Distillation

Date: Sep 10, 2026

• 🔴 [requested-review] (11:35) User requested a READ-ONLY independent security/supply-chain merge-gate review of getsentry/cli PR #1569 in /home/byk/.local/share/opencode/worktree/0e8c2f3bbe145a3280d6fb6ed900a5121f382cf0/toolkit-bridge-upgrade.
• 🔴 [enforced-workflow] (11:35) User required immutable Git objects as the sole evidence source and stated never to modify files, commits, branches, the worktree, or VCS state.
• 🔴 (11:35) User specified exact immutable base ec83887a16f780f32fba4b7d710bad262dba3a22 and exact immutable head 9525f72c70fabbb23ec21d13cf86add58f6287cc.
• 🟡 (11:35) User asked to verify the merge base, trees, paths, complete diff, and git diff --check, and to inspect every changed source and test file.
• 🟡 (11:35) User requested adversarial review of: typed genuine-404-only Toolkit-to-legacy fallback; terminal non-404/transport/TLS/malformed responses; source affinity across all GitHub/GHCR/delta/prefetch/changelog/download/setup stages; trusted pagination reconstruction and cycle handling; caller abort identity and body transport versus malformed JSON; strict npm response shape/status across npm, pnpm, bun, and yarn with no subprocess on invalid or non-404 responses; canonical Toolkit and legacy tags; stable/nightly pin and release-metadata validation; GHCR trimmed tokens, non-array annotations, OCI manifest/layer/digest/size/tag schemas, and repeated cursors; bearer-token removal on redirects; target/tracking channel separation; offline/cache behavior; delta final SHA and cleanup; and an end-to-end nightly selected-source blob/setup assertion.
• 🔴 (11:35) User stated the settled contract: the patch cache is intentionally source-neutral because dual publication is mandatorily byte-identical and the final SHA is verified; it should only be raised as an issue if a proven defect survives both guarantees.
• 🔴 (11:35) User required substantive non-empty findings first, ordered by severity, using PASS, CONCERN, MUST-FIX, or BLOCKED, with exact HEAD file:line evidence.
• 🔴 [requested-tests] (11:35) User required every defect to include a deterministic regression test and a concrete fix.
• 🔴 (11:35) User required the final review to state scope and residual risks; if blocked, include the exact command and error; the final line must be exactly MERGE or DO-NOT-MERGE.
• 🟢 (11:36) A file-discovery tool returned No files found.
• 🟡 (11:37) Git object verification reported base commit ec83887a16f780f32fba4b7d710bad262dba3a22, tree 110d6530e57ca4fbfb2a3f98e52013d2668b5b5e, parent e7beceb6ba09b64dc277ae1732df04e65500062b, subject fix(event): Prevent immediate retry of rate-limited org in event view fallback (#1566).
• 🟡 (11:37) Git object verification reported head commit 9525f72c70fabbb23ec21d13cf86add58f6287cc, tree 22f49363a13e32c36dcd9e1ca95916809c2dc271, parent a84012184c79c2566c7466aa6beda5f767199218, subject fix(cli): harden upgrade metadata validation.
• 🟡 (11:37) One verification command completed with no output.
• 🟡 (11:37) The immutable base-to-head diff contains 17 modified files, totaling 3,299 insertions and 433 deletions: packages/cli/src/commands/cli/upgrade.ts (180 insertions, 58 deletions); packages/cli/src/lib/binary.ts (181, 10); packages/cli/src/lib/delta-upgrade.ts (134, 36); packages/cli/src/lib/errors.ts (8, 0); packages/cli/src/lib/ghcr.ts (176, 37); packages/cli/src/lib/release-notes.ts (94, 40); packages/cli/src/lib/upgrade.ts (439, 81); packages/cli/src/lib/version-check.ts (13, 8); packages/cli/test/commands/cli.test.ts (17, 23); packages/cli/test/commands/cli/upgrade.test.ts (438, 56); packages/cli/test/lib/binary.test.ts (186, 2); packages/cli/test/lib/delta-upgrade.mocked.test.ts (7, 7); packages/cli/test/lib/delta-upgrade.test.ts (204, 16); packages/cli/test/lib/ghcr.test.ts (225, 10); packages/cli/test/lib/release-notes.test.ts (219, 2); packages/cli/test/lib/upgrade.test.ts (712, 46); packages/cli/test/lib/version-check.test.ts (124, 1).
