fix(artifact): advance wire versions for provenance fields

The manifest and segment schemas gained session_kind and prompt_source
without a version bump, so pre-provenance peers would import new
artifacts under versions they claim to understand, silently drop the
unknown fields, and mark the import complete. Advance the manifest
format to v3 and the message segment format to v2 so older peers park
new artifacts behind the future-version gate until they upgrade, and
add explicit min-decode versions so v2 manifests and v1 segments still
decode with the provenance fields defaulting to empty.

Author: mjacobs

internal/artifact/format_test.go

@@ -97,10 +97,10 @@ func TestCanonicalManifestGolden(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.Equal(t,
-		"{\"data_version\":99,\"generation\":3,\"native_session_id\":\"sess-1\",\"origin\":\"laptop-a1b2c3\",\"raw_source\":{\"hash\":\"raw123\",\"media_type\":\"application/jsonl\",\"path\":\"claude/session.jsonl\",\"size\":4096},\"segments\":[\"seg222\",\"seg111\"],\"session\":{\"agent\":\"claude\",\"compaction_count\":0,\"consecutive_failure_max\":0,\"created_at\":\"2026-06-14T01:02:03Z\",\"edit_churn_count\":0,\"ended_at\":\"2026-06-14T01:03:03Z\",\"ended_with_role\":\"\",\"final_failure_streak\":0,\"first_message\":\"hello\",\"has_peak_context_tokens\":false,\"has_total_output_tokens\":false,\"id\":\"sess-1\",\"is_automated\":false,\"machine\":\"laptop-a1b2c3\",\"message_count\":2,\"mid_task_compaction_count\":0,\"outcome\":\"\",\"outcome_confidence\":\"\",\"parent_session_id\":\"parent-1\",\"peak_context_tokens\":0,\"project\":\"alpha\",\"relationship_type\":\"subagent\",\"secret_leak_count\":0,\"started_at\":\"2026-06-14T01:02:03Z\",\"tool_failure_signal_count\":0,\"tool_retry_count\":0,\"total_output_tokens\":42,\"user_message_count\":1},\"session_has_context_data\":true,\"session_has_tool_calls\":true,\"session_name\":\"Fixture\",\"session_quality_signals\":{\"duplicate_prompt_count\":6,\"missing_success_criteria_count\":4,\"missing_verification_count\":5,\"no_code_context_count\":7,\"runaway_tool_loop_count\":1,\"short_prompt_count\":2,\"unstructured_start\":true,\"version\":3},\"usage_events\":[{\"cost\":{\"microdollars\":31250},\"cost_source\":\"fixture\",\"cost_status\":\"known\",\"dedup_key\":\"usage-1\",\"input_tokens\":11,\"message_ordinal\":2,\"model\":\"claude-test\",\"occurred_at\":\"2026-06-14T01:02:04Z\",\"output_tokens\":7,\"source\":\"fixture\"}],\"v\":2}\n",
+		"{\"data_version\":99,\"generation\":3,\"native_session_id\":\"sess-1\",\"origin\":\"laptop-a1b2c3\",\"raw_source\":{\"hash\":\"raw123\",\"media_type\":\"application/jsonl\",\"path\":\"claude/session.jsonl\",\"size\":4096},\"segments\":[\"seg222\",\"seg111\"],\"session\":{\"agent\":\"claude\",\"compaction_count\":0,\"consecutive_failure_max\":0,\"created_at\":\"2026-06-14T01:02:03Z\",\"edit_churn_count\":0,\"ended_at\":\"2026-06-14T01:03:03Z\",\"ended_with_role\":\"\",\"final_failure_streak\":0,\"first_message\":\"hello\",\"has_peak_context_tokens\":false,\"has_total_output_tokens\":false,\"id\":\"sess-1\",\"is_automated\":false,\"machine\":\"laptop-a1b2c3\",\"message_count\":2,\"mid_task_compaction_count\":0,\"outcome\":\"\",\"outcome_confidence\":\"\",\"parent_session_id\":\"parent-1\",\"peak_context_tokens\":0,\"project\":\"alpha\",\"relationship_type\":\"subagent\",\"secret_leak_count\":0,\"started_at\":\"2026-06-14T01:02:03Z\",\"tool_failure_signal_count\":0,\"tool_retry_count\":0,\"total_output_tokens\":42,\"user_message_count\":1},\"session_has_context_data\":true,\"session_has_tool_calls\":true,\"session_name\":\"Fixture\",\"session_quality_signals\":{\"duplicate_prompt_count\":6,\"missing_success_criteria_count\":4,\"missing_verification_count\":5,\"no_code_context_count\":7,\"runaway_tool_loop_count\":1,\"short_prompt_count\":2,\"unstructured_start\":true,\"version\":3},\"usage_events\":[{\"cost\":{\"microdollars\":31250},\"cost_source\":\"fixture\",\"cost_status\":\"known\",\"dedup_key\":\"usage-1\",\"input_tokens\":11,\"message_ordinal\":2,\"model\":\"claude-test\",\"occurred_at\":\"2026-06-14T01:02:04Z\",\"output_tokens\":7,\"source\":\"fixture\"}],\"v\":3}\n",
 		string(data),
 	)
-	assert.Equal(t, "d84a3987c40f800f23ea943ebd50c0910c64444e6ff4b64b6f8a68782f7a32d6", hashHex(data))
+	assert.Equal(t, "855d1a7ed086095582cc94136837bcb93d74f4ad0cf446b0a77177d1b31aba23", hashHex(data))
 }
 
