Introduction

Chronicle records real application traffic and turns it into deterministic, replayable regression-test evidence.

It attaches around a supervised command, a running process, or a cgroup instead of requiring application instrumentation. Captured evidence is written to a local write-ahead log (WAL) before interpretation, reconstructed into a protocol-independent canonical session, and replayed only against an explicitly authorized loopback target.

Caution

Captured traffic can contain credentials and personal data. Replay can have side effects. Command mode executes only permitted reads against a Chronicle-owned supervised copy; explicit-target mode defaults to dry-run until --execute and all required gates are supplied. Chronicle never falls back to the recorded production destination.

What is supported now?

The current 0.1.x surface is intentionally narrow:

• Live eBPF capture on Linux for bounded plaintext HTTP/1.1 traffic.
• Recording around a command, an existing process, or a cgroup.
• A segmented, crash-recoverable WAL with in-WAL commit markers.
• ETL that publishes one deterministic canonical session per finalized epoch to local filesystem storage.
• Safe command-mode and explicit-target replay with loopback authorization.
• Fixture recording, inspection, catalog listing, and non-destructive readiness checks on any platform.

TLS decryption, HTTP/2+, other protocol implementations, remote persistence, encryption at rest, comprehensive redaction, Docker packaging, and Kubernetes packaging are not implemented.

The path

application behavior
        │
        ▼
eBPF capture evidence
        │
        ▼
segmented WAL ── durable commit boundary
        │
        ▼
ETL ── recover, decode, account for loss
        │
        ▼
canonical session ── inspect and store
        │
        ▼
loopback replay ── verify, never production fallback

Start with installation, then follow quick start. When you need the model behind the commands, read capture, WAL, canonical model, and replay.

Documentation status

English is the canonical source. Traditional Chinese and Japanese pages are maintained alongside the current English pages, with a localized counterpart for every supported page. Keep command names, format versions, and flags unchanged across locales. See terminology for recurring terms.