Distillation

Date: Sep 16, 2026

• 🔴 (11:30) User stated recall was broken for the session and instructed the review not to call or depend on it.
• 🔴 (11:30) User stated distilled project guidance could be obtained through the read-only Lore search UI at http://127.0.0.1:3207/ui/search with project=/home/byk/Code/opencode and scope=knowledge.
• 🔴 [requested-review] (11:30) User asked to continue the existing immutable review using Git objects and /tmp/opencode/session-recovery-final-v5.patch as authoritative code evidence; a Lore context warning was not to block or cause empty output, and any inability to report had to identify a concrete non-Lore blocker.
• 🔴 (11:30) User required the substantive review report to end exactly with MERGE or DO-NOT-MERGE.
• 🔴 (11:30) User supplied packages/core/test/session-projector.test.ts:1821-1864, containing test marks an inbox row promoted with the Prompted event sequence: it admits msg_admitted with prompt text promote me, delivery: "steer", and requestExecution: true; publishes SessionEvent.Prompted; and expects SessionInputTable.promoted_seq to equal event.durable?.seq.
• 🔴 (11:30) User supplied the beginning of packages/core/test/session-projector.test.ts:1866-1899, test projects durable context messages supported by the updater, which publishes SessionEvent.AgentSwitched with agent build and SessionEvent.ModelSwitched with model.
• 🔴 (11:30) User supplied packages/core/test/session-prompt.test.ts:642-666, test reprojects pending inbox input without scheduling execution: prompts Replay pending with resume: false, replays projection, expects the admitted row to remain present with wake_pending: false, expects no visible Session messages, runs recovery, and expects wakeCalls to remain [].
• 🔴 (11:30) User supplied packages/core/test/session-prompt.test.ts:668-687, test returns an exact retry of a legacy projected prompt: publishes SessionEvent.Prompted for Historical prompt with delivery: "steer", retries the same ID and prompt with resume: false, and expects the admitted row to have promotedSeq.
• 🔴 (11:30) User supplied packages/core/test/session-prompt.test.ts:689-708, test returns an exact retry of a legacy projected queued prompt: publishes Historical queued prompt with delivery: "queue", retries it with the same ID, delivery: "queue", and resume: false, and expects the admitted row’s delivery to remain queue.
• 🔴 (11:30) User supplied packages/core/test/session-prompt.test.ts:710-738, test rejects reuse of one globally unique message ID across sessions: creates ses_prompt_other, uses the ID in the original Session, retries it in the other Session, and expects _tag: "Session.PromptConflictError" with the other sessionID and the same messageID.
• 🔴 (11:30) User supplied packages/core/test/session-prompt.test.ts:740-759, test rejects a prompt ID already used by visible Session history: publishes SessionEvent.Synthetic with text Existing history, attempts prompt text Conflicting prompt using the same ID, expects Session.PromptConflictError, and expects no admitted inbox row.
• 🔴 (11:30) User supplied the beginning of packages/core/test/session-prompt.test.ts:761-769, test starts execution by default after recording the prompt, which resets executionCalls and wakeCalls and submits prompt text Run by default without explicitly setting resume.
• 🟡 (11:30) During review, assistant identified a potential redrive security weakness: the 100-row selection limit bounds Sessions rather than pending inputs, while the ordinary-input CAS updates every pending row in a selected Session at the minimum attempt count. Assistant noted that an arbitrarily large same-Session cohort could therefore cause an unbounded write transaction every 10 seconds, and that the existing fairness test used one row per Session and did not cover this amplification.
• 🔴 (11:31) User supplied immutable-review verification output: changed-file count 33; reconstructed candidate tree d7c7ac9d3aa5606d2b8adf965fd584cd37494110; SHA-256 49183f9e082f71a26d07ce8bf7dd2b391214908f3d07637a3c02163fe20826c7 for /tmp/opencode/session-recovery-final-v5.patch; and SHA-256 f08e78a61ef53f72a9810cc09facbe2d181c63f6a14231a95d66d16de44a80ed for /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server.
• 🔴 (11:33) User supplied a five-item completed review checklist, all priority high: 1. verify frozen base, patch/SEA hashes, 33-file scope, and clean application; 2. read immutable repository guidance and package scripts; 3. inspect all changed files and trace security invariants through immutable base+patch; 4. audit migration, schema/API lineage, dependencies, and multi-node startup behavior; 5. produce a severity-ordered security verdict with exact frozen evidence.
