roadmap: enforce self-dogfood release gates and add session intelligence

[2233admin]

Abstract

v0.5.0 established the compiled Rust CLI as the primary execution kernel, with PowerShell retained as a recovery/compatibility surface. The next product-quality step is not another provider: it is to make the Pipeline prove its own health before release, then add first-class Agent session intelligence.

Today GitHub CI can be fully green while a fresh code-intel self-run fails its own architecture gate. That mismatch allows structural debris to accumulate behind a successful release badge and makes the final Hospital output less actionable than the underlying evidence.

Reference implementation for the session-observability surface: cosmtrek/mindwalk. We should internalize the useful contracts and workflows, not clone its entire UI or introduce a runtime dependency on it.

Core product-quality defect

Release green is not equivalent to product healthy.

Fresh evidence from the released v0.5.0 code:

• PR CI and the post-merge main CI completed successfully.
• A fresh normal self-run ended as process_failed with diagnosis.hospital - architecture gate failure.
• Sentrux gate reported:
  • quality 5470 -> 5274;
  • cycles 0 -> 1;
  • complex functions 21 -> 85.
• Sentrux check identified the circular dependency:
  • crates/code-intel-cli/src/dag_run.rs;
  • crates/code-intel-cli/src/execution_kernel.rs.
• The published Hospital view exposed only architecture gate failure; the surgery plan was not_required and the primary target fields were empty.

This is both a gating defect and an artifact UX defect: authoritative evidence knows the failure, but CI does not enforce it and the human-facing report does not carry the actionable target forward.

Target outcome

Code Intel becomes a self-governing, model-independent Pipeline with two complementary intelligence planes:

1. Repository intelligence — deterministic code structure, evidence, risk, governance, query, and impact.
2. Agent session intelligence — deterministic traces of how Claude/Codex explored, changed, and verified that repository.

Models remain optional judges/consumers. Pipeline facts, release authority, trace normalization, mechanical scoring, and artifact publication remain deterministic and Pipeline-owned.

Delivery slices

v0.5.1 — Self-dogfood release integrity

• Break the dag_run / execution_kernel circular dependency at the shared ownership boundary.
• Add a release-blocking self-scan job against the exact candidate commit/package.
• Require the admitted architecture verdict to pass; do not weaken or regenerate the baseline to obtain green.
• Propagate the first failing structural rule, evidence source, target files, and remediation command into Hospital Markdown/JSON.
• Produce a bounded surgery/govern plan whenever an actionable target exists.
• Make release green, self-scan green, and published artifact green refer to the same snapshot identity.

v0.6.0 — Session Trace and behavior intelligence

• Add Claude Code and Codex JSONL adapters behind one Pipeline-owned trace schema.
• Normalize search, read, edit, command, error, verification, user-turn, compaction, and subagent events.
• Correlate parent/subagent sessions without requiring raw provider internals downstream.
• Bind traces to repository snapshot identity and mark missing/outside-repository paths explicitly.
• Compute mechanical, evidence-anchored signals for scope fit, wandering, churn, post-edit verification, recovery after errors, and relevant-file coverage.
• Keep LLM evaluation optional, sealed, attributable, cached, and stale when its trace changes.

v0.7.0 — Minimum useful viewer and comparison

• Provide a local 2D repository map, playback timeline, file visit inspector, and agent/subagent filters.
• Compare sessions across models, Pipeline/Skill versions, and repeated attempts on the same task.
• Export bounded Markdown/JSON summaries suitable for GitHub PR checks.
• Publish native macOS/Linux packages in addition to the Windows Release package.

Acceptance criteria

• A candidate with a failing self-scan cannot publish a stable GitHub Release.
• The self-scan uses the exact candidate snapshot/package, not an unrelated checkout or mutable baseline.
• A Hospital failure names the first failed rule, target files, evidence provenance, and smallest rerun command.
• The current dag_run / execution_kernel cycle is removed and a regression check prevents its return.
• Claude and Codex fixtures normalize into the same versioned trace schema with deterministic ordering.
• Subagent relationships, user turns, compactions, edits, errors, and verification events remain traceable to source events.
• Behavior scores are mechanically derived and expose unknown/unsupported coverage rather than inventing certainty.
• Raw prompts, secrets, provider-private payloads, and unrelated sessions do not enter published artifacts.
• The viewer consumes exported schemas only; trace adapters do not depend on rendering.
• Cross-session comparison binds task identity, repository snapshot, tool/model identity, and Pipeline version.
• Targeted tests, full Rust tests, package smoke, self-scan, and post-merge CI all pass before release.

