Implement daily coding surfaces: rewind, non-Git snapshots, rules/context and structured I/O #93

Scheduling update, 2026-11-03: the user requested moving to #93 after merging #105. This supersedes the previous workstream ordering; #92 remains open and its incomplete guarantees must not be assumed by daily-coding integrations.

Implement the remaining approved daily coding workstream from PR #53. At the original main baseline 6099e1327a79f32ed33fd5f418f1123f5ed0bded, the plan was approved but implementation had not started. Implementation began from a6165c18 on 2026-11-03. Begin from current main with the approved daily-coding plan. Record unresolved cross-workstream dependencies explicitly.

Proposal · Design · Authoritative task list.

Scope: CLI/TUI rewind and undo/redo; private non-Git snapshots and recoverable restore; path-scoped rules and /context; top-level structured output; streaming JSONL input. Preserve existing Git behavior, permission ceilings, durable retry/unknown-effect evidence and compatibility.

Implementation progress

PR #107 is merged at d3c27330 with all 19 CI checks green. It implements reviewed CLI/server rewind with explicit fingerprint confirmation, fresh Session/Location/snapshot checks, actual three-way patches, unrelated-edit preservation and inactive branches.

PR #108, merged at cf392c83, implements TUI /rewind, idle Esc-Esc and reviewed staged /undo//redo. It includes explicit busy interruption, guarded composer restoration, scope/generation fencing, durable changed-path ownership for repeated stages/clear, generated API/SDK updates, synchronized guides and real terminal screenshots. All 19 checks passed on reviewed head 06871acd before merge. No review threads or blocking comments remained.

Local validation: 642 TUI tests passed (three ignored); all eight focused rewind tests passed after final corrections; four server ownership tests and 12 real Git snapshot tests passed. Workspace all-target Clippy, OpenAPI/SDK consistency, SDK typecheck/128 tests (ten configured external skips), formatting and diff checks passed. Strict OpenSpec passed 114 items; lint reported zero errors and 25 warnings. The substantive code-review pass resolved unrelated-file adoption and typed-command attachment-consumption risks. No external model provider was used; Linux, macOS and Windows CI passed; broader native recovery acceptance remains open.

Task 2.3 is implemented and merged in #108. This does not complete full workstream acceptance. Broader native interrupt/crash/restart acceptance, historical exclusions and restore journaling remain open under 2.4. Then continue private non-Git snapshots, path rules/context, root structured output and JSONL input. Original composer drafts are bounded in-memory text, not persistent media recovery. #92 remains unfinished and #94's owner-closed status is preserved.

Recovery acceptance follow-up

PR #109, merged at 3dac1557 after all 16 checks passed on reviewed head e459fe29, adds real CLI kill/reload/restage/clear cases for code/both, conversation continuation/export outside Git, snapshots-disabled clear, and busy/interruption stale-confirmation refusal. A fresh TUI App checks preservation of its new draft while clearing a retained stage. The instrumented unknown-native test now reloads a Runtime and checks that subtree stop retains unknown evidence and closes admission without replaying restore. Windows CI explicitly selects the new CLI recovery cases and server ownership suite.

Local macOS verification: eight real CLI/server scenarios, four server ownership tests and nine focused TUI tests passed. CLI/server/TUI all-target Clippy, formatting, diff checks, SDK generation consistency and strict OpenSpec validation passed (114 items; lint zero errors/25 warnings). Unchanged main cf392c83 passed the four original CLI scenarios and four server ownership tests. Linux/macOS/Windows CI passed. No review comments or unresolved threads remained at merge; no goal implementation PR remains open.

Task 2.4 remains open for native partial-replacement crash cuts and complete journal/recovery acceptance. Unknown-native evidence here uses an instrumented host; it does not prove a killed native replacement. Next implementation: the approved private non-Git backend and recovery journal needed to exercise those remaining cuts. #93 remains open.

Non-Git snapshot implementation follow-up

Integration update: PR #110 now includes main 913fe1b0 and merged #111's Ctrl+R history search. The old head's Linux directory-sync failure is corrected by reopening pinned O_PATH directories for I/O; a native Linux regression was added. Bounded short lock acquisition handles handoffs/interruption before restore while preserving live-owner exclusion. A combined regression covers history-search cancellation, snapshot warnings, the current draft and Esc-Esc rewind. All targeted local checks and workspace Clippy passed; strict OpenSpec now passes 115 items (lint 0 errors/25 warnings). Ten repeated parallel file-copy suites also passed. Fresh platform CI is required on 91756950; old-head checks do not accept the update. No new goal PR was opened.

