refactor(engine): retire raw recording in favor of sanitized observations

Remove the legacy raw invocation recorder, its launch flag and transport
hooks, and its obsolete test modules. Retain the original qualification
records with Superseded status and document the sanitized recorder as the
sole implementation.

Record the user-authorized configuration migration and live MCP reload.
Preserve the old database and private recovery copies; use a separate
private database for sanitized observations.

Validation: 49 targeted tests passed. Engine refresh and read-only verification
passed 73 suites and 121 checks. Live runtime reported current; all 28 observed
MCP launches used sanitized recording.

Author: MrScripty

docs/plans/README.md

@@ -159,8 +159,9 @@ the historical temporary candidate checkout is no longer present.
 
 ## Agent interaction observation
 
-[Agent interaction observation](agent-interaction-observation/plan.md) is accepted
-for its recorded isolated source. Its implementation and qualification evidence
-are retained with the Interface 47 checkout changes. The
+[Agent interaction observation](agent-interaction-observation/plan.md) retains
+historical acceptance for its isolated raw-capture source and is now Superseded.
+[Sanitized MCP observability](mcp-observability/plan.md) is the sole supported
+recorder after the user's 2026-10-22 migration decision. The
 [checkout reconciliation record](authoring-publication-evidence/reports/checkout-reconciliation.md)
-separates current integration checks from historical acceptance.
+separates historical qualification, synchronization and recorder retirement.

docs/plans/agent-interaction-observation/execution-ledger.md

@@ -54,3 +54,13 @@ while 51 older checkout differences were restored to it. The initial complete
 repository check now passes 73 suites and 121 checks. Historical O-I1 results and
 the isolated campaign remain unchanged. Current combined Interface 47 validation
 is recorded in the [checkout reconciliation report](../authoring-publication-evidence/reports/checkout-reconciliation.md).
+
+## 2026-10-22 — raw recorder superseded
+
+After GitHub synchronization, the user explicitly selected the newer sanitized
+MCP recorder as the sole implementation, preservation of the old database and
+migration of the existing configuration. The raw source and its tests were
+retired. This plan's original acceptance and frozen qualification remain
+historical. The [migration and activation record](../mcp-observability/reports/recorder-retirement.md)
+documents the new configuration, preserved database, refreshed connections and
+49 passing targeted tests. The current plan status is Superseded.

docs/plans/agent-interaction-observation/plan.md

@@ -1,10 +1,10 @@
 # Plan: Agent Interaction Observation
 
-**Plan status:** `Accepted`
+**Plan status:** `Superseded`
 
-**Current phase:** O1 — private agent-interaction capture
+**Current phase:** Raw capture retired by the user's 2026-10-22 decision; [sanitized MCP observability](../mcp-observability/plan.md) is the supported implementation. Historical O1 acceptance is retained below.
 
-**Next slice:** O1
+**Next slice:** none for this superseded implementation.
 
 **Acceptance status:** `accepted`
 
@@ -745,4 +745,4 @@ Analytics, interface-quality conclusions, and future interface redesign are sepa
 
 - Acceptance status: `accepted`
 - Deferred follow-ups: MCP proxy, native-harness adapter, analytics/query tooling, automatic retention
-- Final status: `Accepted`
+- Final status: historical O1 `Accepted`; current implementation `Superseded` by sanitized MCP observability on 2026-10-22.

docs/plans/authoring-publication-evidence/reports/checkout-reconciliation.md

@@ -97,3 +97,12 @@ assertion against the actual captured runtime identity. The combined check ran
 Both recorder suites, existing MCP behavior, runtime identity, schema handling,
 snapshot handoff and the incoming Analysis fixture were covered. No standards
 wording changed during synchronization.
+
+## Subsequent recorder selection
+
+The user subsequently chose the newer sanitized implementation only, preservation
+of the historical raw database and migration of the existing configuration.
+The [retirement and activation record](../../mcp-observability/reports/recorder-retirement.md)
+supersedes the temporary dual-recorder compatibility decision above. The raw
+implementation and its tests were removed; all 49 remaining targeted checks
+passed, and the live sanitized installation was verified after reload.

docs/plans/mcp-observability/execution-ledger.md

@@ -68,3 +68,15 @@ No production, validator or normative edits; both call-count assertions unchange
 Final evidence retains the historical I1 failure and resolves prior I2 transport
 confusion. Reviewed bounded staged scope before committing for approved PR #4
 branch push; publication identity is the Git ref, merge remains parent-owned.
+
+## 2026-10-22 — sole recorder and operator activation
+
+The user selected this sanitized implementation as the sole supported recorder,
+authorized migration of the existing Codex launch configuration and required
+preservation of the earlier raw database. The earlier implementation was retired
+after 49 targeted checks passed. The live configuration was migrated and reloaded
+through the running daemon; all 28 observed server launches used the sanitized
+options, and new sanitized observations were confirmed. The original database
+and private recovery backups remain separate historical evidence. The
+[retirement and activation record](reports/recorder-retirement.md) owns the exact
+scope and validation; the original source qualification above is unchanged.

