Distillation

Date: Sep 16, 2026

• 🔴 [requested-security-review] (15:26) User requested a final independent SECURITY/pentest review with a strict read-only scope: do not modify files, refs, index, services, artifacts, or databases; do not build or run tests.
• 🔴 (15:26) User specified immutable base commit ab9408c81cc9916177641ae8e9f08624fc27b5b9.
• 🔴 (15:26) User specified frozen patch /tmp/opencode/session-recovery-final-v8.patch with expected SHA-256 446412b56ac31b2a60f98765b5f14955a771f6074ebeb9309f603a0ceefad1bc.
• 🔴 (15:26) User specified exact SEA /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server with expected SHA-256 f4f0bd585d33bd47114b2d8d54082c2b061380771c808e909223350e62c8c72f.
• 🔴 (15:26) User specified clean applied inspection tree /tmp/opencode/session-recovery-v7-check; newly added files may be untracked because the patch is not committed.
• 🔴 (15:26) User required verification of hashes, base, and patch application before review, with an immediate stop on any mismatch.
• 🔴 (15:26) User required inspection of all 33 changed files and threat modeling for corrupt rows, forged or cross-Session IDs, stale owners, concurrent nodes, public retry of internal continuations, replay, starvation/DoS, counter poisoning, malformed phases, and migration constraints.
• 🔴 (15:26) User required explicit verification that execution-recovery conversion defects quarantine the exact acquired claim and that 100 poison claims cannot starve later valid work.
• 🔴 (15:26) User required maximum retry counters to always transition to a different persisted value before wake, preserve compare-and-set exclusivity under concurrent nodes, and rotate so saturated rows cannot starve.
• 🔴 (15:26) User required EOF and durable-settlement publication failures to retain or create a durable terminal/recovery path.
• 🔴 (15:26) User required migration constraint names and bounds to match the full schema.
• 🔴 (15:26) User required all work classes to remain bounded to 100 per scan.
• 🔴 (15:26) User required rechecking: no live lease theft; no expired-owner renewal; no ordinary overwrite of expired claims; exact Session/execution/owner/unexpired fencing; slow cancellation cleanup; canonical deterministic same-Session newest-assistant recovery; exact-only promotion; fail-closed malformed rows; and Schema→Core→Server layering.
• 🔴 (15:26) User stated an accepted operational residual: a process can pause after the final synchronous claim renewal and before an external provider/tool call; lease fencing cannot guarantee exactly-once external dispatch without idempotency or distributed side-effect infrastructure.
• 🔴 (15:26) User required judging whether uncertain outcomes are treated as unknown and never replayed, and directed that the accepted physical instruction interval alone must not cause rejection.
• 🔴 (15:26) User stated wall-clock skew below the lease interval is a documented operational assumption.
• 🔴 (15:26) User supplied exact-source evidence: 227 focused tests; full Core result 1164/0; five typechecks; no incremental migration; and authenticated SEA health, clean shutdown, named constraints, and three-launch exactly-once continuation smoke. User stated this evidence does not replace review.
• 🔴 (15:26) User required the final report to classify findings as MUST-FIX, CONCERN, or PASS, include precise patched file:line evidence, and end exactly with either MERGE or DO-NOT-MERGE.
• 🔴 (15:26) User-provided Jujutsu guidance stated that if .jj/ exists, mutations must use jj, not git; interactive flags and editor-opening commands must be avoided; mutations must be verified with jj st and jj log; and change IDs are preferred over commit IDs.
• 🔴 (15:26) User-provided Jujutsu guidance stated jj never fails on conflict: after rebase, new, or squash, conflicts are recorded in the resulting commit and must be checked with jj st and resolved manually rather than with interactive jj resolve.
• 🔴 (15:26) User-provided Jujutsu guidance stated the working copy is commit @, bookmarks do not auto-advance, jj new creates a new empty change rather than committing, jj commit leaves an empty @ with content in @-, and recovery options include jj undo, jj op log, jj op restore <op-id>, and jj workspace update-stale.
• 🟡 (15:26) Assistant stated the mandatory repo-setup skill was unavailable, loaded the available Jujutsu guidance, and committed to read-only operations.
