goose

Identity

  • Names: goose / xyz.block.goose.
  • Native format: goose-sqlite, sessions, messages and usage_ledger in sessions.db.
  • Session ID: sessions.id, a local YYYYMMDD_N counter. Require a stable installation/profile namespace under ASR-054/055. Separate bundles alone do not prevent identity collisions.
  • Notes: agentVisible and userVisible describe audience. steer records steering; turnContext records harness injection. Agent-only visibility does not prove compaction; metadata.usage.isCompaction supports a summary with unknown replaced extent. A usage_ledger row reports one model call but has no message join. If a ledger is present, keep message usage native to avoid double counting. Without ledger rows, that message’s metadata.usage can support a derived inference. Keep model, cost source and explicit counters as recorded. Password/writeOnly form answers are secrets in every representation.
  • Side stores: Explicitly session-owned thread_messages are vendor records, not duplicate calls. Unowned thread rows remain manifest facts. Current settings and usage follow source logs as snapshots.

Position basis

Transcript order is created_timestamp,id. Message row IDs can change on replacement; unique native message_id remains stable. Ledger rows are ordered by their native ledger ID.
  • Entity keys and order: Unique message_id is stable. Conversation replacement deletes and reinserts SQL rows, so integer row IDs are not stable message identity. Use created_timestamp,id order with second precision. Gaps in row IDs alone do not prove deletion.
Use only positions established by the stated format and mapping evidence. Current-state rows without transcript positions form the snapshot tail. A protocol commit boundary takes precedence over physical EOF; uncommitted bytes are not a gap.

Destinations

goose: native facts without a standard field

  • Links and lineage: toolResponse.id joins a unique toolRequest.id or frontendToolRequest.id. toolConfirmationRequest.id and actionRequired.data carry request identity; qualify the exact actionType before joining decisions or elicitation responses. sessions.parent_session_id supplies only relatedUnknown. No copied prefix or root follows from it.
agent_only visibility does not establish compaction. Require explicit metadata or a pinned structural contract to identify the summary and the extent it replaced. A ledger is_compaction flag identifies inference purpose, not message ownership.

Usage

Select one report per native accounting identity only when this entry establishes that identity. Keep unjoinable or overlapping reports as native evidence. Declare incomplete semantic coverage. Schema defaults and placeholder zeros are not reported usage. Backend inclusion rules require evidence; do not infer them from a model name. Select the session ledger when present; otherwise use message reports with a qualified call association. Keep unjoinable message reports in native metadata. A partial ledger does not establish complete usage coverage; declare usage when this policy leaves reports unprojected. Never join by timestamp, model or equal counts.

Lane and unassigned facts

Facts without established session ownership use manifest _meta["xyz.block.goose/unassigned"] with the common shape. Selection may retain these facts with any session subset, including an empty subset, but must not imply session ownership. State the selection policy in the export report.

Losses

Declare every applicable loss under ASR-157. Missing model rendering, accounting joins, lineage or exact context boundaries remain losses when this entry does not qualify them. Unknown ownership is not itself lost data. Omitted unassigned facts use a documented vendor loss or report, not a new core category.

Evidence

Basis: source-verified at block/goose commit 7c4ba2219166700becb68d6db35989ebcaa52f69; schema 14/15 fixtures and authored semantic tests. This source review alone does not establish a package version; the 1.56.0 observation below has a separate scope. Evidence applies only to the named formats and explicit mappings above. A real capture covers only exercised behavior. A writer probe run without a model covers persistence, not model or tool execution. Authored tests do not qualify an agent version. Unlisted formats and link mappings remain unqualified.

Observations from 2026-10-27

observed, version 1.56.0: Goose 1.56.0 kept the records of edit, shell-test, resume and review/question runs. Export requires an explicit installation namespace. A request in a prompt to ask questions does not establish a native approval lifecycle. Preserve native rows and parts in native.record or native.blob. The ctx conversion produced 2 streams and 51 records, with 0 errors, 0 notices, 0 gaps and 0 unidentified inputs under validator-v0.1.2. These counts describe the selected output; an empty bundle qualifies no source format. No sanitized native fixture was retained for this observation. Whole native records use native.record or native.blob, with JSON text columns preserved as strings. The exporter’s own bookkeeping for serialization, partitioning and message keys belongs in the exporter namespace (rs.ctx for ctx), not in a provider metadata destination. These runs add no evidence for unexercised approvals, lineage links, compaction boundaries or exact request context.