Add durable Session provenance and safe workspace indexes

[luokerenx4]

What changed

• add a versioned, append-only artifact provenance store and migration
• record authoritative Inbox and Issue create/update/comment attribution
• expose safe Inbox origins with legacy resumeId backfill
• project Issue runs through an explicit whitelist and keep native runtime session ids backend-only
• make issue show compact by default, with --mode detailed for full prompts
• add alice-workspace peer sessions as a safe Workspace Session directory keyed by product resumeId
• document the Phase 1 trail/index contract and agent-facing usage

Why

Cross-Session follow-up needs a durable answer to “which product Session produced this?” before collaboration can safely resume or recruit an agent. Existing Issue and Inbox views either omitted this identity or exposed backend-native fields, and Issue CLI output repeated large prompts per run.

Impact

Agents and UI consumers can now trace Inbox/Issue activity to OpenAlice-owned resumeId handles without learning Codex/Pi/Claude native session ids. Missing provenance remains explicit; the Session directory is an audit/addressing surface and does not guess an owner.

Validation

• pnpm test — 217 files passed, 2548 tests passed, 6 skipped
• pnpm build
• npx tsc --noEmit
• live /cli verification against the dev service: peer sessions returned real Codex/Claude/Pi histories with no native ids
• live Issue verification: default output dropped from about 21 KB to 7 KB, retained every resumeId, omitted repeated prompts, and contained no agentSessionId

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openalice-demo	Ready	Preview, Comment	Jul 11, 2026 2:06pm