• 🟡 (11:38) The base-to-head commit sequence was: 1. 04867eaf9b412a62d4b1ea1c59c2b382c557bd0b — feat(cli): add toolkit upgrade bridge; 2. 9c874298e3b57515ba36d35140627a668a46dc7b — fix(cli): address toolkit bridge review; 3. 723375b6ce4e37884e760fa0f848e7e7e3effcc9 — fix(cli): address upgrade review findings; 4. dbee7e9f2a4555e044f74dfebad002cccfa43a1f — test(cli): update toolkit upgrade fixtures; 5. 5ffa5cd0fe02c0a5dc5bec9a8a099f4135c0b447 — fix(cli): harden upgrade source resolution; 6. c8c815bbecf472061ec02ab96d1a31f23f078d01 — fix(cli): validate GitHub release pagination; 7. b6484e0fb1eb0f8bce68272d538f5c3b26cd5bd5 — fix(cli): validate resolved upgrade metadata; 8. c6030fbf4d0c190f037c86d832edb6680d3e54ab — fix(cli): bind nightly manifests to versions; 9. 2f9b5d0d26124d445a916b8bfc584ad518720584 — fix(cli): isolate pinned upgrade resolution; 10. 4a1d5bad105c006193c68459175f5eb3c7f78e08 — test(cli): update pinned version fixture; 11. e565b1afb39a341605adc883de8812851de7d581 — fix(cli): validate stable upgrade metadata; 12. f1c10a6cb1a753b8c4b8c613cd78735c3f12cba6 — fix(cli): preserve pinned upgrade contracts; 13. dcf6719995800d28d6f88a8c709abe4aa3d0b6db — test(cli): validate GitHub request origin; 14. e22f0eba66298a7228a988a4adcf1ec5be85227b — fix(cli): preserve source and cancellation provenance; 15. 878459c490576dbb7abb76d3a3dc1b5d9fc62c1f — fix(cli): fail closed on upgrade metadata; 16. 7d62ffa8317f9b98be0dc4afec0a927c1cabb0b7 — fix(cli): preserve paginated request cancellation; 17. cea7b2afba91f11f1cdbb1785ea97ba61159520c — fix(cli): validate release response shapes; 18. a84012184c79c2566c7466aa6beda5f767199218 — fix(cli): validate upgrade response bodies; 19. 9525f72c70fabbb23ec21d13cf86add58f6287cc — fix(cli): harden upgrade metadata validation.
• 🟡 (11:38) Immutable raw diff metadata confirmed all 17 paths remained mode 100644; representative blob transitions include packages/cli/src/commands/cli/upgrade.ts from 8d8282368307f48d894a54c6315a9c94af9f3ed2 to b3039d86b5935a806f265c906460686d83ee2c64, packages/cli/src/lib/upgrade.ts from 945adc48d962ce15e82b986e93196caabea21672 to b29d67ff2da3f1ba4940ec971aa9b11f41ed390f, and packages/cli/test/lib/upgrade.test.ts from 78963b47163a371015dfa190af14d24e6595fe23 to ffccf49016b3c37ec9fcb9f0ada57753ee9f5986.
• 🟡 (11:38) An attempted AGENTS file lookup failed with exact error: fatal: :(glob)**/AGENTS.md: pathspec magic not supported by this command: 'glob'.
• 🔴 (11:38) User stated that repo-setup must always be loaded before situation skills.
• 🔴 (11:38) User stated to always check package.json for the latest scripts; commands run from packages/cli or via pnpm --filter sentry run <script> from the repository root.
• 🔴 (11:38) User stated all packages must be placed in devDependencies, never dependencies, because everything is bundled at build time through esbuild and CI enforces this with pnpm run check:deps.
• 🔴 (11:38) User stated package additions must always use pnpm add -D <package> with the -D flag.
• 🔴 (11:38) User stated property-test invariants must always hold regardless of input; property tests use fcAssert(property(...), { numRuns: DEFAULT_NUM_RUNS }), with DEFAULT_NUM_RUNS shown as 50 runs.
• 🔴 (11:38) User stated that when property tests are added for a function already covered by unit tests, redundant unit tests should be removed and the unit-test file should receive a header comment identifying which invariants live in the property file.
• 🔴 (11:38) User stated required JSDoc coverage includes every exported function, class, and type, important internal items, and each type/interface field with its meaning, units, allowed values, null meaning, and defaults.
• 🔴 (11:38) User stated command files under src/commands/ should focus on: 1. argument parsing, including positional arguments, flags, and URL detection; 2. API orchestration, including fetching, error handling, and enrichment; 3. output dispatch through yield new CommandOutput(data).
• 🔴 (11:38) User stated never to pass a per_page value larger than API_MAX_PER_PAGE, because the server silently caps it and can cause fewer returned items than requested.
• 🟡 (11:39) Base/head line counts for the 17 changed files were recorded as: packages/cli/src/commands/cli/upgrade.ts 1,050/1,114; packages/cli/src/lib/binary.ts 597/768; packages/cli/src/lib/delta-upgrade.ts 627/725; packages/cli/src/lib/errors.ts 1,004/1,012; packages/cli/src/lib/ghcr.ts 520/659; packages/cli/src/lib/release-notes.ts 739/793; packages/cli/src/lib/upgrade.ts 1,144/1,502; packages/cli/src/lib/version-check.ts 496/501; packages/cli/test/commands/cli.test.ts 236/230; packages/cli/test/commands/cli/upgrade.test.ts 1,202/1,584; packages/cli/test/lib/binary.test.ts 790/974; packages/cli/test/lib/delta-upgrade.mocked.test.ts 500/500; packages/cli/test/lib/delta-upgrade.test.ts 1,846/2,034; packages/cli/test/lib/ghcr.test.ts 558/773; packages/cli/test/lib/release-notes.test.ts 295/512; packages/cli/test/lib/upgrade.test.ts 2,153/2,819; packages/cli/test/lib/version-check.test.ts 547/670.