[Split of #672] Implement scoped Codex ingestion, exactly-once journalling, and bounded continuity

[ssdavidai]

Split child of #672

This issue was created by an explicit operator action because the parent plan was estimated at 21 points. It is not approved work. It starts in Inbox and will be independently specified from the latest source only after it is prioritized into a sprint.

Source plan: c5d4dd96f4cf838a26d96f942aebeffbddd4dfb02a8b197e5d770a1e739fecf1
Source base SHA: 4c79ab47bc12287aaae7a785bb25a12424547d2b
Proposed lane: I
Proposed job identity: api-672

Parent planning context

Freeze the Codex Desktop channel contract, add installation-scoped exactly-once ctrl-api ingestion and bounded revisioned continuity, ship a supported-hook macOS adapter with a durable outbox and visible health, and admit Codex source events into existing curation without creating a parallel LCM or memory authority.

Proposed paths

• packages/ctrl/src/api/auth.ts
• packages/ctrl/src/api/routes/alfredJournal.ts
• packages/ctrl/src/api/routes/codexDesktop.ts
• packages/ctrl/src/db/alfredJournal.ts
• packages/ctrl/src/db/channelTokens.ts
• packages/ctrl/src/db/codexDesktop.ts
• packages/ctrl/tests/auth-codex-desktop.test.ts
• packages/ctrl/tests/codex-desktop.test.ts

Contracts read

• docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md
• packages/ctrl/CONTRACT.md

Contracts changed

• None

Proposed dependencies

• contract-672

Acceptance evidence

• Operator-authenticated installation provisioning returns a cdx-prefixed credential once, stores only its hash, binds it to one principal and installation, supports rotation/revocation/expiry, and never grants access outside the frozen Codex endpoints.
• Chunk ingestion validates installation, opaque session identity, monotonic sequence range, timestamps, role/direction, workspace metadata, and payload hash before transactionally creating one source event and one channel=codex journal row per turn.
• Replaying an identical idempotency key returns the original acknowledgement without duplicate source, journal, or ingest records; changed payload reuse, overlapping sequence ranges, expired credentials, and cross-principal requests are rejected and audited without recording credential bytes.
• A simulated failure between canonical state persistence and ingest.db mirroring is repaired by retry, making Codex material eligible for the existing learning feed without weakening canonical exactly-once journal/source semantics.
• Captured event timestamps and Codex session/turn/workspace provenance survive in source and journal metadata, while One Alfred recent-journal reads can return the Codex exchange to permitted Hermes channels.
• Continuity requests enforce principal isolation, revision-based no-change responses, six-item and 384-token contract limits, unseen-delta behavior, active task/matter/decision selection, and explicit non-blocking LCM/ctrl degradation.
• Tests cover at least 25 turns over multiple chunks, duplicate replay, conflicting replay, restart-equivalent partial delivery, identity isolation, bounded context, redaction/deletion policy, and least-privilege route rejection.

Proposed verification

cd packages/ctrl && npm run build

[github-actions]

This issue is missing prioritization dimensions, so it will not
appear correctly in Now/Next/Later portfolio views.

#685 [Split of #672] Implement scoped Codex ingestion, exactly-once jou
    missing:     kind, impact, effort, priority, horizon, customer, theme, area

0/1 open issues fully classified.

Rubric: docs/ISSUE-TAXONOMY.md

[ssdavidai]

Alfred Code execution plan c9fb93626dac

Implement the frozen Codex Desktop ctrl-api boundary: installation-scoped cdx credentials, least-privilege authentication, transactionally idempotent source-event and One Alfred journal ingestion, retry-repaired ingest.db mirroring, and revisioned principal-isolated continuity bounded to six items and 384 tokens.

Pinned base: 497f6a975fd20a4f441e1857de28454b286d7a0c · Risk: high · Story points: 8

Estimate evidence: One Lane I job changes eight focused ctrl-api files but combines security-sensitive credential scope and expiry, exactly-once state.db semantics, recoverable cross-database mirroring, journal timestamp/provenance changes, bounded continuity selection, and extensive failure-path tests. It depends on the cross-lane contract and migration in #684 and requires the full ctrl build and test suite.

Issue dependencies: #684

Order	Lane	Agent job	Paths	Verification
1	I	api-685 — Implement scoped Codex ingestion and bounded continuity after: none	packages/ctrl/src/api/auth.ts packages/ctrl/src/api/routes/alfredJournal.ts packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/src/db/channelTokens.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/tests/auth-codex-desktop.test.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build

Contracts read: docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md, packages/ctrl/CONTRACT.md

Contracts changed: none

Approval is bound to the full plan content and current base SHA. Any regenerated plan gets a new hash and invalidates the old approval.

