Distillation

Date: Sep 16, 2026

• 🔴 (14:27) Security review found failed responses still expose provider-controlled data: no-recall response.failed is forwarded verbatim in packages/gateway/src/pipeline.ts:10639-10674; packages/gateway/test/openai-responses-recall-aware-stream.test.ts:507-532 expects private message "provider failed" publicly; synthetic non-resource failures use buildOutputItems(...) at packages/gateway/src/pipeline.ts:11939-11976; and malformed-terminal coverage at test lines 2254-2268 requires prior output in the failure.
• 🔴 (14:27) User established that hidden provider data was never delivered publicly: a hidden codex.rate_limits event after recall detection can still reach onComplete after later failure despite never being emitted to the client. finish() spreads the full response and clears only content and rawOutputItems at packages/gateway/src/pipeline.ts:9738-9746, retaining codexRateLimits; unvalidated allowlisted provider values are copied at packages/gateway/src/stream/openai-responses.ts:588-603 and exported at lines 888-900.
• 🔴 (14:27) Required failed-terminal fix: sanitize every client-visible response.failed to the fixed public error with output: []; construct unsuccessful callback data from an explicit minimal projection containing only validated usage and required protocol identity, rather than spreading accumulated response state.
• 🔴 (14:27) Security review found missing Codex terminal output bypasses reasoning lifecycle validation: materializeCompletedCodexMessages() handles only messages at packages/gateway/src/pipeline.ts:7985-7996; absent output causes assertTerminalOutputMatches() to return at lines 9461-9466, and empty output performs no reconciliation.
• 🔴 (14:27) User stated assertOutputLifecyclesComplete() never checks unfinished text-part lifecycles and permits unfinished Codex reasoning without string ciphertext at packages/gateway/src/pipeline.ts:9349-9373; principal recall can then begin at lines 10723-10748, while continuation can reach nested recall at lines 11225-11245 and 11500-11538.
• 🔴 (14:27) Concrete malformed-lifecycle attack described: send a reasoning item, one reasoning_summary_text.delta without its .done, a completed recall call, then response.completed with absent or empty output; recall executes despite the unfinished reasoning lifecycle. If .done exists, its valid final value is still lost from the finalized accumulator.
• 🔴 (14:27) Required Codex lifecycle fix: before accepting omitted output_item.done, validate every tracked reasoning/content part, reject unfinished deltas and part lifecycles, and materialize completed reasoning summary/content into canonical state. Add principal and continuation tests for absent and empty terminal output, covering positive completed parts and negative unfinished parts.
• 🔴 (14:27) Security review found failure accounting depends on downstream demand: safeEnqueue() waits for capacity at packages/gateway/src/pipeline.ts:10158-10187, while failure invokes finish(failedResponse, false) only after enqueue at lines 11939-11980. A client can leave response.created unread, allow hidden recall/continuation work, trigger failure, then cancel while delivery is blocked.
• 🔴 (14:27) User stated the cancellation handler only rolls back at packages/gateway/src/pipeline.ts:11999-12015, so the integration callback at lines 18903-18908 never registers unsuccessful accounting; even when registered, finishUnsuccessfulStreaming() waits for downstream settlement at lines 18827-18855. Accounting therefore occurs zero times rather than exactly once.
• 🔴 (14:27) Required accounting fix: settle failed internal accounting before waiting for client demand, separate one-shot unsuccessful finalization from best-effort public delivery, and add a regression that cancels while a resource-limit failure is blocked by backpressure.
• 🔴 (14:27) Security review found CPU-exhaustion risks: each added raw item scans every existing item at packages/gateway/src/pipeline.ts:8560-8576, making large valid streams quadratic; the 63,000-item test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:7668-7732 bypasses production behavior by mocking Map.prototype[Symbol.iterator] and only proves the replacement maximum-index calculation avoids argument-spread overflow.
• 🔴 (14:27) Sparse materialization can amplify work: each incomplete message may allocate an array through its highest coordinate at packages/gateway/src/pipeline.ts:7971-7996, and finalization walks holes at packages/gateway/src/stream/openai-responses.ts:821-846; many messages with one part near index 99,999 can cause billions of hole iterations while remaining within frame and retained-byte ceilings.
• 🔴 (14:27) Required CPU/address-space fix: replace per-item scans with indexed identity maps, retain sparse parts as maps through finalization, enforce an aggregate work/address-space budget, and ensure the regression exercises the real path without prototype mocks.
