Add a Chronicle control center for capture state, exclusions, and privacy consent #165

Problem

Chronicle/Skysight has working Linux backend controls, but Codex Desktop does not expose a coherent user-facing control surface for them.

A desktop user can currently encounter all of these at once:

• Chronicle appears enabled in Codex Settings.
• The actual capture daemon is paused or stopped.
• The only visible capture control is a separate system-tray action labeled Pause/Resume Chronicle.
• The backend reports zero exclusions, but there is no in-app way to list, create, or remove exclusions.
• Runtime evidence, summaries, OCR state, and capture paths exist but are discoverable only through CLI commands or files under runtime/Codex directories.

This is not a documentation problem. Desktop users should not need to discover or edit ~/.codex/memories/extensions/chronicle/exclusions.json, invoke bridge methods manually, or infer capture state from a feature toggle.

Confirmed current behavior

Live verification after merging #163 showed the ownership/lifecycle fix working correctly:

• Explicit tray start/resume recorded source: chronicle-tray and owner: manual-continuous.
• Tray pause left the daemon alive but prevented captures across subsequent 60-second intervals.
• Chronicle status reported state: paused, is_running: true, and paused: true.
• The current Linux compatibility adapter collapses that richer paused state into the upstream sidecar shape as running: false / state: stopped.
• Exclusions reported exclusions_count: 0; the configured rule list was empty.

The backend and main-process bridge already expose:

• linux-record-replay-skysight-status
• linux-record-replay-skysight-start
• linux-record-replay-skysight-pause
• linux-record-replay-skysight-resume
• linux-record-replay-skysight-stop
• linux-record-replay-skysight-list-exclusions
• linux-record-replay-skysight-update-exclusion

The installed ASAR contains the exclusion handlers, but no renderer consumer for them was found. The missing layer is a coherent desktop UI and an explicit state model.

Important distinctions

The implementation must not collapse these separate concepts into one toggle:

1. Capability availability — the Linux Record & Replay/Chronicle backend is installed and callable.
2. Capture lifecycle — never started, running, paused, stopped, or failed.
3. Summary behavior — whether the Chronicle summary agent is enabled.
4. Privacy policy — configured exclusion rules and whether they can be verified for the current desktop/browser state.

The existing Codex Settings toggle may be an upstream Memory/Chronicle preference rather than a Linux capture toggle. Do not rename or repurpose it until its upstream semantics are traced. The Linux UI should instead make the actual capture state visible and controllable beside it.

Proposed UX: Chronicle control center

Add an in-app Chronicle panel reachable from Codex Settings. The tray menu should retain the one-click Pause/Resume action and add Open Chronicle settings so both entry points converge on the same state model.

1. Truthful live status

Show one primary capture state:

• Not started
• Capturing desktop
• Paused
• Stopped
• Unavailable
• Error

Also show, when available:

• last capture time and configured interval
• capture owner/source (manual-continuous, recording-session:<id>, etc.) in operator details
• OCR enabled/available/backend state
• summary-agent enabled/last-run/error state
• exclusion count

Use linux-record-replay-skysight-status for this richer Linux state. Do not infer paused versus stopped solely from the compatibility adapter's running boolean.

2. State-derived controls

Render controls from actual runtime state rather than from the feature toggle:

• Not started/stopped -> Start Chronicle
• Running -> Pause Chronicle and Stop Chronicle
• Paused -> Resume Chronicle and Stop Chronicle
• Error/unavailable -> disabled control plus actionable error text

Actions should refresh status after completion and expose failures rather than optimistically changing labels.

3. Exclusion management

Add a normal CRUD interface backed by the existing list/update bridge methods.

MVP canonical rule types should match behavior already supported by the backend:

• application/app ID
• window title
• WM class
• browser domain

The UI should:

• list kind, value, reason, and last-updated time
• add a rule with validated, non-empty input
• remove a rule with confirmation
• refresh status/exclusion count after mutation
• explain that matching suppresses screenshot/accessibility/OCR evidence rather than merely hiding it from summaries
• explain that domain exclusions depend on reliable browser URL/domain observation

An Exclude currently focused app/window affordance would be valuable, but it is not free: it needs a dedicated, privacy-safe bridge operation that returns only stable window identity fields. Treat that as an optional follow-up unless implemented and tested as part of this work.