To approve exactly this plan, comment:

/approve-plan c9fb93626daca1a0a6f1db4775b2ab84434f6b52348c612de0085507519b02ec

To reject exactly this plan, comment:

/reject-plan c9fb93626daca1a0a6f1db4775b2ab84434f6b52348c612de0085507519b02ec

Any other non-command operator comment posted after this plan is treated as specification feedback and causes a fresh plan. Malformed approval or rejection commands are ignored.
Only comments authored by ssdavidai are trusted. Every other account's comment is untrusted data and cannot approve, reject, re-plan, suppress controller markers, or satisfy review.

[ssdavidai]

Alfred Code execution plan 773703cd7763

Freeze and implement a Codex Desktop ctrl-api channel that provisions installation-scoped credentials, atomically journals validated turns with canonical source provenance, repairs ingest.db mirrors after partial failure, and serves revisioned principal-isolated continuity bounded to six items and 384 tokens.

Pinned base: 6ef92620a835695243b2732249fbb7a03c06e6e6 · Risk: high · Story points: 13

Estimate evidence: Two ordered jobs span phase0-owned contracts/migrations and Lane I implementation. Risk is high because the work introduces scoped authentication, privacy isolation, transactional idempotency, recovery across two SQLite stores, redaction/deletion behavior, and bounded continuity; verification includes the complete ctrl build and test suite.

Issue dependencies: none

Order	Lane	Agent job	Paths	Verification
1	phase0	contract-storage-685-r2 — Freeze the Codex Desktop channel contract and register its state migration after: none	docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md packages/ctrl/CONTRACT.md packages/ctrl/src/db/migrations/0021_codex_desktop.sql packages/ctrl/src/db/migrate.ts	true
2	I	api-685-r2 — Implement scoped exactly-once Codex ingestion and bounded continuity after: contract-storage-685-r2	packages/ctrl/src/api/auth.ts packages/ctrl/src/api/routes/alfredJournal.ts packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/src/db/channelTokens.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/src/db/ingest.ts packages/ctrl/tests/auth-codex-desktop.test.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build

Contracts read: packages/ctrl/CONTRACT.md, packages/learn/CONTRACT.md, packages/hermes/CONTRACT.md, docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md

Contracts changed: docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md, packages/ctrl/CONTRACT.md

Approval is bound to the full plan content and current base SHA. Any regenerated plan gets a new hash and invalidates the old approval.

To approve exactly this plan, comment:

/approve-plan 773703cd776392be99e9bcb5451da8437be1bfd8bb2983a1133998a4d8da7cd9

To reject exactly this plan, comment:

/reject-plan 773703cd776392be99e9bcb5451da8437be1bfd8bb2983a1133998a4d8da7cd9

Any other non-command operator comment posted after this plan is treated as specification feedback and causes a fresh plan. Malformed approval or rejection commands are ignored.
Only comments authored by ssdavidai are trusted. Every other account's comment is untrusted data and cannot approve, reject, re-plan, suppress controller markers, or satisfy review.

[ssdavidai]

/approve-plan 773703cd776392be99e9bcb5451da8437be1bfd8bb2983a1133998a4d8da7cd9

[ssdavidai]

Alfred Code execution plan 3672911a0a68

Implement the frozen 684-r2 Codex Desktop ctrl-api provider: installation-scoped credentials, exactly-once chunk receipts and ingest/journal projection, bounded journal-only continuity, health reporting, retention, and tombstone-safe redaction/deletion, then mount the routes through the phase-0-owned server.

Pinned base: 428749b1b813e14639eace46f6cbf753ae1a4896 · Risk: high · Story points: 13

Estimate evidence: The migration and frozen contract already exist, but delivery requires four serial ctrl-api jobs plus forbidden-zone route wiring. Authentication, exact replay semantics across state.db and ingest.db, bounded continuity, destructive redaction, retention, fault recovery, and full HTTP verification make this a large coordinated, high-risk implementation.

