Feature: portable SQLite incident capsules

[awksedgreep]

Related: cross-signal correlation #35 and observability-schema umbrella #20.

Summary

Export a bounded, self-contained incident capsule as a portable SQLite database containing selected metrics, logs, traces, provenance, and the metadata required for independent offline analysis.

Candidate workflow

timeless incident export \
  --start ... --stop ... \
  --service checkout \
  --output checkout-incident.db

The capsule may include selected raw telemetry, complete traces whose matched spans fall in scope under a documented expansion budget, schema/capability and build identity, checksums, export criteria, source query reports, optional correlation results, redaction report, and a compact set of public analysis views.

Contract

• Export operates from a consistent source snapshot.
• Selection, trace expansion, output bytes, rows, work, deadline, and temporary space are bounded.
• The manifest records completeness, truncation, source identity, time units, filters, redaction policy, and checksums.
• Output is independently integrity-checkable and queryable with documented SQLite/Timeless versions.
• Existing output is never silently overwritten.
• Partial failure leaves no artifact that can be mistaken for a complete capsule.

Privacy and safety

• Support an explicit pre-export redaction policy.
• Ensure removed values do not survive in indexes, freelist pages, WAL, or temporary artifacts in the distributed capsule.
• Default to excluding authentication material and operational secrets.
• Report every dropped, hashed, truncated, or rejected field class.

Acceptance criteria

• Deterministic manifests and semantic contents for a pinned snapshot.
• Round-trip tests cover all codecs, rich types, IDs, partial traces, retention boundaries, and missing signal planes.
• Integrity/checksum verification detects tampering and incomplete copies.
• Cancellation, disk-full simulation, collision, cleanup, and crash behavior are safe.
• A capsule can reproduce the included documented queries without source-system access.