Distillation

Date: Sep 16, 2026

• 🔴 (14:11) User requires that once recall interception starts, only validated, explicitly allowed semantic frames may be emitted; malformed or custom continuation frames must never pass through.
• 🟡 (14:11) Projection security review verdict: DO-NOT-MERGE for candidate change ozrmvotwxzuykyvutstpwpzukpptktxv, head 583020fad43e1481470aac2588251b8636d16251, based on base 2cbf40060c67df229731cf1b9e34d5bf22ec2145.
• 🟡 (14:11) Projection security MUST-FIX 1: private recall data could escape through non-semantic SSE frames. Continuations queued non-JSON events not beginning with response. at packages/gateway/src/pipeline.ts:10900-10920; remapVisibleOutputIndices() forwarded unparsable frames unchanged at packages/gateway/src/pipeline.ts:9983-9988; transactional delivery emitted them at packages/gateway/src/pipeline.ts:11536-11545. Principal streams had a second bypass through deferred arbitrary non-indexed events at packages/gateway/src/pipeline.ts:11604-11618, retained at packages/gateway/src/pipeline.ts:10716-10723, then delivered transactionally. Existing regression packages/gateway/test/openai-responses-recall-aware-stream.test.ts:8136-8209 covered only JSON response.custom continuation events, not non-JSON continuation or principal custom events. Required regressions: hostile ID, query, argument, and result leakage tests on both principal and continuation paths.
• 🔴 (14:11) User requires terminal output to never expose an unvalidated created_at value.
• 🟡 (14:11) Projection security MUST-FIX 2: buildTerminal() copied terminalResponse.created_at without type validation at packages/gateway/src/pipeline.ts:9851-9856; terminal validation at packages/gateway/src/pipeline.ts:9201-9247 checked identity, status, and incomplete reason but not created_at; the continuation terminal became the rebuilt source at packages/gateway/src/pipeline.ts:11460-11463. A provider could smuggle private recall data in an object-valued created_at. Existing extension-field test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:8158-8176 covered only an unknown top-level field. Required fix: accept only a finite, non-negative numeric timestamp or derive a local timestamp; add object, array, string, and non-finite regressions with negative leakage assertions.
• 🟡 (14:11) Projection security MUST-FIX 3: projection work was approximately O(n² log n) because each map construction rebuilt complete output items, deduplicated, and sorted all source indices at packages/gateway/src/pipeline.ts:9874-9881; assertForwardedProjectionStable() repeated the work and scanned every forwarded item at packages/gateway/src/pipeline.ts:10149-10161; it ran after every indexed event at packages/gateway/src/pipeline.ts:10389-10391; forwarding rebuilt the map again at packages/gateway/src/pipeline.ts:10163-10186. Existing limits of 100,000 frames and 64 MiB at packages/gateway/src/pipeline.ts:8051-8055 still permitted worker exhaustion. Required fix: incremental append-only source-to-slot projection, immediate failure when a newly visible source index precedes an emitted index, sorting only fully deferred batches or terminal state, and a deterministic operation-count boundary test rather than timing-based testing.
• 🟡 (14:11) Projection security review PASS findings: candidate range had no conflicts and changed exactly two declared files; projection changes failed before forwarding the triggering frame because state update at packages/gateway/src/pipeline.ts:10368-10375 preceded stability check at packages/gateway/src/pipeline.ts:10389-10391 and forwarding at packages/gateway/src/pipeline.ts:11604-11627; projectionInvalid failed closed by suppressing recall recovery at packages/gateway/src/pipeline.ts:11783-11788 and returning public output: [] with a fixed message at packages/gateway/src/pipeline.ts:11843-11875.
• 🟡 (14:11) Projection security review further PASS findings: internal accumulation retained the rejected triggering item, verified at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:5830-5875; recognized recall lifecycle frames remained private and were accumulated/counted/suppressed at packages/gateway/src/pipeline.ts:10368-10472; cleanup removed recall and unresolved-tool identities at packages/gateway/src/pipeline.ts:11804-11839; continuation arithmetic used safe-integer checks at packages/gateway/src/pipeline.ts:9721-9726; principal overflow was rejected before recall at packages/gateway/src/pipeline.ts:10627-10639; commits occurred only after terminal enqueue and rollback covered failed completion/cancellation at packages/gateway/src/pipeline.ts:11547-11589 and packages/gateway/src/pipeline.ts:11900-11916; changed failure paths logged fixed categories rather than provider text at packages/gateway/src/pipeline.ts:11494-11508 and packages/gateway/src/pipeline.ts:11759-11768.
