Distillation

Date: Sep 16, 2026

• 🔴 (16:04) Projection security review verified candidate identity: change zlsmzkntqzzxsqvyxzzpxltmrsprymww, commit a3fa555bdcabb376aa33278bdb76007269f1940a, base 2cbf40060c67df229731cf1b9e34d5bf22ec2145, diff SHA-256 a7e914bd8ffb704f8fba2798f9de95fd4668b7212a485304c1cf7c056c278a40, and changed paths exactly packages/gateway/src/pipeline.ts and packages/gateway/test/openai-responses-recall-aware-stream.test.ts. Candidate range had no conflicts and the working copy remained clean with an empty child; unrelated bookmark fix/responses-private-references remained conflicted.
• 🔴 (16:04) Projection security review found unsupported event names under accepted prefixes, such as response.output_text.private, can pass as semantic because packages/gateway/src/pipeline.ts:8060-8074 classifies prefixes rather than exact event names. Validation does not reject unknown suffixes or payload fields, and remapping at :10008-10026, :11309-11327, and :11729-11749 copies payloads wholesale.
• 🔴 (16:04) Projection security review found arbitrary extension fields on otherwise valid semantic deltas, parts, items, created/in-progress events, reasoning, refusals, and function calls can survive public remapping.
• 🔴 (16:04) Projection security review found non-semantic principal frames are forwarded verbatim before recall is identified at packages/gateway/src/pipeline.ts:10364-10390, allowing an early private diagnostic or indexed extension to escape before a later or terminal-discovered recall.
• 🔴 (16:04) Projection security review found raw item fields survive terminal reconstruction at packages/gateway/src/pipeline.ts:9910-9972 and :9872-9889; failure envelopes use those raw items at :11931-12005 unless projectionInvalid is set. Potentially exposed fields include query, result, coverage, internal identity, and newline-bearing diagnostics.
• 🔴 (16:04) Projection security review found refusal extensions can enter GatewayResponse.content as opaque data at packages/gateway/src/stream/openai-responses.ts:824-859 and then reach temporal persistence through packages/gateway/src/pipeline.ts:13300-13310.
• 🔴 (16:04) Projection security review identified missing privacy regressions for: extensions before late or terminal-discovered recall; indexed custom events; unsupported names beneath accepted prefixes; unknown fields on semantic deltas, parts, items, created/in-progress frames, and failed output; and callback and persistence projections. Existing relevant coverage was at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:8223-8264 and :8372-8453.
• 🔴 (16:04) Projection security review found codex.rate_limits sanitization can be bypassed: applyResponsesEvent builds a reviewed top-level projection at packages/gateway/src/stream/openai-responses.ts:587-603, and packages/gateway/test/codex-usage-metadata.test.ts:97-112 tests removal of arbitrary fields, but the recall-aware principal path forwards the original raw payload at packages/gateway/src/pipeline.ts:10378-10390, potentially exposing fields such as authorization or debug.
• 🔴 (16:04) Projection security review found continuation codex.rate_limits state is accumulated into contState but lost because mergeContinuation() at packages/gateway/src/pipeline.ts:11435-11448 merges only output items, raw items, and usage—not codexRateLimits—so onComplete/postResponse receives incomplete quota accumulation.
• 🔴 (16:04) Projection security review found adversarial descending source-index order causes quadratic CPU work at packages/gateway/src/pipeline.ts:10176-10241: each non-tail insertion splices the visible-index array and rewrites all later map entries. An attacker can keep one sparse function identity unresolved so nothing is forwarded while repeatedly inserting visible items in descending order.
• 🔴 (16:04) Projection security review stated the existing performance test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:8310-8370 uses only 64 ascending indices and counts sort() calls, so it cannot detect splice/map-rewrite amplification.
• 🔴 (16:04) Projection security review found live dense remapping can contradict a Codex terminal snapshot. Live frames are remapped at packages/gateway/src/pipeline.ts:10268-10292 and :11744-11749, but when no recall executes the terminal is forwarded verbatim at :10718-10745; because terminal validation at :9382-9397 permits omission of streamed items, a sparse item may be exposed live at dense output_index: 0 and then followed by terminal output: [] or an output array missing that item.
• 🔴 (16:04) Projection security review raised a created_at validation concern: packages/gateway/src/pipeline.ts:9230-9238 accepts any finite non-negative number rather than requiring a non-negative safe integer, allowing fractional or unsafe values through rebuilding at :9877-9881. response.created and response.in_progress also do not validate/project created_at or extension fields before forwarding; tests cover only malformed continuation terminal values at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:8266-8308.
• 🔴 (16:04) Projection security review found failing-first and mutation discrimination unproven: production code and tests changed together across a three-commit stack; no evidence showed regressions failing on literal base 2cbf4006 or independently demonstrated each projection, suppression, and overflow guard.
