feat(platform-integrations): close Bob provenance via a session-id bridge

Bob (a Gemini-CLI fork) exposes no session-id env var to tool subprocesses, so
audit_recall.py minted a uuid that could never be tied to Bob's saved trajectory
— provenance resolved the entity but never the trajectory. But Bob DOES store
the real session id: ~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json
carries it in a 'sessionId' field (verified: projectHash == sha256(cwd), and the
filename's trailing block is the id's first segment).

Bridge both ends to that real id:
- audit_recall.py: when under Bob (gated on BOBSHELL_CLI) with no Claude/Codex
  env id, recover sessionId from the newest chat file under sha256(cwd) instead
  of minting. Inert on every other host.
- provenance.locate_trajectory: add a Bob branch that matches the chat file whose
  'sessionId' equals the audited id (filename-prefiltered, body field authoritative).

Validated headlessly end-to-end: Bob recall logs the real sessionId, provenance
fully resolves (entity + trajectory), influence verdict records, candidates
dedup to empty. All three platforms now close discover→save→recall→audit→
provenance. +6 unit tests (recover, newest-wins, inert-without-BOBSHELL_CLI,
env-id-precedence, locate, body-mismatch-rejected).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: illeatmyhat

platform-integrations/bob/evolve-lite/lib/evolve-lite/audit_recall.py

@@ -15,6 +15,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 import sys
@@ -28,12 +29,48 @@ def _evolve_dir() -> Path:
     return Path(env) if env else Path.cwd() / ".evolve"
 
 
+def _bob_session_id() -> str | None:
+    """Recover Bob's real session id for the current run.
+
+    Bob (a Gemini-CLI fork) exposes no session-id environment variable to tool
+    subprocesses, but it writes the live session to
+    ``~/.bob/tmp/<sha256(cwd)>/chats/session-<ts>-<sid8>.json`` with a real
+    ``sessionId`` field (the filename's trailing segment is that id's first
+    block). Recovering it lets `provenance` tie this recall to the saved
+    trajectory instead of an opaque minted uuid. Gated on ``BOBSHELL_CLI`` so it
+    is inert on every other host. Returns the id, or ``None`` when not under Bob
+    or no chat file is found (caller then mints a uuid)."""
+    if not os.environ.get("BOBSHELL_CLI"):
+        return None
+    try:
+        project_hash = hashlib.sha256(os.getcwd().encode()).hexdigest()
+        chats = Path.home() / ".bob" / "tmp" / project_hash / "chats"
+        files = sorted(
+            chats.glob("session-*.json"),
+            key=lambda p: p.stat().st_mtime,
+            reverse=True,
+        )
+        for chat in files:
+            try:
+                sid = json.loads(chat.read_text(encoding="utf-8")).get("sessionId")
+            except (OSError, json.JSONDecodeError):
+                continue
+            if sid:
+                return str(sid)
+    except OSError:
+        return None
+    return None
+
+
 def _session_id() -> tuple[str, bool]:
     """Return (session_id, self_minted)."""
     for var in ("CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID"):
         val = os.environ.get(var)
         if val:
             return val, False
+    bob_sid = _bob_session_id()
+    if bob_sid:
+        return bob_sid, False
     return str(uuid.uuid4()), True
 
 

platform-integrations/bob/evolve-lite/skills/evolve-lite-provenance/scripts/provenance.py

@@ -99,6 +99,10 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
        Codex names each rollout file with the thread id as the trailing segment,
        so a recursive glob for ``*<sid>*.jsonl`` under ``~/.codex/sessions/``
        finds it regardless of date directory.
+    4. NEW native Bob transcript: ``~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json``.
+       Bob carries the real session id in the file's ``sessionId`` field (the
+       filename's trailing segment is that id's first block). ``audit_recall.py``
+       logs that real id, so match the chat file whose ``sessionId`` equals it.
 
