Module proof_intent 

Durable proof-intent schema and store (bd-session-history-remediation-ocv9i.5.2).

When a proof-mode attempt is denied, RCH records a ProofIntent: enough to replay (or refuse to replay) the attempt later, and safe to reference in a Beads handoff. The record is redaction-safe by construction — it stores a command_digest (a hash, never the raw command line), an env_allowlist of variable names (never their values), and source fingerprints (hashes, never content). There is deliberately no field that could carry a secret; test_no_raw_or_secret_fields enforces that.

The ProofIntentStore is an append-only JSONL log, deduplicated by intent_id (latest write wins) and corruption-tolerant on read, mirroring crate::incident_ledger. validate_replay decides whether a stored intent may be replayed given the current revision / source fingerprints / age, honoring the intent’s StaleSourcePolicy and ReplayConstraints.

Structs

ProofIntent

A durable record of a denied proof attempt.

ProofIntentStore

Append-only, dedup-by-intent_id, corruption-tolerant proof-intent store.

ReplayConstraints

Constraints that must hold for a stored intent to be replayed.

ReplayContext

Current state used to decide whether a stored intent may be replayed.

SourceFingerprint

A source file’s identity by hash (never its contents).

Enums

ReplayDecision

The replay decision for a stored intent.

StaleSourcePolicy

How to treat source that changed since the intent was recorded.

Functions

derive_intent_id

Stable intent id: pi-<blake3(command_digest|cwd|revision)[..16]>.

proof_intent_schema

Export the JSON Schema for ProofIntent.

proof_intent_schema_version

The current proof-intent schema version.

validate_replay

Decide whether intent may be replayed in ctx, honoring its stale-source policy and replay constraints.