Distillation

Date: Sep 16, 2026

• 🔴 (20:04) User-provided review policy mandates TDD failing-first for bug fixes: write a deterministic regression test first, confirm it fails on the base branch, then confirm it passes on the fix—“Never trust the fix without seeing it fail.”
• 🔴 (20:04) User-provided quality/REVIEW.md requires regression tests to drive the real precondition rather than artificially constructed state; a guard test must fail if the guard is deleted.
• 🔴 (20:04) User-provided adversarial state-order policy requires: 1. state already present before the operation meant to handle it; 2. delete-then-recreate sequences across lifecycle boundaries; 3. content modification while sync is disabled.
• 🔴 (20:04) User-provided review policy identifies skip/early-return branches as the highest-risk surface; every skip branch needs a test that makes it fire wrongly and proves it does not skip the required work.
• 🟡 (20:04) quality/REVIEW.md maps fan-out registries to contract batteries: SYNCED_TABLES → packages/core/test/sync-registry-contract.test.ts; MIGRATIONS → db.test.ts schema-version assertion plus migration-specific tests; AGENTS → agents.test.ts.
• 🟡 (20:04) Standing bug-class batteries are: 1. Registry contract—SYNCED_TABLES shape, pull-only guard, id-column correctness, versioned flag; 2. Sync invariants—no pull-only outbox, profiles ≤ 1, and every state row references a registered table, enforced by assertSyncInvariants in packages/core/src/sync-data.ts; 3. Sequence properties—post-operation invariants, prune-floor liveness, eventual convergence, no ping-pong, and currentTier correctness in packages/gateway/test/sync.property.test.ts.
• 🟡 (20:04) quality/REVIEW.md states property-based testing with faithful mocks found four sequence-dependent engine bugs missed by example tests across enable/disable/push/pull boundaries.
• 🟡 (20:04) quality/REVIEW.md recommends freezing memoized arrays shared by multiple callers so accidental mutation throws TypeError in strict mode rather than silently corrupting cache state.
• 🟡 (20:04) quality/REVIEW.md states db().query monkeypatches are shadowed by the tracing Proxy; SQL-counting tests must use log.registerSink({ withDbSpan }), because direct db().query = ... assignment is silently ignored.
• 🟡 (20:04) Mandatory adversarial-review checks include apply-then-revert mutants, property-test stability across 10 runs, hash-equivalence proofs, frozen-array mutation safety, stale-cache analysis, and structured per-point PASS / FAIL / CONCERN / MUST-FIX verdicts with file:line evidence plus an overall MERGE or DO-NOT-MERGE.
• 🟡 (20:05) vitest.config.ts includes tests from packages/core/test/**/*.test.ts, packages/core/eval/**/*.test.ts, packages/gateway/test/**/*.test.ts, packages/opencode/test/**/*.test.ts, and packages/pi/test/**/*.test.ts; it uses packages/core/test/setup.ts, Node environment, fork pool, and 300_000 ms test and hook timeouts.
• 🟡 (20:05) vitest.config.ts aliases @loreai/core to packages/core/src and @loreai/gateway to packages/gateway/src at top-level resolve.alias; placing aliases under test.resolve.alias silently resolves stale dist builds and can mask real failures.
• 🔴 (20:05) User-provided test-isolation rule states plugin-induced stderr silencing “never crosses a test boundary”; packages/core/test/setup.ts enforces this with afterEach(() => silenceStderr(false)).
• 🔴 (20:05) User-provided cache-isolation rule states a settled/alias project path→ID mapping cached by one test must “never be served to another test that reuses the same path”; packages/core/test/setup.ts calls invalidateProjectIdCache() after every test.
• 🟡 (20:05) packages/core/test/setup.ts creates one temporary directory via mkdtempSync(join(tmpdir(), "lore-test-")), sets LORE_DB_PATH to <temp>/test.db, closes the DB in afterAll, and removes the directory recursively with force.
• 🟡 (20:05) packages/core/test/setup.ts replaces globalThis.fetch with a guard that intercepts only https://models.dev/api.json, returns canned Anthropic/OpenAI model metadata with HTTP 200 and content-type: application/json, and delegates all other requests to the real fetch implementation.
• 🟡 (20:05) Canned models.dev data includes: claude-opus-4-6 costs input 5, output 25, cache read 0.5, context 1_000_000, output limit 128_000; claude-sonnet-4-20250514 costs 3/15/0.3, context 1_000_000, output 64_000; claude-haiku-4-5 costs 1/5/0.1, context 200_000, output 64_000; gpt-5.4-mini costs 0.75/4.5/0.19, context 400_000, output 100_000.
• 🔴 (20:05) User-provided gateway build invariant states the Node-only undici path is “never bundled or evaluated under Bun”—real undici@7 hangs on streaming response reads under Bun.
• 🔴 (20:05) User-provided gateway build invariant states the Bun path uses native fetch and “never touches undici”; undici is therefore safe only as a development dependency for the Node bundle path.
• 🟡 (20:05) packages/gateway/package.json identifies @loreai/gateway version 0.40.0, requires Node >=22.15, exports dist/index.bun.js for the bun condition and dist/index.cjs for require/default, and declares undici ^8.9.0 as a dev dependency.
• 🟡 (20:06) packages/gateway/script/bundle.ts copies ort-wasm-simd-threaded.mjs and ort-wasm-simd-threaded.wasm; injects a Sentry debug ID with skipSnippet: true; replaces PLACEHOLDER_DEBUG_ID; uploads sourcemaps only when SENTRY_AUTH_TOKEN exists; and deletes the map only after a successful upload.
• 🟡 (20:06) Generated dist/bin.cjs rejects Node versions below 22.15, suppresses process warnings, and runs require("./index.cjs").runCli().
• 🟡 (20:06) Generated gateway declarations define default ports as readonly [3207, 5673], primary DEFAULT_PORT as 3207, default host ["127.0.0.1"], default idle timeout 60 seconds, and default Anthropic/OpenAI upstreams https://api.anthropic.com and https://api.openai.com.
• 🟡 (20:06) Read-only candidate inspection confirmed actual state: working copy zkttmwuntxzm at commit b30b51fc2df58ae55a58170c315057892a5f05c5 is empty and clean; parent wywumkptssoy at 8063355cb32832bd8fac492bcbba7da22ae1976c is non-empty and clean; base pxrvwsvvkmpo at 2cbf40060c67df229731cf1b9e34d5bf22ec2145 is non-empty and clean.
• 🟡 (20:06) Read-only diff inspection found exactly two changed files: packages/gateway/src/pipeline.ts and packages/gateway/test/openai-responses-recall-aware-stream.test.ts; computed plain diff SHA-256 was exactly 007a15b7fd1bcf9b346d89911b2353098b6fec408c12d3b6fcc24a498a37a356.
• 🟡 (20:06) Jujutsu reported an unrelated conflicted bookmark fix/responses-private-references; neither candidate-range commit was conflicted.
• 🟡 (20:06) Validation environment reported Node v24.16.0 and pnpm 10.28.0.