Observatory

QEL produces a verdict every time it verifies work, and without Observatory those verdicts scroll past with the run that produced them. Observatory writes them down, keyed to the file they were about, so the question "has anything ever verified this file, and did it pass" has an answer.

The view is the Code-mode Map panel: with Observatory on, the map picks up verdict badges and a rail down the side. With it off, the panel shows an affordance telling you it is off rather than pretending there is no data to show.

It is a record, not a gate. Nothing about QEL's behaviour changes when you turn it on - it does not block, escalate, or re-verify. It only remembers.

Settings → AI Behavior → Observatory has exactly two switches:

The census only runs when both switches are on - turning on the census alone does nothing. It is a full walk of the project, so it costs real time on a large repo; that is why it is separate.

With observatory.enabled off, nothing is recorded at all. The backend route returns early and the panel does not fetch. Turning it on does not backfill - you start collecting from that moment forward.

One row per (run, file) in a local SQLite table, holding:

• the project path and file path
• the verdict, the score, and whether it passed
• a SHA-256 hash of the file's contents at verification time
• the session id and the repair iteration

The content hash is the part that makes the record trustworthy: a verdict is bound to the exact bytes it was about, so an old pass on a file you have since edited is identifiable as stale rather than silently reassuring.

Rows are scoped to your user id on both write and read, and the store prunes itself to the newest rows per (user, project) - observatory.verdict_retention_rows, default 5000, pruned in batches with a little slack so it is not trimming on every insert. The census is capped by observatory.census_max_files, default 20000.

Those two limits and a small local usage ledger (observatory.usage, one entry per distinct day the panel is opened) are deliberately not exposed in the settings UI. They exist as setting keys.

Observatory has no outbound network path. Its two data sources are the local SQLite verdict table and an on-disk file walk for the census; its endpoints are local read-only queries plus the one local write that records a panel open. There is no upload, no telemetry destination, and no behaviour difference in air-gap mode - because there was nothing to disable.

If you want the record gone, turning observatory.enabled off stops collection; the retention limit eventually ages out what was already stored.