 func TestDecodeManifestRejectsUnsupportedOlderVersion(t *testing.T) {
@@ -122,6 +122,37 @@ func TestDecodeManifestRejectsUnsupportedOlderVersion(t *testing.T) {
 	assert.Contains(t, err.Error(), "manifest has unsupported artifact version 1")
 }
 
+func TestDecodeManifestAcceptsPriorVersionWithoutSessionKind(t *testing.T) {
+	data := []byte(`{
+		"v": 2,
+		"origin": "laptop-a1b2c3",
+		"native_session_id": "sess-1",
+		"segments": [],
+		"session": {
+			"id": "sess-1",
+			"machine": "laptop-a1b2c3",
+			"agent": "claude",
+			"created_at": "2026-06-14T01:02:03Z"
+		}
+	}`)
+
+	decoded, err := decodeManifestWithLimits(data, productionArtifactLimits())
+	require.NoError(t, err)
+	assert.Equal(t, 2, decoded.Version)
+	assert.Empty(t, decoded.Session.SessionKind,
+		"v2 manifests predate session_kind and must decode with it empty")
+}
+
+func TestDecodeSegmentAcceptsPriorVersionWithoutPromptSource(t *testing.T) {
+	data := []byte("{\"content\":\"hello\",\"ordinal\":0,\"role\":\"user\",\"v\":1}\n")
+
+	msgs, err := decodeSegmentWithLimits(data, productionArtifactLimits())
+	require.NoError(t, err)
+	require.Len(t, msgs, 1)
+	assert.Empty(t, msgs[0].PromptSource,
+		"v1 segments predate prompt_source and must decode with it empty")
+}
+
 func TestCanonicalMessageSegmentGolden(t *testing.T) {
 	msgs := []db.Message{
 		{
@@ -177,13 +208,13 @@ func TestCanonicalMessageSegmentGolden(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.Equal(t,
-		"{\"claude_message_id\":\"msg-1\",\"claude_request_id\":\"req-1\",\"content\":\"world\",\"content_length\":5,\"has_output_tokens\":true,\"has_tool_use\":true,\"model\":\"claude-test\",\"ordinal\":2,\"output_tokens\":2,\"role\":\"assistant\",\"source_parent_uuid\":\"uuid-parent\",\"source_subtype\":\"assistant\",\"source_type\":\"jsonl\",\"source_uuid\":\"uuid-msg-1\",\"timestamp\":\"2026-06-14T01:02:05Z\",\"token_usage\":{\"input\":1,\"output\":2},\"tool_calls\":[{\"call_index\":0,\"category\":\"file\",\"file_path\":\"README.md\",\"input_json\":\"{\\\"file_path\\\":\\\"README.md\\\"}\",\"result_content\":\"file content\",\"result_content_length\":12,\"result_events\":[{\"agent_id\":\"agent-1\",\"content\":\"done\",\"content_length\":4,\"event_index\":0,\"source\":\"tool_result\",\"status\":\"success\",\"subagent_session_id\":\"child-1\",\"timestamp\":\"2026-06-14T01:02:06Z\",\"tool_use_id\":\"tool-1\"}],\"subagent_session_id\":\"child-1\",\"tool_name\":\"Read\",\"tool_use_id\":\"tool-1\"}],\"v\":1}\n",