• 🟡 (16:04) Projection security review passed hidden recall/reference lifecycle behavior: semantic principal events at packages/gateway/src/pipeline.ts:10483-10490 and continuation events at :11127-11133 enter applyResponsesEvent before suppression; non-semantic principal events at :10378-10390 and continuation events at :11049-11052 enter the private accumulator; item_reference uses a separate private lifecycle map at :9471-9573 and is intercepted at :10411-10413 and :11066-11075.
• 🟡 (16:04) Projection security review passed operational controls: principal retry clears projection and identity state at packages/gateway/src/pipeline.ts:11834-11848; continuation retry restores transactional counters and identity sets at :11347-11363; cancellation rolls back transactions and releases readers at :12027-12043; finish() enforces one callback attempt at :9638-9649; failure logs at :11624-11626 and :11893-11895 use fixed categories; packages/gateway/src/recall-diagnostics.ts:7-75 retains hashes only within the request closure and emits bounded aggregates; unsuccessful callbacks enter accounting rather than successful persistence at packages/gateway/src/pipeline.ts:18855-18886.
• 🟡 (16:04) Projection security focused validation passed 223/223 recall-aware stream tests in 18.67s and 15/15 Codex usage metadata tests in 6.92s, both with Vitest isolated temporary database setup and --printConsoleTrace. No exhaustive suite was run. A separate concurrent vitest run -- --printConsoleTrace remained active and was not altered.
• 🟡 (16:04) Projection security review verdict was DO-NOT-MERGE.
• 🟡 (16:04) Assistant froze candidate a3fa555b and stated it would never be pushed. Any still-running exhaustive validation could finish only as evidence; the candidate workspace would not be edited.
• 🟡 (16:06) Created isolated Git worktree ../opencode-lore-responses-projection-review-fix with working copy zuyzuzlq / 0330f63b as an empty child of immutable candidate zlsmzknt / a3fa555b; 1,072 files were added to the worktree with 0 modified and 0 removed.
• 🟡 (16:07) Named the isolated repair working copy zuyzuzlq / 5e86b63ea5d2d8bd5f707ef1ac04e611cef62f04, description fix(responses): complete hidden-output state. It remained clean, empty, and conflict-free atop zlsmzknt / a3fa555bdcabb376aa33278bdb76007269f1940a; base remained pxrvwsvv / 2cbf40060c67df229731cf1b9e34d5bf22ec2145, while bookmark fix/responses-private-references remained conflicted.
• 🟡 (16:07) Assistant planned to add four fail-first regression groups before changing production: 1. terminal-resolved ordinary tools; 2. exact extension redaction before and after recall; 3. quota state across chained retries; 4. no-recall sparse terminal consistency. The intended architecture change would follow only after those regressions.
• 🟡 (16:08) Projection exhaustive validator task ses_f5521ff1dffe3BUt7wNxDKTzjl returned only a Lore context warning and supplied no validation evidence.
• 🟡 (16:08) Assistant planned to separate public wire projection from internal accumulation using exact event names, public-frame field allowlists, a terminal-authoritative source-to-public index map, and explicit transactional quota state.
• 🟡 (16:09) Accumulation security review task ses_f5516ae57ffeIMuTqVZ4QeM4Ik returned only a Lore context warning and supplied no valid review evidence. Assistant deferred a fresh replacement review until the active correctness review and exhaustive gate returned.
• 🟡 (16:09) Assistant narrowed the projection correction to fail-closed public projection: always drop unsupported events, rebuild recognized events from allowlisted fields, merge quota metadata transactionally, and rebuild terminal output whenever live indices were remapped.
• 🟡 (16:09) Search found buffered accumulation logic at packages/gateway/src/pipeline.ts:18717-18720 that prepends currentResp.codexRateLimits to continuationResp.codexRateLimits.
• 🟡 (16:10) Inspection identified relevant state and transaction locations in packages/gateway/src/pipeline.ts: makeResponsesAccState() at lines 7877 and 7940; restoreTransactionBaseline() at 8016; transaction baseline creation at 10775; continuation state creation at 10904; mergeContinuation() at 11389; merge invocation at 11582; transaction completion/reset around 11688; and principal state reset at 11835.
• 🟡 (16:10) transactionBaseline at packages/gateway/src/pipeline.ts:10775-10780 clones state, usage, items, and rawItems; the inspected clone did not explicitly clone codexRateLimits.
• 🟡 (16:11) mergeContinuation() at packages/gateway/src/pipeline.ts:11389-11448 checks duplicate id/call_id identities across continuation and principal items/rawItems, shifts continuation indices using shiftedOutputIndex(idx, contIndex), and merges usage via mergeUsage(state.usage, contState.usage), but does not merge contState.codexRateLimits.
• 🔴 (16:11) User directive: “Always accumulate into the internal state for postResponse.”