     Native discovery makes provenance work in the hookless world where no
     ``.evolve/trajectories/`` file is ever written. Each native step is keyed on
@@ -156,6 +160,26 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
             if matches:
                 return matches[0]
 
+    # --- 4. Native Bob transcript -------------------------------------------
+    # Bob (a Gemini-CLI fork) stores sessions at
+    # ~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json, each
+    # carrying a real ``sessionId`` field whose first block is the filename's
+    # trailing segment. audit_recall.py logs that real sessionId (see its
+    # ``_bob_session_id``), so match the chat file whose sessionId equals it.
+    # Glob across project-hash dirs (cheap) and prefilter filenames by the id's
+    # first block rather than recomputing the hash.
+    if session_id and "/" not in session_id and "*" not in session_id:
+        bob_tmp = base / ".bob" / "tmp"
+        if bob_tmp.is_dir():
+            sid_head = session_id.split("-", 1)[0]
+            for chat in sorted(bob_tmp.glob(f"*/chats/session-*{sid_head}*.json")):
+                try:
+                    data = json.loads(chat.read_text(encoding="utf-8"))
+                except (OSError, json.JSONDecodeError):
+                    continue
+                if data.get("sessionId") == session_id:
+                    return chat
+
     return None
 
 

platform-integrations/claude/plugins/evolve-lite/lib/evolve-lite/audit_recall.py

@@ -15,6 +15,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 import sys
@@ -28,12 +29,48 @@ def _evolve_dir() -> Path:
     return Path(env) if env else Path.cwd() / ".evolve"
 
 
+def _bob_session_id() -> str | None:
+    """Recover Bob's real session id for the current run.
+
+    Bob (a Gemini-CLI fork) exposes no session-id environment variable to tool
+    subprocesses, but it writes the live session to
+    ``~/.bob/tmp/<sha256(cwd)>/chats/session-<ts>-<sid8>.json`` with a real
+    ``sessionId`` field (the filename's trailing segment is that id's first
+    block). Recovering it lets `provenance` tie this recall to the saved
+    trajectory instead of an opaque minted uuid. Gated on ``BOBSHELL_CLI`` so it
+    is inert on every other host. Returns the id, or ``None`` when not under Bob
+    or no chat file is found (caller then mints a uuid)."""
+    if not os.environ.get("BOBSHELL_CLI"):
+        return None
+    try:
+        project_hash = hashlib.sha256(os.getcwd().encode()).hexdigest()
+        chats = Path.home() / ".bob" / "tmp" / project_hash / "chats"
+        files = sorted(
+            chats.glob("session-*.json"),
+            key=lambda p: p.stat().st_mtime,
+            reverse=True,
+        )
+        for chat in files:
+            try:
+                sid = json.loads(chat.read_text(encoding="utf-8")).get("sessionId")
+            except (OSError, json.JSONDecodeError):
+                continue
+            if sid:
+                return str(sid)
+    except OSError:
+        return None
+    return None
+
+
 def _session_id() -> tuple[str, bool]:
     """Return (session_id, self_minted)."""
     for var in ("CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID"):
         val = os.environ.get(var)
         if val:
             return val, False
+    bob_sid = _bob_session_id()
+    if bob_sid:
+        return bob_sid, False
     return str(uuid.uuid4()), True
 
 

platform-integrations/claude/plugins/evolve-lite/skills/evolve-lite/provenance/scripts/provenance.py

@@ -99,6 +99,10 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
        Codex names each rollout file with the thread id as the trailing segment,
        so a recursive glob for ``*<sid>*.jsonl`` under ``~/.codex/sessions/``
        finds it regardless of date directory.
+    4. NEW native Bob transcript: ``~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json``.
+       Bob carries the real session id in the file's ``sessionId`` field (the
+       filename's trailing segment is that id's first block). ``audit_recall.py``
+       logs that real id, so match the chat file whose ``sessionId`` equals it.
 
     Native discovery makes provenance work in the hookless world where no
     ``.evolve/trajectories/`` file is ever written. Each native step is keyed on
@@ -156,6 +160,26 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
             if matches:
                 return matches[0]
 
+    # --- 4. Native Bob transcript -------------------------------------------
+    # Bob (a Gemini-CLI fork) stores sessions at
+    # ~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json, each
+    # carrying a real ``sessionId`` field whose first block is the filename's
+    # trailing segment. audit_recall.py logs that real sessionId (see its
+    # ``_bob_session_id``), so match the chat file whose sessionId equals it.
+    # Glob across project-hash dirs (cheap) and prefilter filenames by the id's
+    # first block rather than recomputing the hash.
+    if session_id and "/" not in session_id and "*" not in session_id:
+        bob_tmp = base / ".bob" / "tmp"
+        if bob_tmp.is_dir():
+            sid_head = session_id.split("-", 1)[0]
+            for chat in sorted(bob_tmp.glob(f"*/chats/session-*{sid_head}*.json")):
+                try:
+                    data = json.loads(chat.read_text(encoding="utf-8"))
+                except (OSError, json.JSONDecodeError):
+                    continue
+                if data.get("sessionId") == session_id:
+                    return chat
+
     return None
 