• 🟡 (11:33) Assistant’s first MUST-FIX finding was that ordinary wake redrive can be reset indefinitely and amplified into unbounded database writes. Evidence: packages/core/src/session/recovery.ts:255-271 orders Sessions by minimum wake_attempts and limits results to 100 Sessions; public prompts request execution by default at packages/core/src/session.ts:360-383; new rows begin at zero via packages/core/src/session/sql.ts:153-155.
• 🟡 (11:33) Assistant described the first finding’s exploit: an authenticated client can continually create fresh execution-requested prompts in 100 Sessions; every fresh row resets its Session’s minimum attempt to zero, causing those Sessions to sort ahead of failed victim work with attempts above zero and permitting indefinite starvation across scans and restarts.
• 🟡 (11:33) Assistant reported same-Session amplification in packages/core/src/session/recovery.ts:273-291: the update affects every pending row in the selected Session having the chosen attempt count, so a cohort of N prompts creates an N-row write transaction on each scan. Every server node runs the scan every 10 seconds via packages/core/src/session/recovery.ts:302-307, multiplying load in multi-node deployments.
• 🟡 (11:33) Assistant reported that the index at packages/core/src/session/sql.ts:168-174 narrows eligible rows but does not bound either the grouped scan or update count. The regression test at packages/core/test/session-projector.test.ts:559-634 uses one input per Session and a fixed workload, so it does not test continuous zero-attempt injection or same-Session amplification. Assistant concluded this violates the required bounded, fair, non-resettable redrive invariant.
• 🟡 (11:33) Assistant’s second MUST-FIX finding was that cancellation silently continues cleanup after losing renewal ownership. Explicit cancellation performs one fenced renewal and forks a repeating renewal fiber at packages/core/src/session/execution/local.ts:108-112; the coordinator then waits for interruption finalizers and cleanup at packages/core/src/session/run-coordinator.ts:99-125.
• 🟡 (11:33) Assistant reported the cancellation renewal fiber is never joined or observed. If its exact-owner update fails during long cleanup, it dies independently while cancellation continues. The final clear suppresses SessionExecutionClaim.Lost at packages/core/src/session/execution/local.ts:115-119, allowing cancellation to report success after another node takes ownership.
• 🟡 (11:33) Assistant described the second finding’s concrete race: the initial renewal succeeds; interruption enters a long finalizer; the process stalls or temporarily loses database access for more than 30 seconds; another node takes the expired claim; the original renewal detects Lost; old cleanup continues without ownership and can overlap successor work; and the caller receives no ownership-loss failure.
• 🟡 (11:33) Assistant reported that packages/core/test/session-execution-local.test.ts:200-240 covers normal cleanup lasting beyond 30 seconds but does not transfer ownership during cleanup. The implementation keeps the lease alive under normal scheduling but does not fail closed when renewal ownership is lost.
• 🟡 (11:33) Assistant reported no separate CONCERN items beyond the two merge-blocking MUST-FIX findings.
• 🟡 (11:33) Assistant verified frozen evidence: base commit ab9408c81cc9916177641ae8e9f08624fc27b5b9; base tree d3323b963b9ef2de41a7ff9884299c74b93886ba; patch SHA-256 49183f9e082f71a26d07ce8bf7dd2b391214908f3d07637a3c02163fe20826c7; SEA SHA-256 f08e78a61ef53f72a9810cc09facbe2d181c63f6a14231a95d66d16de44a80ed; reconstructed candidate tree d7c7ac9d3aa5606d2b8adf965fd584cd37494110; exactly 33 changed files; and no whitespace errors from git diff --check.
• 🟡 (11:33) Assistant reported the required repo-setup skill was unavailable, so it directly read frozen AGENTS.md, CONTRIBUTING.md, applicable package guidance, and package scripts.
• 🟡 (11:33) Assistant passed ordinary claim acquisition: packages/core/src/session/execution/local.ts:29-45 does not overwrite live or expired claims, and packages/core/src/session/sql.ts:227-230 defines a unique per-Session index.
• 🟡 (11:33) Assistant passed recovery takeover fencing: packages/core/src/session/recovery.ts:79-95 fences the exact Session, execution, prior owner, expiry, and unquarantined state.
