Distillation

Date: Sep 17, 2026

• 🔴 (00:56) User stated that Jujutsu (jj) operations never fail on conflict; conflicts are recorded in the resulting commit and must be detected with jj st and resolved manually rather than with interactive jj resolve.
• 🔴 (00:56) User directed that repositories containing .jj/ use jj rather than git for mutations; interactive flags are prohibited, -m "msg" is required for describe/commit operations, and mutations must be verified afterward with jj st and jj log.
• 🔴 (00:56) User stated tests use a temporary SQLite database through packages/core/test/setup.ts, never the production DB.
• 🔴 (00:56) User directed never to manually bump versions or edit CHANGELOG.md; Sentry Craft and GitHub Actions handle both automatically.
• 🔴 [enforced-tdd] (00:56) User stated every bug fix must have a regression test that fails on the base branch and passes with the fix; tests of guards must fail when the guard is removed. Never trust the fix without seeing it fail.
• 🔴 (00:56) User stated every non-trivial PR requires an adversarial correctness review before merge under quality/REVIEW.md, including regression-test discipline, adversarial-order state setup, fan-out registry coverage, recurring bug-class batteries, and the two-reviewer rule.
• 🔴 (00:56) User stated the project runtime is Node.js >= 22.5 and the monorepo uses TypeScript with pnpm workspaces; root package.json pins Volta Node 24.16.0, pnpm 10.28.0, and packageManager pnpm@10.28.0.
• 🟡 (00:57) Initial immutable-review integrity verification succeeded: working copy /home/byk/Code/opencode-lore-responses-projection-security was clean at empty change muqyuuym / commit 60d399b5, whose parent was candidate kwmswwmt / 6d9f8d6a8a1953c655061bd8e37b33c91788d498; candidate had conflict=false.
• 🟡 (00:57) Repository status reported a conflicting bookmark fix/responses-private-references; the reviewed candidate commit itself was not conflicted.
• 🟡 (00:57) Candidate ancestry was verified as: kwmswwmtzlnxuvpkqymrwrxttlwowsys (6d9f8d6a8a1953c655061bd8e37b33c91788d498, fix(responses): sanitize projected output) → lnvrxqoqsqutpvpxvnppskkmmmsztwus (f30236708bc928ee2e12739d1de7a7d21871c7d2, fix(responses): complete hidden-output state) → zlsmzkntqzzx (a3fa555bdcabb376aa33278bdb76007269f1940a, fix(responses): harden hidden-output projection) → ozrmvotwxzuy (583020fad43e1481470aac2588251b8636d16251, fix(responses): stabilize sparse principal projection) → unznwpylspzq (ab979df5cddfec3952680e423e39564664e881fe, fix(responses): project hidden output consistently) → base pxrvwsvvkmpoxnsqmrkwrnlqvvkoltwz (2cbf40060c67df229731cf1b9e34d5bf22ec2145, feat(cch): add seeds for Claude Code up to 2.1.272 (#1780)); all listed commits had conflict=false.
• 🟡 (00:57) Independent hash verification reproduced jj diff --from main@origin --to kwmswwmt | sha256sum as c447298696afdce49d888cc6c8e107cdf2aac3a973d5adfe9e2578d25bcaaa95.
• 🟡 (00:57) Independent changed-path verification found exactly packages/gateway/src/pipeline.ts and packages/gateway/test/openai-responses-recall-aware-stream.test.ts; diff statistics were 2 files changed, 1,994 insertions, and 108 deletions, with approximately 1,074 added diff lines shown for pipeline.ts and 1,028 for the test file.