Distillation

Date: Sep 16, 2026

• 🔴 [enforced-workflow] (22:51) User requires always running the repository’s full validation path, including the gateway pretest bundle and aggregate Vitest suite, before classifying a candidate.
• 🔴 [enforced-workflow] (22:51) User requires recording exact validation exit codes, durations, file/test totals, failures, and relevant environmental warnings; production-build warnings must be reported separately from test failures, and code regressions must be distinguished from infrastructure/environment failures.
• 🔴 [enforced-workflow] (22:51) User considers a completed aggregate validation run conclusive even when it fails; disjoint fallback shards must be used only when the aggregate run is genuinely inconclusive due to a timeout, worker crash, or missing final totals. Before fallback runs, only workspace-owned workers may be cleaned up, and cleanup must be verified.
• 🔴 [requested-tests] (22:51) User requires the security matrix matching regex (never exposes non-semantic|never treats forged reasoning|rejects a .* continuation created_at|updates the principal projection); prior requested execution count was 10 runs with --printConsoleTrace.
• 🔴 [enforced-safety-invariant] (22:53) User requires: "Always accumulate into the internal state for postResponse."
• 🟡 (22:53) Candidate graph in /home/byk/Code/opencode-lore-responses-projection-security: lnvrxqoqsqutpvpx / f30236708bc9 (fix(responses): complete hidden-output state) descends from zlsmzkntqzzxsqvy / a3fa555bdcab (fix(responses): harden hidden-output projection), which descends from ozrmvotwxzuykyvu / 583020fad43e (fix(responses): stabilize sparse principal projection), then unznwpylspzqykmn / ab979df5cddf (fix(responses): project hidden output consistently), based on pxrvwsvvkmpoxnsq / 2cbf40060c67; all listed candidate-chain changes had conflict=false.
• 🟡 (22:53) Candidate diff adds hidden-output projection machinery including buildOutputItemsWithIndices, visible-output index remapping, sparse recall-index handling, projectionInvalid, terminal status validation, and continued internal accumulation for postResponse; tests include failed projections with { status: "failed", output: [] } and a response.completed continuation fixture using created_at.
• 🔴 [enforced-test-isolation] (22:55) User requires tests to use a temporary SQLite database via packages/core/test/setup.ts, never the production database.
• 🔴 [enforced-release-workflow] (22:55) User requires: "Never manually bump versions or edit CHANGELOG.md"; releases use Sentry Craft via GitHub Actions, which handles both automatically.
• 🟡 (22:55) Repository root package.json identifies lore-monorepo, pins packageManager and engine package manager to pnpm@10.28.0, defines "test": "vitest run", "build": "pnpm -r run build", "format": "oxfmt", and "premutation": "pnpm --filter @loreai/gateway run bundle".
• 🟡 (22:55) Repository package layout: @loreai/core in packages/core/ provides DB, distillation, knowledge/LTM, recall, gradient context management, and prompts; @loreai/gateway in packages/gateway/ provides the transparent LLM proxy, lore CLI, context management, and dashboard; @loreai/opencode in packages/opencode/ is the OpenCode lifecycle adapter; @loreai/pi in packages/pi/ is the Pi coding-agent extension adapter.
• 🟡 (22:55) Gateway CLI entry chain is packages/gateway/src/cli/bin.ts → packages/gateway/src/cli/main.ts via _cli(). Gateway build uses packages/gateway/script/build.ts for a CJS bundle and script/bundle.ts for a standalone binary; core build uses packages/core/script/build.ts for Node.js-compatible CJS output.
• 🟡 (22:55) Long-term knowledge architecture has 4 creation paths in order: 1. LLM Curator in packages/core/src/curator.ts, periodically returning create/update/delete operations; 2. Pattern Extraction in packages/core/src/pattern-extract.ts, regex-based without an LLM after each distillation; 3. File Import in packages/core/src/agents-file.ts, parsing .lore.md markers such as <!-- lore:UUID -->; 4. Consolidation through curator.ts consolidate() when entry count exceeds maxEntries of 25.
• 🟡 (22:56) packages/core/test/setup.ts creates one isolated temporary directory with mkdtempSync(join(tmpdir(), "lore-test-")), sets process.env.LORE_DB_PATH = join(tmp, "test.db"), and thereby prevents fixtures from reaching the live DB at ~/.local/share/lore/lore.db.
• 🟡 (22:56) packages/core/test/setup.ts replaces globalThis.fetch with a guard that intercepts only https://models.dev/api.json (MODELS_DEV_API) and returns CANNED_MODELS_DEV with HTTP 200 and content-type: application/json; all other requests delegate to captured realFetch.
• 🟡 (22:56) CANNED_MODELS_DEV contains: Anthropic claude-opus-4-6 with costs { input: 5, output: 25, cache_read: 0.5 } and limits { context: 1_000_000, output: 128_000 }; claude-sonnet-4-20250514 with costs { input: 3, output: 15, cache_read: 0.3 } and limits { context: 1_000_000, output: 64_000 }; claude-haiku-4-5 with costs { input: 1, output: 5, cache_read: 0.1 } and limits { context: 200_000, output: 64_000 }; OpenAI gpt-5.4-mini with costs { input: 0.75, output: 4.5, cache_read: 0.19 } and limits { context: 400_000, output: 100_000 }.
• 🟡 (22:56) The models.dev fetch guard prevents real gateway pre-warming from making live third-party calls during tests, avoiding failures when models.dev returns 500 or times out and preventing cross-file pollution of worker-model.test.ts fetch-mock assertions.
• 🟡 (22:56) packages/core/test/setup.ts registers afterEach() to run silenceStderr(false) and invalidateProjectIdCache(), preventing Pi/OpenCode force-active tests from leaving stderr silenced and preventing cached project path→ID mappings from crossing test boundaries.
• 🟡 (22:56) packages/core/test/setup.ts registers afterAll() to call close() and rmSync(tmp, { recursive: true, force: true }), closing the shared test DB and deleting its temporary directory.