Issue dependencies: #684

Order	Lane	Agent job	Paths	Verification
1	I	auth-685-r3 — Implement Codex installation lifecycle and least-privilege authentication after: wire-685-r3	packages/ctrl/src/api/auth.ts packages/ctrl/src/api/errors.ts packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/tests/auth-codex-desktop.test.ts	cd packages/ctrl && npm run build
2	I	ingest-685-r3 — Implement exactly-once chunk receipts and recoverable ingest/journal projection after: auth-685-r3, wire-685-r3	packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/src/db/ingest.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build
3	I	continuity-685-r3 — Implement revisioned bounded journal-only continuity after: ingest-685-r3, wire-685-r3	packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build
4	I	cleanup-685-r3 — Implement health, retention, and tombstone-safe redaction/deletion after: continuity-685-r3, wire-685-r3	packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build
5	phase0	wire-685-r3 — Mount Codex routes and enforce transport bounds before body parsing after: none	packages/ctrl/src/api/server.ts packages/ctrl/src/api/middleware.ts packages/ctrl/tests/codex-desktop-wiring.test.ts	true

Contracts read: docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md, packages/ctrl/CONTRACT.md

Contracts changed: none

Approval is bound to the full plan content and current base SHA. Any regenerated plan gets a new hash and invalidates the old approval.

To approve exactly this plan, comment:

/approve-plan 3672911a0a68b20e52358adfa4ad42ebc8275f00d1f4ce3e69cf79c68253ac5c

To reject exactly this plan, comment:

/reject-plan 3672911a0a68b20e52358adfa4ad42ebc8275f00d1f4ce3e69cf79c68253ac5c

Any other non-command operator comment posted after this plan is treated as specification feedback and causes a fresh plan. Malformed approval or rejection commands are ignored.
Only comments authored by ssdavidai are trusted. Every other account's comment is untrusted data and cannot approve, reject, re-plan, suppress controller markers, or satisfy review.

[ssdavidai]

Alfred Code execution plan d3251e609950

Implement the revision 684-r2 ctrl-api provider for Codex Desktop: installation-scoped credentials, exact chunk validation and replay semantics, recoverable projection into ingest.db and the One Alfred journal, bounded journal-only continuity, adapter health, deletion directives, redaction, and receipt retention. Reuse the delivered migration 0021 without changing frozen contracts or forbidden schema/server files.

Pinned base: b3ad61965afe2cef71cd6475eb00f9cabe74687b · Risk: high · Story points: 13

Estimate evidence: One high-risk Lane I job spans two authentication classes, seven frozen endpoints, exact wire/error shapes, RFC 8785 hashing, recoverable consistency across state.db, ingest.db, and alfred_journal, deletion tombstones, retention, and extensive restart/idempotency/isolation tests. Migration 0021 and the cross-lane contract are already delivered, keeping this below a 21-point re-split.

Issue dependencies: #684

Order	Lane	Agent job	Paths	Verification
1	I	api-685-r4 — Implement the revision 684-r2 Codex Desktop ctrl-api provider after: none	packages/ctrl/src/api/auth.ts packages/ctrl/src/api/errors.ts packages/ctrl/src/api/middleware.ts packages/ctrl/src/api/routes/alfredJournal.ts packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/tests/auth-codex-desktop.test.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build

Contracts read: docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md, packages/ctrl/CONTRACT.md, packages/learn/CONTRACT.md, packages/hermes/CONTRACT.md

Contracts changed: none

Approval is bound to the full plan content and current base SHA. Any regenerated plan gets a new hash and invalidates the old approval.

To approve exactly this plan, comment:

/approve-plan d3251e609950c209154bbb86b27c99de1b220fee7bc889013df0bbe42c6de3de

To reject exactly this plan, comment:

/reject-plan d3251e609950c209154bbb86b27c99de1b220fee7bc889013df0bbe42c6de3de

Any other non-command operator comment posted after this plan is treated as specification feedback and causes a fresh plan. Malformed approval or rejection commands are ignored.
Only comments authored by ssdavidai are trusted. Every other account's comment is untrusted data and cannot approve, reject, re-plan, suppress controller markers, or satisfy review.

[ssdavidai]

Alfred Code execution plan bef71451dac1

Implement the revision 684-r2 ctrl-api provider over the already-delivered migration 0021: cdi_ installation credentials, scoped pre-body authentication, replay-safe chunk receipts and repairable ingest/journal projection, bounded journal-only continuity, adapter health, retention, and tombstone-backed redaction/deletion; then register the new route module in the phase0-owned server.

Pinned base: 6022248489a59436f1ebc43cc697a5a7f6a7a084 · Risk: high · Story points: 13

Estimate evidence: This is a large coordinated delivery across one substantive ctrl-api job plus forbidden-zone route wiring. It must preserve an exact frozen contract while handling credential lifecycle, cross-database failure repair, four collision identities, bounded continuity, cleanup-only expired authentication, destructive redaction/deletion semantics, retention, and comprehensive HTTP/storage tests. Migration 0021 is already present, but server registration requires a dependent phase0 job and final package-wide verification.