4. Zero-exclusion start warning

When starting manual continuous capture with zero exclusions, show a one-time-per-start confirmation:

Chronicle will capture every visible application on your desktop every 60 seconds. No exclusions are configured.

Offer:

• Configure exclusions
• Start anyway
• Cancel

Do not hard-block zero-exclusion capture: some users intentionally want full-desktop memory, and exclusions cannot be sensibly pre-populated for every environment. The requirement is informed explicit consent, not a forced policy.

The warning must not weaken the backend's existing fail-closed behavior when exclusions exist but window/domain verification is unavailable.

5. Data visibility without scope creep

For the first version, show the configured runtime, resources, and evidence locations with Open folder actions where supported. Do not bundle a retention-policy editor or destructive cleanup implementation into this issue unless the backend gains explicit, safe APIs with confirmation and tests. Retention and deletion deserve a follow-up rather than ad hoc filesystem deletion from renderer code.

Interaction and accessibility requirements

• The panel must be keyboard navigable.
• Status changes should use an appropriate live region without announcing every periodic poll.
• Do not rely on color alone for running/paused/error state.
• Do not render captured screenshot, OCR, accessibility, window-title, or browser contents in Settings.
• Poll at a bounded interval and stop polling when the panel is unmounted/backgrounded.
• Tray and Settings actions must reflect the same post-action status.

Implementation constraints

• Keep the feature under linux-features/record-and-replay/; do not patch generated app output directly.
• Use feature patch descriptors and idempotent/fail-soft ASAR patching consistent with repository rules.
• Preserve Fix Chronicle capture lifecycle ownership #163 ownership semantics. Stopping a recording-session-owned daemon must not stop unrelated manual capture, and Settings must not silently take ownership of another session.
• Feature availability and passive status/permission polling must remain side-effect-free.
• Starting capture must remain an explicit user action.
• Avoid creating a second independent state store. Runtime status and exclusion APIs are the source of truth.

Acceptance criteria

• Codex Settings exposes a Chronicle panel reachable without editing files or using a CLI.
• The system tray includes Open Chronicle settings and keeps a state-correct one-click Pause/Resume action.
• The panel distinguishes capability availability, capture lifecycle, summary-agent state, and exclusion state.
• A paused daemon is displayed as Paused, not merely off/stopped.
• Start, Pause, Resume, and Stop controls are derived from and reconciled against live backend status.
• Users can list, add, and remove supported exclusion rules in the UI.
• Starting manual continuous capture with zero exclusions requires an explicit warning/confirmation.
• Passive rendering/status polling never starts or resumes capture.
• Session ownership protections from Fix Chronicle capture lifecycle ownership #163 remain covered and intact.
• UI tests cover running, paused, stopped, unavailable/error, zero-exclusion confirmation, exclusion CRUD success/failure, and tray/Settings state consistency.
• Existing Record & Replay Node, patcher, Rust, packaging, and upstream-DMG checks remain green.

Non-goals

• Automatically inventing exclusion rules from observed private content.
• Displaying captured screenshots or raw OCR/accessibility contents in Settings.
• Replacing the Chronicle summarizer or OCR implementation.
• Implementing retention/deletion by directly manipulating backend-owned files from the renderer.
• Changing bounded Record & Replay session ownership semantics established by Fix Chronicle capture lifecycle ownership #163.

Relationship to previous work

• Chronicle can leave continuous full-desktop capture running after Record & Replay ends #162 / Fix Chronicle capture lifecycle ownership #163 fixed unintended continuous-capture lifecycle and ownership.
• This issue closes the remaining desktop-product gap: users can now trust the backend lifecycle, but they still need an understandable, accessible UI to control it and configure its privacy boundary.