Non-goals for these slices

• No Three.js/3D city, cinematic effects, or video export in the first viewer.
• No general IDE/workbench, autonomous code modification, or automatic PR creation.
• No third-party session adapters beyond Claude Code and Codex until the trace contract proves stable.
• No runtime dependency on Mindwalk.
• No new production dependency unless the existing Rust/platform stack cannot meet a measured requirement.

Implementation order

1. Fix the self-scan cycle and actionable diagnostic propagation.
2. Put the exact self-scan into CI and the release workflow.
3. Define trace/event/session schemas and golden fixtures.
4. Implement Claude and Codex adapters plus subagent correlation.
5. Implement mechanical scoring and optional sealed judge input.
6. Add the minimum 2D viewer and cross-session comparison.
7. Publish cross-platform packages after the CLI and schema contracts are stable.

Review questions

1. Does the proposed self-dogfood gate prove the exact release candidate, or can checkout/package/baseline drift still create a false green?
2. Is the dag_run / execution_kernel cycle best removed by ownership inversion, extracting a shared request/result type, or deleting a redundant orchestration layer?
3. Which Hospital fields must become mandatory so every structural failure is immediately actionable?
4. Does the trace schema preserve enough source provenance for replay and review without leaking prompts or provider-private data?
5. Which session-quality signals can be deterministic, and which must remain advisory or unknown?
6. Are the v0.5.1, v0.6.0, and v0.7.0 boundaries independently shippable and rollback-safe?
7. What should be deleted or deferred to prevent the viewer and adapter surface from becoming another parallel product?

[2233admin]

Independent review: REVISE — and the v0.5.1 slice is now implemented in #15

Reviewed against the actual v0.5.0 code (= main = 372dd83), both workflows, and a live reproduction — not just this issue's text. The reproduction confirmed the symptom set exactly (exit 70, hospital architecture gate failure, surgery not_required, empty targets, green CI on the same commit), but three of the issue's premises needed correction. Those corrections shaped the fix.

Corrected root causes

1. process_failed was not the gate failing. The coordinator gives ProcessFailed precedence (exit 70) over DomainFailed (exit 10). In reproduction the process failures were doctor ("doctor bootstrap observation lacks the non-authoritative v1 contract" — a bare kernel run couldn't satisfy doctor without wrapper side-files) and inventory.rg (linked-worktree .git pointer file). The architecture gate produced a clean domain verdict underneath, invisible in the outcome string.
2. The Hospital gap was a schema problem, not a rendering problem. The full failing output (rules, thresholds, values) existed on disk in evidence.sentrux/sentrux-command-observation.json, but the adapter rule contract structurally forbade failure details (exact {kind,status,verdict,failure} with failure:{kind:"none"} even on verdict:"fail"), and Hospital then reduced rules to booleans. "Propagate the target files" required a versioned contract change through provider → adapter → admission → Hospital, not field plumbing.
3. The gate verdict was not a function of the snapshot. Three engines disagreed on the same tree: this issue's run saw cycles 0→1; both available sentrux-lite shims report cycles 0 always (cycle_count = 0 is hardcoded) while failing on max_cc 162>70 / god files / coupling; the native DSM saw the whole crate as one module. The installed sentrux.cmd is a thin forwarder hardcoded to one dev checkout path — scanning any snapshot executed another checkout's analyzer. And the committed baseline had no engine identity: quality_signal 0.5469 (float 0–1, foreign engine) was being compared against lite's integer 0–10000 scale. "Do not regenerate the baseline" is unenforceable until the baseline says who produced it.

What #15 lands (v0.5.1 scope)

• Both real cycles removed: dag_run <-> execution_kernel and a second, previously undetectable artifact_ref <-> capability cycle surfaced by the new engine.
• sentrux-native gate engine inside the binary with real resolved-import cycle detection, structured violations with target files; PATH/forwarder drift eliminated from the default path (toolPathPrefix remains the external-engine seam).
• Baseline v2 with engine id/version + source commit; gate fail-closes on engine mismatch.
• Hospital now names the failing rule, targets, and smallest rerun command, and plans a bounded surgery whenever a target exists. Verified end-to-end: a seeded cycle fixture exits 10 with cycles exceeded: 1 > 0 (targets: src/a.rs, src/b.rs) in hospital.md and surgery: planned.
• Execution results expose failures: {process[], domain[]} so tooling noise can never mask a gate verdict again.
• Kernel self-sufficiency (native doctor fallback; worktree .git fix), so run execute works on a bare checkout — which is what makes a CI self-scan honest.
• CI + release self-scan jobs and verifiable stable packaging (git archive HEAD, sha256 + release manifest, packaged-binary check/gate) — in the pending workflow commit on the same branch (needs a workflow-scoped token to push).
• Full local verification: 973 tests pass (one pre-existing local-env failure unrelated to the change), hospital trust contract 16/16, self-scan exit 0 on the fixed tree.