+		"{\"claude_message_id\":\"msg-1\",\"claude_request_id\":\"req-1\",\"content\":\"world\",\"content_length\":5,\"has_output_tokens\":true,\"has_tool_use\":true,\"model\":\"claude-test\",\"ordinal\":2,\"output_tokens\":2,\"role\":\"assistant\",\"source_parent_uuid\":\"uuid-parent\",\"source_subtype\":\"assistant\",\"source_type\":\"jsonl\",\"source_uuid\":\"uuid-msg-1\",\"timestamp\":\"2026-06-14T01:02:05Z\",\"token_usage\":{\"input\":1,\"output\":2},\"tool_calls\":[{\"call_index\":0,\"category\":\"file\",\"file_path\":\"README.md\",\"input_json\":\"{\\\"file_path\\\":\\\"README.md\\\"}\",\"result_content\":\"file content\",\"result_content_length\":12,\"result_events\":[{\"agent_id\":\"agent-1\",\"content\":\"done\",\"content_length\":4,\"event_index\":0,\"source\":\"tool_result\",\"status\":\"success\",\"subagent_session_id\":\"child-1\",\"timestamp\":\"2026-06-14T01:02:06Z\",\"tool_use_id\":\"tool-1\"}],\"subagent_session_id\":\"child-1\",\"tool_name\":\"Read\",\"tool_use_id\":\"tool-1\"}],\"v\":2}\n",
 		string(data),
 	)
 	assert.NotContains(t, string(data), `"id"`)
 	assert.NotContains(t, string(data), `"session_id"`)
 	assert.NotContains(t, string(data), `"message_id"`)
-	assert.Equal(t, "f46c1edbc77dab4eb15f43bcb3ce196243c784445b07e9135c223b5d58c6dea5", hashHex(data))
+	assert.Equal(t, "e45219604ab58bb9685ac3dfb0f5cc5e865705e29dc8a985ccebe1b748a6d396", hashHex(data))
 }
 
 func TestEncodeSegmentPreservesPromptSource(t *testing.T) {

internal/artifact/import_checkpoint_test.go

@@ -72,34 +72,34 @@ func TestReadVerifiedImportArtifactByteBoundaries(t *testing.T) {
 func TestFutureArtifactVersionErrorsIdentifyDependencyKind(t *testing.T) {
 	t.Run("manifest", func(t *testing.T) {
 		_, err := decodeManifestWithLimits(
-			[]byte(`{"origin":"contract-a1b2c3","v":3}`),
+			[]byte(`{"origin":"contract-a1b2c3","v":4}`),
 			productionArtifactLimits(),
 		)
 		require.ErrorIs(t, err, errFutureArtifactVersion)
 		var future *futureArtifactVersionError
 		require.ErrorAs(t, err, &future)
 		assert.Equal(t, Kind(KindManifests), future.Kind)
-		assert.Equal(t, 3, future.Version)
+		assert.Equal(t, 4, future.Version)
 	})
 
 	t.Run("segment", func(t *testing.T) {
 		_, err := decodeSegmentWithLimits(
-			[]byte("{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":2}\n"),
+			[]byte("{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":3}\n"),
 			productionArtifactLimits(),
 		)
 		require.ErrorIs(t, err, errFutureArtifactVersion)
 		var future *futureArtifactVersionError
 		require.ErrorAs(t, err, &future)
 		assert.Equal(t, Kind(KindSegments), future.Kind)
-		assert.Equal(t, 2, future.Version)
+		assert.Equal(t, 3, future.Version)
 	})
 }
 
 func TestFutureSegmentVersionPrecedesCurrentRecordLimit(t *testing.T) {
 	var body strings.Builder
 	for range productionArtifactLimits().segmentMessages + 1 {
 		body.WriteString(
-			"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":2}\n",
+			"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":3}\n",
 		)
 	}
 
