Capsule

A local commission desk, Qiskit drafting helper, registered run catalog and field guide. Python launchd service at http://127.0.0.1:8779. No dedicated GPU or local inference required.

Source of truth

The app projects crew platform runs and runs show, including provider metadata and central Backstage delivery, verification and acceptance records. Study lead/liaison identities come from crew platform study list. jobs.json was deleted: no authored capsule list remains. Runtime JSON files under ~/.local/share/fmvision-crew/platform-telemetry are disposable source projections, numeric evidence caches and outbound request receipts, not a competing task registry. Authored drafts use the existing request journal until explicit submission. Review notes and source artifacts do not establish central acceptance.

Each registered session has a persistent SSE subscription. Connect/reconnect and lifecycle events reconcile that session through the registered CLI. New local launch receipts trigger full-catalog reconciliation; the Reconcile button performs an explicit full refresh, including externally created sessions. No periodic cloud status scan. Filesystem kqueue events feed the browser SSE channel. Connection retry delays follow actual failures. The full archive retains exact turns; capsule cards summarize the latest execution and show costs for all measured jobs/follow-ups.

Workbench and helper

/commissions shows a writing surface beside Qiskit. Commission and Charter are adjacent labels using one format; no separate execution semantics have been defined. Author text is preserved verbatim. Saving and queueing launch nothing. Explicit Send resolves the existing central qiskit alias through the registered API adapter, configures exact Sol 6.1 medium/no Astra, and uses the durable sendChat journal. Busy requests remain queued. Ambiguous submissions become needs_reconciliation and never automatically replay. Prior runs remain intact.

The drafting helper can receive the unsent draft and an explicitly selected guide chapter. It has zero workers and drafting-only instructions; asking does not launch a study. Applying a suggested draft is explicit and reversible. Replies render local Markdown with raw HTML/unsafe links blocked and remote images inert. Source text is preserved. The chat transcript follows the persistent Qiskit conversation through SSE; original messages and saved drafts remain distinct.

Field guide and interface

/guide/ serves the retained facelift-002 platform guide and its assets/library directly, confined to that source directory. /guide-original/ preserves designed-guide-001. Chapters connect to preparation, recovery, costing and acceptance and may be selected as helper context. These are dated research editions, not live entitlement checks. Shared navigation, warm paper, serif typography, copper accents and a green Qiskit panel unify workbench, runs and archive. Desktop and mobile DOM geometry were checked without screenshots or model image inspection.

Costs and titles

English capsule titles are saved as provider session metadata.title, preserving original IDs and other metadata. The catalog reads those records; the title-update receipt is audit evidence, not a runtime lookup table.

A prominent total and large per-capsule amounts come from per-agent invocation trace usage, with per-execution breakdowns. Agent spans are counted once; chat spans and reasoning are not added again. Model attribution comes from exact trace attributes or is explicitly marked as inferred from other traces for the same agent identity. Totals reconcile against provider usage. Unknown execution/model evidence remains unavailable and makes the total partial.

Rates are pinned from official model pages (6 Nov 2026). Estimates use Standard short-context token rates and exclude tools, hosted compute, cache-write premiums, regional/tier/long-context adjustments and unavailable usage. They are not invoices. Confirmed billing remains unavailable. A full refresh and relevant session lifecycle changes update cost evidence; no billing polling occurs.

Results and reports

Completed runs offer exact-turn Pull results, logs, source-safe local storage, SHA-256 manifests and synthesis/conclusion PDFs. Pulls invoke crew platform artifact pull, never extract or execute artifacts, and reject path escapes/unverified overwrites. Existing files are reused only with matching recorded hashes. Results live under research/platform/ansel/telemetry-results/SESSION-TURN-HASH/. Historical pre-migration deliveries remain preserved in their original directories.

Report design v2 uses a first-page purpose/synthesis/conclusion/evidence briefing, followed by attributed findings and provenance, with measured pagination and page footers. capsule-run-report is registered in Protocols/library.json; source drift requires review rather than implying acceptance. Logs are loaded on demand and expose visible messages and available activity metadata, not hidden reasoning or raw tool arguments.