docs/plans/mcp-observability/reports/recorder-retirement.md

@@ -0,0 +1,53 @@
+# Raw recorder retirement and sanitized recorder activation
+
+Date: 2026-10-22.
+
+The user selected the newer sanitized recorder as the sole supported
+implementation, requested preservation of the historical raw database, and
+authorized migration of the existing launch configuration. This supersedes the
+temporary compatibility decision in synchronization merge `bc7d9efd`.
+
+## Source and configuration
+
+The raw `interaction_observation` implementation, its two test modules, the
+`observation_db` constructor argument and the `--observation-db` launch option
+were removed. Historical O1 qualification records remain; that plan is now
+Superseded. Interface 47, generated agent-tool contracts and normative standards
+are unchanged. `interaction_observer` is the remaining recorder owner.
+
+Only the Standards Engine argument list in `/home/jeremy/.codex/config.toml`
+changed. All other parsed configuration values were preserved. The new arguments
+select `--observe-database` at
+`/home/jeremy/.local/share/standards-engine/observations/sanitized.sqlite3` and
+`--observe-deployment codex-local`. The destination directory is mode 0700;
+the new database is mode 0600, outside the repository and separate from domain
+stores. Recording uses the sanitized recorder's existing defaults and schema.
+
+The original `.standards-engine/interaction-observations.sqlite3` remains in
+place. A consistent SQLite backup and the original configuration are retained
+in a private operator recovery directory outside the repository. No raw rows,
+configuration secrets or live observation payloads accompany this report.
+
+## Activation and checks
+
+The running Codex daemon acknowledged `config/mcpServer/reload`. A subsequent
+`runtime_info` call through this thread's configured server returned interface
+47 and installation state `current`. A process check observed 28 Standards
+Engine MCP launches with the sanitized options and none with the raw option.
+The new database contains `sessions`, `interactions` and `events`, with new
+observations present. The preserved old database still had its original 135
+sessions and 885 interactions at the post-reload check.
+
+The supported configuration and reload boundaries are described in
+[OpenAI's MCP configuration documentation](https://learn.chatgpt.com/docs/extend/mcp?surface=cli)
+and [app-server documentation](https://learn.chatgpt.com/docs/app-server).
+The daemon was not restarted; loaded connections were refreshed through its
+configuration operation.
+
+The sanitized recorder, existing MCP behavior, runtime identity, schema
+presentation, snapshot handoff and incoming Analysis fixture passed all 49
+targeted tests on the retired-source candidate. Engine repository verification
+passed 73 suites and 121 checks. A separate negative CLI probe confirmed the
+retired flag is rejected before opening a preserved database copy, whose digest
+remained unchanged. The historical raw recorder's earlier tests and acceptance
+are evidence for its original source only.

evaluation/standards-effectiveness/generated/suite-inputs.json

@@ -887,7 +887,7 @@
       ]
     },
     {
-      "digest": "sha256:415dc2a22a7d6448d6205b7648d7ad5bcb59a7263babeb436e1c09c5aa27937b",
+      "digest": "sha256:32472c630734bc0a281d376b1efdbc8cc6163fff42cdca23699d06cc2e9bef8a",
       "path": "docs/plans/README.md",
       "state": "present",
       "uses": [
@@ -7313,7 +7313,7 @@
       ]
     },
     {
-      "digest": "sha256:78ae764c5e17a8628c6d2df095195f9b40785da1da1ca8a3c9aa98302a04a52a",
+      "digest": "sha256:9ee0999a00a09a285c07411d339bbd42baffdab2817488aaae878a2749c78df4",
       "path": "tools/standards_engine/README.md",
       "state": "present",
       "uses": [
@@ -7626,18 +7626,6 @@
         }
       ]
     },
-    {
-      "digest": "sha256:44a338768c3245fb4a9317fe6c3e1ff304f49ca8fd48fa20a22881bfa2fd06e5",
-      "path": "tools/standards_engine/standards_engine/interaction_observation.py",
-      "state": "present",
-      "uses": [
-        {
-          "check": "python-package-contract",
-          "role": "package-contract-input",
-          "suite": "a1c-public-cutover"
-        }
-      ]
-    },
     {
       "digest": "sha256:bc14652d3aa78ea400495d7f89fe9c4662c4de16acf759cac41d8279239a2a78",
       "path": "tools/standards_engine/standards_engine/interaction_observer.py",
@@ -7663,7 +7651,7 @@
       ]
     },
     {
-      "digest": "sha256:1a30c65a51cc1e10939cd42d7bd85a77e966b624141ec4da5c3d7b33c07ee230",
+      "digest": "sha256:899c6bb6605a9b6e07bee7992c48120f3dd10fe2a8bf77fa9d20a35a3575ab22",
       "path": "tools/standards_engine/standards_engine/mcp.py",
       "state": "present",
       "uses": [
@@ -14094,7 +14082,7 @@
     "path": "evaluation/standards-effectiveness/suite-registry.toml"
   },
   "repository_index": {
-    "digest": "sha256:ca93367d16925cdf297eba515ada44d25ed171b087de758cd93136f52c85c376",
+    "digest": "sha256:3df2bd48406cef6d36cbe2e40436ac663644bc23983ef48614d8b159b56c6332",
     "uses": [
       {
         "check": "python-package-contract",

tools/standards_engine/MCP-OBSERVABILITY.md

@@ -6,13 +6,11 @@ operations, or change the installed agent catalog. The qualification observer re
 **observer v3**, with its existing raw-event acquisition, assessment and exact-source
 replay. The production recorder does not import the harness or rewrite verdicts.
 
