Skip to content
Agent Archaeology

Telltale

Source Validation Matrix

Telltale supports several coding-agent source shapes, but validation depth is intentionally stated conservatively. This page summarizes what the Telltale documentation and local fixture gates support today, and where evidence remains lossy or fixture-backed only.

How to read support claims

A source is considered supported only when required coverage gates have fixture-backed proof. Live host validation is useful operational context, but it is not the support gate and should not require scanning large or sensitive real stores.

  • Most validated so far: Codex and OpenCode.
  • Some real-world validation: Claude Code, GitHub Copilot, and Gemini CLI.
  • Primarily fixture-backed today: Qwen CLI, RooCode, KiloCode, and OpenClaw.
  • Public examples should use synthetic fixtures and bounded dry-run commands, not raw local transcripts.

Client evidence matrix

This matrix summarizes Telltale source support notes from the repository. “Lossy” means the live agent or raw format may contain useful detail that the current legacy normalization path does not preserve.

Telltale source validation status and evidence caveats

Codex

Source kind
`codex.sessions`, `codex.archived_sessions`, `codex.headless_sessions`
Session format
JSONL
Current confidence
Highest; bounded live validation R01 complete

Call ID, error state, and structured content parts are lossy through legacy flat conversion.

OpenCode

Source kind
`opencode.sqlite`, `opencode.legacy_json`
Session format
SQLite and legacy JSON
Current confidence
Highest; bounded live validation R02 complete

Call ID, error state, workspace, and structured content parts are lossy through legacy flat conversion.

GitHub Copilot

Source kind
`copilot.process_log`
Session format
Process logs
Current confidence
Medium; bounded live validation R03 complete

Process logs are lossy; user intent, call ID, error state, workspace, static MCP inventory, and content parts are unavailable through the legacy path.

Claude Code

Source kind
`claude.projects`
Session format
JSONL
Current confidence
Medium; fixture-backed with no current live session note

Workspace is absent; timestamps can be partial; call ID, error state, and content parts are lossy through legacy conversion.

Gemini CLI

Source kind
`gemini.tmp`
Session format
Single JSON session files
Current confidence
Medium-low; fixture-backed and not installed in current live-validation notes

Workspace is absent; timestamps are partial; call ID, error state, and content parts are lossy.

Qwen CLI

Source kind
`qwen.projects`
Session format
JSONL
Current confidence
Fixture-backed; needs stronger documentation confirmation

Workspace is absent; timestamps can be partial; usage metadata is not currently extracted.

RooCode

Source kind
`roocode.tasks`
Session format
`ui_messages.json` arrays
Current confidence
Fixture-backed

Static MCP inventory, call ID, error state, and content parts are unavailable through current support.

KiloCode

Source kind
`kilocode.tasks`
Session format
`ui_messages.json` arrays
Current confidence
Fixture-backed

Static MCP inventory, call ID, error state, and content parts are unavailable through current support.

OpenClaw

Source kind
`openclaw.agents`
Session format
JSONL-like files
Current confidence
Fixture-backed; needs stronger documentation confirmation

Workspace is absent; non-standard `.jsonl` suffix variants are handled by filename matching.

Required coverage gates

Before a source should be advertised as supported, the Telltale source-validation matrix requires deterministic coverage that can run from a clean checkout.

  • Discovery finds the expected fixture files.
  • At least one benign fixture parses without errors.
  • At least one tool-call fixture parses correctly.
  • At least one tool-result fixture parses correctly.
  • At least one positive detection fixture fires a deterministic rule.
  • At least one benign or negative fixture stays quiet under bundled rules.
  • Capability and lossy-field notes are documented when the source becomes user-visible.

Adding or changing a source

The public contributor checklist separates session-store discovery from installed-agent inventory, requires synthetic fixtures before support claims, and keeps source-specific parser work out of detection logic. The parser refactor plan makes source identity and fallback behavior explicit without changing the normalized pipeline.

Adding an agent source Source adapter refactor plan

Safe validation commands

Use fixture-backed checks first. When checking real stores, keep the scan bounded, read-only, and summarized without publishing raw paths or transcripts.

Fixture-safe scan and rule validation
SH 
cargo run --bin telltale -- scan --once --dry-run --root tests/fixtures/session_stores
cargo run --bin telltale -- rules validate --rules config/rules/tool-call-regex.yaml

Run from the Telltale repository. The fixture tree is synthetic and safe for local verification.

Bounded real-store parser health check
SH 
telltale scan --once --dry-run --root "$HOME" --client codex --max-sources 5

Source-validation docs recommend client filters and source caps for real-store checks. Do not publish raw transcript content or local machine-specific paths.

Project-local source discovery

Some sources are project-local rather than home-relative. Telltale can scan project roots declared in YAML; project-local discovery is additive to home-relative sources discovered from --root.

Project root declaration
YAML 
projects:
  - name: my-project
    path: ~/github/my-project
Scan with project roots
SH 
telltale scan --once --root "$HOME" --project-config projects.yaml

Copilot process logs use project-local logs/copilot. Project-local OpenCode and Codex stores use registry-defined subpaths.

What not to overclaim

  • Do not describe fixture-backed sources as fully live-validated.
  • Do not treat normalized records as originals; preserve raw stores separately.
  • Do not imply Copilot logs preserve user intent, complete workspace metadata, or full structured transcript context.
  • Do not publish workstation-specific session paths, transcript identifiers, credentials, telemetry logs, or SIEM configuration from live validation.