Unattended capture produces records with no Record-Id, so nothing can cite or supersede them

[MongLong0214]

What happens

A record captured through the full unattended pipeline lands on the commit with no Record-Id.

Reproduced end to end against current dev:

commitlore capture --transcript <t> --draft <d> --unattended   # staged: true, rejected: []
git commit -m "fix: bound the limiter"

fix: bound the limiter

Ruled-out: Redis-backed sliding window | pricing must answer when Redis is down
Provenance: drafted

Provenance is stamped by the pipeline. Record-Id is not stamped by anything, so a draft that does not carry one produces an anonymous record — and nothing in prepare, verify or stage reports its absence.

Why this is not a drafting nit

The product's claim is that recording leaves the user's workflow: install it, work normally, and the decision is preserved without anyone remembering an extra step. A pipeline that requires the author to invent a well-formed unique identifier has not left the workflow — it has moved one step of it onto whoever writes the draft, and that step is the one most likely to be skipped, because omitting it produces no error.

Measured across four repositories running unattended capture today:

                       CommitLore trailers   Record-Id
agent-operator-score                   250          28
logic-pro-mcp                          101           0
stock-ai-newsletter                     39           0
hermes-agent                           106           0

The one repository with identities is the one whose records were hand-authored by someone who knew to add them. Every repository relying on the automatic path has none.

What is lost without an identity

Record-Id is not decoration. Without it:

• supersession cannot resolve. A later record that retires an earlier one has nothing to name, so lifecycle state cannot be folded (SPEC §5).
• identity-collision detection has no key. The withheld: ... due to a Record-Id collision path cannot fire on records that have no id to collide.
• the injected payload renders - where the id belongs. An agent handed a constraint cannot cite the record it is about to act on, which is the whole point of delivering it.
• CDEB candidate registration requires record_ids (PRD §3.2), so records accumulating now cannot back a task later.

Expected

The capture pipeline mints a Record-Id when the draft does not carry one, the same way it already stamps Provenance. A draft that supplies its own valid id keeps it.

Properties worth pinning:

• the minted id matches ^r-[a-z0-9]{6,}$ — the same grammar validate enforces
• it is unique within the repository at stage time; an id already present is not reused
• re-preparing an unchanged record yields the same id rather than a second one, so a retried capture does not create a duplicate identity for one decision
• an id the draft supplied is never silently replaced

Related

Not the same as #527, which is about init overstating what unattended capture does when no host initiator exists. This one is about what the pipeline produces once it does run.

[MongLong0214]

Fixed on dev in #537. Merged to dev, unreleased.

The pipeline mints the identity from the record's own content, beside where it already stamps Provenance. Stable under retry — the same record prepared twice yields the same id, so a retried capture does not create a second identity for one decision. Historical ids are reserved and a collision retries with a deterministic probe. A supplied id is never replaced, and a rejected draft mints nothing.

One thing worth recording from review. The first cut used the full sha256:

Record-Id: r-1dbdf2e8fd1a1d53c9f12eee3bfef592d8c68607df3a2911e1385fae9ba56df8

Valid under the grammar and wrong in practice. This identity is not a secret — it prints on every commit and again on every injected line, where the renderer pads it into a column. At 64 characters it dominates the payload and pushes real record content out of the injection budget, so the budget gets spent on identity rather than on what was decided. Shortened to 12; the probe covers collisions regardless.

End to end, with nobody supplying anything:

fix: bound it

Ruled-out: Redis-backed sliding window | pricing must answer when Redis is down
Record-Id: r-1dbdf2e8fd1a
Provenance: drafted

[MongLong0214]

Fixed and verified against 0.8.1.

mintRecordId in src/core/capture-verify.ts:122 assigns an identity after every evidence and vocabulary check passes — "the only safe place to mint is after", per the comment there.

Confirmed end to end rather than by reading: three records produced by real agent sessions through the capture pipeline today, each with an id something else can cite or supersede.

r-61e88551961c   Provenance: drafted
r-8431bd3eb945   Provenance: drafted
r-csvscan1       Provenance: drafted

The third was produced with the Claude plugin disabled — the skill-less host path — so minting does not depend on which host drove the capture.