[OA-009] Store metadata events and a bounded local timeline #9

Planned implementation slice OA-009. No application behavior is implemented by this issue.

Phase: P3 · Dependencies: OA-008

Full roadmap detail · Contracts

Requirements

OA-ALT-005, OA-DAT-001, OA-DAT-002, OA-DAT-003, OA-CTL-004

Target files

• packages/storage/src/migrations/001-events.sql
• packages/storage/src/events.ts
• apps/desktop/src/renderer/events/Timeline.tsx
• packages/contracts/src/event.ts

Acceptance criteria

• Session observations/events/conversation are memory-only by default with a proposed 1,000-event/16 MiB content cap. Structural settings persist separately. Explicit local-history consent enables encrypted SQLite content; raw images require a separate choice and remain off.
• Opt-in encrypted history shows its location/content; proposed retention is seven days and 100 MiB, with clear/delete/export controls, OS-protected keys, and redacted exports.
• Restart restores monitoring configuration in an inactive state until the user starts sources.
• Database failure is visible; bounded writes cannot block capture/preview.

Verification

• Migration and transactional failure tests using temporary SQLite databases.
• Retention test with fake time and export redaction fixture.
• Restart confirms inactive source state and no hidden automatic capture.
• With content history disabled, assert no content-bearing history rows or image files are persisted; structural SQLite configuration/minimal audits may remain. Enabling history cannot implicitly retain raw frames.
• Verify encryption/key-store behavior, bounded memory/history quotas, and redacted clear/delete/export paths using synthetic content.

Gate and estimate

G3a: event storage is bounded, recoverable, and readable.

3-6 first-pass work-unit hours; NOT an alpha completion estimate; assumption: 6 bounded 30-60 minute work units, prepared environment and fixtures; integration waits/rework excluded

Handoff

Record changed files, actual commands/results, mock versus live evidence, residual limits, and review verdict. Do not connect personal feeds or accounts in CI.

Bounded work units

• Create event migration (30-60 minutes)
• Implement bounded persistence (30-60 minutes)
• Add retention cleanup (30-60 minutes)
• Build timeline (30-60 minutes)
• Implement redacted export (30-60 minutes)
• Test restart and database failures (30-60 minutes)

Linked dependencies

• OA-008