correx/RETRO.md

CORREX — RETRO (archive of resolved BACKLOG items)

Counterpart to BACKLOG.md (the live outstanding list). Items here are built and unit-verified (Gradle green). Where a live-QA gate applies, that's called out as a follow-up — this sandbox has no local model / SearXNG / GPU / network, so live-QA could not be run here.

---

2026-06-21 — wider grants + revoke (branch feat/backlog-burndown)

Operator-requested (not a prior BACKLOG item): grants that outlive a single session, plus a revoke path. Two commits, each compiled + unit-tested green.

Commit	What
c36d41b	Cross-session grant scopes (PROJECT/GLOBAL) + revoke. GrantScope.GLOBAL(toolName) added; PROJECT made tool-bound. Engine scopeMatches: GLOBAL matches the bound tool anywhere, PROJECT when the session's projectId (derived from the bound workspace root via ProjectIdentity.of) AND tool match. New reserved GRANT_LEDGER_SESSION_ID stream holds PROJECT/GLOBAL grants; the approval gate unions the ledger's grants with the session's. RevokeGrant → ApprovalGrantExpiredEvent on the ledger (reducer already drops it); ListGrants/GrantList expose the active standing grants. Server-side T2 grant ceiling removed per operator request — a grant may now authorize any tier (incl. T3/T4); tool-binding is the remaining guard. New GrantScopeMatchingTest (5).
8df0ec7	TUI: scope picker (A) + standing-grants viewer. A (approve-always) opens a session/project/global picker (SESSION default = old behaviour); p/g create wider grants. grants palette command + G shortcut open OverlayGrants listing scope/tool/tiers/path with x/enter to revoke. protocol.go: TypeGrantList+GrantDto, RevokeGrant/ListGrants encoders. Both overlays rendered via cmd/preview (kinds grants, grant-scope).

Why the design: session grants are event-sourced per-session and die with the session; project/global grants must outlive any one session, so they live in a dedicated ledger stream the gate folds in — keeps grants in the audit log (invariant #9) rather than config.

⚠️ Live-QA gate (move out of RETRO once passed): unit tests cover the engine matching, reducer, and ledger fold, but the cross-session behaviour — create a GLOBAL/PROJECT grant in session A, confirm a different session B auto-clears that tool, then revoke and confirm it prompts again — needs a running server + model. Not runnable in this sandbox.

---

2026-06-20 — backlog burndown (branch feat/backlog-burndown)

Nine tracks, each compiled + unit-tested green before commit.

