Distillation

Date: Sep 16, 2026

• 🟡 (10:10) packages/gateway/test/ort-platform-package.test.ts binds runtime package resolution to generated package metadata: ORT_NATIVE_TARGETS and ORT_NPM_PLATFORMS.map((p) => p.target) must equal, in order, linux-x64, linux-arm64, darwin-arm64, win32-x64, win32-arm64; each target must equal ${p.os}-${p.cpu} and ortPlatformTarget(p.os, p.cpu); package names follow @loreai/onnxruntime-<target>.
• 🟡 (10:10) packages/gateway/test/ort-platform-package.test.ts verifies real onnxruntime-node package generation using buildOrtPlatformPackages(out, "9.9.9"): one package per platform, ORT_PACKAGE_BINDING_SUBPATH physically present, exact name/version/os/cpu, preferUnplugged: true, loreOrtNodeVersion === ortNodeVersion(), no exports, and every file declared in package.json exists.
• 🟡 (10:10) Native-library alias tests require Linux libonnxruntime.so.1 while dropping libonnxruntime.so.1.27.0; Darwin retains libonnxruntime.1.dylib while dropping libonnxruntime.1.27.0.dylib; Win32 ships both onnxruntime.dll and DirectML.dll.
• 🟡 (10:11) Existing generated workers were present. packages/gateway/dist/embedding-worker.cjs had size 581816, SHA-256 eb0ccfc5ef503b0351675b9e5d86579f8152fbfae7c1786aa909f3bbb2f93915; packages/gateway/dist/embedding-worker.js had size 581495, SHA-256 e02912f98b6bf4c74f539311093ad08fcb3c2e152f86170d580d6dddf7902025.
• 🟡 (10:11) String probes of each generated worker found LORE_ORT_NODE_VERSION 0 times, loreOrtNodeVersion once, glibcVersionRuntime 4 times, 1\.27\.0 4 times, and resolveNativeOrtBindingPath twice.
• 🟡 (10:12) Read-only Bun probes succeeded: one reported bun-e-ok with exit 0; another exited 0; another returned string with exit 0.
• 🟡 (10:15) Bun 1.3.14 runtime metadata probe returned process.report present, process.report.getReport as a function, platform linux, architecture x64, and glibc 2.39.
• 🟡 (10:15) Native-load classifier probe results: 1. "/tmp/onnxruntime_binding.node: wrong ELF class: ELFCLASS32" → classified: false; 2. "/tmp/onnxruntime_binding.node: version GLIBC_2.38 not found (required by /tmp/libonnxruntime.so.1)" → false; 3. "C:\\x\\onnxruntime_binding.node: %1 is not a valid Win32 application." → false; 4. "dlopen(/tmp/onnxruntime_binding.node, 0x0001): incompatible architecture" → true.
• 🟡 (10:16) Generated-worker token probes found in packages/gateway/dist/embedding-worker.cjs: __filename 4 times, import_meta_url 0, __LORE_ORT_BINDING_PATH__ 5, __LORE_NPM_WASM_PATHS__ 5; in packages/gateway/dist/embedding-worker.js: __filename 3 times, import_meta_url 0, __LORE_ORT_BINDING_PATH__ 5, __LORE_NPM_WASM_PATHS__ 5.
• 🟡 (10:18) Darwin loader-message probe classified "Library not loaded: @rpath/libonnxruntime.1.dylib\nReason: image not found" as false.
• 🟡 (10:19) Frozen Jujutsu candidate: working-copy change tmzmtlsspstnppsrlpmuulsywurmlnqu, commit aee4651c96b009c28f9e79f40f019fd2c7c49a0a, description fix(core): correct embedding runtime selection and admission; parent change pxrvwsvvkmpoxnsqmrkwrnlqvvkoltwz, commit 2cbf40060c67df229731cf1b9e34d5bf22ec2145, description feat(cch): add seeds for Claude Code up to 2.1.272 (#1780).
• 🟡 (10:19) Candidate had no file conflicts. Jujutsu reported an unrelated conflicted bookmark, fix/responses-private-references. SHA-256 of jj diff --git -r @ was f0b8e99bf067fc02503826cb13843a0baf725f9ae83276de21c6da0ba3c5c1dc.
• 🟡 (10:19) Candidate changed exactly 17 paths: added packages/core/src/cgroup-memory.ts; modified packages/core/src/embedding/local.ts, packages/core/src/embedding/pool.ts, packages/core/src/embedding-cap.ts, packages/core/src/embedding-worker-types.ts, packages/core/src/embedding-worker.ts, packages/core/src/embedding.ts, packages/core/src/ort-native.ts; added packages/core/test/cgroup-memory.test.ts; modified packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-pool.test.ts, packages/core/test/embedding-worker-types.test.ts, packages/core/test/ort-native.test.ts, packages/gateway/script/bundle.ts, packages/gateway/script/ort-platform-package.ts, packages/gateway/test/bundle-exports.test.ts, and packages/gateway/test/ort-platform-package.test.ts.
