Distillation

Date: Sep 16, 2026

• 🔴 (13:58) Native-loader diagnostics must use a fixed categorical message; hostile absolute paths and embedded newlines from raw loader errors must never reach log sinks.
• 🟡 (13:58) Independent native-candidate audit issued a MUST-FIX/DO-NOT-MERGE finding for packages/core/src/embedding-worker.ts:232-242: it discards structured Error.code and classifies only err.message, while packages/core/src/embedding-worker-types.ts:227-235 expects ERR_DLOPEN_FAILED in the message. Node stores that value separately in error.code.
• 🟡 (13:58) Native-loader classification misses real failures including failed to map segment from shared object, not a valid Win32 application, version 'GLIBC_…' not found, and wrong ELF class. These become init-error, causing another native attempt instead of the one-shot WASM fallback.
• 🟡 (13:58) packages/core/test/embedding-worker-types.test.ts:82-100 uses a synthetic message containing [ERR_DLOPEN_FAILED] and therefore does not reproduce Node’s real structured error shape. Audit required passing the structured error code to the classifier and adding Linux, macOS, Windows, noexec, and version-mismatch cases.
• 🟡 (13:58) Independent audit found bundle freshness checks incomplete: packages/gateway/test/bundle-exports.test.ts:60-62,114-123 considers only dist/index.cjs and dist/index.bun.js, although regressions at packages/gateway/test/bundle-exports.test.ts:185-413 read and execute embedding-worker.cjs and embedding-worker.js. A stale worker can therefore be tested without triggering a rebuild; audit recommended including both workers, preferably every asserted generated artifact, in the freshness set.
• 🟡 (13:58) Independent audit found the symlink regression does not prove binding-level containment. The guard is at packages/core/src/ort-native.ts:157-160, but packages/core/test/ort-native.test.ts:422-438 symlinks the entire bin directory and is already rejected by packages/core/src/ort-native.ts:271-272; removing the binding-level guard would leave the test green. Required regression: escaped onnxruntime_binding.node symlinks with an otherwise-contained bin tree for both workspace and published-package routes.
• 🟡 (13:58) Independent audit found packages/core/src/embedding-worker.ts:235-239 emits and forwards raw loader messages, which packages/core/src/embedding/local.ts:768-771 interpolates into persistent logs. Real messages can expose absolute installation paths and inject newlines.
• 🟡 (13:58) Independent audit raised a Bun-parity concern: both worker artifacts are exercised through Node’s Worker in packages/gateway/test/bundle-exports.test.ts:196-413, with __filename and require manually injected, so the tests do not validate Bun’s loader, globals, or native-error shape. Source and build settings appear symmetric, but there is no real Bun integration regression for the problematic runtime.
• 🟡 (13:58) Native audit passed the resolver’s checks for supported targets, exact package/version identity, glibc compatibility, canonical containment, regular files, native magic, and ambiguous N-API layouts.
• 🟡 (13:58) Native audit confirmed packaging shares the target registry and embeds the same ONNX Runtime version in CJS and ESM workers; main-thread fallback is sticky and limited to one native-to-WASM transition; artifact probes model real pre-fix malformed and load-failing Node addons.
• 🟡 (13:58) Audited candidate was tmzmtlss / e6d0f1edc8504c79ef3a6baacb1d74e4908e116b, parent 2cbf40060c67df229731cf1b9e34d5bf22ec2145, with plain-diff SHA-256 63ee4287e8fa794a661519a52a493edf6dba857a33b5da39b33bc0e40d7950da. Candidate was conflict-free, though an unrelated bookmark conflict remained.
• 🟡 (13:58) Native audit validation passed 125 tests across 4 focused files. Scoped files matched the candidate before and after testing, bundle hashes stayed unchanged, and the audit performed no edits, builds, network access, service operations, or VCS mutations.
• 🟡 (13:58) The repo-setup skill was unavailable during the native audit, so the reviewer manually examined AGENTS.md, quality/REVIEW.md, and package manifests.
• 🟡 (13:59) Assistant reported the independent cgroup review found four blocking correctness faults: 1. repeated admission against one headroom sample, 2. hybrid/duplicate mount misresolution, 3. fail-open behavior when inspection is unknown, and 4. permanent topology caching.
• 🟡 (13:59) Assistant concluded both independent audits blocked the candidate. Planned workflow: add separate failing counterexamples for each native and cgroup guard, preserve failure evidence, then apply the smallest fixes.
• 🟡 (13:59) Work status changed: “Finish independent cgroup admission review” completed; “Address native runtime review findings with failing-first regressions” became in progress. Pending high-priority work remained: address cgroup findings with failing-first regressions; run full final validation and mutation proofs; freeze the exact candidate and obtain final correctness and security verdicts. Pending medium-priority work remained: commit the completed Jujutsu change and report runtime guidance.