Chronicle workspaces and history

Chronicle is the preservation-first project layer beneath the Studio. Every edit creates an immutable generation with a stable identity, parent fingerprint and audit record. Saving serializes local writers, requires the expected current fingerprint, archives the exact prior document without clobbering history, then atomically installs and reopens the candidate.

Create and inspect

vfs-federation-workspace init project.vfsworkspace.json \
  --name "Root VFS" --namespace example.root
vfs-federation-workspace show project.vfsworkspace.json

Generation-safe edits

Design federation sends every project, source, mount, and profile edit through the Chronicle controller. Commands require the exact current generation and workspace fingerprint. Before a save, Studio writes a recovery checkpoint; after atomic replacement it reopens and verifies the committed document. A failed save leaves the candidate available for review rather than claiming success. Persisted JSON rejects duplicate or unknown members, wrong types, and over-budget collections instead of coercing them. Equivalent command-line rename and source examples:

vfs-federation-workspace rename-project project.vfsworkspace.json "Release Root"
vfs-federation-workspace add-source project.vfsworkspace.json assets/input.bin \
  --virtual-root /assets

Prior saved bytes remain under the workspace’s immutable history directory. Undo and redo are compensating generations; neither rewinds a committed file in place.

Recovery

Recovery checkpoints are candidates with a base fingerprint, command count and difference summary. Listing them does not change the selected workspace. Promotion performs a compare-and-swap and fails when the saved workspace has diverged.

Trust

A reviewed or trusted decision is bound to the precise workspace fingerprint that was inspected. The next command invalidates that decision until a reviewer records a new one.

Monk Loom proposals

A trained attachment can be registered by artifact and evidence fingerprints, then accepted, rejected or superseded. Acceptance is only a review record. It does not apply the candidate, rebuild an image or commit anything.

vfs-federation-workspace proposal-register project.vfsworkspace.json \
  loom-candidate monk-loom-attachment root-model ARTIFACT_SHA EVIDENCE_SHA
vfs-federation-workspace proposal-resolve project.vfsworkspace.json \
  loom-candidate accepted --note "Evidence reviewed"

Perl-agent workspace proposals

Chronicle v4 persists trusted agent-signing keys, permanent revocations, admission thresholds, signed bundle evidence, and canonical digest-bound action plans. The exact agent bundle must have a trusted unexpired Ed25519 signature, pass independent-benchmark accuracy and regression gates, then be registered and accepted. Plan registration replays every proposed command against the current configuration without saving it. Review and application are different records: Accept never changes the workspace; Apply revalidates the signer, admission, and plan, runs its ordinary commands, records the application authority, and saves the batch atomically. Build and export remain separate.

Start with signer trust and regression limits, then use the GUI-first agent reconfiguration walkthrough. The command vfs-federation-agent-actions --help exposes the same gates in a terminal.

Legacy migration

Migration always writes a separate candidate and verifies that the original bytes are unchanged:

vfs-federation-workspace migrate legacy.json candidate.vfsworkspace.json