@@ -110,7 +110,7 @@ func TestFutureSegmentVersionPrecedesCurrentRecordLimit(t *testing.T) {
 	var future *futureArtifactVersionError
 	require.ErrorAs(t, err, &future)
 	assert.Equal(t, Kind(KindSegments), future.Kind)
-	assert.Equal(t, 2, future.Version)
+	assert.Equal(t, 3, future.Version)
 }
 
 func TestCurrentSegmentRecordLimitPrecedesLaterRecordDecode(t *testing.T) {

internal/artifact/import_session.go

@@ -159,7 +159,7 @@ func loadImportedSession(
 func validateImportedManifest(
 	m manifest, origin, gid string, limits artifactLimits,
 ) error {
-	if m.Version != manifestFormatVersion {
+	if m.Version < manifestMinDecodeVersion || m.Version > manifestFormatVersion {
 		return errors.New("manifest version is unsupported")
 	}
 	if m.Origin != origin {

internal/artifact/import_session_test.go

@@ -143,7 +143,7 @@ func TestLoadImportedSessionDefersOversizedFutureSegment(t *testing.T) {
 	var segment strings.Builder
 	for range productionArtifactLimits().segmentMessages + 1 {
 		segment.WriteString(
-			"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":2}\n",
+			"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":3}\n",
 		)
 	}
 	segmentHash := createHashedImportArtifact(
@@ -165,7 +165,7 @@ func TestLoadImportedSessionDefersOversizedFutureSegment(t *testing.T) {
 	var future *futureArtifactVersionError
 	require.ErrorAs(t, err, &future)
 	assert.Equal(t, Kind(KindSegments), future.Kind)
-	assert.Equal(t, 2, future.Version)
+	assert.Equal(t, 3, future.Version)
 }
 
 func TestLoadImportedSessionDefersMissingAndFutureDependencies(t *testing.T) {
@@ -191,7 +191,7 @@ func TestLoadImportedSessionDefersMissingAndFutureDependencies(t *testing.T) {
 		{
 			name: "future manifest",
 			prepare: func(t *testing.T, store ArtifactStore) string {
-				body := []byte(`{"origin":"contract-a1b2c3","v":3}`)
+				body := []byte(`{"origin":"contract-a1b2c3","v":4}`)
 				return createHashedImportArtifact(
 					t, store, KindManifests, ".json", body,
 				)
@@ -202,7 +202,7 @@ func TestLoadImportedSessionDefersMissingAndFutureDependencies(t *testing.T) {
 			name: "future segment",
 			prepare: func(t *testing.T, store ArtifactStore) string {
 				segment := []byte(
-					"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":2}\n",
+					"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":3}\n",
 				)
 				segmentHash := createHashedImportArtifact(
 					t, store, KindSegments, ".ndjson", segment,

