Distillation

Date: Sep 16, 2026

• 🔴 (13:18) User stated knowledge-delta insertion is capped at messages.length - 1 so at least one real message—user turn or tool_result—always follows the injected pair and closes the request.
• 🔴 (13:18) User stated the knowledge delta must be inserted before an assistant message carrying tool_use, never after its tool_use, including both completed pairs and pending tool calls.
• 🔴 (13:18) User stated the knowledge-delta closer *🧠 Refreshed memory* must always remain a separate assistant message and never be coalesced into a real assistant response.
• 🔴 (13:18) User stated the knowledge-delta closer is always followed by a real message after the safeDeltaInsertIndex cap; if that message is an assistant with tool_use, a user-turn separator is required.
• 🔴 (13:18) captureToolPairing400() identifies a specific Anthropic tool-pairing HTTP 400 only when status === 400 and errorBody contains tool_use, without, and tool_result; this avoids false positives from other tool-related 400s such as malformed schemas.
• 🔴 (13:18) captureToolPairing400() records only counts, layer, model, and the first 16 characters of sessionID, never message content, honoring the NO gen_ai.input.messages proxy posture.
• 🔴 (13:18) When Sentry is initialized, captureToolPairing400() captures Error("tool-pairing 400 (tool_use/tool_result concurrency)") with tags error_class: "tool_pairing_400", gradient_layer, and model; context includes layer, tool_use_count, tool_result_count, message_count, session_id_prefix, and concurrency_class: true.
• 🔴 (13:18) coalesceAdjacentAssistants() merges adjacent assistant messages by concatenating content blocks in order, but intentionally leaves user-to-user adjacency unchanged because providers accept it and delta-placement tests depend on distinct user blocks.
• 🔴 (13:25) packages/gateway/src/stream/anthropic.ts defines the shared finite SSE frame ceiling DEFAULT_MAX_SSE_FRAMES = 100_000, independently bounding parser work for tiny, blank, and comment-only frames.
• 🔴 (13:25) User stated deterministic local stream limits must never be reclassified as transport failures.
• 🔴 (13:25) SSEStreamTransportError represents post-header SSE body transport failures with kind: "inactivity" | "read"; SSEStreamLimitError is a separate deterministic local-limit error.
• 🔴 (13:25) readStreamChunk() preserves SSEStreamLimitError, wraps other reader failures as SSEStreamTransportError("read", "SSE stream read failed", { cause }), independently races caller abort and inactivity, and emits SSEStreamTransportError("inactivity", "SSE stream inactivity deadline exceeded") on timeout.
• 🔴 (13:29) For non-stream OpenAI Responses, parseResponsesNonStreamEnvelope() obtains a GatewayResponse via accumulateResponsesNonStreamJSON(), reads string json.status or defaults to "unknown", validates completion for statuses "completed" and "incomplete", and returns { response, status }.
• 🔴 (13:29) Non-stream OpenAI Responses accumulation throws ResponsesTerminalError(response, parsed.status) whenever status is not "completed".
• 🔴 (13:29) accountUnsuccessfulResponse() records validated positive usage via accountConversationUsage(), optionally invokes markDirty(), sets GenAI usage attributes, then always sets span status code 2 with message "upstream response did not complete" and ends the span.
• 🔴 (13:29) captureUnsuccessfulResponses() returns { response, successful: true } on success; for ResponsesTerminalError, it calls finishUnsuccessfulStreaming(error.response), returns { response, successful: false } only for status "incomplete", and returns undefined for other terminal statuses.
• 🔴 (13:29) In non-stream forwarding, an uncaptured terminal result becomes errorResponse(502, "Gateway request failed"); an incomplete response also becomes that 502 if it contains recall tool use, otherwise it is projected through nonStreamHttpResponse().
• 🔴 (13:30) streamResponsesRecallAware() accepts onComplete(response, successful), transaction commit()/rollback(), sessionID, maxRecallExecutions, deprecated maxRecallDepth, storage and byte/frame ceilings, validation: "public" | "codex", caller signal, recallDeadlineAt, retryPrincipal({ attempt, signal }), test-only sseInactivityMs, and an onRecall() callback.
• 🔴 (13:30) retryPrincipal() is specified to reissue the byte-stable principal request only after a pre-output body-read failure; the caller must preserve the original transformed request, route, credentials, and abort deadline.
• 🟡 (13:36) Assistant’s scope review passed immutable revision wswlsmrn, commit 24880457763b6f10831856d01c41bd72d62ddc28, descending through the provider-failure stack from main@origin commit 2cbf40060c67df229731cf1b9e34d5bf22ec2145.
• 🟡 (13:36) Assistant reported the plain diff SHA-256 remained c79cc2ec010e22f01961d8eec7bce3a60b8dfcb02c12b9ce4c0de9c5e173cb4d from review start to end and that the immutable candidate revision and patch hash did not change.
• 🟡 (13:36) Assistant raised a scope concern: the worktree began clean but ended with four externally modified files, so the review stopped using live files and relied on immutable jj file show -r wswlsmrn; all cited line numbers refer to that immutable revision.
• 🟡 (13:36) Assistant identified a MUST-FIX high-severity privacy bug: after response.created, a malformed non-JSON frame such as event: error / data: private-provider-diagnostic can be forwarded verbatim because the principal parser forwards non-JSON events unless the name starts with response. or is message (packages/gateway/src/pipeline.ts:10135-10156), while sanitization runs only after successful JSON parsing (:10284-10320).
