Distillation

Date: Sep 16, 2026

• 🔴 (22:42) User/project security directive: recall interception must “never expose non-semantic %s frames after recall interception.”
• 🔴 (22:42) User/project security directive: the gateway must “never treat forged reasoning lifecycle names as semantic %s frames.”
• 🟡 (22:42) Candidate tests in packages/gateway/src/pipeline.ts cover private diagnostic frames around recall interception using response IDs "resp_private_diagnostic_principal" and model "gpt-5.6-terra", ensuring non-semantic private data is not exposed.
• 🟡 (22:42) Candidate forged-reasoning lifecycle test uses response IDs "resp_forged_reasoning_followup" and "resp_forged_reasoning_principal" with model "gpt-5.6-terra" and asserts output does not contain "private forged reasoning result".
• 🟡 (22:42) Candidate continuation validation tests reject invalid created_at data before rebuilding the terminal; one enumerated case is ["array", '["private created-at array"]']. The recall scenario asserts output does not contain "private recall result".
• 🟡 (22:42) Candidate projection-performance test instruments Array.prototype.sort via numericProjectionSorts, constructs terminalOutput: Array<Record<string, unknown>>, drains the client, and includes a follow-up path that throws new Error("should not run").
• 🟡 (22:42) Candidate allowlisted-terminal-field tests use eventSecret, terminalSecret, response usage { input_tokens: 11, output_tokens: 3 }, principal response ID "resp_allowlisted_principal", capture completedResponse, and assert exactly one response.completed SSE event with expect(out.match(/^event: response\.completed$/gm)).toHaveLength(1).
• 🟡 (22:43) Search found exactly 51 matches in /home/byk/Code/opencode-lore-responses-projection-security/packages/gateway/src/pipeline.ts.
• 🟡 (22:43) Relevant pipeline.ts symbols and locations include: onComplete: (response: GatewayResponse) => void at line 6827; onComplete(response) at line 6896; documentation that onComplete mirrors streamResponsesPassthrough and is invoked exactly once at line 7787; onComplete: (response: GatewayResponse, successful: boolean) => void at line 7797; and isSemanticResponsesEvent at line 8060.
• 🟡 (22:43) pipeline.ts response-state and projection locations include applyResponsesEvent(acc, "response.output_item.added", ...) at line 9162, applyResponsesEvent(acc, "response.output_item.done", ...) at line 9453, buildOutputItemsWithIndices at lines 9904 and 9907, visibleOutputIndexMap at line 9986, and remapVisibleOutputIndices at line 9996.
• 🟡 (22:43) Principal projection logic in pipeline.ts includes projectionInvalid at line 10143, visibleSourcePosition at line 10184, syncVisibleOutputIndex at line 10195, projection-invalidating branches at lines 10233, 10257, and 10269, and enqueueProjectedPrincipal at line 10276.
• 🟡 (22:43) Principal event processing checks !isSemanticResponsesEvent(event) at line 10386, applies such events to accumulated state with applyResponsesEvent(state, event, parsed) at line 10389, and also calls applyResponsesEvent(state, event, parsed) at line 10492.
• 🟡 (22:43) Continuation event processing checks !isSemanticResponsesEvent(ce) at line 11057, accumulates it via applyResponsesEvent(contState, ce, cparsed) at line 11059, and has another applyResponsesEvent(contState, ce, cparsed) path at line 11135.
• 🟡 (22:43) Transactional recall handling in pipeline.ts declares transactionalEvents: Uint8Array[] at line 10795, pushes chunks at lines 10805 and 10986, tracks continuationCompleted beginning at line 11011 and updates it at line 11305, restores transactionalEvents.length from continuationRetryBaseline.transactionalEvents at lines 11356–11357, checks !continuationCompleted at line 11471, and later iterates transactional chunks at line 11669 while applying remapVisibleOutputIndices(chunk, visibleIndices) at line 11672.
• 🟡 (22:43) Completion/error paths in pipeline.ts call opts.onComplete(resp, successful) at line 9651, log "openai-responses recall-aware onComplete error:" at line 9655, log "recall onComplete failed after delivery" at line 11715, and define another onComplete: (response, successful) => callback at line 18941.