Repository navigation
Parity audit: legacy as the behaviour spec — the gap table that scopes the repair #61
Description
Part of #58
Question
Legacy is the behaviour spec. Walk every user journey and compare legacy against v1.0, producing the gap table that becomes the repair scope. Journeys, at minimum: launch with an Opening Instruction (legacy initial_task: bridge/__main__.py:295, daemon.py:1674-1728, store.py:398, terminal.py:200, validate_initial_task at terminal.py:1263); launch identity and retry (_assert_same_launch); Answer Relay delivery and receipt classification (bridge/delivery.py, coordinator.py:1075-1235); Reply Window persistence (store.py:255); Stop Notice escalation and retention after failure (coordinator.py:988-1019); approval round-trip; Companion Channel inbound/outbound and liveness; restore / recovery (store.py recover_*, expire_recoveries, daemon.py:1167); drain-before-exit; logging of every exercised path.
For each row: what legacy does, what v1.0 does today, the gap, and whether legacy's behaviour fits the seam architecture (port / adapt / drop-with-reason). Cross-reference the open bugs #38, #39, #47, #55 and the post-v0 queue (#31, #33, #36) so each lands in exactly one row. Use the #27 migration inventory on the legacy repo as the starting index, not as the answer — it listed mechanisms, not behaviours, which is how the gaps were missed.
Output: docs/parity-gap.md on a branch, reviewed with Simon (HITL — mattpocock-skills:grilling + mattpocock-skills:domain-modeling). Resolved when Simon signs off the table and it is merged.
Activity
Simon-AI-coding commentedon Aug 25, 2026
Resolution — signed off by Simon on 2026-08-25\n\nThe parity audit is complete.\n\nEvidence was frozen at:\n- Legacy behaviour spec: 1d3284510f9f1af21bd527e1c18e0cc9c2b07de2. The legacy working tree was dirty, so every citation was read from the Git object, not the working tree.\n- v1.0 snapshot: b55c454.\n\nThe local table contains 34 user-journey rows. Every row has an exact legacy file:line citation and an exact v1.0 file:line citation. A no-analogue conclusion cites the closed action, payload, configuration, or nearest legacy boundary rather than leaving the source blank. All cited files and line ranges were mechanically checked.\n\n### Signed product boundary\n\n1. Engine restart rebuilds Session truth from the live computer. It discovers all active local Claude Code and Codex Sessions, regardless of who launched them, reads current state, recent progress and last activity, and lets the user choose one. Ordinary shells are excluded. Engine or app exit never closes Sessions.\n2. The actionable roster excludes ended Sessions. Unreachable or unidentified candidates are reported separately with a reason. Every active Session has a stable readable name and duplicates are distinguishable.\n3. Restart does not restore the old Session roster, pending Answers, Stop Notices, launch transactions, or Companion backlog. Current inspection may create a new notice when a Session is still waiting. Switch preferences do survive restart.\n4. A discovered Session can be viewed, continued, or explicitly closed without distinguishing user-launched from system-launched. Close reports the main and child outcomes.\n5. Launch carries one mandatory validated Opening Instruction on both lanes. It participates in current-Engine request identity. Cross-restart launch identity is deliberately not retained.\n6. Delivery truth is DELIVERED, FAILED, or UNKNOWN. UNKNOWN never auto-resends. Approval may only be announced as approved or denied after DELIVERED. Queued Answers remain bounded to ten minutes in the current Engine.\n7. Stop Notices carry the exact Session, question, options and recommendation. Proven failed delivery may retry when an outlet appears; unknown delivery does not.\n8. Companion messages sent while the Engine is off are not replayed. Outbound results are reported honestly without a durable delivery ledger. The already-decided reboot-safe Telegram credential flow remains required.\n9. First run keeps Duty, Voice and Message off. User switch preferences persist. Re-enabling Duty refreshes current Session facts instead of replaying historical events.\n10. v1 keeps one Bridge-owned Live Toggle, adds a global shortcut to that same action, keeps Delegated Turn as a v1-defined capability, and must automatically end a long-silent Live Call.\n11. v1 needs a complete install, whole-system verify, uninstall and local-data-clear journey. Login startup remains explicit opt-in.\n\n### Explicitly not required by this parity scope\n\n- Legacy manual attach and install-hooks operations, because live discovery and v1-owned adapter behaviour replace their outcomes.\n- Cross-restart pending-work ledgers, offline Companion replay, and historical Duty replay.\n- Comprehensive every-path logging without a demonstrated operational need.\n- CPU, memory, latency thresholds and real microphone/audio proof.\n- Shell E2E and the already-deferred post-v0 shell defects.\n\n### Required issue ownership\n\nEach required existing issue is owned by exactly one row:\n- A restore that ends live Sessions does not write the result down → live rediscovery replaces durable roster settlement.\n- The drain-before-exit ordering guarantee is not enforced end to end → v1-only pre-adoption stderr ordering, deferred post-v0.\n- The supervision suite fails under load because every spawn now starts a login shell → per-Engine-spawn cost, deferred post-v0; the source does not impose it on every Session.\n- The installed Session Channel plugin hard-codes the developer checkout Python → installed-bundle self-containment verification.\n- The engine never attaches to a launched Codex Session app-server, so relays deadlock and delivery fails → mandatory Opening Instruction on both lanes plus bounded Codex subscription bootstrap.\n- The control-plane socket path is built independently in Swift and Python → the fixed snapshot already contains the cross-language guard; verify and close rather than create a new repair.\n- Telegram token is set from the menu bar and survives a reboot → reboot-safe Companion credential.\n\n### Delivery ruling\n\nThe ticket body asked for docs/parity-gap.md on a branch, merged before closure. That clause is superseded by the later map rule that process documents are local-only and gitignored. Simon explicitly approved this during grilling. The signed file remains at docs/parity-gap.md on Simon's machine; this comment is the durable public record of its decisions.\n\nNo production code was changed and no test suite was run for this evidence-only audit.
End a silent Live Call on its own after the configured silence (#125) (…