fixture for deterministic tests, recorded_replay for local development from a prior sanitized authenticated run, and live for real authenticated execution. Firestore remains authoritative in live; replay is an inert, process-local historical projection.
End-to-end flow
- A deliberately selected
liverun writes normal durable job, ADK handoff, A2UI, approval, delivery, receipt, verification, usage, and trace records. - The operator exports selected observations to private parent-level evidence storage. Source text requires explicit capture authorization.
npm run replay:record -- --input <private-input.json> --output <private-output.json>projects allowlisted fields, rejects the entire capture if forbidden material appears, computes deterministic terminal state, and signs aprivate_candidatebundle.- A human reviews the sanitized candidate. Public inclusion is a separate explicit decision that changes provenance to
approved_public_bundle; it is never inferred. - The local replay import endpoint validates the strict schema, sequence, release policy, terminal-state digest, and bundle integrity before creating a bounded in-memory session.
- Playback supports start, speed, pause, resume, stop, and reconnect using
after=<exclusive-sequence>. - The UI permanently displays “Recorded authenticated run — replay mode”, capture date, and bundle ID. Replay is not fresh provider or deployment evidence.
Golden scenarios
Success, awaiting approval, rejection, transient recovery, permanent failure, duplicate-effect suppression, scheduled autonomy, Memory Bank retrieval, and Telegram approval begin asnot_captured. Do not fabricate a missing scenario. Promote one only after that behavior occurs authentically and passes sanitization and review.