internal/artifact/import_test.go

@@ -217,21 +217,22 @@ func TestStoreImportCoordinatorTracksIndependentFutureRequirements(t *testing.T)
 			prepare: func(t *testing.T, store ArtifactStore) string {
 				return createHashedImportArtifact(
 					t, store, KindManifests, ".json",
-					[]byte(`{"origin":"contract-a1b2c3","v":3}`),
+					[]byte(`{"origin":"contract-a1b2c3","v":4}`),
 				)
 			},
-			wantManifest: 3, wantSegment: messageSegmentFormatVersion,
+			wantManifest: manifestFormatVersion + 1,
+			wantSegment:  messageSegmentFormatVersion,
 			understood: db.ArtifactImportVersions{
 				Checkpoint: checkpointFormatVersion,
-				Manifest:   3,
+				Manifest:   manifestFormatVersion + 1,
 				Segment:    messageSegmentFormatVersion,
 			},
 		},
 		{
 			name: "future segment",
 			prepare: func(t *testing.T, store ArtifactStore) string {
 				segment := []byte(
-					"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":2}\n",
+					"{\"content\":\"future\",\"ordinal\":0,\"role\":\"user\",\"v\":3}\n",
 				)
 				segmentHash := createHashedImportArtifact(
 					t, store, KindSegments, ".ndjson", segment,
@@ -240,11 +241,12 @@ func TestStoreImportCoordinatorTracksIndependentFutureRequirements(t *testing.T)
 				m.Segments = []string{segmentHash}
 				return createImportTestManifest(t, store, m, false)
 			},
-			wantManifest: manifestFormatVersion, wantSegment: 2,
+			wantManifest: manifestFormatVersion,
+			wantSegment:  messageSegmentFormatVersion + 1,
 			understood: db.ArtifactImportVersions{
 				Checkpoint: checkpointFormatVersion,
 				Manifest:   manifestFormatVersion,
-				Segment:    2,
+				Segment:    messageSegmentFormatVersion + 1,
 			},
 		},
 	}
@@ -343,7 +345,7 @@ func TestStoreImportCoordinatorFinishesSupportedSessionsBeforeFutureGate(
 	sessionMap := map[string]string{
 		contractOrigin + "~000-future": createHashedImportArtifact(
 			t, store, KindManifests, ".json",
-			[]byte(`{"origin":"contract-a1b2c3","v":3}`),
+			[]byte(`{"origin":"contract-a1b2c3","v":4}`),
 		),
 	}
 	const supportedSessions = artifactImportDrainLimit + 1
@@ -405,15 +407,15 @@ func TestStoreImportCoordinatorFinishesSupportedSessionsBeforeFutureGate(
 		t.Context(),
 		db.ArtifactImportVersions{
 			Checkpoint: checkpointFormatVersion,
-			Manifest:   3,
+			Manifest:   manifestFormatVersion + 1,
 			Segment:    messageSegmentFormatVersion,
 		},
 		attempt,
 		10,
 	)
 	require.NoError(t, err)
 	require.Len(t, pending, 1)
-	assert.Equal(t, 3, pending[0].RequiredManifestVersion)
+	assert.Equal(t, manifestFormatVersion+1, pending[0].RequiredManifestVersion)
 }
 
 func TestStoreImportCoordinatorQuarantinesInvalidCheckpointAndContinues(

internal/artifact/wire.go

@@ -38,10 +38,17 @@ var errIncompleteArtifact = errors.New("incomplete artifact")
 const (
 	checkpointFormatVersion = 1
 	// Manifest v2 replaces usage_events[].cost_usd floats with exact
-	// integer-microdollar cost objects.
-	manifestFormatVersion       = 2
-	messageSegmentFormatVersion = 1
-	metadataEventFormatVersion  = 1
+	// integer-microdollar cost objects. Manifest v3 adds the optional
+	// session_kind provenance field; v2 manifests still decode, with the
+	// field defaulting to empty.
+	manifestFormatVersion    = 3
+	manifestMinDecodeVersion = 2
+	// Segment v2 adds the optional prompt_source provenance field on
+	// message records; v1 segments still decode, with the field defaulting
+	// to empty.
+	messageSegmentFormatVersion    = 2
+	messageSegmentMinDecodeVersion = 1
+	metadataEventFormatVersion     = 1
 )
 
 // metadataEventExtension is the file extension for metadata event artifacts.

internal/artifact/wire_decode.go

@@ -27,7 +27,7 @@ func decodeManifestWithLimits(data []byte, limits artifactLimits) (manifest, err
 			Kind: KindManifests, Version: envelope.Version,
 		}
 	}
-	if envelope.Version != manifestFormatVersion {
+	if envelope.Version < manifestMinDecodeVersion {
 		return manifest{}, fmt.Errorf(
 			"manifest has unsupported artifact version %d", envelope.Version,
 		)
@@ -211,7 +211,7 @@ func preflightSegmentData(data []byte, limits artifactLimits) (segmentPreflight,
 					Kind: KindSegments, Version: version,
 				}
 			}
-			if version != messageSegmentFormatVersion {
+			if version < messageSegmentMinDecodeVersion {
 				return segmentPreflight{}, fmt.Errorf(
 					"message segment has unsupported artifact version %d",
 					version,