[WIP] Plan TraceDecay V2 brain rewrite

[ScriptedAlchemy]

WIP: plan only

This PR contains only the TraceDecay V2 total-rewrite design: one canonical master plan plus 27 linked subsystem/crate plans (28 documentation files). It deliberately contains no implementation.

Unified product and architecture

• Rebuild TraceDecay as one coherent, profile-wide system across projects, repositories, worktrees, branches, threads, turns, agents, workflows, tools, artifacts, code, Git, facts, memories, tasks, plans, and time.
• Make an immutable observation/event stream the write authority; derive versioned projections, graph/read models, search indexes, analytics, hints, and UI views through fenced, replayable projectors with checkpoints, dead letters, repair, and provenance.
• Replace ambiguous project-only identity and split stores with canonical profile/project/repository/worktree/session/message/agent/task/artifact/code identities, explicit source bindings, variant safety, temporal validity, and protected consolidation/quarantine workflows.
• Define crate ownership, dependency/release DAGs, anti-corruption boundaries, migration gates, deletion gates, and a shared presentation layer so the rewrite converges instead of recreating fragmented subsystems.

Product surfaces

• Replace the project-only dashboard with an All / Brain workspace plus project lenses; interactive Git, code, thread, turn, agent, task, plan, memory, impact, and timeline graphs; reasoning/code/artifact lineage; Work/Resume task views; and a powerful temporal explorer.
• Add replay/debug labs for search, LCM, facts/memory, hooks, hints, redaction, curation, automation, scheduling, and configuration with current-versus-historical policy comparisons and reproducible receipts.
• Port and redesign the Hermes Kanban concept as a native TraceDecay task/plan graph—not an adapter—with multi-board/multi-project views, DAG dependencies, model/effort routing, executor/provider SPI, offers/admission, leases, capability grants, reservations, work packets, nearby-agent awareness, and duplicate/conflict prevention.
• Make autonomous curation, memory/skill evolution, optional near-real-time model-assisted context scouting, compact suggestion envelopes, dynamic hint arbitration, and replay-measured precision first-class.

Search, APIs, CLI, and MCP

• Redesign hybrid lexical/vector/graph/temporal retrieval, supersession-aware ranking, contextual anchors/retrieval IDs, cross-project scope, explainability, qrels/judgment workflows, and evaluation against real local sessions across repositories.
• Publish one typed application contract through an official HTTP API, SDKs, CLI, MCP, dashboard, and executor integrations; eliminate surface-specific business logic and inconsistent output schemas.
• Redesign MCP as a first-class protocol surface: generated task catalog, lifecycle/capability negotiation, tools/resources/templates/prompts/completion, structured content and resource links, subscriptions/list-change notifications, progress/cancellation, roots, sampling/elicitation policy, auth, stdio and Streamable HTTP transports, official Rust SDK integration, and host conformance suites.
• Centralize typed view models and markdown/JSON renderers so CLI/MCP/API output, errors, pagination, missing-registry states, project labels, and machine-readable envelopes remain consistent.

Privacy and control plane

• Add ingest-time, retrieval-time, export-time, and presentation-time secret detection/redaction with policy versions, sensitivity labels, grants, audit receipts, protected quarantine, and leak-regression tests.
• Put all configuration—including redaction, retention, providers/models, hints, hooks, search, automation, executors, task routing, and sharing—in a versioned control plane available through UI, CLI, API, and MCP.
• Preserve fully autonomous curation semantics; there is no generic preview/apply/rollback proposal queue. Inspection, policy controls, outcome history, recovery, and protected reversible domain operations remain explicit.

Accepted-base reconciliation

• Rebased on master at 273f50c0372f063b97f4755563a3ded65ef324d5 (chore: release v0.0.53 (#437)).
• Incorporates all accepted changes through fix(doctor): isolate registry diff conflicts #440, including fix(storage): add explicit split-store consolidation #425 split-store consolidation semantics and the fix(doctor): derive orphan stores from registry reconstruction #439/fix(doctor): isolate registry diff conflicts #440 registry-reconstruction truth and per-manifest conflict isolation.
• At the final publication refresh, draft PR [WIP] Plan TraceDecay V2 brain rewrite #421 was the only open PR; every merged/open input is recorded with commit/PR provenance and execution-time refresh gates.
• Includes a Hermes heritage ledger requirement: pinned source/test/UI spans, license/provenance, direct-port versus behavioral-port versus redesign/drop decisions, destination owners, implementation PRs, and source-to-regression-test mapping.

Evidence and privacy

• Planning used TraceDecay LCM/session/message/fact/code/Git/analytics/diagnostic/automation surfaces, raw-provider fallbacks when supported tools failed, merged PR evidence, several independent subagent audits, and primary-source/web/arXiv research.
• Private chronological exports remain outside Git under /fast/tracedecay-redesign-research (0700; files 0600): 34,344 discovered role-user records and a 9,980-record best-effort human-authored subset through 2026-07-10T20:26:39.847Z.
• Retained sanitized-content SHA-256: broad edfe67d6baf9fd87faa9fd49c443a777bbb838c3eb36a79106c06f18a161baff; human 5afb40d25f3fc43b86d620b25daea94a0b4f33ffc4421b5bb20b6a550b8c3bcb.
• No transcript, database, generated fixture, or secret-bearing research artifact is committed or indexed by this PR.
• TraceDecay's own final CLI failures are retained as product evidence: contradictory daemon freshness/sync state, ANSI-heavy output under TERM=dumb/NO_COLOR, and Git commit_context aborting on an optional corrupt test-annotation store instead of returning partial Git context (FM-115–FM-117).

Validation

• 28/28 intended plan files and no other changed paths.
• Internal links/anchors valid; Markdown fences balanced; no placeholders or unresolved plan references.
• Failure modes FM-001 through FM-117 are contiguous and unique.
• 845 public contract declarations checked with zero incompatible duplicate definitions.
• Corpus ordering, deduplication, identities, timestamps, retained-content hashes, and redacted-mirror equality validated.
• git diff --check, direct plan secret scan, private-corpus secret scan, and origin/master..HEAD history scan pass with zero findings.

Draft/WIP remains intentional until the plan is reviewed as one flowing architecture.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2c51643

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 986f25cca6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Schedule the catalog before generated-metadata consumers

When the Phase 3 ladder is followed literally, this schedules PR 22F–22H before PR 22A even though the 22F–22H checklist requires plan 08's generated SurfaceKind everywhere. PR 22A is the step that creates the generated capability/tool catalog and its surface/availability artifacts, so the accounting/adoption work either blocks or has to invent duplicate local surface metadata; move 22A ahead of the first generated-catalog consumer or split the dependent 22H work after it.

Useful? React with 👍 / 👎.