Distillation

Date: September 9, 2026

• 🔴 (15:44) User stated the repository is a colocated Jujutsu repo (.jj/ and .git/): mutations must use jj, while Git tooling is permitted only for read-only operations or functionality unavailable in jj.
• 🔴 (15:44) User stated Jujutsu operations “never fail on conflict”; rebase, new, and squash record conflicts in the resulting commit, after which jj st must be checked and files resolved manually rather than with interactive jj resolve.
• 🔴 (15:44) User stated Jujutsu safety rules: never use -i/--interactive; always supply -m "msg" when describing or committing; verify mutations with jj st and jj log; prefer stable letter-based change IDs over rewritten hexadecimal commit IDs; never rebase or describe immutable commits; use jj undo, jj op log, or jj op restore <op-id> for recovery.
• 🟡 (15:44) Assistant planned the read-only review sequence: verify the frozen revision and artifact hashes first; inspect the full parent-to-target diff, every changed file, relevant call sites, generated/package output, and tests; use jj --ignore-working-copy plus isolated validation that cannot access production data or services.
• 🔴 (15:44) User stated Lore is a Node.js >= 22.5 TypeScript monorepo using pnpm workspaces, SQLite WAL mode, and FTS5; its three packages relevant here are @loreai/core (packages/core/), @loreai/gateway (packages/gateway/), and @loreai/opencode (packages/opencode/), with the OpenCode package shipping raw TypeScript before this reviewed port.
• 🔴 (15:44) User stated tests use a temporary SQLite database configured via packages/core/test/setup.ts—“never the production DB.”
• 🔴 (15:44) User stated release policy: “Never manually bump versions or edit CHANGELOG.md”; Sentry Craft handles both automatically through the release workflow.
• 🔴 (15:44) User stated every non-trivial PR requires an adversarial correctness review before merge, while security/pentest review is a separate pass selected according to risk.
• 🔴 (15:44) User stated regression-test discipline: every defect found by adversarial review must receive a deterministic test in the same PR; the test must fail on the base branch, pass on the fix, and exercise the real precondition rather than an artificially seeded state.
• 🔴 (15:44) [requested-tests] User requires tests of guards to fail when the guard is deleted; a test that still passes without the guard does not prove the guard.
• 🔴 (15:44) User stated the TDD rule: “Never trust the fix without seeing it fail.”
• 🔴 (15:44) User identified skip/early-return branches as the highest-risk surface, specifically guards involving NOT EXISTS, latest <> 'upsert', and content matches; each needs a test that causes the branch to skip something incorrectly and proves that it does not.
• 🔴 (15:44) User requires adversarial state setup in real-world order: state already exists before the handling operation; delete-then-recreate spans lifecycle boundaries; and modifications occur while sync is disabled.
• 🔴 (15:44) User requires reviewers to run pnpm test, pnpm run typecheck, pnpm run lint, and pnpm run format:check, inspect exit codes even when output tails are blank, run property tests 10 times, hash-verify the tree remains unmodified, and provide structured per-point verdicts with file:line evidence and an overall merge verdict.
• 🔴 (15:45) Read-only verification matched the frozen repository revision and dist/server.js hash, but the first tarball check failed because packages/opencode/opencode-ai-opencode-0.22.6.tgz did not exist; the packed OpenCode artifact was subsequently located at /tmp/opencode/loreai-opencode-0.40.0.tgz and its hash matched the frozen value.
• 🔴 (15:45) User identified an upstream OpenCode client tarball at /home/byk/Code/opencode/packages/app/vendor/opencode-ai-client-1.17.13-v2.tgz.
• 🔴 (15:45) User identified generated package tarballs at /tmp/opencode/loreai-opencode-0.40.0.tgz, /tmp/opencode/loreai-gateway-0.40.0.tgz, and /tmp/opencode/loreai-core-0.40.0.tgz.
• 🔴 (15:46) The frozen diff contains exactly 15 changed files, with 2,904 insertions and 196 deletions: modified packages/core/src/fetch-interceptor.ts, packages/core/src/index.ts, packages/opencode/package.json, packages/opencode/src/index.ts, packages/opencode/src/internal.ts, packages/opencode/test/internal.test.ts, and pnpm-lock.yaml; added packages/core/test/fetch-interceptor-request.test.ts, packages/opencode/script/build.ts, packages/opencode/src/server-core.ts, packages/opencode/src/server-runtime.ts, packages/opencode/src/server.ts, packages/opencode/test/package.test.ts, packages/opencode/test/server-runtime.test.ts, and packages/opencode/test/server.test.ts.
• 🔴 (15:46) packages/core/src/fetch-interceptor.ts adds exported types DynamicRequestHeaders and DynamicRequestHeadersSource, exports rewriteRequest(), factors local-host detection into isLocalHost(), factors request screening into mayBeLLMRequest(), and replaces buildGatewayHeaders() with in-place applyGatewayHeaders().
• 🔴 (15:46) User stated the rewriteRequest() body-safety contract: known LLM paths may carry streaming bodies without the function reading them, while unknown paths “always pass through.”
• 🔴 (15:46) rewriteRequest() returns the original Request for non-LLM URLs, local hosts (localhost, 127.0.0.1, 0.0.0.0, ::1, [::1]), and unknown unmatched paths; direct gateway requests are also returned unchanged but their headers are observed through onRequestHeaders.
• 🔴 (15:46) For routed requests, rewriteRequestForProtocol() creates new Request(rewrite.gatewayUrl, request), preserves caller headers including authentication, adds x-lore-upstream-url and x-lore-upstream-path, adds dynamic headers only when the request has not already supplied them, and invokes the optional header observer.
• 🔴 (15:46) The installed fetch interceptor now converts input to a Request, delegates routing to rewriteRequestForProtocol(), preserves the original fetch(input, init) call when routing returns the same request, calls originalFetch(routed) for an original Request, and otherwise calls originalFetch(routed.url, { ...init, headers: routed.headers }).
• 🟡 (15:46) Added packages/core/test/fetch-interceptor-request.test.ts with 7 behavioral cases: 1. V2-style routing preserves method, body, authorization, x-api-key, path, query, dynamic attribution headers, and original-body unread state; 2. caller-provided x-lore-session-id overrides the dynamic value; 3. direct gateway requests remain identical while headers are observed; 4. local requests remain identical for 4 host forms; 5. non-LLM requests remain identical; 6. a streaming body on a known path routes without being read; 7. a streaming body on an unknown path is neither read nor routed.