 

platform-integrations/claw-code/plugins/evolve-lite/lib/evolve-lite/audit_recall.py

@@ -15,6 +15,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 import sys
@@ -28,12 +29,48 @@ def _evolve_dir() -> Path:
     return Path(env) if env else Path.cwd() / ".evolve"
 
 
+def _bob_session_id() -> str | None:
+    """Recover Bob's real session id for the current run.
+
+    Bob (a Gemini-CLI fork) exposes no session-id environment variable to tool
+    subprocesses, but it writes the live session to
+    ``~/.bob/tmp/<sha256(cwd)>/chats/session-<ts>-<sid8>.json`` with a real
+    ``sessionId`` field (the filename's trailing segment is that id's first
+    block). Recovering it lets `provenance` tie this recall to the saved
+    trajectory instead of an opaque minted uuid. Gated on ``BOBSHELL_CLI`` so it
+    is inert on every other host. Returns the id, or ``None`` when not under Bob
+    or no chat file is found (caller then mints a uuid)."""
+    if not os.environ.get("BOBSHELL_CLI"):
+        return None
+    try:
+        project_hash = hashlib.sha256(os.getcwd().encode()).hexdigest()
+        chats = Path.home() / ".bob" / "tmp" / project_hash / "chats"
+        files = sorted(
+            chats.glob("session-*.json"),
+            key=lambda p: p.stat().st_mtime,
+            reverse=True,
+        )
+        for chat in files:
+            try:
+                sid = json.loads(chat.read_text(encoding="utf-8")).get("sessionId")
+            except (OSError, json.JSONDecodeError):
+                continue
+            if sid:
+                return str(sid)
+    except OSError:
+        return None
+    return None
+
+
 def _session_id() -> tuple[str, bool]:
     """Return (session_id, self_minted)."""
     for var in ("CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID"):
         val = os.environ.get(var)
         if val:
             return val, False
+    bob_sid = _bob_session_id()
+    if bob_sid:
+        return bob_sid, False
     return str(uuid.uuid4()), True
 
 

platform-integrations/claw-code/plugins/evolve-lite/skills/evolve-lite/provenance/scripts/provenance.py

@@ -99,6 +99,10 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
        Codex names each rollout file with the thread id as the trailing segment,
        so a recursive glob for ``*<sid>*.jsonl`` under ``~/.codex/sessions/``
        finds it regardless of date directory.
+    4. NEW native Bob transcript: ``~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json``.
+       Bob carries the real session id in the file's ``sessionId`` field (the
+       filename's trailing segment is that id's first block). ``audit_recall.py``
+       logs that real id, so match the chat file whose ``sessionId`` equals it.
 
     Native discovery makes provenance work in the hookless world where no
     ``.evolve/trajectories/`` file is ever written. Each native step is keyed on
@@ -156,6 +160,26 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
             if matches:
                 return matches[0]
 
+    # --- 4. Native Bob transcript -------------------------------------------
+    # Bob (a Gemini-CLI fork) stores sessions at
+    # ~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json, each
+    # carrying a real ``sessionId`` field whose first block is the filename's
+    # trailing segment. audit_recall.py logs that real sessionId (see its
+    # ``_bob_session_id``), so match the chat file whose sessionId equals it.
+    # Glob across project-hash dirs (cheap) and prefilter filenames by the id's
+    # first block rather than recomputing the hash.
+    if session_id and "/" not in session_id and "*" not in session_id:
+        bob_tmp = base / ".bob" / "tmp"
+        if bob_tmp.is_dir():
+            sid_head = session_id.split("-", 1)[0]
+            for chat in sorted(bob_tmp.glob(f"*/chats/session-*{sid_head}*.json")):
+                try:
+                    data = json.loads(chat.read_text(encoding="utf-8"))
+                except (OSError, json.JSONDecodeError):
+                    continue
+                if data.get("sessionId") == session_id:
+                    return chat
+
     return None
 
