Distillation

Date: Sep 16, 2026

• 🔴 (13:45) User asserted: “Failed output is never authoritative and must not reach accounting hooks.”
• 🔴 (13:45) User asserted: “Failed usage/accounting never depends on client demand.”
• 🟡 (13:44) packages/gateway/src/pipeline.ts now calls validateResponsesProviderFailureTerminal() for provider-failure terminals on both the principal stream and recall continuation stream before lifecycle handling; both paths emit log.error(RESPONSES_PROVIDER_FAILURE_LOG).
• 🟡 (13:44) packages/gateway/src/stream/openai-responses.ts adds exported constant RESPONSES_PROVIDER_FAILURE_LOG = "openai-responses provider failure" and logs it when a sanitized provider failure is accepted.
• 🟡 (13:44) Added validateResponsesProviderFailureTerminal(event, parsed, state, validation, maxSparseIndex, sanitizedFailure) in packages/gateway/src/stream/openai-responses.ts. It rejects when parsed.type !== event or !state.created; validates the sanitized response.failed payload through validatePublicResponsesEvent() or validateCodexResponsesEvent(); and calls validateFailureTerminal(parsed) for failure events other than error and response.error.
• 🟡 (13:44) Added projectResponsesInProgressEvent(parsed, state) in packages/gateway/src/stream/openai-responses.ts. It projects response.in_progress from trusted accumulator state: preserves sequence_number when present; uses state.id, state.createdAt, and state.model; fixes status: "in_progress" and output: []; and only accepts provider response.object when it equals "response", otherwise defaulting to "response".
• 🟡 (13:44) packages/gateway/src/pipeline.ts no longer forwards response.in_progress verbatim; it serializes projectResponsesInProgressEvent(parsed, state) so provider lifecycle metadata after response.created is advisory and only the trusted created-state projection reaches clients.
• 🟡 (13:44) accumulateResponsesSSEStream() in packages/gateway/src/stream/openai-responses.ts likewise sends projected JSON to opts.onValidatedEvent for response.in_progress, while other non-message events retain their original data.
• 🟡 (13:44) Responses validation now permits a provider model mismatch specifically on response.in_progress; model consistency remains enforced for other events.
• 🟡 (13:44) Responses event validation now explicitly calls validateResponsesUsage(parsed.response.usage, "malformed Responses usage").
• 🟡 (13:45) ResponsesAccState in packages/gateway/src/stream/openai-responses.ts now includes created: boolean, optional createdAt?: number, and optional lastAcceptedSequenceNumber?: number; initial state sets created: false.
• 🟡 (13:45) Added cloneResponsesAccState(state) using structuredClone(state) and restoreResponsesAccState(state, snapshot), which deletes keys absent from the snapshot and then restores snapshot fields with Object.assign.
• 🟡 (13:45) The live OpenAI Responses routing in packages/gateway/src/pipeline.ts:18864-19142 uses streamResponsesRecallAware() when the client protocol is openai-responses, no warning is injected, and a recall tool exists; otherwise it uses streamResponsesPassthrough() for no-recall passthrough or accumulateResponsesSSEStream() for warning/non-Responses-client buffering.
• 🟡 (13:45) In the recall-aware route, onComplete sends successful responses to finishStreaming(response) and unsuccessful responses to finishUnsuccessfulStreaming(response), while captureUnsuccessfulResponses() catches ResponsesTerminalError, accounts via finishUnsuccessfulStreaming(error.response), returns incomplete responses as { successful: false }, and suppresses other failed terminals from becoming client responses.