• 🟡 (13:36) Assistant found the same malformed-error leak in continuation handling: packages/gateway/src/pipeline.ts:10921-10944 retains the raw frame and :11259-11268 can later queue it for client delivery, bypassing the fixed "Gateway request failed" envelope.
• 🟡 (13:36) Assistant recommended principal and continuation regressions for malformed non-JSON error events across recall pending, backpressure, EOF, and later successful or failing terminal outcomes.
• 🟡 (13:36) Assistant identified a second MUST-FIX high-severity privacy bug: visible response.in_progress events can leak untrusted metadata before a sanitized failure because recall-aware validation checks identity, status, and empty output but does not validate or project model, timestamp, extensions, or nested diagnostics (packages/gateway/src/pipeline.ts:9183-9198) before forwarding the original event (:11664-11675).
• 🟡 (13:36) Assistant found plain passthrough rejects a changed model but still forwards arbitrary extensions and changed timestamps (packages/gateway/src/stream/openai-responses.ts:1094-1118, :2583); the existing test at packages/gateway/test/openai-responses-recall-aware-stream.test.ts:820-894 covers only an in-progress event hidden by active recall, not the visible no-recall path.
• 🟡 (13:36) Assistant recommended projecting every visible lifecycle frame solely from trusted response.created state.
• 🟡 (13:36) Assistant identified a third MUST-FIX high-severity observability/privacy issue: validated provider failures settle without a categorical error log in the buffered/plain path (packages/gateway/src/stream/openai-responses.ts:2134-2174), recall-aware principal path (packages/gateway/src/pipeline.ts:10284-10333), and continuation path (pipeline.ts:10959-10983).
• 🟡 (13:36) Assistant found callback failures may log private arbitrary error text at packages/gateway/src/stream/openai-responses.ts:2764-2774, packages/gateway/src/pipeline.ts:9618-9628, and rollback handling at pipeline.ts:8033-8040; log.error() exports message and sanitized stack to durable sinks and Sentry (packages/core/src/log.ts:206-222, :497-504), and pattern redaction does not remove arbitrary callback text.
• 🟡 (13:36) Assistant recommended always logging a fixed categorical provider-failure message and never passing callback or rollback error objects into logs or Sentry.
• 🟡 (13:36) Assistant raised an atomicity concern in the shared accumulator: the sanitized-failure branch invokes applyResponsesEvent() without the terminal snapshot used by the normal branch (packages/gateway/src/stream/openai-responses.ts:2134-2174; snapshot begins at :2179).
• 🟡 (13:36) Assistant explained the atomicity failure mechanism: applyResponsesEvent() sets terminal state and stop reason before validating usage (packages/gateway/src/stream/openai-responses.ts:845-928), so malformed or overflowing failure usage throws after partial state mutation even though output remains hidden.
• 🟡 (13:36) Assistant recommended malformed and overflowing failure-usage tests that assert complete accumulator state restoration in both public and Codex modes.
• 🟡 (13:36) Assistant noted supplied green evidence—615/615, a repeated 200/200 sequence battery, static checks, and bundle results—did not prove failing-first or mutation behavior because no base-failure or guard-removal artifact was provided.
• 🟡 (13:36) Assistant listed missing test cross-products: 1. malformed non-JSON error in principal and continuation, 2. visible response.in_progress metadata poisoning, 3. malformed failure usage with state restoration, 4. throwing onComplete and rollback callbacks with sink/Sentry assertions, 5. Codex rate-limit events followed by failure, 6. numbered principal frames followed by a locally synthesized failure.
• 🟡 (13:36) Assistant verified gateway-owned terminal sequencing: direct Responses streaming derives sanitized terminal sequence from trusted prior state (packages/gateway/src/stream/openai-responses.ts:605-650), while recall-aware output rewrites every JSON frame to contiguous gateway-owned numbers (packages/gateway/src/pipeline.ts:9586-9615).
• 🟡 (13:36) Assistant verified duplicate, decreasing, negative, non-integer, and unsafe provider sequence values are rejected before sanitizer or accumulator mutation (packages/gateway/src/stream/openai-responses.ts:653-666, :2109-2119; packages/gateway/src/pipeline.ts:10161-10167, :10950-10964).
• 🟡 (13:36) Assistant verified failure terminal ID, model, creation time, output, error details, and extensions are replaced with the fixed envelope (packages/gateway/src/stream/openai-responses.ts:605-650), and failed completion projections clear content and raw output while retaining validated usage (:1030-1044).
• 🟡 (13:36) Assistant verified the implementation fails closed for response.in_progress before creation, failure diagnostics before creation, alias/type mismatches, contradictory terminal statuses, malformed identities, malformed references, and malformed output lifecycles.
• 🟡 (13:36) Assistant verified failure accounting occurs before terminal backpressure and survives client cancellation (packages/gateway/src/stream/openai-responses.ts:2801-2805; packages/gateway/src/pipeline.ts:10312-10325), while unsuccessful finalization performs accounting and rollback without successful-turn persistence (pipeline.ts:18795-18826).
• 🟡 (13:36) Assistant verified usage validation rejects negative, inconsistent, and overflowing counts before cost accounting, while request-wide frame, byte, retained-state, hidden-recall, and transactional limits remain bounded.
• 🟡 (13:36) Assistant verified recall-bearing failed output and arguments do not reach client output, completion callbacks, or successful persistence.
• 🟡 (13:36) Assistant did not rerun candidate tests. A read-only ad hoc import probe failed before execution because the checkout lacked the expected built @loreai/core artifact, so it provided no validation evidence.
• 🟡 (13:36) Assistant’s final review disposition was DO-NOT-MERGE.