• 🟡 (11:33) Assistant passed execution-mutation fencing: packages/core/src/session/execution/claim.ts:25-31 requires the exact unexpired (session, execution, owner) tuple for every execution mutation.
• 🟡 (11:33) Assistant passed provider/local-tool boundary fencing: packages/core/src/session/runner/llm.ts:290-320 fences immediately before provider publication and local-tool dispatch; the instruction-level dispatch gap remains an accepted residual.
• 🟡 (11:33) Assistant passed stream/provider failure handling: step-finish only records in-memory settlement at packages/core/src/session/runner/publish-llm-event.ts:441-446; stream failure exits at packages/core/src/session/runner/llm.ts:346-399 before Step.Ended can publish at packages/core/src/session/runner/llm.ts:400-431; provider failure sets providerFailed, preventing a later Ended event.
• 🟡 (11:33) Assistant passed hosted-tool settlement: hosted tools settle or receive a durable failure before successful continuation and Step.Ended at packages/core/src/session/runner/llm.ts:372-431, with regression coverage at packages/core/test/session-runner.test.ts:1954-2003.
• 🟡 (11:33) Assistant passed assistant-less supersession handling: the latest-assistant sequence check rejects it before wake or promotion at packages/core/src/session/input.ts:347-395; scanner validation precedes wake CAS at packages/core/src/session/recovery.ts:213-244; exact promotion validates again at packages/core/src/session/input.ts:244-301; coverage is at packages/core/test/session-projector.test.ts:1136-1191.
• 🟡 (11:33) Assistant passed cross-Session identity validation: assistant and continuation identities are rejected at packages/core/src/session/projector.ts:415-431 and packages/core/src/session/input.ts:380-394.
• 🟡 (11:33) Assistant passed recovery-owned continuation isolation: such rows do not enter ordinary queue or steer selection at packages/core/src/session/input.ts:399-423 and packages/core/src/session/input.ts:498-559; public exact retries and execution-request events reject recovery IDs at packages/core/src/session/input.ts:62-68, packages/core/src/session/input.ts:112-180, and packages/core/src/session/input.ts:220-241.
• 🟡 (11:33) Assistant passed admit-only prompt behavior: resume:false maps to requestExecution:false at packages/core/src/session.ts:368-383; omitted historical event values default to false at packages/core/src/session/projector.ts:371-383, leaving admit-only prompts unwoken.
• 🟡 (11:33) Assistant passed recovery poison-row handling: rows are validated and quarantined before advisory wake at packages/core/src/session/recovery.ts:213-230; under a fixed workload, a fully poisoned batch cannot permanently block later recovery rows, covered at packages/core/test/session-projector.test.ts:494-556.
• 🟡 (11:33) Assistant passed coordinator cleanup-failure handling: local coordination cannot wedge because state and deferred waiters settle before cleanup failure is rethrown at packages/core/src/session/run-coordinator.ts:107-123; coverage is at packages/core/test/session-run-coordinator.test.ts:285-327.
• 🟡 (11:33) Assistant passed multi-node startup exclusivity: stale-claim takeover and wake increments use database CAS, provider work passes through the unique Session claim, and duplicate advisory wakes cannot create two claim owners.
• 🟡 (11:33) Assistant passed artifact lineage: migration, source schema, snapshot, generated full schema, migration registry, OpenAPI, event manifest, and generated SDK all contain the same recovery fields and events. The candidate snapshot’s prevIds at packages/core/schema.json:4-7 points to exact base snapshot ID f14a9b18-8207-487e-a3d3-227e629ba9ad.
• 🟡 (11:33) Assistant verified no V2 recovery or runner code calls legacy SessionPrompt; its only Core occurrence is explanatory prose at packages/core/src/session/runner/llm.ts:51.
• 🟡 (11:33) Assistant verified Core has no runtime dependency on Server: packages/core/package.json:63-127 has no @opencode-ai/server dependency, and frozen Core source has no Server import.
• 🟡 (11:33) Assistant reported that the accepted bounded wall-clock-skew residual remains documented at packages/core/src/session/execution/claim.ts:33-37.
• 🟡 (11:33) Assistant stated it ran no builds, tests, services, or mutable-VCS operations, per the immutable-review instruction.
• 🟡 (11:33) Assistant’s final security verdict was DO-NOT-MERGE.