{
  "schema_version": "0.1",
  "artifact_type": "implementation_plan",
  "canonical": true,
  "artifact_id": "IMP-015",
  "agent_summary": {
    "title": "Configurable ordered Reason Guard history backfill",
    "status": "complete",
    "summary": "Add a cursor-backed visible-summary ingestion path with recent-20 as the default, optional live-only and full-history modes, exactly-once ordered processing, truthful coverage, aggregate telemetry, and no access to private reasoning.",
    "last_reviewed_at": "2026-07-25",
    "load_notes": "The user approved implementation and then set the default to the most recent 20 visible summaries. This plan extends the existing local deterministic Reason Guard kernel; it does not add a service, model, embedding index, dependency, daemon, or GPU path."
  },
  "source_ids": [
    "REQ-175",
    "REQ-174",
    "PRD-011",
    "ARCH-011",
    "WFR-438"
  ],
  "approval_gate": {
    "status": "approved",
    "implementation_authorized": true,
    "approved_at": "2026-07-25",
    "approved_by": "user"
  },
  "scope": {
    "included": [
      "Configurable live, recent, and full visible-summary startup modes",
      "Default recent backfill of 20 summaries",
      "Append-only byte cursor and bounded summary digest replay protection",
      "Oldest-to-newest processing of every unseen complete JSONL record",
      "Fail-safe handling of torn, replaced, missing, or truncated rollouts",
      "Coverage, telemetry, status, UI guidance, downstream template parity, documentation, and release metadata"
    ],
    "excluded": [
      "Private reasoning, encrypted reasoning, prompts, or arbitrary transcript content",
      "Semantic models, embeddings, RAG, new services, daemons, GPU work, or synchronous network calls",
      "Edits to downstream repositories"
    ]
  },
  "assumptions": [
    "Codex visible summaries remain response_item reasoning records containing summary_text entries in trusted session JSONL.",
    "A rollout is append-only during a stable session; replacement or shrinkage invalidates coverage and must fail safe.",
    "The existing report-only default enforcement mode remains unchanged."
  ],
  "phases": [
    {
      "id": "IMP-PHASE-047",
      "title": "Bounded historical ingestion and release",
      "complexity": "medium",
      "confidence": "high",
      "risk": "medium",
      "tasks": [
        {
          "id": "IMP-TASK-116",
          "summary": "RED: extend existing Reason Guard and configuration/UI coverage to prove last-X, full-history beyond the old tail bound, live-following, recent-20 defaults, ordered exactly-once replay, private-content exclusion, torn-tail retry, and shrink fail-safe behavior. GREEN: add the smallest cursor-and-digest ingestion ledger to the existing hook; mirror it into the shipped skeleton; expose configuration, status, guidance, truthful coverage, and aggregate telemetry; update operator and wiki documentation; bump and ship the patch release.",
          "status": "complete",
          "complexity": "medium",
          "confidence": "high",
          "risk": "medium",
          "requirement_ids": [
            "REQ-175",
            "PRD-011"
          ],
          "architecture_ids": [
            "ARCH-011"
          ],
          "validation_ids": [
            "IMP-VAL-102"
          ],
          "files": [
            ".prd_plugin/hooks/prd_reason_guard.py",
            "templates/repo-skeleton/.prd_plugin/hooks/prd_reason_guard.py",
            ".prd_plugin/config.json",
            "templates/config.json",
            "templates/repo-skeleton/.prd_plugin/config.json",
            "templates/repo-skeleton/.prd_plugin/templates/config.json",
            "scripts/prd_config.py",
            "scripts/prd_status.py",
            "scripts/prd_ui_export.py",
            "tests/test_reason_guard.py",
            "tests/test_config_toggles.py",
            "tests/test_prd_ui_export.py",
            "docs/REASONING-GUARD.md",
            "wiki/hooks/reasoning-guard.md"
          ],
          "red_command": "python -m unittest tests.test_reason_guard tests.test_config_toggles tests.test_prd_ui_export -q",
          "green_command": "python -m unittest tests.test_reason_guard tests.test_config_toggles tests.test_prd_ui_export tests.test_reason_guard_benchmark -q",
          "broader_verification": "python -m unittest discover -s tests -p \"test_*.py\"",
          "expected_updates": [
            "EV-* verification and publication evidence",
            "CHG-* implementation and release changelog",
            "REQ-175 implemented",
            "TRK-162 complete"
          ]
        }
      ]
    }
  ],
  "dependencies": [
    "Existing Reason Guard trusted Codex rollout path validation",
    "Existing local state lock and atomic report write",
    "Existing unified configuration, status, UI export, installer, and release workflows"
  ],
  "validations": [
    {
      "id": "IMP-VAL-102",
      "summary": "Recent mode defaults to 20 and selects exactly the newest X existing visible summaries; full mode reads all complete visible summaries beyond the former tail bound; live mode starts at the latest existing summary; every mode consumes later complete appended summaries oldest-to-newest exactly once; torn tails retry without cursor loss; replaced or shrunk sources produce reduced coverage; private/encrypted reasoning never enters state or telemetry; source and skeleton hooks are identical; focused, benchmark, full-suite, workflow, state, feature, release, and repeated CHML audits are green before publication.",
      "applies_to": [
        "IMP-TASK-116"
      ],
      "expected_evidence": [
        "Focused red/green test output",
        "Full-suite verification output",
        "Source/template byte-parity check",
        "CHML zero audit",
        "Published registry read-back"
      ]
    }
  ],
  "evidence_plan": [
    "Record one EV-* for behavior, privacy, parity, and full-suite proof.",
    "Record one EV-* for release workflow, tag publication, and registry read-back."
  ],
  "risks_and_rollback": [
    {
      "risk": "Full history can add startup latency on very large rollouts.",
      "mitigation": "Default to recent 20; stream full mode without retaining arbitrary transcript records; expose mode and limitation in status/UI."
    },
    {
      "risk": "A torn or replaced rollout could skip or duplicate a summary.",
      "mitigation": "Advance only across newline-complete records, bind the cursor to a hashed trusted source identity, retain bounded digest replay protection, and reduce coverage on invalidation."
    },
    {
      "risk": "Transcript access could capture private content.",
      "mitigation": "Construct new records from summary_text only and persist only sanitized text needed by the existing guard plus hashes and aggregate counters."
    },
    {
      "rollback": "Revert the patch release; schema migration preserves prior obligations/evidence and the default report mode never makes inferred findings blocking authority."
    }
  ],
  "traceability": {
    "request_ids": [
      "REQ-175",
      "REQ-174"
    ],
    "prd_ids": [
      "PRD-011"
    ],
    "architecture_ids": [
      "ARCH-011"
    ],
    "tracking_ids": [
      "TRK-162"
    ],
    "workflow_ids": [
      "WFR-436",
      "WFR-437",
      "WFR-438",
      "WFR-439",
      "WFR-440",
      "WFR-441",
      "WFR-442"
    ],
    "evidence_ids": [
      "EV-213",
      "EV-214",
      "EV-215"
    ],
    "change_ids": [
      "CHG-140"
    ]
  }
}