• 🟡 (10:21) All checks used jj --ignore-working-copy, so Jujutsu did not snapshot or mutate the worktree. Changed paths, candidate identity, and diff hash remained stable before and after the audit.
• 🟡 (10:21) Nine scoped filesystem hashes matched their initial values and the bytes recorded in @: packages/core/src/ort-native.ts → 784f55f936ab766188d43382d1aee06fcc3fd45c03aee9baa762fd6424376f36; packages/core/src/embedding-worker.ts → 0d74b4c3251f56d7599060c19ef22bdb9b0da5bdc2968c89305769684bc00353; packages/core/src/embedding-worker-types.ts → 4a7102ba0678b21b9608f6f0560b93429238e3fd70b534f829c5e771bd5a5254; packages/core/test/ort-native.test.ts → 774575a632e380ba5d06aa43ad8a283ad1629252d8beba8324a30dc32236a1bf; packages/core/test/embedding-worker-types.test.ts → 0d09dc266eb2d11b3738cec05dab7ee993826864e06772fd9d38153f816863d0; packages/gateway/script/bundle.ts → 02fd0231a4374de3e859c9168a65608e1227409de5aeea4b9d4ee4ffb420f50f; packages/gateway/script/ort-platform-package.ts → d5b67bf3fe2f5b7f1cb7e8c610fbe54031b1cca6602f3d5a2f76228eda121888; packages/gateway/test/bundle-exports.test.ts → f1f9863e0b60ce22bb4476241d3f9b28f0f9a59ac69d639d44f626042f18e56f; packages/gateway/test/ort-platform-package.test.ts → 71a3be381ef07ac967653e7aa4104a59d11691402a5b645a4d6d1111ee645449.
• 🟡 (10:21) Audit finding 1, MUST-FIX: real native-loader failures bypass WASM fallback. packages/core/src/embedding-worker.ts:231-240 reduces exceptions to err.message, discarding err.code, while isNativeOrtLoadError() at packages/core/src/embedding-worker-types.ts:226-235 expects ERR_DLOPEN_FAILED in the message. Node ordinarily exposes it as error.code. Common Linux wrong ELF class and missing GLIBC_*, Windows %1 is not a valid Win32 application, and Darwin Library not loaded: @rpath/libonnxruntime.1.dylib messages are unclassified, causing init-error rather than WASM fallback.
• 🟡 (10:21) Finding 1 test-gap analysis: packages/core/test/embedding-worker-types.test.ts:82-100 manually embeds [ERR_DLOPEN_FAILED] in a string, while packages/gateway/test/bundle-exports.test.ts:221-226 uses specially matched file too short; neither supplies a real error object with code: "ERR_DLOPEN_FAILED" nor exercises ABI/libc failures. Recommended fix: classify the error object, preserve error.code, and test actual Linux, Darwin, and Windows loader-message forms.
• 🟡 (10:21) Audit finding 2, MUST-FIX: raw native and model diagnostics cross the worker boundary. Raw exception text reaches console output at packages/core/src/embedding-worker.ts:233-237, 279-283, 298-300, and 313-316; reaches init-needs-wasm at :239 and :285; is explicitly represented in the protocol at packages/core/src/embedding-worker-types.ts:100-104; and is required to survive by packages/gateway/test/bundle-exports.test.ts:273-276. Such errors may expose home directories, cache paths, URLs, and provider diagnostics; stderrSilenced suppresses only console output and does not sanitize posted messages.
• 🟡 (10:21) Finding 2 recommendation: replace raw diagnostics with fixed categories such as native_runtime_load_failed and native_model_load_failed; never include original exception text in worker messages or logs.
• 🟡 (10:21) Audit finding 3, MUST-FIX: validNativeBinding() at packages/core/src/ort-native.ts:150-172 accepts only superficial magic bytes—ELF magic, Mach-O magic, or the first two MZ bytes—without validating ELF class/machine, Mach-O CPU type, PE signature/machine, minimum file size, or compatible N-API version. packages/core/src/ort-native.ts:273-285 accepts any sole directory named napi-v<N>, even if newer than the runtime supports.
• 🟡 (10:21) Finding 3 test-gap analysis: fixtures at packages/core/test/ort-native.test.ts:35-43 write only 4 bytes, and successful resolver tests at :169-201 accept that file. Packaging tests at packages/gateway/test/ort-platform-package.test.ts:61-89 check names and existence only, so an x64 addon mislabeled arm64 could pass. Recommended fix: validate machine/class and N-API compatibility and test real generated binaries for every declared target. Header validation is not an authenticity mechanism; package-manager integrity remains the security boundary.