-This document describes the sanitized recorder selected by `--observe-database`
-and `--observe-deployment`. The independent `--observation-db` option in the
-[Engine README](README.md#private-interaction-observations) captures raw invocation
-values under its own operator contract. Enabling sanitized observations does not
-enable raw capture. Each recorder needs a dedicated database; their schemas are
-not interchangeable. The privacy and retention rules below describe the
-sanitized recorder.
+The sanitized recorder selected by `--observe-database` and
+`--observe-deployment` is the sole supported recording mode. The earlier raw
+recorder and its `--observation-db` option are retired. Historical raw databases
+retain their original schema and remain separate evidence; configure a new
+dedicated database for sanitized observations.
 
 ## Configuration and authority
 

tools/standards_engine/README.md

@@ -30,12 +30,10 @@ See [checkout reconciliation](PURPOSE-SEPARATION.md#publication-checkout-reconci
 
 The versioned sections below retain implementation history.
 
-Sanitized operator measurements use `--observe-database` with
-`--observe-deployment`; see [MCP observability](MCP-OBSERVABILITY.md). Private raw
-invocation capture uses the separate `--observation-db` option documented below.
-Both are disabled by default and preserve the existing qualification observer v3
-and agent-visible interface. Each recorder requires its own database file;
-their schemas and retained data differ.
+Optional sanitized operator measurements use `--observe-database` with
+`--observe-deployment`; see [MCP observability](MCP-OBSERVABILITY.md). Recording is
+disabled by default and preserves the existing qualification observer v3 and
+agent-visible interface. This is the sole supported MCP recorder.
 
 ## Purpose separation (interface 31)
 
@@ -409,35 +407,13 @@ See [the public contract](PURPOSE-SEPARATION.md#focused-routing-fact-assertions-
 [host qualification](tests/ROUTING-FACT-QUALIFICATION.md). Reload the server/catalog
 after installation without changing launch arguments or deleting stores.
 
-## Private interaction observations
-
-MCP launch optionally accepts `--observation-db /existing/private/directory/observations.sqlite3`.
-Omitting the option disables observation: no observation database, serialization
-or retained recorder state is created. The parent directory must already exist.
-Use a dedicated file separate from every Engine domain store. The operator owns
-its filesystem permissions and retention; request values can contain repository
-or user material. This feature neither exports data nor performs cleanup.
-
-Each process records one session with the existing RuntimeIdentity interface
-version, catalog digest, schema digest and purpose. Ready-session `tools/call`
-parameters are committed exactly as supplied, before tool-name/argument checks;
-JSON-RPC envelopes and lifecycle traffic are excluded. Sequence numbers order
-invocations within a session. Only existing string identifiers `kind`, `code`,
-`outcome` and `status` from structured results may be attached as response
-metadata. Bodies, standards text, messages, details and nested result data are
-excluded; missing metadata remains SQL NULL and implies no classification.
-
-The local SQLite store has `PRAGMA user_version = 1`, with `sessions` and
-`interactions` as defined by the
-[observation plan](../../docs/plans/agent-interaction-observation/plan.md).
-Cold reopening appends a new session and preserves previous rows. Unknown
-versions or contradictory schemas are rejected without migration or recreation.
-On initialization, serialization or write failure, capture becomes inert for
-that process and emits at most one bounded diagnostic to private stderr.
-Diagnostic-channel failure is also contained. MCP catalogs, results and errors
-remain unchanged. Observation is evidence only and has no domain authority.
-
-To stop future recording, omit `--observation-db` on the next launch. Historical
-file deletion remains an operator action. No installed MCP registration is
-changed by this source feature; use an explicitly configured disposable launch
-for qualification before selecting a real local destination.
+## Recorder migration
+
+The earlier raw invocation recorder was retired on 2026-10-22. Its
+`--observation-db` launch option is no longer accepted. Historical raw databases
+remain operator-owned evidence and are not converted, reused or deleted.
+Select a new dedicated database with `--observe-database` and a nonsensitive
+`--observe-deployment` label. Follow the [sanitized recorder's operating contract](MCP-OBSERVABILITY.md)
+for permissions, retained data, retention and reports. The
+[original observation plan](../../docs/plans/agent-interaction-observation/plan.md)
+retains its historical acceptance and qualification records.