VFS FEDERATION STUDIO v0.0.12 — CHRONICLE WORKSPACE FOUNDATION HANDOFF
=====================================================================

OUTCOME
-------
This cut restores roadmap discipline and establishes Chronicle as the preservation layer beneath
the Studio. Workspace edits now become immutable, fingerprinted generations with guarded commands,
compensating undo/redo, exact-byte history, explicit recovery, migration, trust and review-only
proposal records. Monk remains a distinctive governed instrument, not a replacement for project,
build, verification or commit authority.

START HERE
----------
1. docs/VFS_Federation_Studio_Living_Roadmap_v2.1.txt
2. docs/architecture/ROADMAP_CONFORMANCE_v0.0.12.md
3. docs/architecture/CHRONICLE_WORKSPACE_CONTRACT.md
4. docs/architecture/CHRONICLE_STATUS_v0.0.12.md
5. docs/architecture/CHRONICLE_EVIDENCE_v0.0.12.md
6. src/vfs_federation_studio/workspace/
7. src/vfs_federation_studio/tools/workspace_cli.py
8. scripts/chronicle_workspace_proof.py

MILESTONE LANGUAGE
------------------
- RM-P0..RM-P12 are the numbered preservation-first roadmap phases.
- MONK-M1..MONK-M5 are cross-cutting Monk research/product milestones.
- Release numbers are delivery cuts, not phase-pass claims.
- v0.0.11 qualifies MONK-M2 headlessly; it never completed roadmap RM-P4.
- v0.0.12 delivers C1A headlessly and advances RM-P2, which remains PARTIAL.

FROZEN v0.0.12 DECISIONS
------------------------
- Workspace schema v2 is canonical typed UTF-8 JSON with a SHA-256 identity.
- Persisted parsing is strict: duplicate/unknown members and type coercion fail closed.
- Every semantic mutation uses a target generation and exact expected fingerprint.
- Undo/redo append compensating generations; they never rewind committed history.
- Replacement requires an explicit expected current fingerprint.
- Chronicle writers serialize per workspace; initial and history writes are no-clobber.
- The exact previous workspace bytes are archived before authoritative replacement.
- Recovery remains a separate candidate until explicit base-checked promotion.
- Legacy migration always writes a separate candidate and verifies source non-mutation.
- Reviewed/trusted state binds the reviewed parent fingerprint and is invalidated by later edits.
- Accepting a Monk/external proposal records review only; it never applies or commits the artifact.
- VFS Image v2 wire bytes and existing Python/Pure-Perl runtime behavior are unchanged.

PRIMARY API
-----------
Python:
  WorkspaceDocument / WorkspaceCommand / apply_command
  ChronicleSession
  WorkspaceStore / RecoveryJournal
  migrate_legacy_snapshot

CLI:
  vfs-federation-workspace init|show|rename-project|add-source
  vfs-federation-workspace trust
  vfs-federation-workspace proposal-register|proposal-resolve
  vfs-federation-workspace history|recovery|migrate

NEXT SAFE DEVELOPMENT SLICE
---------------------------
C1B: adapt Chronicle to the native shell. Add the Qt command adapter, bounded autosave checkpoints,
History/Recovery/Proposal views, real project-browser/editor binding and GUI/CLI fingerprint parity.
Keep Qt presentation-only: domain commands, recovery promotion, proposal application and build
authority remain headless and independently testable.

Then resume C2 native shell completion, C3 federation authoring and C4 RM-P4 scheduler completion in
the dependency order recorded by living roadmap v2.1. Do not rename Monk work as a numbered roadmap
phase or let a visual feature bypass Chronicle.

VERIFICATION
------------
Use CHRONICLE_EVIDENCE_v0.0.12.md. The observed source-tree gates are 183 Python passes with two
documented optional-PySide skips, 93/93 Pure-Perl assertions, eight syntax-clean Perl modules, a
deterministic Chronicle proof, a clean-installed functional wheel and a source manifest verified
after clean extraction.