• 🟡 (10:21) Audit finding 4, MUST-FIX: isBundleFresh() in packages/gateway/test/bundle-exports.test.ts:114-123 checks only dist/index.cjs and dist/index.bun.js, but the suite asserts and executes dist/embedding-worker.cjs and dist/embedding-worker.js at :185-413. Current index artifacts can therefore suppress rebuilding while stale workers are tested. Recommended fix: include both worker artifacts and every other asserted generated file in the freshness gate.
• 🟡 (10:21) Audit finding 5, CONCERN: package ownership is weaker than documentation claims. resolveDeclaredPackageDir() at packages/core/src/ort-native.ts:136-148 performs normal ancestor-walking resolution; packages/core/test/ort-native.test.ts:383-401 deliberately accepts a package from ancestor node_modules, contrary to the claim at packages/core/src/ort-native.ts:193-196 that this never occurs.
• 🟡 (10:21) Finding 5 tradeoff: ancestor resolution supports legitimate npm hoisting; pnpm package-root symlinks are canonicalized; Yarn PnP uses preferUnplugged at packages/gateway/script/ort-platform-package.ts:155-164. However, declared dependency plus self-reported name/version cannot distinguish a legitimate hoist from a matching package injected into an ancestor install tree. Recommended fix: explicitly define the trust boundary, add a hostile matching-ancestor test, and avoid claiming physical ownership if npm hoisting remains supported.
• 🟡 (10:21) Audit finding 6, CONCERN: containment checks apply to the addon but not its sibling native dependencies. The binding path is canonicalized and constrained to the package root at packages/core/src/ort-native.ts:157-172, but sibling libonnxruntime*/DLL files are unchecked, so a sibling symlink could escape the package. Validation closes the descriptor before later dlopen, leaving a check/load race. Existing regression coverage at packages/core/test/ort-native.test.ts:422-442 covers only an escaped workspace bin directory, not escaped published-package bindings or shared-library siblings.
• 🟡 (10:21) Audit finding 7, CONCERN: complete one-shot and Bun behavior are not proved by scoped tests. Locally, forceWasm skips native resolution at packages/core/src/embedding-worker.ts:389-406; WASM makes usedNativeBinding false at :410-416; and wasmRespawnRequested suppresses the trailing per-request error at :780-829.
• 🟡 (10:21) Finding 7 test-gap analysis: shouldRequestWasmRespawn() is tested only as a disconnected pure function at packages/core/test/embedding-worker-types.test.ts:311-350, while the worker duplicates rather than invokes it, leaving no drift guard for the full decision. packages/gateway/test/bundle-exports.test.ts:196-284 runs both artifacts using Node’s Worker and injects Bun-like globals through a CJS preload at :215-230; it never runs embedding-worker.js under Bun. Target lists at :199-207 and :289-297 are duplicated and silently return on unsupported hosts.
• 🟡 (10:21) Verified control 1, PASS: unsupported targets and unknown/non-glibc Linux runtimes fail closed before package resolution at packages/core/src/ort-native.ts:207-213, covered by packages/core/test/ort-native.test.ts:285-341.
• 🟡 (10:21) Verified control 2, PASS: gateway, package, release, ORT version, OS, and CPU metadata receive exact comparisons at packages/core/src/ort-native.ts:221-269.
• 🟡 (10:21) Verified control 3, PASS: the binding itself is canonicalized, constrained to its package root, required to be a regular file, and its descriptor is closed in finally at packages/core/src/ort-native.ts:150-183.
• 🟡 (10:21) Verified control 4, PASS: both CJS and Bun worker builds define LORE_ORT_NODE_VERSION at packages/gateway/script/bundle.ts:195-224 and :232-260; both generated artifacts contain the resolved version and no unresolved define token.
• 🟡 (10:21) Verified control 5, PASS: generated packages use exact OS/CPU metadata, omit restrictive exports, and request Yarn unplugging at packages/gateway/script/ort-platform-package.ts:144-167.
• 🟡 (10:21) Audit validation used read-only Bun probes against the classifier and Bun 1.3.14 runtime metadata. No network, database, service, repository, Jujutsu snapshot, or worktree mutation occurred.
• 🟡 (10:21) Vitest was intentionally not run because packages/gateway/test/bundle-exports.test.ts:132-156 can invoke packages/gateway/script/bundle.ts, whose lines 60-61 delete and recreate dist/, violating the audit’s read-only constraint. A clean rebuild and real Node/Bun worker test remain required after fixes.
• 🟡 (10:21) Out-of-scope residual areas: parent respawn latch, superseded-worker retirement, ort-npm-plugin.ts, vendor-ort-native.ts, package manifests and lockfiles, and real macOS/Windows loader behavior.
• 🟡 (10:21) Assistant’s final audit disposition was DO-NOT-MERGE.