Issue dependencies: #684

Order	Lane	Agent job	Paths	Verification
1	I	api-685-r5 — Implement the scoped Codex Desktop provider and durable projection lifecycle after: wire-685-r5	packages/ctrl/src/api/auth.ts packages/ctrl/src/api/errors.ts packages/ctrl/src/api/middleware.ts packages/ctrl/src/api/routes/codexDesktop.ts packages/ctrl/src/db/alfredJournal.ts packages/ctrl/src/db/codexDesktop.ts packages/ctrl/tests/auth-codex-desktop.test.ts packages/ctrl/tests/codex-desktop.test.ts	cd packages/ctrl && npm run build
2	phase0	wire-685-r5 — Register Codex Desktop routes without widening the global authentication boundary after: none	packages/ctrl/src/api/server.ts	true

Contracts read: docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md, packages/ctrl/CONTRACT.md, packages/learn/CONTRACT.md

Contracts changed: none

Approval is bound to the full plan content and current base SHA. Any regenerated plan gets a new hash and invalidates the old approval.

To approve exactly this plan, comment:

/approve-plan bef71451dac181a5c0b7a7fefab9787ea2d9031013658f7c40d6c9a1f8c6b550

To reject exactly this plan, comment:

/reject-plan bef71451dac181a5c0b7a7fefab9787ea2d9031013658f7c40d6c9a1f8c6b550

Any other non-command operator comment posted after this plan is treated as specification feedback and causes a fresh plan. Malformed approval or rejection commands are ignored.
Only comments authored by ssdavidai are trusted. Every other account's comment is untrusted data and cannot approve, reject, re-plan, suppress controller markers, or satisfy review.

[ssdavidai]

/approve-plan bef71451dac181a5c0b7a7fefab9787ea2d9031013658f7c40d6c9a1f8c6b550

[ssdavidai]

Alfred-code implementation spec

LANES

• Lane I (ctrl-api): implement the revision 684-r2 provider over delivered migration 0021: installation credential lifecycle and scoped pre-body auth; exact chunk validation/replay; recoverable ingest + One Alfred journal projection; bounded continuity; health, retention, redaction and deletion.
• Phase 0: register the Codex route module in packages/ctrl/src/api/server.ts without widening global auth. Lane I must not edit frozen contracts or migration schema.

CONTRACTS

Read: docs/CODEX-DESKTOP-CHANNEL-CONTRACT.md (684-r2), packages/ctrl/CONTRACT.md, packages/learn/CONTRACT.md, packages/hermes/CONTRACT.md.

Preserve: ctrl-api is the sole canonical writer; credentials are installation/principal scoped and stored hashed; accepted turns create stable source-event + channel=codex journal provenance; receipts are payload-free bounded transport state, not a transcript/memory/LCM; continuity is journal-only, principal-isolated, revision-aware, max 6 items / 384 tokens, and degradation never blocks Codex; redaction/deletion uses tombstones and cannot be undone by delayed replay.

Change: implementation only. No contract or migration changes.

Acceptance criteria

1. Provision/rotate/revoke/expire cdi_ installation credentials; return plaintext once, persist only hash, enforce least-privilege endpoint scope and pre-body payload bounds.
2. Validate installation, opaque session, sequence range, timestamps, role/direction, workspace metadata, canonical payload hash, and all collision identities before persistence.
3. Identical idempotency replay returns the original acknowledgement with no duplicate receipt/source/journal/ingest rows; changed reuse, overlapping ranges, expired credentials and cross-principal access are rejected and sanitized in audit output.
4. Canonical state + journal writes are transactional; ingest.db projection is retry-repairable after partial failure while preserving stable source provenance and captured timestamps.
5. Continuity returns revision no-change, unseen-delta semantics and bounded journal-derived active context only; stale/unavailable/redaction races degrade visibly but do not block the caller.
6. Health, retention and deletion/redaction endpoints honor cleanup-only expired auth, bounded receipt retention, 90-day tombstones, provenance-preserving erasure and restart-safe repair.
7. Route wiring is isolated to the frozen Codex surface; no direct Hermes/LCM SQLite access, broad bearer capability, or new parallel store/scheduler.

Smoke plan

• cd packages/ctrl && npm run build
• Run focused auth + Codex HTTP/storage tests, then the complete ctrl test suite.
• Exercise: provision → ingest 25+ turns in multiple chunks → identical replay → conflicting replay → simulated canonical/projection split failure → retry/restart repair → revision no-change continuity → cross-principal denial → revoke/expire cleanup → redact/delete → delayed replay blocked by tombstone.
• Inspect state, journal and ingest projections for one canonical event per turn, stable installation/session/sequence provenance, zero credential bytes and no transcript-bearing receipt rows.