• 🟡 (14:11) Projection security review CONCERN: a throwing registered logging sink could alter behavior because log.error() invoked the sink without containment at packages/core/src/log.ts:497-504; a throw in the fixed-failure path could reach the outer stream error handler at packages/gateway/src/pipeline.ts:11884-11892. Production gateway no-op callbacks at packages/gateway/instrument.ts:196-204 limited current exposure, but the best-effort invariant remained untested.
• 🟡 (14:11) Projection security review CONCERN: mutation evidence remained incomplete because pipeline.ts was absent from the Stryker allowlist at stryker.config.mjs:37-43, no mutation report existed, and the projection helper skipped index-bearing events without item identity at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:94-106. No executable failing-first evidence was supplied; static review indicated the late-lower-index test would fail without the stability guard.
• 🟡 (14:11) Focused validation command pnpm exec vitest run packages/gateway/test/openai-responses-recall-aware-stream.test.ts --printConsoleTrace exited 0: 1 passed file, 213 passed tests, duration 11.49s.
• 🟡 (14:11) Final projection-review verification found a clean empty working-copy child, no candidate-range conflicts, the same two changed files, and unchanged plain-diff SHA-256 83d7c15b3b0c7dd4b58df93af5f20b0e18de6ad99e939d02aa75c0d5e7dea30d; unrelated conflicted bookmark fix/responses-private-references remained outside the candidate range.
• 🟡 (14:11) Assistant accepted the security block, kept 583020fa immutable for ongoing validator/correctness review, and planned a separate correction workspace with base-failing regressions before implementation for all three findings.
• 🟡 (14:12) Work queue state was: 1. “Finish exact public Responses projection fix and mutation proof” — completed; 2. “Run focused, static, bundle, and exhaustive validation on exact projection candidate” — in progress; 3. “Fix projection security review findings with failing-first tests” — pending; 4. “Freeze corrected projection candidate and obtain independent correctness/security reviews” — pending; 5. “Finish provider candidate security review and publication gate” — pending; 6. “Resolve accumulation review findings or publish approved candidate” — pending; 7. “Resume blocked Codex, recovery, and private-reference lanes” — pending. All had high priority.
• 🔴 (14:12) User stated that jj never fails on conflict; conflict-producing operations record conflicts in the resulting commit, so jj st must be checked after rebase, new, or squash, and conflicts must be resolved by manually editing files rather than using interactive jj resolve.
• 🔴 (14:12) User’s JJ workflow rules: use jj, not git, for mutations when .jj/ exists; never use interactive flags; always supply -m "msg" when describing or committing; verify mutations with jj st and jj log; prefer stable letter-based change IDs over hex commit IDs; never rebase or describe immutable commits; use jj undo or jj op restore <op-id> for recovery.
• 🟡 (14:12) Assistant chose an isolated sibling JJ workspace based on immutable change ozrmvotw; planned tests-only first edits for hostile non-semantic principal/continuation frames, malformed created_at, and an operation-count projection-complexity guard.
• 🟡 (14:13) JJ created workspace ../opencode-lore-responses-projection-security with initial empty working-copy change zlsmzknt / 3f826af6, parent ozrmvotw / 583020fa, adding 1072 files with 0 modified and 0 removed. Original candidate remained untouched.
• 🟡 (14:13) Workspace verification showed opencode-lore-responses-projection-security clean and conflict-free, while unrelated bookmark fix/responses-private-references still had conflicts.
• 🟡 (14:13) Assistant named the additive correction change fix(responses): harden hidden-output projection; working copy became change zlsmzkntqzzxsqvyxzzpxltmrsprymww, commit 5b1dfd4be2002e007605ec826104a7e8a3dd2227, empty and conflict-free, with parent ozrmvotwxzuykyvutstpwpzukpptktxv / 583020fad43e1481470aac2588251b8636d16251.
• 🔴 (14:13) User stated tests use a temporary SQLite database through packages/core/test/setup.ts; tests must never use the production database.
• 🔴 (14:13) User requires releases to use Sentry Craft through GitHub Actions; versions must never be manually bumped and CHANGELOG.md must never be edited manually because Craft handles both automatically.
• 🟡 (14:13) Release workflow command provided: gh workflow run release.yml -f version=auto; version: "auto" uses conventional commits to determine semantic versioning.