• 🟡 (15:27) Tool output confirmed /tmp/opencode/session-recovery-final-v8.patch SHA-256 as 446412b56ac31b2a60f98765b5f14955a771f6074ebeb9309f603a0ceefad1bc and /home/byk/Code/opencode/packages/opencode/dist/server/opencode-server SHA-256 as f4f0bd585d33bd47114b2d8d54082c2b061380771c808e909223350e62c8c72f; output also showed ab9408c81cc9916177641ae8e9f08624fc27b5b9, object type commit, and d3323b963b9ef2de41a7ff9884299c74b93886ba.
• 🟡 (15:27) Patch statistics listed 33 changed files: packages/core/schema.json (+531/-48); packages/core/src/database/migration.gen.ts (+1); packages/core/src/database/migration/20260914170650_session-recovery.ts (+58); packages/core/src/database/schema.gen.ts (+48/-1); packages/core/src/session.ts (+5/-4); packages/core/src/session/compaction.ts (+31/-16); packages/core/src/session/context-epoch.ts (+54/-34); packages/core/src/session/execution/local.ts (+135/-19); packages/core/src/session/input.ts (+342/-31); packages/core/src/session/message-updater.ts (+69); packages/core/src/session/projector.ts (+77/-1); packages/core/src/session/recovery.ts (+449); packages/core/src/session/run-coordinator.ts (+30/-5); packages/core/src/session/runner/index.ts (+4); packages/core/src/session/runner/llm.ts (+272/-104); packages/core/src/session/runner/publish-llm-event.ts (+89/-37); packages/core/src/session/sql.ts (+78/-1); packages/core/test/database-migration.test.ts (+66/-1); packages/core/test/session-execution-local.test.ts (+283); packages/core/test/session-projector.test.ts (+2007/-3); packages/core/test/session-prompt.test.ts (+247/-25); packages/core/test/session-run-coordinator.test.ts (+45); packages/core/test/session-runner-recorded.test.ts (+4/-10); packages/core/test/session-runner-tool-events.test.ts (+46/-7); packages/core/test/session-runner.test.ts (+954/-20); packages/opencode/src/server/routes/instance/httpapi/server.ts (+2/-1); packages/schema/src/session-event.ts (+43/-1); packages/schema/test/event-manifest.test.ts (+8/-5); packages/sdk/js/src/v2/gen/types.gen.ts (+190); packages/sdk/openapi.json (+657/-44); packages/server/src/routes.ts (+2); packages/core/src/session/execution/claim.ts (+66); and packages/core/src/session/recovery-id.ts (+6).
• 🟡 (15:27) Inspection-tree status showed 28 modified tracked files and 5 untracked newly added files: packages/core/src/database/migration/20260914170650_session-recovery.ts, packages/core/src/session/execution/claim.ts, packages/core/src/session/recovery-id.ts, packages/core/src/session/recovery.ts, and packages/core/test/session-execution-local.test.ts.
• 🟡 (15:28) Exact patch-target blob verification passed for all 33 files (COUNT 33), including target blob IDs: packages/core/schema.json 7e176bd78b3a434a0be700e9579de40e5028ba92; packages/core/src/database/migration.gen.ts 77948f152910d908fa990652e38c8d756dca04e6; packages/core/src/database/migration/20260914170650_session-recovery.ts 31fd351cb1846ff2f5269a16310b719977276724; packages/core/src/database/schema.gen.ts a4b613c119b5bce8b15bf5f3310565122c66cf24; packages/core/src/session.ts fc5868837ad3e062e4bb13410217458f40d24db6; packages/core/src/session/compaction.ts 92a934c44f1f805afbc6e8f01f76cb55362ddc91; packages/core/src/session/context-epoch.ts 880d42bcf9450b074028c920cbcaa4107178543c; packages/core/src/session/execution/local.ts 37cfe481150b0e3818c7faa577e52eb31de42f0f; packages/core/src/session/input.ts 0b38eb2519691cfe2c57954513573f65a8deb386; packages/core/src/session/message-updater.ts e2d7e6b38eebdfcdbe9742a2d6c2f16258c19090; packages/core/src/session/projector.ts 43a9d26b12260de670b21c98222835ae30481c46; packages/core/src/session/recovery.ts 93e5ad495305a5a83588fae9829066ea2ab34b5f; packages/core/src/session/run-coordinator.ts ab4b833374ef9492f1aa5223bcf8289a7e12c155; packages/core/src/session/runner/index.ts 7b9ac3ae83340794c509b353a6dccd442be3319a; packages/core/src/session/runner/llm.ts 