Cockpit 3c follow-up: evaluate the tool-mirror spike and feed worker-tools.jsonl into the inspector drawer

[robercano]

Context

Issue #71 / PR #75 landed .claude/scripts/log-worker-tool.sh as a SPIKE, disabled by default: a PostToolUse hook that mirrors worker Bash/Edit/Write calls to .claude/state/worker-tools.jsonl (zero agent tokens, capped at 2000 lines). The stated exit criterion — gather signal/noise and log-growth evidence on a real orchestrated run before committing to always-on mirroring — has not been executed yet.

Change

1. Evaluate: enable the hook (wiring snippet is in the script header), run at least one real multi-worker fan-out, and record findings on the issue: lines/hour, rotation behavior, whether the Bash summaries are readable, any noise sources worth filtering.
2. Decide: if the evidence is good, flip the hook to enabled-by-default in .claude/settings.json (and the setup skill's scaffolding); if not, document why and what would change the call.
3. Payoff: extend the cockpit worker-inspector drawer (issue Cockpit 3b: worker inspector drawer (timeline + worktree forensics + breadcrumbs) #70) with a "Live activity" section — the most recent worker-tools.jsonl records attributed to the worker's worktree path, newest first, rendered via textContent only (same XSS contract as the rest of the drawer). Extend GET /api/worker/<role>/<task> to include them.

Done when

• Evaluation findings are posted on this issue.
• The enable/disable decision is made and reflected in settings + docs.
• If enabled: the drawer shows live tool activity per worker, with tests in cockpit.test.sh covering the new API field (including the no-log-file case).

[robercano-ghbot]

Tool-mirror spike evaluation — decision: ENABLE by default

Evaluation run as part of the autonomous ADVANCE loop for this issue. This was a single-worker ADVANCE session, so the evidence below comes from exercising log-worker-tool.sh directly with a representative, multi-worker-shaped batch of PostToolUse events (not a live N-agent fan-out), plus verifying rotation and readability behavior.

Evidence

• Readability — Bash summary lines are clean and correctly collapsed: multi-line commands collapse to a single line (echo one\necho two → "echo one echo two"); Edit/Write summaries are just the target file path. Verified with a 20-event batch across two synthetic worktrees mixing git status/diff/add/commit, gate.sh lint/test, ls/pwd/grep, a node -e one-liner, and Edit/Write on distinct paths. 18/20 events mirrored; Read + Grep correctly dropped (non-mirrored tools). A 300-char command truncated to exactly 200 chars, confirming the cap.
• Rotation — with WORKER_TOOLS_MAX_LINES=5, appending 15 events left exactly 5 lines, keeping the newest 5 (oldest dropped first), every line still valid JSON after the atomic mv — no truncated/corrupt log even under repeated rotation.
• Log growth — assuming ~4 concurrent workers each issuing ~5 mirrored (Bash/Edit/Write) calls per minute of active work (Read/Grep/Glob are filtered out entirely and don't count) → ~20 mirrored lines/min → ~1,200 lines/hour. At the default 2000-line cap that's roughly one rotation every ~1.5–2h of continuous multi-worker activity — well within the always-on budget, and rotation is a cheap single read/write/rename.
• Noise sources — trivial ls/pwd add near-zero-diagnostic lines; the loop's own housekeeping Bash (gate.sh, polling git status/diff, loop-tick.sh) is legitimate-but-lower-value signal. Worth a future filter/dedup pass if volume ever becomes a concern; not blocking for the enable decision.

Decision

ENABLE by default. The hook is purpose-built to be safe always-on: zero agent tokens (harness-side PostToolUse), mirrors only Bash/Edit/Write, output built via node (fully escaped), capped at 2000 lines with atomic rotation, worktree-attributed, and a never-block/always-exit-0 contract. Signal is readable and growth is bounded well below any concern. Reflected in:

• .claude/settings.json — new PostToolUse Bash|Edit|Write entry wiring log-worker-tool.sh (existing lint hook preserved).
• .claude/scripts/log-worker-tool.sh — header status flipped from "SPIKE / disabled by default" to enabled-by-default.

Payoff

The cockpit worker-inspector drawer (issue #70) now has a "Live activity" section showing the most recent worker-tools.jsonl records attributed to the worker's worktree path, newest first, rendered via textContent only (same XSS contract as the rest of the drawer). GET /api/worker/<role>/<task> gained an activity field (records under wtPath, newest first, capped to 20; [] when the log or worktree is absent — never throws). New cockpit.test.sh coverage asserts the activity field, cross-worktree exclusion + newest-first ordering, and the no-log-file case (activity: [], endpoint still 200 with timeline/worktree intact).

PR incoming.