Distillation

Date: Sep 16, 2026

• 🔴 (14:45) User stated tests use a temporary SQLite database through packages/core/test/setup.ts; tests must never use the production database at ~/.local/share/lore/lore.db.
• 🔴 (14:45) User requires releases to use Sentry Craft through GitHub Actions and stated: “Never manually bump versions or edit CHANGELOG.md” because Craft handles both automatically.
• 🔴 (14:45) User stated the project runtime is Node.js >= 22.5, the language is TypeScript in a pnpm workspace monorepo, and storage is SQLite in WAL mode with FTS5 full-text search at ~/.local/share/lore/lore.db.
• 🔴 (14:45) User stated root tooling is pinned in /home/byk/Code/opencode-lore-embedding-runtime/package.json to pnpm@10.28.0, Volta Node 24.16.0, and Volta pnpm 10.28.0.
• 🔴 (14:45) User stated standard validation commands are pnpm test, pnpm run typecheck, pnpm run lint, pnpm run format:check, and pnpm run build; formatting is applied with pnpm run format, and lint autofixes use pnpm run lint:fix.
• 🔴 (14:45) User stated the release commands are gh workflow run release.yml -f version=auto for conventional-commit-derived semver or gh workflow run release.yml -f version=0.23.0 for an explicit version.
• 🔴 (14:45) User stated the release workflow order is: 1. scripts/bump-version.sh updates every package.json; 2. changelog is generated from conventional commits; 3. a release/X.Y.Z branch is created and pushed; 4. CI runs tests and builds npm tarballs, standalone binaries, and delta patches; 5. Craft opens a publish issue; 6. adding the accepted label triggers npm OIDC publishing and a GitHub Release with binaries and patches.
• 🔴 (14:46) User requires every defect found during adversarial review to land with a deterministic regression test in the same PR that fails on the base branch, passes with the fix, and drives the real precondition rather than artificially constructing state.
• 🔴 (14:46) User requires guard tests to fail when the guard is deleted; if the test still passes without the guard, it does not test the guard.
• 🔴 (14:46) User requires TDD failing-first for bug fixes and stated: “Never trust the fix without seeing it fail.”
• 🔴 (14:46) User requires adversarial state setup in the order an adversary would create it, including: 1. state present before the handling operation; 2. delete-then-recreate across lifecycle boundaries; 3. content modification while synchronization is disabled.
• 🔴 (14:46) User stated fan-out registries require matching parametrized contract batteries: SYNCED_TABLES → packages/core/test/sync-registry-contract.test.ts; MIGRATIONS → the db.test.ts schema-version assertion plus migration-specific tests; AGENTS → agents.test.ts, checking name, displayName, binary, detect(), and that binary is a constant placeholder string.
• 🔴 (14:46) User stated standing bug-class batteries are: registry contracts in packages/core/test/sync-registry-contract.test.ts; per-operation sync invariants in packages/core/src/sync-data.ts through assertSyncInvariants; and sequence properties in packages/gateway/test/sync.property.test.ts, covering prune-floor progress, eventual convergence, no ping-pong, and currentTier correctness.
• 🔴 (14:46) User stated skip and early-return branches are the highest-risk correctness surface; every such branch needs a test that makes it fire incorrectly and proves the operation is not skipped.
• 🔴 (14:46) User stated memoized arrays shared among callers should be frozen so accidental mutation throws TypeError in strict mode instead of silently corrupting the cache.
• 🔴 (14:46) User stated db().query monkeypatches are hidden by the tracing Proxy; SQL-counting tests must use the log.registerSink({ withDbSpan }) seam because direct assignment to db().query is silently ignored.
• 🔴 [requested-review] (14:46) User’s project requires two distinct review passes for non-trivial changes: 1. adversarial/correctness review covering enumerated failure states, apply-then-revert mutants, property-test stability ×10, hash-equivalence proofs, frozen-array mutation safety, and stale-cache analysis; 2. security/pentest review covering injection, credential leaks, protocol attacks, and privilege escalation. Adversarial review is mandatory before merge; security review depends on risk.
• 🔴 [requested-review] (14:46) User requires reviewers to run pnpm test, pnpm run typecheck, pnpm run lint, and pnpm run format:check, explicitly checking exit codes; run property tests ×10; verify the working tree ends unmodified via hashes; and report each point as PASS, FAIL, CONCERN, or MUST-FIX with file:line evidence plus an overall MERGE or DO-NOT-MERGE verdict.
• 🟡 (14:46) Jujutsu working copy tmzmtlss / commit e6d0f1ed is on bookmark fix/embedding-runtime-admission with description fix(core): correct embedding runtime selection and admission, based on main commit 2cbf4006.
• 🟡 (14:46) Current candidate comprises 18 changed files with 1,818 insertions and 90 deletions: added packages/core/src/cgroup-memory.ts and packages/core/test/cgroup-memory.test.ts; modified packages/core/src/embedding/local.ts, packages/core/src/embedding/pool.ts, packages/core/src/embedding-cap.ts, packages/core/src/embedding-worker-types.ts, packages/core/src/embedding-worker.ts, packages/core/src/embedding.ts, packages/core/src/ort-native.ts, packages/core/test/embedding-cap.test.ts, packages/core/test/embedding-pool-memory.test.ts, packages/core/test/embedding-pool.test.ts, packages/core/test/embedding-worker-types.test.ts, packages/core/test/ort-native.test.ts, packages/gateway/script/bundle.ts, packages/gateway/script/ort-platform-package.ts, packages/gateway/test/bundle-exports.test.ts, and packages/gateway/test/ort-platform-package.test.ts.
• 🟡 (14:46) Jujutsu reported a separate conflicted bookmark fix/responses-private-references; assistant stated the current embedding-runtime candidate itself had no conflicts.
• 🟡 (14:47) Focused admission, cgroup, loader, and packaging regression run passed all 249 tests across 7 test files in 8.19 seconds.
• 🟡 (14:47) Assistant began auditing the actual diff and missing adversarial cases after the focused suite passed, explicitly noting that 249/249 passing did not yet establish worker containment, generated-bundle freshness, or diagnostic privacy.