Distillation

Date: Sep 16, 2026

• 🔴 [requested-review] (23:45) User requested a read-only, focused code audit in /home/byk/Code/opencode-lore-embedding-runtime of current working-copy changes for native ONNX Runtime selection and native-to-WASM fallback only.
• 🔴 (23:45) User directed that the audit must not edit files or mutate VCS.
• 🔴 (23:45) Audit scope: packages/core/src/ort-native.ts, embedding-worker.ts, embedding-worker-types.ts, packages/gateway/script/bundle.ts, ort-platform-package.ts, and relevant tests.
• 🟡 (23:45) User asked the audit to identify concrete correctness/security defects, unnecessary complexity, fallback loops, package-resolution boundary mistakes, platform/ABI mistakes, privacy leaks, and missing tests.
• 🔴 (23:45) Required runtime invariant: native ONNX Runtime is preferred for SEA/vendor, development, tests, and supported npm targets.
• 🔴 (23:45) Required runtime invariant: npm distribution can fall back to single-thread WASM.
• 🔴 (23:45) Required runtime invariant: missing or malformed native packages never throw.
• 🔴 (23:45) Required package-resolution invariant: undeclared ancestor packages never resolve.
• 🔴 (23:45) Required model-management invariant: vendored models are never purged or downloaded.
• 🔴 (23:45) Required privacy invariant: fallback posts no free-form native error.
• 🔴 (23:45) Required classification invariant: unrelated missing files are never classified as a missing ML stack.
• 🔴 (23:45) User required concise findings labeled PASS, CONCERN, or MUST-FIX, with exact file:line citations.
• 🔴 (23:45) User prohibited running the full test suite, accessing the network, or starting any service; focused read-only tests are permitted if needed.
• 🔴 (23:45) User stated this is a preliminary review, not the final immutable-candidate review.
• 🔴 (23:46) Repository /home/byk/Code/opencode-lore-embedding-runtime contains both .jj/ and .git/, making it a colocated Jujutsu repository; project workflow uses jj rather than git for mutations.
• 🔴 (23:46) Jujutsu workflow invariant: jj never fails on conflict; conflicts are recorded in the resulting commit and must be checked with jj st and resolved by editing files, not with interactive jj resolve.
• 🔴 (23:46) Project runtime is Node.js >= 22.5; language is TypeScript in a pnpm workspaces monorepo.
• 🔴 (23:46) Project database is SQLite with WAL mode and FTS5, normally stored at ~/.local/share/lore/lore.db.
• 🔴 (23:46) Tests use a temporary SQLite database through packages/core/test/setup.ts, never the production DB.
• 🔴 (23:46) Gateway build details: packages/gateway/script/build.ts produces the CJS bundle, while packages/gateway/script/bundle.ts creates the standalone binary.
• 🔴 (23:46) Core build details: packages/core/script/build.ts produces Node.js-compatible CJS output.
• 🔴 (23:46) Project review policy in quality/REVIEW.md requires every non-trivial PR to receive an adversarial correctness review before merge; review practices include regression-test discipline, adversarial-order state setup, fan-out registry coverage, recurring bug-class batteries, and the two-reviewer rule.
• 🔴 (23:46) Release directive: never manually bump versions or edit CHANGELOG.md; Sentry Craft handles both automatically.
• 🟡 (23:46) Release workflow commands documented: gh workflow run release.yml -f version=auto for conventional-commit-derived semver, or gh workflow run release.yml -f version=0.23.0 for an explicit version.
• 🟡 (23:46) Release workflow sequence: 1. scripts/bump-version.sh updates all package.json versions; 2. changelog is generated from conventional commits; 3. a release/X.Y.Z branch is created and pushed; 4. CI tests and builds npm tarballs, standalone binaries, and delta patches; 5. Craft opens a publish issue; 6. labeling it accepted triggers npm OIDC publishing and a GitHub Release with binaries and patches.