Service and checks

• Service: institute.kosmos.fmvisual.platform-telemetry.
• Python environment: ~/.local/share/fmvision-crew/platform-telemetry/venv with requirements.txt.
• Existing credential stores stay server-side. HTTP binds only 127.0.0.1:8779, with Host/Origin/custom-header checks on mutations.
• Run: python3 tools/platform-telemetry/server.py using the service environment.
• Tests: python -m unittest discover -s tools/platform-telemetry -p 'test_*.py'.

Checks cover exact-turn selection, tamper/path/retry behavior, draft revisions and verbatim text, helper scope/context, Markdown injection defenses, per-model accounting and per-job summation. Browser checks cover desktop/mobile layout, Markdown DOM, apply/undo, central Cosine visibility, guide shell, English titles and prominent total/job costs. No paid model submissions were launched to test the app.

Organization and navigation

Capsules carry editable provider metadata.categories (a JSON-encoded list), currently including Sine Research, Quantum, Deep Research, Protocols and Platform. Filter chips and capsule tags read that metadata; user edits update the provider record, then reconcile the local projection. Additional category names are supported. Filter selection is a browser preference, not a registry. The pending-acceptance count is a subdued note rather than a featured metric.

chrome.py supplies one identical global header to the workbench, ledger, archive and both retained guide editions. Original guide site/mobile headers are removed only in the HTTP projection; the retained source files remain unchanged. Guide chapter/sidebar navigation is kept separate from global navigation.

Protocol library

/protocols presents styled, mobile-readable operating references under Capsule's shared header. The commission-to-accepted-result method is explicitly local guidance; the operating guide renders this README; the run report standard is projected directly from the current capsule-run-report entry in Protocols/library.json. These pages are allowlisted and do not expose arbitrary repository files.

Each reference offers Copy reference text, a copyable commission outline and Use with Qiskit. The latter opens the workbench with that reference selected and disclosed beside the existing draft editor. Selection starts no API call or submission. Only the user's explicit Ask includes the current source reference in the zero-worker drafting conversation. It does not alter the commission text. Existing field-guide references remain available in the same selector.

Durable job logs

/logs defaults to English with a searchable job list and per-entry original output. It requests 25 recent entries, keeps at most 80 in the DOM, and pages older entries explicitly. Initial excerpts are limited to 1,600 output characters; originals load in 16,000-character chunks only when expanded. The log page uses its own small catalog event channel rather than receiving the entire app snapshot.

The existing provider subscription now persists normalized visible command/message evidence in ~/.local/share/fmvision-crew/platform-telemetry/logs.sqlite3. This database is durable evidence, unlike the disposable catalog JSON projections. SQLite WAL transactions preserve an append-only sequence of output edits and current entry projections, indexed by exact session/turn and item identity. SSE emits durable event cursors and honors Last-Event-ID on reconnect. Provider event IDs suppress duplicate replay. No log retention deletion is scheduled. Storage remains local; no remote backup is implied.

On connection the latest provider page is recovered; earlier pages are imported only on request. This does not certify complete provider history across an arbitrarily long disconnected interval. Worker logs are included only where the provider exposes them in this session. Hidden reasoning is excluded, common credentials are redacted, and terminal escapes are stripped. English interpretation is generated locally from the current excerpt; expanding the original reveals the retained full sanitized output. Historical streamed chunks that were never observed cannot be recreated from final saved items.

Use make backup-logs BACKUP=/absolute/fresh/path.sqlite3 for a consistent online backup, ideally to another mounted volume. The command refuses an existing destination. Do not copy only the SQLite main file while WAL ingestion is active. The database and backups stay outside Git.

Shared header verification

chrome.py owns the only app/guide header markup; header.css owns its sizing, typography and responsive layout. General page CSS contains no header component rules, and page templates contain no fallback headers. The component sets its own box sizing and fonts so retained guide styles and page resets do not change its geometry. Run node tools/platform-telemetry/test_header_layout.mjs to compare 13 routes at six widths, including both guide editions, exact navigation geometry and typography.

Interface polish

Application typography, surfaces, forms and responsive layouts now live in app.css, scoped to .capsule-app; the old inline prototype styles were removed from the page templates. Retained guide editions receive only served-shell adjustments under .capsule-guide. The independently scoped header.css continues to own all global header geometry. No runtime catalog or authored study content was replaced.