 

platform-integrations/codex/plugins/evolve-lite/lib/evolve-lite/audit_recall.py

@@ -15,6 +15,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 import sys
@@ -28,12 +29,48 @@ def _evolve_dir() -> Path:
     return Path(env) if env else Path.cwd() / ".evolve"
 
 
+def _bob_session_id() -> str | None:
+    """Recover Bob's real session id for the current run.
+
+    Bob (a Gemini-CLI fork) exposes no session-id environment variable to tool
+    subprocesses, but it writes the live session to
+    ``~/.bob/tmp/<sha256(cwd)>/chats/session-<ts>-<sid8>.json`` with a real
+    ``sessionId`` field (the filename's trailing segment is that id's first
+    block). Recovering it lets `provenance` tie this recall to the saved
+    trajectory instead of an opaque minted uuid. Gated on ``BOBSHELL_CLI`` so it
+    is inert on every other host. Returns the id, or ``None`` when not under Bob
+    or no chat file is found (caller then mints a uuid)."""
+    if not os.environ.get("BOBSHELL_CLI"):
+        return None
+    try:
+        project_hash = hashlib.sha256(os.getcwd().encode()).hexdigest()
+        chats = Path.home() / ".bob" / "tmp" / project_hash / "chats"
+        files = sorted(
+            chats.glob("session-*.json"),
+            key=lambda p: p.stat().st_mtime,
+            reverse=True,
+        )
+        for chat in files:
+            try:
+                sid = json.loads(chat.read_text(encoding="utf-8")).get("sessionId")
+            except (OSError, json.JSONDecodeError):
+                continue
+            if sid:
+                return str(sid)
+    except OSError:
+        return None
+    return None
+
+
 def _session_id() -> tuple[str, bool]:
     """Return (session_id, self_minted)."""
     for var in ("CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID"):
         val = os.environ.get(var)
         if val:
             return val, False
+    bob_sid = _bob_session_id()
+    if bob_sid:
+        return bob_sid, False
     return str(uuid.uuid4()), True
 
 

platform-integrations/codex/plugins/evolve-lite/skills/evolve-lite/provenance/scripts/provenance.py

@@ -99,6 +99,10 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
        Codex names each rollout file with the thread id as the trailing segment,
        so a recursive glob for ``*<sid>*.jsonl`` under ``~/.codex/sessions/``
        finds it regardless of date directory.
+    4. NEW native Bob transcript: ``~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json``.
+       Bob carries the real session id in the file's ``sessionId`` field (the
+       filename's trailing segment is that id's first block). ``audit_recall.py``
+       logs that real id, so match the chat file whose ``sessionId`` equals it.
 
     Native discovery makes provenance work in the hookless world where no
     ``.evolve/trajectories/`` file is ever written. Each native step is keyed on
@@ -156,6 +160,26 @@ def locate_trajectory(session_id, evolve_dir, *, project_root=None, home=None):
             if matches:
                 return matches[0]
 
+    # --- 4. Native Bob transcript -------------------------------------------
+    # Bob (a Gemini-CLI fork) stores sessions at
+    # ~/.bob/tmp/<sha256(projectpath)>/chats/session-<ts>-<sid8>.json, each
+    # carrying a real ``sessionId`` field whose first block is the filename's
+    # trailing segment. audit_recall.py logs that real sessionId (see its
+    # ``_bob_session_id``), so match the chat file whose sessionId equals it.
+    # Glob across project-hash dirs (cheap) and prefilter filenames by the id's
+    # first block rather than recomputing the hash.
+    if session_id and "/" not in session_id and "*" not in session_id:
+        bob_tmp = base / ".bob" / "tmp"
+        if bob_tmp.is_dir():
+            sid_head = session_id.split("-", 1)[0]
+            for chat in sorted(bob_tmp.glob(f"*/chats/session-*{sid_head}*.json")):
+                try:
+                    data = json.loads(chat.read_text(encoding="utf-8"))
+                except (OSError, json.JSONDecodeError):
+                    continue
+                if data.get("sessionId") == session_id:
+                    return chat
+
     return None