Distillation

Date: Sep 16, 2026

• 🔴 [requested-read-only-review] (23:45) User requested a read-only focused code audit in /home/byk/Code/opencode-lore-embedding-runtime; instructed not to edit files or mutate VCS.
• 🟡 (23:45) Audit scope is current working-copy changes for cgroup memory headroom and embedding-pool admission in packages/core/src/cgroup-memory.ts, embedding/local.ts, embedding/pool.ts, embedding-cap.ts, and relevant tests.
• 🟡 (23:45) User asked the audit to identify concrete correctness defects, unnecessary complexity, and missing edge-case tests, with concise per-finding PASS / CONCERN / MUST-FIX verdicts and exact file:line citations.
• 🟡 (23:45) User asked whether the logic preserves these invariants: the primary worker always exists; a cgroup limit is not mistaken for remaining free memory; unknown constrained headroom fails closed only for expansion; healthy sibling workers continue serving while a failed slot has retry debt; all unproven workers plus the next worker are charged; observed per-worker resident budget is represented safely; and no NaN or infinity occurs.
• 🔴 (23:45) User prohibited running the full test suite, network access, or any service during this audit; focused read-only test commands are allowed if needed.
• 🔴 (23:45) User stated this is a preliminary review, not the final immutable-candidate review.
• 🔴 (23:47) User stated tests must use a temporary SQLite database via packages/core/test/setup.ts — never the production DB.
• 🔴 (23:47) User stated the project runtime is Node.js >= 22.5, uses TypeScript with pnpm workspaces, and stores its SQLite WAL/FTS5 database at ~/.local/share/lore/lore.db.
• 🔴 (23:47) User stated releases use Sentry Craft through GitHub Actions and directed: Never manually bump versions or edit CHANGELOG. Craft handles both automatically.
• 🟡 (23:47) Documented release commands are gh workflow run release.yml -f version=auto for conventional-commit-derived semver or gh workflow run release.yml -f version=0.23.0 for an explicit version.
• 🟡 (23:47) Documented release workflow order: 1. scripts/bump-version.sh updates all package.json versions; 2. changelog is generated from conventional commits; 3. a release/X.Y.Z branch is created and pushed; 4. CI runs tests and builds npm tarballs, standalone binaries, and delta patches; 5. Craft opens a publish issue; 6. labeling it accepted triggers npm publishing via OIDC and a GitHub Release with binaries and patches.
• 🔴 (23:49) User stated adversarial-review defects must receive deterministic regression tests in the same PR that fail on the base branch, pass on the fix, and establish the real precondition rather than an artificial state.
• 🔴 (23:49) User stated tests of guards must fail when the guard is removed; otherwise they do not test the guard.
• 🔴 (23:49) User stated adversarial setup should include state present before the handling operation, delete-then-recreate across lifecycle boundaries, and modify-while-off sequences.
• 🔴 (23:49) User stated skip/early-return branches are the highest-risk surface and each skip branch needs a test that causes it to skip something incorrectly and proves that it does not.
• 🔴 (23:49) User stated the TDD rule: Never trust the fix without seeing it fail. Every bug fix should begin with a regression test confirmed failing on the base branch and then passing on the fix.
• 🔴 (23:49) User stated frozen shared arrays are preferred for memoized results shared across callers so accidental mutation throws a TypeError in strict mode rather than silently corrupting the cache.
• 🔴 (23:49) User stated db().query monkeypatches are shadowed by the tracing Proxy; SQL-counting tests should use log.registerSink({ withDbSpan }) because assigning db().query = ... is silently ignored.
• 🔴 (23:49) User stated non-trivial changes require two separate review passes: 1. adversarial/correctness review covering breaking states, enumerated cases, apply-then-revert mutants, property-test stability ×10, hash-equivalence proofs, frozen-array mutation safety, and stale-cache analysis; 2. security/pentest review covering injection, credential leaks, protocol attacks, and privilege escalation.
• 🔴 (23:49) User stated adversarial review is mandatory before merge for non-trivial changes, while security review depends on risk profile.
• 🟡 (23:49) General final-review policy requires pnpm test, pnpm run typecheck, pnpm run lint, and pnpm run format:check, checking exit codes; property tests must be run ×10, the working tree must end unmodified and hash-verified, and reports must provide per-point PASS / FAIL / CONCERN / MUST-FIX verdicts with file:line evidence plus an overall MERGE / DO-NOT-MERGE verdict. This session’s preliminary audit separately prohibits the full test suite.