Distillation

Date: Sep 16, 2026

• 🟡 (13:27) Focused projection matrix and TypeScript check passed: tsc --noEmit; Vitest reported 1 test file passed, 5 tests passed, 207 skipped, 212 total.
• 🟡 (13:27) Assistant added an adversarial visible-output control in packages/gateway/test/openai-responses-recall-aware-stream.test.ts: after source index 7 is published as public slot 0, a later ordinary visible item at source index 5 must fail closed before its frames escape because it would move source 7 to slot 1. This verifies the reindex guard is not recall-specific.
• 🟡 (13:29) The new lower-index visible-output test initially failed only in its assertion: production correctly raised principal_protocol, but normalized callback content contained canonical { type: "text", text: "already visible" } blocks rather than Responses item IDs. The test was corrected to assert the already-completed text in canonical content and the newly accepted lower-index item in private rawOutputItems, proving accumulation-before-rejection without assuming IDs survive text normalization.
• 🟡 (13:30) Corrected focused projection matrix passed: 1 test file passed, 5 tests passed, 208 skipped, 213 total.
• 🟡 (13:30) Complete packages/gateway/test/openai-responses-recall-aware-stream.test.ts suite passed all 213/213 tests.
• 🟡 (13:31) First mutation proof temporarily disabled principal output_index rewriting in packages/gateway/src/pipeline.ts. Exactly 3 sparse projection tests failed as intended: 1. allows a terminal-discovered recall that preserves sparse visible output positions, 2. allows a late recall that preserves sparse visible output positions, 3. allows deferred sparse output before a higher-index recall. Each failed because the emitted sparse source index did not identify the corresponding item in terminal response.output.
• 🟡 (13:31) Principal output_index rewriting was restored after the mutation proof.
• 🟡 (13:32) Second mutation proof disabled only stored-map stability checking in packages/gateway/src/pipeline.ts; the later visible lower-index control stopped failing closed as expected, proving the stability guard detects public-slot reassignment. The guard was subsequently restored.
• 🟡 (13:31) Projection implementation details in packages/gateway/src/pipeline.ts: buildOutputItemsWithIndices() sorts the union of state.rawItems and state.items, excludes explicitly hidden indices and raw item_reference entries, and builds terminal-visible items; visibleOutputIndexMap() assigns dense public positions from that exact ordered set; remapVisibleOutputIndices() rewrites each parsed frame’s output_index and throws "hidden Responses output item reached the client" if its source index is absent; forwardedVisibleOutputIndices stores delivered source-to-public assignments; assertForwardedProjectionStable() throws "Responses output changed a client-visible output_index" and sets projectionInvalid = true if a later state would change any delivered assignment.
• 🟡 (13:33) Provider security review session ses_f55b91206ffeI1n4PmsKUWUka6 initially returned only [lore:context-warning] Lore could not retrieve more memory; this was treated as a context-retrieval failure rather than a review verdict.
• 🔴 [provided-debugging-workaround] (13:34) User stated recall context warnings can be bypassed with lore recall or http://127.0.0.1:3207/ui/search; the ordinary recall mechanism is broken in the area currently being fixed.
• 🟡 (13:35) Projection source-set audit concluded that the shared public map matches terminal-visible output: private item_reference entries are excluded, unresolved calls remain deferred, and recall indices reserve the slot later occupied by the synthetic recall anchor. This preserves each slot assignment from first client delivery through terminal reconstruction.
• 🔴 [corrected-workflow] (13:36) User instructed not to retire a reviewer after another context warning because doing so discards existing work; the same review session must instead be resumed with new instructions.
• 🟡 (13:36) Exact provider security reviewer session ses_f55b91206ffeI1n4PmsKUWUka6 was resumed with its prior state preserved and instructed to recover context via lore recall or the local search UI rather than the broken recall tool.
• 🟡 (13:37) Formatted projection validation passed 218/218 tests across the full recall-aware suite and adjacent principal-transport coverage, including packages/gateway/test/sentry-principal-transport-failure.test.ts.
• 🟡 (13:37) Provider security reviewer verified immutable change wswlsmrn, commit 24880457763b6f10831856d01c41bd72d62ddc28, based on main@origin commit 2cbf40060c67df229731cf1b9e34d5bf22ec2145. Plain diff SHA-256 remained c79cc2ec010e22f01961d8eec7bce3a60b8dfcb02c12b9ce4c0de9c5e173cb4d; exactly 6 changed files matched scope and the candidate had no conflicts. The live worktree changed from clean to 4 modified files during review, so the reviewer completed analysis using immutable jj file show -r wswlsmrn evidence.
