jilog

01 What jilog watches

Each scan of session transcripts emits typed Signals. Detectors are simple, deterministic heuristics — no LLM in the loop — so the same input always produces the same signals.

• Correction
  User pushes back on a turn
  An assistant → user → assistant window where the user message is 15–200 chars. Short pushback, not a new question.
• Error
  A tool call returned a structured failure
  A role: tool message whose JSON content has success: false.
• Workaround
  Assistant admits a hacky path
  First match across for now, temporary, workaround, hardcoded, TODO, FIXME, quick fix, hack.
• P0 Alert
  Same tool fails across many sessions
  Aggregation pass: a tool that errored in 3+ distinct root sessions in the window (sub-agent sessions excluded).

Each signal carries the session_id it came from, so digests and issues link back to the originating conversation.

02 What jilog produces

A nightly run writes a markdown digest and (optionally) files issues to your tracker. The digest layout is byte-stable so downstream tooling can grep it.

---
date: 2026-05-09
signals_captured: 7
p0_count: 1
corrections: 3
errors: 2
workarounds: 2
---

# Learning Digest — 2026-05-09

## P0 Alerts
- **P0 ALERT**: `bash` failed in 4
  distinct sessions: 0e91a2b4…, 2f1c8d77…,
  8a4b1e09…, c5d76f02…

## Corrections
- `0e91a2b4-…` — 'no, use the gog cli for
  calendar, not osascript'
- `2f1c8d77-…` — 'wrong path — that file is
  in jibrain/atlas, not switchboard/people'

## Errors
- `0e91a2b4-…` / `bash`:
    Command timed out after 30 seconds
- `c5d76f02-…` / `read_file`:
    ~ was not expanded; use $HOME

## Workarounds
- `2f1c8d77-…` pattern=`for now`:
    'Hardcoding the retry count to 3…'

{
  "id": "myproj-a1b",
  "title": "[jilog/error] bash:
       Command timed out after 30 seconds",
  "type": "bug",
  "priority": 1,
  "status": "open",
  "labels": ["jilog", "p0", "tool:bash"],
  "body": "Detected by jilog/review on
   2026-05-09. Tool `bash` failed in 4
   distinct root sessions in the last
   24h, exceeding the P0 threshold (3).

   Example sessions:
   - 0e91a2b4-7d3f-…
   - 2f1c8d77-91ab-…
   - 8a4b1e09-3344-…
   - c5d76f02-aabb-…

   First observed message:
   > Command timed out after 30s",
  "source": "jilog/review",
  "created": "2026-05-09T08:02:11Z"
}

On the next nightly run, this issue will be in list_open() and not refiled. Tracker::create dedups against open issues automatically.

03 Two flows, one CLI

jilog has two independent data flows. supervise wraps recurring tasks and feeds the ledger directly. review reads agent session transcripts and emits signals. Both write to the same event ledger; both can be queried.

supervise instruments your jobs; review mines your agent transcripts. Both write events to the same ledger. A nightly review also files issues for novel patterns.

04 The mental model

Four layers, top to bottom. Segment files are the source of truth; everything below them is derivable. Nothing generated is ever manually edited.

05 Pluggable backends

Readers and trackers are independent extension points. Each Reader normalizes its native log format into Vec<Message>; detectors are blind to where the messages came from.

Configure one or more in jilog.toml; the nightly loop merges signals across all configured readers and writes through to the configured tracker.

06 Crates and event classes

A small Rust workspace with five crates, plus ten core event classes appended to the ledger.

• ledger-coreEvent types, segment format, CRC32 integrity, zone store.
• ledger-sqliteRebuildable SQLite projection over segments. Throwaway state.
• ledger-spoolCross-machine transport with dedup and integrity checks.
• jilog-reviewNightly engine: signal extraction, dedup, digest generation.
• jilogThe CLI binary: supervise, query, review, issues, status.

Ten event classes

• ingestcontent arrived
• routedirected to destination
• decisionhuman or system decision
• state_changeobject state transition
• healthsystem health observation
• deliverynotification delivered
• projectionprojection refreshed
• note_metaoperational note lifecycle
• reviewnightly review run
• learningpattern extracted from session

07 Patterns it surfaces in practice

Drawn from real runs against Amplifier and Claude Code transcripts. The point isn't that any one is interesting in isolation — it's that the same signal across many distinct sessions is a load-bearing operational fact.

• P0 ALERT bash — agents hitting the default 30-second timeout on long-running builds, tests, or find. The fix is invariably one of timeout=, run_in_background=true, or "scope this to a directory."
• workaround [for now] — feature work that landed with a hardcoded config value waiting for an env-var or settings plumbing pass.
• workaround [TODO] — error paths the assistant explicitly flagged as incomplete; the highest-signal source of follow-up tickets.
• correction — short user pushbacks: "wrong path", "that's the old API", "don't auto-resolve conflicts". Each one says some context (a skill, an AGENTS.md note, a frontmatter convention) wasn't loaded or wasn't followed.
• error read_file: ~ was not expanded — recurring tilde-expansion bugs in tool surfaces; pass an absolute path or use $HOME.

08 Commands