Answers to the review questions

1. Checkout/package/baseline drift: yes, all three existed — skip-flagged smokes, working-tree packaging after mutating steps, identity-free baseline, plus two more found during review: the global forwarder executing a different checkout, and ambient CODE_INTEL_HOME redirecting manifest discovery. Self-dogfood release gates: built-in structural engine, cycle removal, actionable Hospital #15 closes the first three; the forwarder/CODE_INTEL_HOME hardening of the legacy wrapper remains open (tracked below).
2. Cycle removal method: none of the three listed options — the correct fix was re-partitioning ownership (CLI front-end out of dag_run.rs, RunError to a leaf), keeping execution_kernel as the execute+publish composition point.
3. Mandatory Hospital fields: failing rule kind, per-violation message, target files, rerun command — now enforced by the details contract and covered by the trust-contract tests.
   4–5. (v0.6.0) The issue ignores the existing surface: session_evidence.rs (pinned MINDWALK_COMPATIBILITY_REVISION), provider session-adapt, prototypes/session-observability. Scope v0.6.0 as a v2 of that surface. Direct Claude/Codex JSONL ingestion pulls raw prompt text — a redaction layer must be a first-class component with a sensitive-string fixture proving prompts never reach artifacts. Scope-fit/wandering cannot be fully mechanical; give every signal an explicit unknown state.
4. Slice independence: v0.6.0/v0.7.0 are independently shippable; v0.5.1 as originally written was not — it under-scoped the engine unification and outcome semantics that Self-dogfood release gates: built-in structural engine, cycle removal, actionable Hospital #15 had to include.
5. Delete/defer: ship v0.7.0's first viewer as static HTML/JSON + file-visit inspector + PR-check export only (defer interactive playback and macOS/Linux packaging until the CLI/schema contracts stabilize); keep the agreed non-goals. Also worth deleting from the release payload: orchestration/retirements/** rehearsal copies (3.1 MB, includes two full copies of the 4.7k-line legacy wrapper) and overlays/ (1.9 MB).

Remaining tracked debt (not in #15)

• Ratchet thresholds back down (max_cc 162 → 70, god files 29 → 0, coupling D → B) as decomposition proceeds; the no-degradation gate now prevents backsliding.
• Legacy wrapper (run-code-intel.ps1) still spawns PATH sentrux for its own steps; the installer still writes checkout-hardcoded forwarders; CODE_INTEL_HOME can still redirect discovery. Either retire the wrapper's gate steps in favor of the kernel or pin them to the built-in engine.
• CHANGELOG had no 0.5.0 entry; release notes are template text. The release-manifest now records tag+commit — consider requiring a changelog section per stable tag.
• advisory_workflow_recommend capability test fails on this dev machine (pwsh unicode in atom stdout) independent of any change — worth a CI-side look.

[2233admin]

状态核实（2026-07-27，对照 origin/main@b73c16a 直接读文件验证，非转述）：

v0.5.1「Self-dogfood release integrity」这部分验收标准，其实已经在 main 上落地了，只是这张票没跟着关/更新：

• dag_run.rs / execution_kernel.rs 循环依赖已拆掉（dag_run.rs 现在零引用 execution_kernel）。
• .sentrux/rules.toml 里 max_cycles = 0 是绝对约束（非 ratchet），常驻 CI 的 Tarjan 环检测强制执行，回归会直接挂红。
• ci.yml 两个 job 都有「Authoritative self-scan (release gate parity)」步骤，跑编译产物本体 run execute，非零退出直接 throw（exit 10 = architecture/domain gate failure）。
• Hospital 有独立的 fail-closed contract test（test-hospital-trust-contract.ps1）。

这些看起来是 #15 和 #38-#42 那批 PR 顺手做掉的，没有回来关这张票或更新验收清单状态。

唯一真缺的一块——ai-safety-003（audit --operation validate 没接进任何自动化路径，--operation render 也不强制先 validate）——已经在 PR #45 补上。

v0.6.0（session trace intelligence）/ v0.7.0（viewer）这两段远期 roadmap 没受影响，仍然是真正待办，建议这张票收窄到只track这两段，或者拆成新票、把这张关掉。这个由你定，我不擅自关。