PR #110 is a draft at 91756950; it has not merged. It adds private BLAKE3 snapshots for admitted Linux/macOS non-Git Locations, reviewed three-way restore, retained native intents/displaced preimages, historical exclusion disclosure, cap warnings that preserve conversation success, reference-aware retention and authenticated read-only recovery inspection. README, roadmap, guides, OpenSpec, API/SDK and terminal screenshots are updated together. This is the only open goal implementation PR.

Task 3.1 is implemented in that PR. Tasks 2.4 and 3.2–3.4 remain open: managed keep/rollback resolution, native receipt acknowledgement and journal reclamation are not implemented; Git restore journaling, complete historical Git exclusions and broader native crash/platform acceptance remain unfinished. Interrupted file-copy journals retain evidence and block replay. Windows file-copy writes remain explicitly unavailable. No retained evidence should be removed to force retry.

Local macOS verification: 17 file-copy tests, 12 existing Git snapshot tests, 11 real CLI scenarios (serialized fixtures), 10 focused TUI tests, four server tests and the OpenAPI artifact check passed. SDK generation consistency/typecheck and 128 tests passed (10 configured external skips), as did workspace all-target Clippy with warnings denied, formatting/diff checks and strict OpenSpec validation (114 items; lint 0 errors/25 warnings). Screenshots were recaptured and visually inspected. The initial parallel CLI run stalled before first prompt admission and was terminated; the complete serialized rerun passed. Native C/linker warnings were observed. PR platform CI is pending, including the new Linux x64/ARM and macOS Intel/ARM snapshot proof matrix and the explicit Windows unsupported-case test.

The next recovery increment must provide managed resolution and safe acknowledgement/reclamation before claiming the non-Git workstream complete. Path rules/context, root structured output and JSONL remain after that. #92 remains unfinished and #94's owner-closed status is preserved; #93 stays open.

Recovery and daily-coding continuation

The user requested implementation of managed recovery/snapshots and the remaining daily-coding surfaces. PR #114 merged at db9e171e after all 23 checks passed on reviewed head 22a01c95. No goal implementation PR remains open. It implements immutable Location-bound Git exclusion history, protects newly ignored owner files from deletion/restore, retains legacy compatibility with explicit unknown history, compacts ignored build directories and expands native Windows Git snapshot coverage. New Git refs retain tree and metadata together; safe reference/lease-aware reclamation remains unfinished.

The concrete managed-recovery protocol is proposed for the user-required security/data-model design review before recovery admission changes: reviewed keep/rollback, exact worker/native acknowledgement, retained legacy unknown fences, lost-reply reconciliation and two-phase cleanup. It is not implemented by this PR. Rules/context, root structured output and JSONL retain their approved scope and remain unfinished.

Local macOS verification passed: two storage cases, 17 file-copy cases, 17 Git cases, all 11 real CLI branch/recovery scenarios, 11 focused TUI rewind cases, workspace all-target Clippy, final snapshot tests/package Clippy after review corrections, formatting/diff checks, SDK generation consistency, roadmap inventory and strict OpenSpec (117 items; lint 0 errors/25 warnings). All 23 current-head CI checks passed before merging, including native snapshot proof and Windows Git coverage. The issue timeline identifies PR #110 as the automatic closer; its ambiguous negated closing-keyword text has been corrected and #93 reopened for the remaining work. The owner's closed #94 is unchanged.

Remaining tasks

• 1.4 Record the revised user-approved priority, establish relevant unchanged-main baseline checks and current clause coverage, and retain unresolved Plugins/hooks dependencies without claiming acceptance.

• 2.1 Reconcile Three-phase revert, Rewind targets, Session branches and structured retry wording in canonical specs and overlapping deltas without deleting historical recovery evidence.

• 2.2 Add typed CLI rewind and server preview/revalidation/confirmation using existing owned revert operations; regenerate command docs and API/SDK where needed.

