Distillation

Date: Sep 16, 2026

• 🔴 [requested-review] (18:12) User requested a read-only independent security/pentest review of frozen v10 at base commit ab9408c81cc9916177641ae8e9f08624fc27b5b9.
• 🔴 (18:12) User specified patch /tmp/opencode/session-recovery-final-v10.patch with expected SHA-256 07b95915924ccf5dcfdf7ea5eb45d6cf972a6058664518935154dff9934222b2.
• 🔴 (18:12) User specified SEA /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server with expected SHA-256 1117176c4cfbf77527216b4161b54f8d3918ca7f7415747117c24f94d8e0b090.
• 🔴 [enforced-read-only] (18:12) User prohibited mutating source, refs, index, or services and prohibited running builds or tests during the review.
• 🔴 (18:12) User required verification of hashes, clean patch application, and inspection of all 33 changed files; any hash, base, clean-apply, or 33-file mismatch was treated as a stop condition.
• 🔴 (18:12) User required threat modeling of corrupt durable rows/events; same-Session and cross-Session identity collisions; stale owners; replay; cancellation; provider/tool side effects; queue/steer leakage; wake amplification/starvation; and fail-open paths.
• 🔴 (18:12) User identified the primary v10 closure target from v9: recovery projection error handling compares the complete stored identity—Session, execution, assistant, deterministic continuation, and phase; mismatches quarantine the exact execution+owner; zero-row quarantine proves deletion or ownership transfer.
• 🔴 (18:12) User required verification that regression quarantines an execution claim blocked by a conflicting recovery identity reaches the complete-identity mismatch/quarantine path.
• 🔴 (18:12) User required reassessment of cancellation cancelling fail-closed behavior; live/expired lease invariants; startAssistant ordering; provider failure and hosted-tool reconciliation; pre-promotion admission race; continuation reservation/public retry rejection; bounded fairness; schema/generated contracts; dependency direction; and authorization/isolation.
• 🔴 (18:12) User accepted the final synchronous claim-check-to-physical-external-call race as a residual risk.
• 🔴 (18:12) User stated multi-node interrupt routing remains process-local by documented contract.
• 🔴 (18:12) User reported exact-source evidence: 231 recovery tests; full Core result of 1168 passing after an isolated timeout; 10 repeated stress passes; five typechecks; manifest/migration/diff gates; and exact SEA health/schema/recovery/idempotence smoke.
• 🔴 (18:12) User required the final review to provide substantive findings by severity with exact candidate file:line evidence, classifications PASS/CONCERN/MUST-FIX, residual assumptions, non-empty output, and an ending of exactly MERGE or DO-NOT-MERGE.
• 🔴 (18:12) User instructed the reviewer not to use recall.
• 🟡 (18:12) Assistant stated the required repo-setup skill was unavailable and committed to following repository instructions directly while keeping the review strictly read-only.
• 🟡 (18:13) Input verification showed /tmp/opencode/session-recovery-final-v10.patch had SHA-256 07b95915924ccf5dcfdf7ea5eb45d6cf972a6058664518935154dff9934222b2, matching the expected patch hash.
• 🟡 (18:13) Input verification showed /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server had SHA-256 1117176c4cfbf77527216b4161b54f8d3918ca7f7415747117c24f94d8e0b090, matching the expected SEA hash.
• 🟡 (18:13) The original /home/byk/Code/opencode working tree was not clean: it contained modifications/deletions across the target files plus untracked packages/core/src/session/execution/claim.ts, packages/core/src/session/recovery-id.ts, perf.data, and perf.data.old.
• 🟡 (18:13) The initial review path /tmp/opencode/session-recovery-v10-review did not exist (NotFound: FileSystem.access); a subsequent operation completed with no output, after which files were read from that review path.
• 🟡 (18:13) Patch inspection confirmed exactly 33 changed files, including new packages/core/src/database/migration/20260914170650_session-recovery.ts, packages/core/src/session/recovery.ts, packages/core/test/session-execution-local.test.ts, packages/core/src/session/execution/claim.ts, and packages/core/src/session/recovery-id.ts.