• 🔴 (14:27) Review pass points: principal and continuation events enter private accumulator state before retained-state checks at packages/gateway/src/pipeline.ts:10408-10474 and 11029-11094; sparse coordinates are bounded before mutation at lines 8386-8421, including shifted continuation coordinates; resource-limit public envelopes use empty output and unsuccessful callbacks clear content/raw output; present terminal reasoning arrays reject untracked, contradictory, malformed, or unfinished parts before recall; continuation usage has a one-shot guard; unsuccessful transactions roll back before onComplete; telemetry uses fixed failure categories with no new raw query, argument, reasoning, or provider-error logging.
• 🔴 (14:27) Validation evidence supplied by the review: exhaustive validation reported 469 files, 10,345 passed, 230 skipped and was not rerun by the reviewer; focused read-only run reported 1 file passed, 48 passed, 207 skipped in 7.76s.
• 🔴 (14:27) Mutation evidence: stryker.config.mjs:37-43 excludes both changed source files, pipeline.ts and stream/openai-responses.ts; added tests discriminate several intended guards but provide no executed fail-first or guard-removal evidence and miss the four MUST-FIX cases.
• 🔴 (14:27) Candidate integrity checks matched: base 2cbf40060c67df229731cf1b9e34d5bf22ec2145; candidate tklkqxytmpkzzryqlolnpvxouropxznp; head ce88c614c0ae55d229cb605aa7c7369d918d3650; clean empty child d890b184d786a4348e30bcdac7412baa7ae01ae9; no candidate-range conflicts; exactly 3 changed files; plain diff SHA-256 02d06b2f84d7d2d8cfa5f22443384d12a2a9bc922ade879449de9b0b9d971d1c. The warning concerned an unrelated conflicted bookmark, and no files, VCS state, network, server, or production database were touched.
• 🔴 [rejected-merge] (14:27) Security review verdict was DO-NOT-MERGE.
• 🟡 (14:27) Assistant reported a fully discriminating projection fail-first matrix: all 9 cases failed on unchanged production; both raw diagnostic paths leaked; every malformed timestamp was accepted or normalized; and 64 items triggered exactly 514 numeric projection sorts.
• 🟡 (14:27) Assistant selected three minimal projection fixes: (1) drop non-semantic frames once inside recall handling via semantic frame allowlisting; (2) validate terminal timestamps before accumulation; (3) replace per-event full-state sorting with an incremental visible-index ledger / transition-only projection stability checks while retaining terminal sorting only at finalization.
• 🟡 (14:31) Assistant stated changes would be limited to reviewed boundaries, with no server or candidate-workspace mutation.
• 🟡 (14:32) Work plan status, in exact order: 1. “Add fail-first regressions for projection security findings” — completed, high priority; 2. “Implement semantic frame filtering, timestamp validation, and bounded projection work” — in progress, high priority; 3. “Run focused tests and guard-removal mutation proofs” — pending, high priority; 4. “Run affected, static, bundle, and exhaustive validation” — pending, high priority; 5. “Freeze and independently review corrected projection candidate” — pending, high priority; 6. “Update projection PR only after both reviews pass” — pending, high priority.
• 🟡 (14:32) Search found 14 codexRateLimits/codex.rate_limits matches: merge logic in packages/gateway/src/pipeline.ts:18590-18593; type declaration in packages/gateway/src/translate/types.ts:349; emission in packages/gateway/src/translate/openai-responses.ts:1281-1282; and accumulation/export in packages/gateway/src/stream/openai-responses.ts:60, 588-603, and 897-898.
• 🟡 (14:33) applyResponsesEvent() in packages/gateway/src/stream/openai-responses.ts:582-603 handles codex.rate_limits by retaining a quota object with type and any present values for plan_type, rate_limits, credits, metered_limit_name, and limit_name; comments say arbitrary events/diagnostic fields are not retained and byte/frame limits bound the list.
• 🟡 (14:34) Source inspection found buildTerminal() in packages/gateway/src/pipeline.ts:9815-9865 rebuilds the terminal event and sets created_at from terminalResponse?.created_at ?? Math.floor(Date.now() / 1000), confirming malformed/missing provider timestamps can be retained or normalized without strict validation.
• 🟡 (14:34) Source inspection found buildOutputItemsWithIndices() in packages/gateway/src/pipeline.ts:9874-9882 constructs a union of state.rawItems.keys() and state.items.keys() and numerically sorts it, identifying the repeated projection-sort boundary targeted for bounded-work changes.
• 🔴 (14:34) User stated private recall source coverage is never emitted to the client; the field is documented as “Private source coverage; never emitted to the client” in packages/gateway/src/pipeline.ts:7854-7855.
• 🟡 (14:30) Identity investigation found outputIdentities is declared as new Set<string>() at packages/gateway/src/pipeline.ts:7880, populated at lines 8460 and 8940 and during continuation at line 11233; despite this index, function completion still scans all state.rawItems at lines 8582-8588 for duplicate identities.