• 🟡 (13:37) Provider security MUST-FIX finding 1: malformed non-JSON error events can bypass sanitization and leak provider text. Principal parsing in packages/gateway/src/pipeline.ts:10135-10156 forwards non-JSON events unless their name starts with response. or equals message, while sanitization occurs only after successful JSON parsing at pipeline.ts:10284-10320. Continuation parsing has the same flaw at pipeline.ts:10921-10944, with raw frames potentially queued for client delivery at pipeline.ts:11259-11268. Required regressions cover principal and continuation paths under recall pending, backpressure, EOF, and later successful or failing terminals.
• 🟡 (13:37) Provider security MUST-FIX finding 2: visible response.in_progress frames can leak untrusted metadata before a later sanitized failure. Recall-aware validation at packages/gateway/src/pipeline.ts:9183-9198 checks identity, status, and empty output but does not project or validate model, timestamp, top-level extensions, or nested diagnostics before forwarding at pipeline.ts:11664-11675. Plain passthrough rejects model changes but still forwards arbitrary extensions and changed timestamps at packages/gateway/src/stream/openai-responses.ts:1094-1118 and :2583. Existing coverage at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:820-894 covers only an in-progress frame hidden behind active recall; visible no-recall coverage is required. Recommended fix: construct every visible lifecycle frame solely from trusted response.created state.
• 🔴 (13:37) User requires every provider failure to emit a fixed categorical provider-failure log message.
• 🔴 (13:37) User requires callback and rollback errors never be passed into logs or Sentry.
• 🟡 (13:37) Provider security MUST-FIX finding 3: valid provider failures currently settle without a categorical error log in buffered/plain handling at packages/gateway/src/stream/openai-responses.ts:2134-2174, recall-aware principal handling at packages/gateway/src/pipeline.ts:10284-10333, and continuation handling at pipeline.ts:10959-10983. Conversely, arbitrary callback Error values are logged at openai-responses.ts:2764-2774, pipeline.ts:9618-9628, and rollback handling at pipeline.ts:8033-8040; log.error() exports messages and sanitized stacks to durable sinks and Sentry at packages/core/src/log.ts:206-222 and :497-504, while pattern redaction does not remove arbitrary callback text.
• 🟡 (13:37) Provider security concern: sanitized failure handling in packages/gateway/src/stream/openai-responses.ts:2134-2174 calls applyResponsesEvent() without the terminal snapshot used by the normal branch beginning at :2179. Because applyResponsesEvent() sets terminal state and stop reason before validating usage at openai-responses.ts:845-928, malformed or overflowing failure usage can throw after partial accumulator mutation. Required tests must verify full pre-event state restoration in public and Codex modes.
• 🟡 (13:37) Provider security reviewer identified missing proof/cross-products: 1. malformed non-JSON error in principal and continuation, 2. visible response.in_progress metadata poisoning, 3. malformed failure usage with complete state restoration, 4. throwing onComplete and rollback callbacks with sink/Sentry assertions, 5. Codex rate-limit events followed by failure, 6. numbered principal frames followed by a locally synthesized failure. Existing green evidence included 615/615 tests, repeated 200/200 sequence batteries, static checks, and bundle output, but no failing-first or guard-removal artifact for that candidate.
• 🟡 (13:37) Provider security reviewer verified protections: gateway-owned contiguous terminal sequence numbering; rejection of duplicate, decreasing, negative, non-integer, and unsafe source sequence values before sanitizer or accumulator mutation; replacement of provider terminal ID, model, creation time, output, error details, and extensions with a fixed envelope; clearing failed completion content/raw output while preserving validated usage; fail-closed handling for lifecycle/identity/reference contradictions; failure accounting before terminal backpressure and despite client cancellation; unsuccessful finalization accounting and rollback without successful-turn persistence; bounded usage and request-wide limits; and suppression of recall-bearing failed output/arguments from client output, completion callbacks, and successful persistence.
• 🟡 (13:37) Provider security review verdict was DO-NOT-MERGE. No candidate tests were rerun by that reviewer; a read-only import probe could not execute because the checkout lacked the expected built @loreai/core artifact.
• 🟡 (13:38) Repository formatting gate passed: oxfmt --check reported all matched files correctly formatted across 874 files, completing in 813 ms with 4 threads.