Milestone 13: deterministic run archiving and retention controls #23

Summary

Implement Milestone 13 for ChatCodex: add deterministic run archiving and retention controls so ChatGPT can explicitly archive runs that should remain preserved but no longer appear in the active working set, without introducing backend autonomy.

This milestone builds on the current system, which already includes:

• deterministic Rust protocol/core/daemon
• thin TypeScript MCP gateway
• minimal coding loop
• refresh / replan / approval plumbing
• approval policy hardening
• deterministic retry/resumption guidance
• run history, audit trail, and direct state inspection
• per-run deterministic policy configuration
• deterministic operation preflight / approval preview
• deterministic run finalization and outcome recording
• deterministic run reopening and continuation controls
• deterministic run supersession and replacement lineage
• SQLite-backed persistence with migration support
• milestone-scoped CI

The architecture rule remains absolute:

The only LLM in the stack is ChatGPT.

No backend model calls, no hidden agent loop, and no coarse autonomous tools may be introduced.

Why this milestone

The control plane can now finalize, reopen, and supersede runs, but it still lacks a first-class way to mark old runs as retained history rather than part of the current operational set.

ChatGPT should be able to say things like:

• archive this completed run so it stays preserved but out of the active list
• archive this superseded run because it should remain historical only
• inspect whether a run is archived and when it was archived
• keep archived runs readable and auditable without allowing silent autonomous behavior

Milestone 13 adds deterministic archival controls so the system can distinguish:

• active/current runs
• finalized but still normal runs
• archived historical runs

This is about lifecycle hygiene and inspectability, not automation.

In scope

1. Deterministic run archiving

Add an explicit lifecycle operation to archive a run.

At minimum:

• archiving must be explicit
• archiving must be auditable
• archiving must not execute work
• archiving must preserve run state and history
• archived runs must remain inspectable via existing read-only surfaces

2. Deterministic archiving rules

Define straightforward rules such as:

• finalized runs may be archived
• superseded runs may be archived
• active / prepared / awaiting-approval runs may not be archived
• reopening or superseding an archived run is either rejected or handled by explicit deterministic rules
• archiving does not delete the run
• archiving does not mutate audit history except for the new archive event

A conservative first version is preferred.

3. Structured archive metadata

Persist compact archive metadata such as:

• archived flag or archived status
• archive reason
• archived timestamp
• archived by lifecycle action type if useful

Keep this compact and deterministic.

4. Authoritative inspection support

Expose archive metadata in:

• run.get
• run.refresh where appropriate
• runs.list
• run history / audit trail

Archived runs should still be visible when explicitly requested, but listing behavior may distinguish them from non-archived runs.

5. Listing and retention behavior

Improve run-list semantics in a tightly scoped way.

At minimum, support deterministic filtering such as:

• include archived runs
• exclude archived runs by default if that is the chosen behavior
• optionally filter specifically for archived runs

Keep the result model compact and backward-compatible where practical.

6. Audit trail integration

Append a deterministic audit entry such as:

• run_archived

If helpful, include concise metadata such as archive reason.

7. TypeScript MCP gateway updates

Keep TypeScript thin:

• add schemas
• validate inputs
• call the daemon
• map responses

Do not move lifecycle logic into TypeScript.

8. SQLite persistence updates

Persist archive metadata with safe, idempotent migration support.

New databases must work immediately.
Older databases must migrate safely and deterministically.

9. Tests and CI

Add milestone-scoped tests for:

• archiving completed runs
• archiving failed runs
• archiving superseded runs if supported
• rejecting archiving of active/prepared/awaiting-approval runs
• persistence roundtrip of archive metadata
• audit trail entry creation
• list filtering behavior for archived vs non-archived runs
• migration behavior for new archive fields
• exact MCP tool registry and daemon method registry
• no hidden-agent regression

Update CI only as needed for Milestone 13.
Do not broaden CI to the full upstream workspace.

Out of scope

Do not implement:

• autonomous cleanup
• background retention jobs
• automatic archival
• hard deletion / garbage collection
• widgets or archival UI
• OAuth
• worktrees
• provider integrations
• backend LLM usage
• generalized retention policy engines

Acceptance criteria

Architecture

• The only LLM in the stack is ChatGPT
• no model/provider SDKs added to deterministic runtime or MCP gateway
• no hidden backend agent loop
• no coarse autonomous public tools

Public MCP surface

It is acceptable to add a tightly scoped lifecycle tool such as:

• archive_run

It is acceptable to extend existing read-only tools such as:

• list_runs
• get_run_state
• get_run_history

No coarse autonomous tools may be added.

Internal daemon surface

It is acceptable to add a tightly scoped lifecycle method such as:

• run.archive

It is acceptable to extend existing read-only inspection methods such as:

• runs.list
• run.get
• run.history
• run.refresh

No agent-style or autonomous methods may be added.

Behavior

• ChatGPT can explicitly archive eligible runs
• archiving is deterministic and audited
• archived runs remain inspectable
• archived-vs-non-archived listing behavior is deterministic
• no work continues without explicit invocation

Verification

Rust:

• cargo build -p deterministic-protocol -p deterministic-core -p deterministic-daemon
• cargo test -p deterministic-protocol -p deterministic-core -p deterministic-daemon -- --nocapture
• cargo clippy -p deterministic-protocol -p deterministic-core -p deterministic-daemon --all-targets -- -D warnings

TypeScript:

• cd apps/chatgpt-mcp
• npm ci
• npm run build
• npm test

CI:

• milestone-scoped workflow updated and passing

Notes

This milestone is about explicit archival and retention visibility, not deletion and not autonomy.

Prefer a conservative deterministic design:

• preserve all history
• require explicit lifecycle actions
• keep archived runs readable
• avoid surprising state transitions
• keep TypeScript thin and Rust authoritative