Decisions

Decision: cargo xtask wrappers uses the vendored shruggie-bash checker as the single Bash compliance authority, and keeps fragcap-specific syntax, help, and dry-run seam checks in xtask. scripts/lint-docs.sh keeps the standard log_info and safe_run fixtures with a file-level ShellCheck fixture suppression because the house Bash standard requires those fixtures even though this linter does not currently call them.

Rationale: S071 vendored the Bash standard checker after xtask already carried a Rust structural checker. Keeping both would let the repository gate drift from the standard agents are instructed to follow. The direct checker still warns when ShellCheck is absent, but the CI gate now preflights ShellCheck from the same plain Bash mode that invokes the checker and exits 2 if it cannot run static analysis. Deleting the unused fixtures from lint-docs.sh would make the script less compliant with the standard this slice is enforcing. The file-level SC2317,SC2329 suppression is the portable pinned-script change because ShellCheck versions differ on whether the dormant fixture is reported as an unused function or unreachable commands.

Alternatives considered: Keeping check_bash would preserve the duplicate authority issue; running both checkers would hide rather than remove the drift risk; modifying the vendored checker would exceed this slice and change shared skill bytes.

Applies-To: 0.6.0

2026-08-26 Recorded S079 doctor probe timing evidence before optimizing suspected slow checks. A terminal run of cargo run -p fragcap-cli -- doctor --timings measured Deep Capture readiness as the dominant local probe at 623 ms, target stores at 2 ms, and platform, capture driver/interface, analyzer integration, identity, process event tracing, and report rendering at 0 ms each. The command exited 1 because the local dev binary lacked the live backend, not because timing failed.

Recorded S081 measurement limitations for issue #204. The local shell was not elevated, so baseline fragcap doctor --timings reported the process event tracing probe as unavailable without entering the expensive elevated EtwWatcher::start path. logman query -ets | Select-String fragcap-doctor-probe returned no matching session after the run.

The implementation replaces doctor's full watcher readiness probe with EtwWatcher::probe_session, which starts and drops only the ETW session. This proves the consumer thread and startup process snapshot are no longer on the doctor readiness path by code structure, but the local non-elevated shell still cannot provide representative elevated before and after timing.

After implementation, cargo run -p fragcap-cli --features etw -- doctor --timings still exited 1 because the local binary lacked the live backend, and the tracing check still reported unavailable without elevation. A second logman query -ets | Select-String fragcap-doctor-probe returned no matching session.

2026-08-24 Recorded the Deep Capture proxy backend research for issue #214. The recommended path is a staged native spike with hudsucker as the first candidate and external mitmdump retained as the baseline and fallback; Pingora is deferred, mitmproxy_rs is rejected for the default target-scoped design, and soth-mitm and slinger-mitm are rejected for policy blockers.

2026-08-25 Defined the Deep Capture session bundle and output correlation model for issue #216. .fcapng remains packet truth, application JSONL is the canonical application event stream, HAR is emitted when HTTP semantics are observable in either Capture or Deep Capture, TLS key logs are sensitive proxy-owned analyzer aids, packet annotations carry sidecar flow_id joins, and the required manifest indexes artifacts, omissions, sensitivity, correlation anchors, compatibility updates, and cleanup report status.

2026-08-25 Defined the Deep Capture MVP implementation plan for issue #219. The first vertical slice will use an external mitmdump backend behind a replaceable adapter, require one stored target with known scoped proxy compatibility, refuse system-wide proxy fallback, require explicit CA trust confirmation, write the #216 session bundle, update #217 compatibility facts, reuse #218 doctor cleanup surfaces, and verify with a controlled local target rather than real game accounts or local title data.

2026-08-26 Implemented packet-side flow correlation on the existing output thread, kept proxy connection ids separate, replaced fake-events-only verification with a live loopback adapter and placeholder child, limited trust mutation to explicit current-user certificate lifecycle operations, and made partial bundles preserve only observed compatibility evidence. This intentionally adds flow_id to ordinary Capture packet outputs because the #216 correlation contract cannot be satisfied by proxy-only identifiers.

2026-08-26 Restricted the first real-target path to a fact-backed cold Steam protocol launch. Warm Steam cannot inherit fragcap's scoped proxy environment, and Capture does not manage direct-executable launches. Deep Capture now prepares and retains the effective Capture configuration before starting the proxy or changing trust, making both unsupported cases side-effect-free preflight refusals.