Distillation

Date: Sep 16, 2026

• 🟡 (14:37) packages/gateway/src/pipeline.ts in /home/byk/Code/opencode-lore-responses-projection-security was modified repeatedly to implement the projection-security fixes.
• 🟡 (14:39) Initial @loreai/gateway@0.40.0 typecheck failed at src/pipeline.ts:10234: Map<number, number | undefined> was passed where ReadonlyMap<number, number> was required; TypeScript reported that undefined was not assignable to number. After another edit to packages/gateway/src/pipeline.ts, tsc --noEmit completed cleanly.
• 🟡 (14:40) Focused validation passed all 9 selected tests with 213 skipped out of 222 in packages/gateway/test/openai-responses-recall-aware-stream.test.ts; duration was 5.96s.
• 🟡 (14:40) Assistant described the three narrow fixes: unknown frames continue to pass before recall but are treated as non-semantic after recall interception; terminal created_at must be a finite, non-negative number; projection state changes only when item visibility changes. Assistant proceeded to mutation-proof each guard independently before broad validation.
• 🔴 (14:41) User established the security invariant encoded by the test never exposes non-semantic principal frames after recall interception.
• 🟡 (14:41) Semantic-frame guard-removal mutation proof was discriminating: 1 test failed, 1 passed, and 220 were skipped. The failing test never exposes non-semantic principal frames after recall interception showed event: diagnostic and the private payload private recall query, arguments, result, and identity reaching client output after the recall marker; assertion failed at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:8177.
• 🟡 (14:41) The leaked mutation output also contained the private recall marker <!-- lore-recall:private-recall-query -->, then safe answer, and a completed response, proving the removed semantic-frame guard specifically allowed a non-semantic principal frame through after interception.
• 🟡 (14:42) Terminal-timestamp guard-removal mutation proof was discriminating: all 6 malformed continuation created_at cases failed—object, array, string, negative, null, and non-finite. Instead of producing the expected fixed failure message Lore could not continue the response after recall, malformed values were accepted into rebuilt response.completed terminals.
• 🟡 (14:42) Examples from the timestamp mutation included provider-controlled created_at values {"private_extension":"private created-at object"}, ["private created-at array"], and "private created-at string" appearing in client-visible completed responses with usage {input_tokens:11, output_tokens:3, total_tokens:14}.
• 🟡 (14:43) Projection-work guard mutation caused updates the principal projection without sorting once per indexed event to fail with category principal_protocol logged from packages/gateway/src/pipeline.ts:11821; the stream emitted a sanitized response.failed for resp_projection_work rather than the expected successful output containing answer 63.
• 🟡 (14:43) The projection-work regression’s success criteria are: output must not contain response.failed, must contain answer 63, and numericProjectionSorts must be at most 4. The mutation run had 1 failed test and 221 skipped out of 222, duration 5.31s.
• 🟡 (14:43) After the projection-work mutation result, packages/gateway/src/pipeline.ts was updated again, consistent with restoring or adjusting the tested guard; no subsequent validation result was shown in this segment.