtraction events (quality+sha currently in ToolExecutionCompleted metadata); dynamic per-session egress allowlist; web approval client (third client on the Ktor bus, behind WireGuard/Tailscale, never public); fresh-machine runtime install (copy research.toml + prompts/ + schemas/ + config entries into ~/.config/correx).
• low-sev hardening (§G): turnId prefix collision — startsWith("repomap:$repoRoot") collides /repo vs /repo2; fix = trailing : in 3 places (ProjectMemoryService write+check, L3RepoKnowledgeRetriever). Narration lane lag — drop queued pause narrations once their approval resolves. WorkspaceStateProbe fingerprint — hashes path|mtime|size without newline separators (cosmetic, deterministic).
• gamedev/Godot (§I): .cs in RepoMapIndexer SYMBOL_PATTERNS (if the repo is Godot Mono; .gd + .md shipped 81a21bf/f521ac8); structural .tscn/.tres validator (node-tree-aware diff).

Blocked / sequenced (don't start yet)

• CritiqueFinding schema (role-rel §6) — lands with Slice 3 (its first consumer); no consumer until then. CriticCalibrationProjection (= addenda A3) — after Slice 3 runs; needs runtime critique/outcome history (CritiqueOutcomeCorrelatedEvent) to exist first.
• dynamic plan-derived diff manifest (role-rel §2) — allowed files from the impl_plan artifact; refinement over the shipped static per-stage writes=[globs].
• §5.2 command-card LLM annotation layer (TUI) — deferred by spec until layer 1 is used.
• idea board → profile promotion — deferred hook; auto-captured ideas promote into .correx/project.toml.
• freestyle follow-ups (§H): graph re-routing by preemptive steering (mid-execution input can't re-route the compiled graph yet); child-session SubagentRunner (seam exists; sequential only); post-lock ApprovalDecisionResolvedEvent.userSteering → L0 promotion.
• scene editing + event-log fine-tuning dataset (§I, far future) — ⚠️ fine-tuning is on CLAUDE.md's not-implemented list; needs an explicit epic + operator de-listing, not an incidental add.

Won't build / deferred-by-design (don't re-litigate)

• 🚫 obs tier-3 Prometheus/Grafana export — spec says "deferred indefinitely."
• 🚫 plan checkpointing (addenda A2) — superseded: verifyProduces + ManifestContainmentRule + validation already reconcile execution vs the compiled plan; only net-new bit fed a consumer (A3) that isn't ready. Revisit only if a positive per-stage checkpoint event gains a real consumer.
• 🚫 research non-responsibilities — no headless browser, no LLM-based extraction, no public approval endpoint.
• ⚠️ architect ADR shape (alternativesConsidered required non-empty, role-rel §4) — conflicts with the standing "don't raise alternatives unless real cost/breakage" preference in architect.md.
• ⚠️ PreemptRedirectEvent producer (QA bug #6) — B3 hard re-route unreachable from the TUI; skipped by design. Build only if the hard-reroute path is actually wanted.

---

Ops notes (bite repeatedly)

• Config copies of examples/* in ~/.config/correx go stale silently (e.g. a missing inject_artifact_kinds → invented artifact kinds). Re-sync after editing repo examples.
• Do not rebuild jars while the server JVM is running — lazy classloading breaks (NoClassDefFoundError). Stop the server first.