The ledger leads with costs, result actions and evidence state. Relay/provenance detail is disclosed on request and remains open across local events. Archive search and status filters operate on the source-backed snapshot, showing capsule names, execution dates and measured costs while preserving exact IDs in disclosures. Findings and publications use short excerpts with their full text available on demand. Mobile guide chapters and keyboard skip links support navigation. These are interface changes; completion and acceptance semantics remain unchanged.

Run node tools/platform-telemetry/test_polish.mjs for desktop/tablet/mobile layout and interaction checks without writes, node tools/platform-telemetry/test_readability.mjs for computed contrast of reading copy, and node tools/platform-telemetry/test_header_layout.mjs for cross-page shell consistency. These checks establish layout, interaction and contrast properties; aesthetic quality remains for the operator to judge.

Customer-flow finish

Capsule discovery now prefers provider metadata.title and passes new launch slugs through titles.display; opaque source IDs are never promoted into display titles. Explicit Rename writes the provider record through the registered adapter and verifies it before refreshing the local projection. Source session/turn IDs stay in provenance disclosures. Naming a capsule creates no commission. The two newly discovered studies have source-persisted English titles; their automatic PDFs were retitled with previous bytes retained.

The ledger supports text search, state filtering and recent/title/cost sorting. Source links use session anchors, so a later turn does not strand the capsule link. Inspect logs opens the existing readable exact-job stream. The total's Over $100 indicator is conditional on measured usage exceeding that amount; it does not change or round up accounting data.

The workbench keeps unsaved editor text in this browser tab's session storage on input events, restores it on reload/navigation, and clears that buffer after a confirmed save. This is an unsent writing buffer, not a job registry. Server saves use a stable request UUID, retain version checks and prevent parallel double-click saves. Replacing unsaved text requires an explicit editor choice. Selecting, restoring or editing a draft never dispatches work. All six team-size options are valid native select options.

Long references now have an on-page section index. Knowledge excerpts preserve full text disclosures across refreshes and offer an explicit retry on read failure. Run node tools/platform-telemetry/test_customer_flow.mjs for these customer-path regressions; draft writes in that test are browser fixtures, with no live journal mutation or model dispatch. The live rename check used the same existing source title and preserved other metadata. A regression test verifies the adapter under launchd's minimal PATH.

Marketing and first-time Codex use

/about (also /marketing) explains Capsule's value and links to the live workbench. Its example workflow and dollar amounts are explicitly illustrative, and the page does not request private run data on arrival. Shared app footers link About Capsule and Use in Codex.

/about#use-in-codex is a six-step novice walkthrough: check the local app, open Terminal, install from the current project marketplace, check the local installation, start a fresh local Codex conversation and paste the first read-only prompt. Commands and prompts have distinct labels and copy actions. Changing the project path regenerates shell-quoted commands; shell steps use && so a failed directory change stops the block. /api/plugin-status is an explicit read-only installed-CLI check returning only Capsule's installation/enabled state. It neither installs nor launches a model run, and it does not establish that an already-open conversation loaded the tools.

The page explains CLI text output versus MCP Apps panel support, /plugins in Codex versus commands in Terminal, service startup on this configured Mac, and why a cloud chat cannot reach a local loopback backend. It explicitly states that the ZIP does not include a standalone backend installer. No public publication, pricing, customer testimonials or product-readiness claims were invented. Official OpenAI sources are linked beside the instructions.

Run node tools/platform-telemetry/test_marketing.mjs to verify desktop/tablet/mobile tabs, keyboard controls, clipboard commands/path quoting, the actual read-only setup check, download and lack of private-data API reads or writes. The installed plugin and ZIP also link to this walkthrough.

Pull Results and continuation previews

Pull Results now exposes a Download Results ZIP link after retrieval. Bundles include the exact-turn manifest, SHA-256-verified output files and the available summary PDF. A final-answer-only execution can have zero output files; the app says so instead of treating that as a failed pull. Summary generation failure is reported separately from file retrieval. Interrupted pulls retain verified checkpoints for retry.

Continue/Rerun previews use cached context first and only visible conversation history when needed, with a 20-second timeout. Missing context is explicit in the preview; preparation never calls dispatch. The dialog retains operator direction on failure and shows preparation progress. Regression and live-request evidence is in docs/action-fixes-testing.json at the repository root.