• 2.3 Implement TUI rewind menu, Esc-Esc, /undo and /redo, composer restoration, explicit busy interruption, conflict/exclusion/effect preview and stale-context fencing.

• 2.4 Test code/conversation/both, snapshots disabled, inactive branches/export, external edits, busy/interrupt races, restage/clear/restart and retained unknown-effect evidence through actual clients.

• 3.1 Add private content-addressed BLAKE3 objects and Location-bound manifests behind the snapshot interface, including ignore/size/metadata reporting and same-size/same-mtime verification.

• 3.2 Implement conflict-aware owned restore and recoverable backups/journal, preserving Git behavior, protected paths, symlink/hardlink safety and interruption evidence.

• 3.3 Integrate 200 MiB cap, visible unavailable/overflow state, reference-aware retention and staged/branch/recovery protections.

• 3.4 Test real non-git editing/restoration, limits, deletes/renames, unsupported files, concurrent Session/editor changes, crashes and native filesystem privacy.

• 4.1 Implement trusted path-scoped rule discovery/precedence, validated globs, overrides and bounded instruction assembly without changing instructions array compatibility.

• 4.2 Bind reminder delivery to successful authorized operations and Context Epoch identity, including edits/patches, partial settlements, compaction/restart and changed/revoked rules.

• 4.3 Add authenticated read-only context inspection and /context, source estimates/origins/status/pending updates and honest utilization; synchronize OpenAPI/SDK and doctor diagnostics.

• 4.4 Test no rule leakage across Location/Epoch, denied/failed calls, truncation, untrusted sources, stale response and token-count consistency with actual request assembly.

• 5.1 Add validated per-prompt root format admission, bounded schema compilation and durable schema/attempt ownership without changing existing child contracts.

• 5.2 Add structured_output finalization, two correction retries, budget/interrupt handling and durable successful/error result settlement.

• 5.3 Add --output-schema, API/SDK result fields and text/JSON/stream rendering; preserve unstructured commands and validate option combinations before admission.

• 5.4 Test valid/invalid schemas, malformed results, retry exhaustion, missing finalizer, compaction, restart/retry identity, budget exits and independent queued prompts with a real server/scripted provider.

• 6.1 Define typed version-2 envelopes, correlation, resource bounds, aggregate exit rules and driver-owned interactive request lifetime; document compatibility and unsupported combinations.

• 6.2 Implement concurrent bounded parsing/admission and exact owned permission/question replies, retained request lookup, interrupt and end/EOF draining without stopping unrelated work.

• 6.3 Emit per-input results, optional partial/hook events and atomic last-message output with bounded backpressure and secret-safe errors.

• 6.4 Test multiple inputs, steering/queueing, malformed/oversized input, capacity, stale/cross-request replies, EOF while awaiting input, slow stdout, SIGINT, server restart and lost admission acknowledgement.

• 7.1 Update guides, roadmap/feature evidence, original task lists and generated API/SDK/CLI artifacts for actual delivered behavior.

• 7.2 Run affected Rust tests, format/Clippy, SDK typecheck/tests, TUI/real-binary acceptance, strict OpenSpec/lint and relevant native/platform CI. Record skips and unperformed external checks explicitly.

• 7.3 Use the code-review skill for substantive review, address findings and deliver reviewable PRs. Merge only when authorized; archive after accepted merge and overlap reconciliation.

• 7.4 Verify all approved first- and second-workstream outcomes against evidence before marking the combined goal complete.

Completion evidence

Verify actual CLI/TUI/server/provider behavior, not just helper tests. Include relevant native/platform tests, generated API/SDK/command artifacts, strict OpenSpec/lint, substantive review and accepted PRs. Document unsupported/skipped cases honestly. This workstream alone does not complete the full goal; the binary editor remains separate.

Track the remaining approved implementation scope, not a new scope proposal. Current priority is daily coding; plugins/hooks and remaining binary integration/acceptance retain their unfinished scope. Normally keep one implementation PR open (maximum two for independently reviewable work); merge ready PRs only under the existing user authorization with current-head CI and review. Preserve meaningful regressions, generated artifacts, documentation, substantive code/security review, and explicit native/design gates. Green probes, universal refusal, or a merged specification do not prove production completion.

Related workstreams

hooks: #92 · binary: #94