docs(kdo): authorize H2-R2 event-derived model history

[TheHalfMoon]

Authorizes the second and final bounded H2 slice: event-derived model-visible session history.

Canonical base: 01daf34d36fc30b20b39293e0a3f1fc03cf32048 (merged H2-R1 PR #45).

Target continuity invariant after the first H2-R1 request anchor:

next-turn model-visible messages == projection(canonical H2 session evidence)

The authorization permits exactly one required history event vocabulary, a bounded pure projector, a read-only in-process journal of successfully appended events, and an agent-loop transition away from a parallel mutable history authority after the first request anchor.

It does not authorize provider transports, model/turn.ts, tool replay, K2/ExecutionGateway/Done Gate, approval/sandbox, plugins, subagents/jobs, terminal/LSP/workflows, JSONL restart/resume, storage policy, or issue #47 work.

PR #42 is explicitly treated as superseded design and is not H2-R2 authority; this PR does not modify or close it.

Changed path must remain exactly:
docs/planning/KODAC_KDO_H2_R2_EVENT_DERIVED_MODEL_HISTORY_AUTHORIZATION_2026-08-14.md

No auto-merge. Expected-head merge only after exact-head governance and review gates pass.

---

Summary by cubic

Authorizes H2-R2 event-derived model-visible session history to remove the loop-local messages authority. Previously, BoundedAgentLoop mutated a private messages[]; now, after the first H2-R1 request anchor, next-turn messages must equal the projection of canonical session events.

• Defines one required event: model.history.message.appended (versioned, bound to afterRequestIdentity, closed source enum for assistant/tool-result/recovery, one validated ModelMessage, deterministic id, explicit bounds).

• Requires a pure projector: processes events in order, validates anchors, enforces continuity (later request snapshots must equal prior projection), rejects stale/malformed/unknown required model.history.*, outputs an independent ModelMessage[].

• Adds a read-only in-process RuntimeSession journal: events are visible to projection only after a successful EventSink.append; failed appends do not advance sequence or influence the next request.

• Shifts agent-loop authority: after the first anchor, assistant/tool/recovery messages must be appended as events; the loop must derive next-turn history via projection; failure to append/project fails closed before provider invocation.

• Restricts implementation to a nine-path allowlist (session history/projection, loop, protocol/event.ts, tests, index export, and a later evidence ledger doc) and keeps protected runtime surfaces byte-identical.

• Explicitly non-grants provider transports, model/turn.ts, tool replay, K2/ExecutionGateway/Done Gate, approval/sandbox, plugins, subagents/jobs, terminal/LSP/workflows, JSONL restart/resume, storage policy, or issue security(kdo): harden evidence-store access and retention for lossless request snapshots #47 work; PR docs(kdo): authorize H2 model-visible reconstructability core #42 is superseded design and not H2-R2 authority.

• This PR adds exactly one file: docs/planning/KODAC_KDO_H2_R2_EVENT_DERIVED_MODEL_HISTORY_AUTHORIZATION_2026-08-14.md.

• Rollout and gates

  • No runtime changes land here; an implementation PR must meet the authorization, proofs, and certification gates before adding the ledger doc.
  • No auto-merge; expected-head merge only after governance and review gates pass.

^{Written for commit 96eac6c. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@TheHalfMoon, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e042b504-0860-4625-9cf1-9becca15f94b

📥 Commits

Reviewing files that changed from the base of the PR and between 01daf34 and 96eac6c.

📒 Files selected for processing (1)

• docs/planning/KODAC_KDO_H2_R2_EVENT_DERIVED_MODEL_HISTORY_AUTHORIZATION_2026-08-14.md

---

_{Comment @coderabbitai help to get the list of available commands.}