Distillation

Date: Sep 16, 2026

• 🟡 (14:25) Tool output showed a clean, empty working copy lrqlyykxvwoqrxzowonmmytxulyqmqlu / Git commit d890b184d786a4348e30bcdac7412baa7ae01ae9, parented by candidate tklkqxytmpkzzryqlolnpvxouropxznp / ce88c614c0ae55d229cb605aa7c7369d918d3650; an unrelated bookmark fix/responses-private-references had conflicts.
• 🟡 (14:25) Candidate diff touched exactly 3 files: packages/gateway/src/pipeline.ts, packages/gateway/src/stream/openai-responses.ts, and packages/gateway/test/openai-responses-recall-aware-stream.test.ts; plain diff SHA-256 was 02d06b2f84d7d2d8cfa5f22443384d12a2a9bc922ade879449de9b0b9d971d1c.
• 🟡 (14:25) Assistant security/privacy review issued DO-NOT-MERGE with 4 MUST-FIX findings: 1. failed responses expose provider-controlled data, 2. missing Codex terminal output bypasses reasoning lifecycle validation, 3. failure accounting depends on downstream demand, 4. item-count and sparse-coordinate work remains vulnerable to CPU exhaustion.
• 🟡 (14:25) MUST-FIX 1 evidence: a no-recall response.failed terminal is forwarded verbatim at packages/gateway/src/pipeline.ts:10639-10674; the test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:507-532 expects private provider text "provider failed" to reach the client; synthetic non-resource failures call buildOutputItems(...) at packages/gateway/src/pipeline.ts:11939-11976, while only resource-limit failures receive output: []; and the malformed-terminal test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:2254-2268 requires prior output in the failure.
• 🟡 (14:25) MUST-FIX 1 callback issue: finish() at packages/gateway/src/pipeline.ts:9738-9746 spreads the full response and clears only content and rawOutputItems, retaining codexRateLimits; allowlisted rate-limit keys contain unvalidated provider values copied at packages/gateway/src/stream/openai-responses.ts:588-603 and exported at packages/gateway/src/stream/openai-responses.ts:888-900. Thus a hidden codex.rate_limits event after recall detection could reach onComplete following a later failure despite never being publicly delivered.
• 🟡 (14:25) MUST-FIX 1 required remediation: sanitize every client-visible response.failed to a fixed public error with output: []; construct unsuccessful callback data as an explicit minimal projection containing only validated usage and required protocol identity instead of spreading the accumulated response.
• 🟡 (14:25) MUST-FIX 2 evidence: materializeCompletedCodexMessages() at packages/gateway/src/pipeline.ts:7985-7996 materializes only messages, not reasoning summaries or reasoning content; assertTerminalOutputMatches() returns immediately for absent output at packages/gateway/src/pipeline.ts:9461-9466, and empty output performs no reconciliation; assertOutputLifecyclesComplete() at packages/gateway/src/pipeline.ts:9349-9373 allows unfinished Codex reasoning without string ciphertext and does not check unfinished text-part lifecycles.
• 🟡 (14:25) MUST-FIX 2 attack path: a reasoning item followed by one reasoning_summary_text.delta without its .done, a completed recall call, and response.completed with absent or empty output can pass malformed lifecycle validation and trigger principal recall at packages/gateway/src/pipeline.ts:10723-10748; continuation processing can similarly reach nested recall at packages/gateway/src/pipeline.ts:11225-11245 and packages/gateway/src/pipeline.ts:11500-11538. If .done exists, its valid final value can still be lost from the finalized accumulator.
• 🟡 (14:25) Existing new reasoning tests at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:4921-5092 cover terminal items that are present but not absent/empty Codex terminal output. Required remediation: validate every tracked reasoning/content part before accepting an omitted output_item.done, reject unfinished deltas and part lifecycles, materialize completed reasoning summary/content into canonical state, and add principal and continuation tests for absent and empty terminal output covering both positive completed-part and negative unfinished-part cases.