Commit	Track	BACKLOG ref
f783eed	CritiqueFinding/CritiqueSeverity/CritiqueRole type + CritiqueOutcomeCorrelatedEvent + core/critique calibration projection (state/reducer/projector)	B §6 + C-A3
784accb	repomap: turnId namespace requires trailing : (no /repo↔/repo2 collision; L3RepoKnowledgeRetriever filter + ProjectMemoryService write) + WorkspaceStateProbe newline fingerprint	G
266bbf0	EventStoreLatencyProbe (wired) + LlamaServerHealthProbe (+ injectable LlamaLivenessClient) + HealthConfig.eventStoreWarnLatencyMs	A §4
f715ffa	.cs / Godot-Mono type symbols in RepoMapIndexer.SYMBOL_PATTERNS	I
0e251d6	SceneValidator — structural .tscn/.tres (header well-formedness, ExtResource/SubResource id resolution, node parent integrity)	I
1df7af5	Brief echo-back gate: BriefEchoMismatchEvent + BriefEchoComparator/BriefEchoExtractor + checkBriefEcho orchestrator gate	C-A1
1a1b5cc	Stage-level plan checkpointing: StageCheckpointPassed/FailedEvent + StageCheckpointReconciler + emitStageCheckpoint (gated on a locked plan)	C-A2
eae0a0c	Architect contradiction-check (display-only): PossibleContradictionFlaggedEvent + L3-backed ArchitectContradictionChecker	B §4
b098d87	Dedicated SourceFetchedEvent / LowQualityExtractionEvent (promoted from ToolExecutionCompletedEvent metadata; additive), emitted from SandboxedToolExecutor	D
027ff1f	Dynamic per-session egress allowlist: EgressHostsGrantedEvent + EgressAllowlist union helper + EgressAllowlistProjection; NetworkHostRule delegates to the union	D
447fc7a	Reviewer static-first: StaticFindingsRecordedEvent + StaticAnalysisRunner (injectable CommandRunner; compiler/ktlint/detekt parsers) + excludeStaticFindingsFromReview filter, live-wired into reviewer context assembly	B §5
eff8f8d	Narration-lane lag: stale pause narrations dropped per-approval-request on resolve / per-session on resume (replay-safe)	G
1e6699a	tui-go go.mod go 1.26 → 1.24.2 (1.26 toolchain unreleased/unfetchable) — unblocks Go build/test on released toolchains	E (enabler)
da72ee5	tui-go: markdown rendering for chat turns via glamour (dark, per-width memoized), plain-text fallback; other roles/UI untouched	E
1f7a5d9	tui-go session list / resume view: R overlay over GET /sessions, resume via POST /sessions/{id}/resume onto the existing global stream	E
2a99e15	tui-go per-event render-matrix golden tests (37 cases) + a coverage guard that parses protocol.go so any new event type without a golden fails	E §2
d5afcd3	tui-go approval ergonomics: navigable pending-approval queue (no modal stacking) + y/n/e keys + tier-gated T3+ arm/confirm	E §3
641051b	Plan-derived diff manifest: PlanStage.writes + PlanDerivedManifest.deriveAllowedWrites/combine, unioned into StageConfig.writeManifest at compile, enforced by the existing containment matcher	B §2
ab7e4be	Egress allowlist activation: resolveSessionEgressHosts threads the session's EgressAllowlistProjection state into ToolCallAssessmentInput at runPlane2Assessment, so NetworkHostRule now consults the live per-session union (was fed emptySet())	D (activation)
4b0024f	Batch source-list fetch-approval: POST /sessions/{id}/approve-sources → SourceListHosts.extract (java.net.URI, lower-cased, ports stripped, dossier-line tolerant) → one EgressHostsGrantedEvent; live allowlist then auto-clears those web_fetches (no per-URL T2)	D
f107ff5	Idea-board → project-profile promotion: IdeaPromotedEvent (board tombstone, like discard) + ProjectProfileWriter (escape-aware TOML serialize/write) + ProjectProfile.withConvention (deduped) + server PromoteIdea handler (loads profile, appends idea text, writes .correx/project.toml); also made SimpleToml's reader unescape \\/\" symmetrically with the writers (fixes pre-existing read/write asymmetry)	E
4e08510	Architect contradiction-check activation: ServerModule.start() subscribes to the architect stage's design ArtifactCreatedEvent, resolves decision text (design-schema approach field, capped fallback), runs ArchitectContradictionChecker.check, appends the non-null PossibleContradictionFlaggedEvent. Live-only, never halts. Checker built in Main.kt (gated on project.enabled) and threaded into ServerModule. Replaces the Main.kt TODO(wiring)	B §4 (activation)
64a90e7	Llama-probe registration: LlamaServerHealthProbe (266bbf0) wired into the health monitor when a llamacpp provider URL is configured — dedicated CIO client (3s timeout, shutdown-hook close) + HttpLlamaLivenessClient. Gated so a model-less box reports no spurious LLAMA_SERVER DEGRADED. Replaces the Main.kt TODO(wiring)	A §4 (activation)

Follow-ups created this pass (refiled into BACKLOG)

• C-A1 activation — planner.md must emit a brief_echo block and role_pipeline.toml must set briefEcho="true" / briefEchoSource for the gate to fire live (model-dependent → live-QA).
• C-A3 producer — nothing emits CritiqueOutcomeCorrelatedEvent yet; the calibration projection has no live feed until a reviewer-loop producer records finding outcomes.
• B §4 wiring — ✅ DONE (4e08510): ServerModule.start() now subscribes to the architect design artifact and emits the flag. (In-session L3 embedding is NOT needed — the checker filters to PRIOR sessions by design, so it works against prior runs' distilled decisions.)
• A §4 llama wiring — ✅ DONE (64a90e7): the probe is registered in the health monitor (gated on a configured llamacpp provider URL) via HttpLlamaLivenessClient. (tokens/sec telemetry still rides liveness-only — the /health endpoint reports reachability; a throughput feed remains future work but the spec's liveness probe is live.)
• D egress wiring — ✅ DONE (ab7e4be): session egress state is now threaded into ToolCallAssessmentInput at runPlane2Assessment, so NetworkHostRule consults the live union. Batch fetch-approval ✅ DONE (4b0024f): POST /sessions/{id}/approve-sources emits one EgressHostsGrantedEvent for the whole source list.
• B §5 static_check stage — runner/event/filter complete and the filter is live, but no workflow stage emits StaticFindingsRecordedEvent yet (// TODO(wiring) in StaticAnalysisRunner.kt); needs an event-emitting deterministic stage-type seam.
• E toolchain — tui-go now builds via auto-downloaded go1.24.2 (GOTOOLCHAIN=auto). The committed directive fix assumes 1.26 was unintended; bump if a specific newer release is actually wanted.

Environment note

• A ~/.gradle/gradle.properties machine-local override was added on this box (-Xmx768m, parallel=false, kotlin daemon -Xmx640m) because the repo's -Xmx4G OOM-killed the foreground process on a 1.9 GB machine. Not committed — repo defaults intact for higher-RAM machines.