Distillation

Date: Sep 16, 2026

• 🟡 (12:17) Validation run under Vitest v4.1.8 in /home/byk/Code/opencode-lore-embedding-runtime rebuilt the missing or stale gateway dist/ bundle with pnpm --filter @loreai/gateway run bundle; result: 3 test files passed, 117 tests passed, duration 32.14s.
• 🟡 (12:17) Assistant stated native resolution and malformed-addon recovery passed in both emitted worker artifacts; next checks were type drift and overly broad fallback classification before mutation evidence, with the live service left untouched.
• 🔴 (12:19) User stated worker admission must never use a stale cgroup directory or a cached cgroup-discovery miss; /proc/self/cgroup and /proc/self/mountinfo must be reread because membership can change during process lifetime.
• 🔴 (12:19) User stated sibling usage must never be subtracted from the wrong cgroup scope; every descendant cgroup boundary must remain readable, except that a cgroup v2 root with files.root === "/" may omit memory.current, memory.high, and memory.max.
• 🟡 (12:19) packages/core/src/cgroup-memory.ts defines resolveLinuxCgroupMemoryFiles(cgroupContent, mountInfoContent) and readLinuxCgroupMemoryHeadroomBytes(readText = readTextFile). Discovery prefers an explicit cgroup v1 memory-controller membership over v2 on hybrid hosts, chooses the deepest directly matching mount root, accepts a namespaced interpretation only when exactly one candidate exists, and returns null when discovery is ambiguous or invalid.
• 🟡 (12:19) packages/core/src/cgroup-memory.ts decodes procfs octal path escapes, rejects non-absolute paths, NUL bytes, and .. components, then normalizes with posix.normalize. Headroom calculation walks from the process cgroup directory toward the mount point and takes the minimum finite limit - usage, clamped at 0; v2 uses memory.current with memory.high and memory.max, while v1 uses memory.usage_in_bytes with memory.limit_in_bytes. Invalid, missing, unsafe-integer, or unreadable required values fail closed with undefined.
• 🔴 (12:19) User stated native ONNX Runtime resolution is fail-closed and must never interrupt WASM fallback, including failures while closing the candidate binding file descriptor.
• 🔴 (12:19) User stated the source-workspace fallback checks only the selected worker package’s own node_modules and never selects an arbitrary ancestor’s potentially ABI-incompatible ONNX Runtime.
• 🔴 (12:19) User stated resolveNativeOrtBindingPath never throws: an unresolvable native package is the expected dist-only case and must degrade to WASM rather than crash embedding.
• 🟡 (12:19) packages/core/src/ort-native.ts supports exactly 5 generated native targets: linux-x64, linux-arm64, darwin-arm64, win32-x64, and win32-arm64. Linux native execution requires a detectable glibc runtime version of at least 2.27; unknown or malformed Linux libc information returns null for WASM fallback.
• 🟡 (12:19) validNativeBinding() in packages/core/src/ort-native.ts canonicalizes the package and binding paths, requires the binding to remain within the package directory and be a regular file, and validates its first 4 bytes: ELF 7f 45 4c 46 on Linux, supported Mach-O magic on Darwin, or MZ on Windows. Every filesystem or close failure returns null.
• 🟡 (12:20) Published native package admission in resolveNativeOrtBindingPath() requires gateway name @loreai/gateway, matching gateway/package/declared versions, matching loreOrtNodeVersion, and exact one-element os and cpu arrays. Workspace onnxruntime-node admission requires an exactly matching declared and installed version, a canonical bin inside the package, and exactly one directory matching /^napi-v\d+$/; all mismatches return null.
• 🟡 (12:20) nativeIntraOpThreads(parallelism = availableParallelism(), logicalCpus = cpus().length) returns the floored available parallelism, with a minimum of 1, only when it is less than the logical CPU count; otherwise it returns undefined to preserve ONNX Runtime’s default. Rationale: prevent a CPU-quota-limited container, such as 1 vCPU on a 32-core host, from spawning roughly 32 native intra-op threads and incurring excess memory arenas and context-switching, without raising thread count on unconstrained hyper-threaded hosts.
• 🟡 (12:21) Work queue contained 7 ordered tasks: 1. “Address native resolver review findings with deterministic regressions” — in_progress, high priority; 2. “Finish cgroup headroom parsing and admission wiring” — pending, high; 3. “Reserve unreflected worker memory during pool growth” — pending, high; 4. “Run fail-first and mutation proofs for every critical guard” — pending, high; 5. “Run complete repository validation and freeze exact candidate” — pending, high; 6. “Obtain independent correctness and security reviews” — pending, high; 7. “Commit completed Jujutsu change and report findings” — pending, medium.
• 🟡 (12:21) Assistant reported an audit found 3 concrete admission defects and set the remediation order as: 1. cgroup authority, 2. primary fail-closed sizing, 3. reserved headroom for burst growth. Each fix was to receive a real counterexample test before implementation changes.
• 🟡 (12:21) Jujutsu workflow guidance loaded: when .jj/ exists, mutations must use jj, not git; interactive flags such as -i and --interactive must not be used; description/commit operations must pass -m "msg"; mutations must be verified with jj st and jj log; stable change IDs are preferred over commit IDs.
• 🟢 (12:22) /home/byk/Code/opencode-lore-embedding-runtime/CONTRIBUTING.md was not found.
• 🟡 (12:22) Current packages/core/src/embedding/pool.ts admission logic exposes the audit targets: the first worker is spawned without calling liveFreemem(); later growth requires a healthy busy slot, total active plus retired workers below ceiling, and live free memory of at least (unhealthy active slots + 1) * PER_WORKER_MEM_BUDGET_BYTES. liveFreemem() returns 0 when a constrained memory limit exists but cgroup headroom is unavailable.
• 🟡 (12:22) EmbeddingPool sizing in packages/core/src/embedding/pool.ts uses testEmbedPoolSize as a deterministic override capped by EMBED_POOL_ABS_MAX; under NODE_ENV === "test" it uses configuredEmbedPoolSize() ?? 1, likewise capped; production uses configuredEmbedPoolSize() ?? DEFAULT_MAX_EMBED_POOL, capped by EMBED_POOL_ABS_MAX.
• 🟡 (12:22) EmbeddingPool.spawnSlot() passes the entire pool ceiling to LocalProvider as the memory divisor, intending every worker to size its token cap from free / ceiling. Retirement removes the slot, preserves healthy sibling service after transient-init exhaustion, tracks shutdown through OwnedRetirements<LocalProvider>, suppresses shutdown rejection, and redispatches after retirement settles.