• 🟡 (14:25) MUST-FIX 3 evidence: safeEnqueue() at packages/gateway/src/pipeline.ts:10158-10187 waits for downstream capacity, while the failure path at packages/gateway/src/pipeline.ts:11939-11980 invokes finish(failedResponse, false) only after enqueueing the failure envelope. A client can let response.created fill the queue, allow hidden recall/continuation work, trigger a resource or protocol failure, then cancel while failure delivery waits for demand.
• 🟡 (14:25) MUST-FIX 3 accounting consequence: cancellation wakes the waiter, but safeEnqueue() can return without calling finish(); the cancellation handler at packages/gateway/src/pipeline.ts:11999-12015 only rolls back, so the integration callback at packages/gateway/src/pipeline.ts:18903-18908 never registers unsuccessful accounting. Even if registered, finishUnsuccessfulStreaming() at packages/gateway/src/pipeline.ts:18827-18855 waits for downstream settlement, permitting provider/recall work to be consumed with failed usage recorded zero times rather than exactly once.
• 🟡 (14:25) MUST-FIX 3 required remediation: settle failed internal accounting before waiting for client demand, separate best-effort client delivery from the one-shot unsuccessful finalizer, and add a regression that cancels while a resource-limit failure is blocked by backpressure.
• 🟡 (14:25) MUST-FIX 4 evidence: adding each raw item scans every existing raw item at packages/gateway/src/pipeline.ts:8560-8576, making large valid streams quadratic. The 63,000-item test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:7668-7732 mocks Map.prototype[Symbol.iterator], bypassing this production behavior and proving only that the replacement maximum-index calculation avoids argument-spread overflow.
• 🟡 (14:25) MUST-FIX 4 sparse amplification: each incomplete message can allocate an array sized to its highest coordinate at packages/gateway/src/pipeline.ts:7971-7996, and finalization scans every slot, including holes, at packages/gateway/src/stream/openai-responses.ts:821-846; many messages with one content part near index 99,999 could force billions of hole iterations while remaining within frame and retained-byte ceilings.
• 🟡 (14:25) MUST-FIX 4 required remediation: replace per-item full scans with indexed identity maps, retain sparse parts as maps through finalization, enforce an aggregate work/address-space budget, and add a regression exercising the real production path without prototype mocks.
• 🟡 (14:25) Assistant recorded 6 PASS points: 1. accepted principal and continuation events enter private accumulator state before retained-state checks at packages/gateway/src/pipeline.ts:10408-10474 and packages/gateway/src/pipeline.ts:11029-11094; 2. sparse coordinates, including shifted continuation coordinates, are bounded before mutation at packages/gateway/src/pipeline.ts:8386-8421; 3. resource-limit public envelopes use empty output and unsuccessful callbacks clear content/raw output; 4. present terminal reasoning arrays reject untracked, contradictory, malformed, or unfinished parts before recall; 5. continuation usage has a one-shot guard and unsuccessful transactions roll back before onComplete; 6. new telemetry uses fixed failure categories and adds no raw query, argument, reasoning, or provider-error logging.
• 🟡 (14:25) Test/mutation assessment: supplied exhaustive validation reported 469 files, 10,345 passed, and 230 skipped, but the assistant did not rerun it. Stryker’s allowlist at stryker.config.mjs:37-43 excludes both changed source files, pipeline.ts and stream/openai-responses.ts; added tests discriminate several intended guards, but there was no executed fail-first or guard-removal evidence and the 4 MUST-FIX cases were uncovered.
• 🟡 (14:25) Candidate-integrity review found matching start/end state: base 2cbf40060c67df229731cf1b9e34d5bf22ec2145, candidate tklkqxytmpkzzryqlolnpvxouropxznp, head ce88c614c0ae55d229cb605aa7c7369d918d3650, clean empty child d890b184d786a4348e30bcdac7412baa7ae01ae9, and no candidate-range conflicts. The conflicted bookmark warning was unrelated to the candidate; no files, VCS state, network, server, or production database were touched.