• 🟡 (18:15) Patch statistics were exactly 33 files changed, 7,167 insertions, and 418 deletions; the patch file contained 9,802 lines.
• 🔴 (18:14) User stated repository runtime dependency direction must remain Schema → Core and Protocol, then Core and Protocol → Server; Client runtime code may depend on Schema and Protocol but never Core or Server; sdk-next composes Client, Core, and Server.
• 🔴 (18:14) User stated imports must never be aliased; forms such as import { foo as bar } from "..." and resolve as pathResolve are prohibited.
• 🔴 (18:14) User stated star imports must never be used; both import * as Foo from "..." and import type * as Foo from "..." are prohibited.
• 🔴 (18:14) User stated type checking must always use bun typecheck from package directories such as packages/opencode, never tsc directly.
• 🔴 (18:14) User stated tests cannot run from the repository root because of the do-not-run-tests-from-root guard; tests must run from package directories such as packages/opencode.
• 🔴 (18:14) User stated current V2 Session Core invariants include: durable prompt admission remains separate from model execution; SessionV2.prompt(...) admits one durable session_input before advisory SessionExecution.wake(sessionID) unless resume: false; the serialized runner promotes admitted inputs at safe boundaries.
• 🔴 (18:14) User stated Session ID reuse adopts the existing Session; prompt message ID reuse reconciles only an exact retry where Session, prompt, and delivery mode match; conflicting reuse fails; historical projected prompts lazily synthesize promoted inbox records during exact retry.
• 🔴 (18:14) User stated SessionExecution is process-global and Session-ID based; its local implementation owns the process-local Session coordinator and discovers placement via SessionStore and LocationServiceMap.get(session.location) only when a drain starts; V2 interruption targets the active process-local ownership chain, while idle or missing interruption is a no-op.
• 🔴 (18:14) User stated SessionRunner, model resolution, tool registry, permissions, and filesystem are Location-scoped; omitted Location.workspaceID means implicit-local placement.
• 🔴 (18:14) User stated each provider turn must have one explicit llm.stream(request) call and projected history must be reloaded before durable continuation; orchestration must not bridge through legacy SessionPrompt.loop(...) or an in-memory tool loop.
• 🔴 (18:14) User stated local Session drains remain process-local until clustering exists; SessionRunCoordinator joins explicit same-Session resumes, coalesces prompt wakeups, and permits different Sessions to run concurrently; EventV2 replay owner claims remain separate from clustered Session execution ownership.
• 🔴 (18:14) User stated delivery semantics: prompts steer by default and promote at the next safe provider-turn boundary while continuation is needed; explicit queue input stays pending until the Session would otherwise become idle; one queued input is promoted at that boundary before continuation is reevaluated; promoting new user input resets the selected agent’s provider-turn allowance, with a steer batch resetting it once.
• 🟡 (18:16) packages/core/src/session/execution/claim.ts defines claim identity as sessionID, executionID, and ownerID; lease predicates additionally require expires_at > now.
• 🟡 (18:16) SessionExecutionClaim.update() in packages/core/src/session/execution/claim.ts:38-52 renews expires_at to now + SESSION_EXECUTION_LEASE_MS, optionally updates assistant_message_id and phase, and dies with SessionExecutionClaim.Lost when no live matching row is returned.
• 🟡 (18:16) SessionExecutionClaim.clear() in packages/core/src/session/execution/claim.ts:54-63 deletes only a row matching Session, execution, owner, and a still-live lease; zero rows causes SessionExecutionClaim.Lost.
• 🟡 (18:16) SessionExecutionClaim.transaction() in packages/core/src/session/execution/claim.ts:65-66 opens an immediate transaction, renews/validates the claim first via update(db, claim), and only then executes the supplied effect.
• 🟡 (18:16) packages/core/src/session/recovery-id.ts deterministically generates fallback assistant message ID msg_recovery_${executionID} and continuation ID msg_recovery_continue_${executionID}; an existing assistant message ID takes precedence over the generated fallback.