Distillation

Date: Sep 16, 2026

• 🔴 (14:49) User specified the security invariant/test contract "never exposes non-semantic %s frames after recall interception".
• 🟡 (14:49) packages/gateway/src/pipeline.ts introduced isSemanticResponsesEvent(event: string) to allow only response.created, response.in_progress, response.completed, response.done, response.incomplete, response.failed, response.output_item.added, response.output_item.done, prefixes response.output_text., response.refusal., response.function_call_arguments., response.content_part., response.reasoning_summary_, response.reasoning_text., and codex.rate_limits; non-semantic events are filtered from both principal and follow-up recall streams.
• 🟡 (14:49) packages/gateway/test/openai-responses-recall-aware-stream.test.ts added rawSSEEvent(event, data) and parameterized controls proving raw non-semantic frames such as event: diagnostic and their private payloads are absent after recall interception.
• 🟡 (14:49) Initial investigation hypothesis: a lower-index hidden recall would not alter an already-visible item because hidden source index 0 would not enter the compact public set and visible source index 1 would remain public slot 0; assistant temporarily treated the inherited fail-closed assertion as stale.
• 🟡 (14:50) Investigation correction: immutable-parent identity behavior showed that a newly private lower-index recall reserves a public synthetic anchor at source index 0, shifting an already-emitted message. Therefore the lower-index case must remain fail-closed; the earlier compact-set-only hypothesis was rejected. A higher-index hidden recall remains a valid sparse-projection success case.
• 🟡 (14:50) Parent implementation /tmp/opencode/projection-parent-pipeline.ts uses recallIndices, forwardedVisibleOutputIndices, and assertForwardedProjectionStable(); the assertion compares each previously forwarded sourceIndex with its current visible index and throws "Responses output changed a client-visible output_index" on any change.
• 🔴 (14:51) User specified the processing invariant: "Always accumulate into the internal state for postResponse."
• 🟡 (14:51) Both parent and working implementations apply every accepted Responses event to internal state with applyResponsesEvent(state, event, parsed) before projection/delivery decisions; response.output_item.done additionally invokes preserveStreamedReasoning(state, outputIndex).
• 🟡 (14:51) Working packages/gateway/src/pipeline.ts strengthened projection tracking with syncVisibleOutputIndex(outputIndex) and calls assertForwardedProjectionStable() when the projection changed, a recall index became newly private, or a visible tool resolved. Newly private recall indices are thereby reserved in the projection ledger as future synthetic public anchors.
• 🟡 (14:51) Recall/tool lifecycle handling suppresses all recall-item and unresolved-tool events while still counting their encoded bytes against maxDeferredBytes and maxHiddenRecallBytes; completed recall arguments are parsed with parseRecallArguments(), and excess parallel recalls throw new RecallContinuationFailure("parallel_recall").
• 🟡 (14:52) Recall-only continuation construction reserves synthetic identity msg_${state.id || "lore"}_${recall.outputIndex}, executes settleRecall(), stores each executed.anchorText, replaces recall tool_use blocks with text anchors, and emits remapped transactional events only after assertForwardedProjectionStable() succeeds.
• 🟡 (14:53) Updated packages/gateway/test/openai-responses-recall-aware-stream.test.ts retained the genuine lower-index fail-closed negative control and the higher-index sparse success positive control.
• 🟡 (14:53) Focused Vitest run for packages/gateway/test/openai-responses-recall-aware-stream.test.ts passed: 1 test file passed; 14 tests passed and 208 skipped out of 222; duration 6.14s.
• 🟡 (14:53) Assistant reported independent mutation proof for three security guards and a passing combined projection matrix of 14 cases, including lower-index fail-closed and higher-index sparse success.
• 🟡 (14:54) Follow-up stream processing in packages/gateway/src/pipeline.ts now parses JSON, enforces cparsed.type === ce, rejects malformed JSON for response.* events, skips events failing isSemanticResponsesEvent(ce), then normalizes and validates accepted events before applying them to contState.
• 🟡 (14:54) Follow-up hidden recall/unresolved-tool events are accumulated internally but withheld from delivery; shifted output indices use shiftedOutputIndex(ci, contIndex), hidden-byte limits produce RecallContinuationFailure("resource_limit"), and unresolved continuation events remain held until identity resolution.
• 🟡 (14:55) Source audit decision for metadata-only allowlisted events such as codex.rate_limits: preserve their sanitized accumulator projection for internal/post-response state, but do not forward the raw provider frame through recall processing; arbitrary extension fields cannot piggyback through raw SSE delivery.
• 🟡 (14:55) packages/gateway/src/pipeline.ts was updated after the metadata/raw-frame audit; a file search returned No files found, indicating no additional matching files from that audit query.
• 🟡 (14:56) Re-run of the focused Vitest suite passed: 1 test file passed; 14 tests passed and 208 skipped out of 222; duration 5.68s.
• 🟡 (14:56) Assistant stated the focused security controls pass and began a complete event-path audit before running the full recall-aware suite; no broad-suite result was available in this segment.