Distillation

Date: Sep 10, 2026

• 🟡 (03:17) User requested a READ-ONLY correctness merge-gate review of getsentry/cli PR #1569 in repository /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade, comparing exact base ec83887a16f780f32fba4b7d710bad262dba3a22 with head e565b1afb39a341605adc883de8812851de7d581.
• 🔴 [enforced-read-only-review] (03:17) User directed that immutable Git objects must be inspected only via git show HEAD:<path>, git diff base..head, and Git object metadata; never inspect working-tree file contents and never fail based on worktree drift.
• 🔴 [prohibited-file-modification] (03:17) User stated: “Never modify files.”
• 🔴 [requested-review] (03:17) User required inspection of every changed file and test in PR #1569.
• 🔴 (03:17) User defined the review scope as the entire upgrade bridge: stable excludes SemVer prereleases; exact pinned metadata is validated; pinned bypasses latest; pinned nightly target drives standalone distribution; source-specific nightly existence annotation equality; channel selectors use latest; 404-only behavior; affinity; canonical pagination; changelog raw/prefetched behavior; GHCR abort/token/redirect behavior; delta/full/cache/offline behavior; and API compatibility.
• 🔴 (03:17) User identified intentional behavior that nightly repository probing uses a source-neutral verified cache.
• 🔴 (03:17) User required a non-empty, findings-first report classifying findings as PASS, CONCERN, MUST-FIX, or BLOCKED, with exact head file:line evidence, a deterministic regression case for each defect, and residual gaps.
• 🔴 (03:17) User required the review’s final line to be exactly MERGE or DO-NOT-MERGE; an empty report is forbidden.
• 🟡 (03:17) Git metadata showed base commit ec83887a16f780f32fba4b7d710bad262dba3a22, authored by sentry[bot] <39604003+sentry[bot]@users.noreply.github.com> and committed by GitHub, titled fix(event): Prevent immediate retry of rate-limited org in event view fallback (#1566).
• 🟡 (03:17) Base commit metadata explained event-view fallback bug CLI-2Y1: when resolveEventInOrg encountered HTTP 429, the error was treated as a generic transient failure and sameOrgSearched remained false, causing findEventAcrossOrgs to immediately retry the same rate-limited organization.
• 🟡 (03:17) Base commit fix introduced orgRateLimited in tryEventFallbacks, sets it when resolveEventInOrg catches an ApiError with status 429, excludes the organization from findEventAcrossOrgs when either sameOrgSearched or orgRateLimited is true, and adds logger.debug to satisfy no-silent-catch; verification added a 429-specific unit test in test/commands/event/view.test.ts.
• 🟡 (03:17) Git metadata showed head commit e565b1afb39a341605adc883de8812851de7d581, authored and committed by Burak Yigit Kaya <byk@sentry.io>, titled fix(cli): validate stable upgrade metadata.
• 🟡 (03:17) PR #1569 changes 16 files with 2,333 insertions and 370 deletions: packages/cli/src/commands/cli/upgrade.ts, packages/cli/src/lib/binary.ts, packages/cli/src/lib/delta-upgrade.ts, packages/cli/src/lib/ghcr.ts, packages/cli/src/lib/release-notes.ts, packages/cli/src/lib/upgrade.ts, packages/cli/src/lib/version-check.ts, packages/cli/test/commands/cli.test.ts, packages/cli/test/commands/cli/upgrade.test.ts, packages/cli/test/lib/binary.test.ts, packages/cli/test/lib/delta-upgrade.mocked.test.ts, packages/cli/test/lib/delta-upgrade.test.ts, packages/cli/test/lib/ghcr.test.ts, packages/cli/test/lib/release-notes.test.ts, packages/cli/test/lib/upgrade.test.ts, and packages/cli/test/lib/version-check.test.ts.
• 🔴 (03:18) User stated large artifacts are always written with pipeline() into createWriteStream() rather than buffering the complete payload in memory, to avoid memory peaks and preserve backpressure in shipped CLI workloads.
• 🔴 (03:18) User stated the Node-version pinning convention uses workflow-level environment variables NODE_VERSION_22: "22.23.1" and NODE_VERSION_24: "24.18.0"; every actions/setup-node step references ${{ env.NODE_VERSION_22 }} or ${{ env.NODE_VERSION_24 }}, with matrix jobs using ${{ matrix.node == '24' && env.NODE_VERSION_24 || env.NODE_VERSION_22 }} rather than bare "22" or "24" strings.
• 🔴 (03:18) User stated the npm package’s Node.js matrix pattern builds on the development Node floor, 22.15+, and smoke-tests across matrix versions using NODE_VERSION_20: "20.20.2" for the WASM-SQLite floor, NODE_VERSION_22: "22.23.1", and NODE_VERSION_24: "24.18.0"; the build job uses env.NODE_VERSION_22, while smoke tests use matrix.node with environment-variable fallbacks so the fallback path is exercised in CI.
• 🔴 (03:18) User stated ApiError must be preserved so classifySilenced in src/lib/error-reporting.ts can silence HTTP 401–499 errors; wrapping it in generic CliError loses status and causes errors such as 403 responses to be captured.
• 🔴 (03:18) User specified rethrowing API failures as new ApiError(msg, error.status, error.detail, error.endpoint) with a terse message because ApiError.format() appends detail and endpoint.
• 🔴 (03:18) User stated ValidationError must always receive field; omitting field collapses unfielded errors into one fingerprint.
• 🔴 (03:18) User stated fingerprint-rule changes do not retroactively re-fingerprint events, so new groups must be manually merged into canonical old parents; the ApiError rule keys by api_status + command.
• 🔴 (03:18) User stated extraction errors for embedded PPDBs via extractEmbeddedPpdb, IL2CPP mappings via createIl2cppLineMapping, and source bundles in src/lib/dif/scan.ts and src/lib/dif/index.ts are always caught per object, logged at debug level, and swallowed—never aborting the surrounding upload or scan—in accordance with legacy Rust sentry-cli behavior.
• 🔴 (03:18) User stated PeekResult.format is never 'unknown'; unrecognized formats return null from peekHeader.
• 🔴 (03:18) User stated nested ZIP archives are never recursively scanned, regardless of the scanZips setting.
• 🟡 (03:18) Repository instructions identified Jared as an autonomous GitHub coding agent working in /workspace/repo, with pipeline triage → explore → plan → implement → review → ship; worker is a deprecated alias for implement.
• 🟡 (03:18) Jared model-role mapping was provided: primary heavy triage/plan/review uses Claude Opus 4.8; primary light triage/plan/review uses xAI Grok 4.3; explore uses OpenAI gpt-5-mini; implement uses Moonshot kimi-k2.7-code; and ship uses xAI Grok grok-build-0.1.
• 🟡 (03:18) Repository instructions said operator turns labeled New operator chat or Operator guidance: skip triage and should be treated directly as the task; long-term Outpost knowledge lives in .lore.md when present; target repositories require reading AGENTS.md or CONTRIBUTING.md first; skills are under .agents/skills/, generated from skills/ by scripts/sync-skills.mjs; and repo-setup must be loaded before situation-specific skills.
• 🟡 (03:18) Git reported that root CONTRIBUTING.md does not exist in HEAD; relevant repository guidance files found were AGENTS.md, packages/cli/.cursor/rules/ultracite.mdc, packages/cli/AGENTS.md, and packages/cli/CONTRIBUTING.md.