1b067f1f2fc7286d6d024355bd1f604cfc6cfb12; packages/core/src/session/runner/publish-llm-event.ts 347c0a7d88837ebdc06c6fbcaffc5591be9b4fee; packages/core/src/session/sql.ts c0584f5c1d84693772b590e1f2ce29f2f2923e22; packages/core/test/database-migration.test.ts 9814b75a11bc44be6dcf5fa1f50ade8d210832fe; packages/core/test/session-execution-local.test.ts a34c4a7c6a75fa13e6b3551c364edff0f7c0b7a1; packages/core/test/session-projector.test.ts b72903e44776d1ca8662cd286985ed3744f67b8e; packages/core/test/session-prompt.test.ts a0d6f26467af572274bd16919d9623b2264be018; packages/core/test/session-run-coordinator.test.ts 63dfad7a719641c3b74c0f221aa2e292a4811aee; packages/core/test/session-runner-recorded.test.ts 6f1b69f9a515ed16d8de5fde540ff7737756e409; packages/core/test/session-runner-tool-events.test.ts 47b92f55e217c457ddcff1755f9150d85a56bddb; packages/core/test/session-runner.test.ts d5c5707506df02d56d9d6580f170fa70ee389867; packages/opencode/src/server/routes/instance/httpapi/server.ts 748e8aa43b0889b935de6727b6c022d69867e372; packages/schema/src/session-event.ts 2599bbb78fa7e8f29c07de6ab375eb83cf6d7aa2; packages/schema/test/event-manifest.test.ts 08617924115a161b688a21c4b3f51121702c97a1; packages/sdk/js/src/v2/gen/types.gen.ts 30c56fdc00e1a6f1bd4728ec1911cd0f1630f9f9; packages/sdk/openapi.json a20210e4a73c9fdf834bff24279b5616d330408c; packages/server/src/routes.ts b6122ff847a14c5133224f99a18fed8263932c67; packages/core/src/session/execution/claim.ts 5c458a549c0a8f5a2f4c324c15f1792d84399233; and packages/core/src/session/recovery-id.ts b79614fd1e4f12fea2d910d56437ae8907819dcf.
• 🟡 (15:28) Assistant reported frozen-input verification passed: both SHA-256 values matched, the inspection tree was exactly at the immutable base, reverse application checked cleanly, and all 33 patched files matched the patch target blob IDs; review proceeded to ownership, recovery, retry, and migration boundaries.
• 🟡 (15:28) Migration inspection of packages/core/src/database/migration/20260914170650_session-recovery.ts:5-55 showed migration ID 20260914170650_session-recovery; it adds session_input.wake_pending as integer DEFAULT false NOT NULL and session.wake_attempts as integer DEFAULT 0 NOT NULL with named constraint session_wake_attempts_check bounding values from 0 through 9007199254740991.
• 🟡 (15:28) Migration packages/core/src/database/migration/20260914170650_session-recovery.ts:13-25 creates session_execution with columns id, session_id, owner_id, nullable assistant_message_id, phase, time_created, expires_at, and nullable recovery_error; primary key constraint session_execution_pk; phase constraint session_execution_phase_check allowing only 'ready', 'safe', 'unknown', or 'continue'; and cascading session foreign key fk_session_execution_session_id_session_id_fk.
• 🟡 (15:28) Migration packages/core/src/database/migration/20260914170650_session-recovery.ts:28-43 creates session_recovery with columns session_id, execution_id, nullable assistant_message_id, continuation_message_id, phase, wake_pending integer DEFAULT true NOT NULL, wake_attempts integer DEFAULT 0 NOT NULL, nullable recovery_error, and time_created; primary key session_recovery_pk on execution_id; named retry bound session_recovery_wake_attempts_check from 0 through 9007199254740991; and cascading foreign keys to session, session_message, and session_input.
• 🟡 (15:28) Migration packages/core/src/database/migration/20260914170650_session-recovery.ts:45-54 creates unique index session_execution_session_idx on session_execution(session_id), index session_execution_owner_idx on owner_id, index session_input_wake_pending_promoted_session_idx on (wake_pending, promoted_seq, session_id), unique index session_recovery_continuation_message_idx on continuation_message_id, and index session_recovery_wake_pending_error_attempts_created_execution_idx on (wake_pending, recovery_error, wake_attempts, time_created, execution_id).