fix: land the L1 lane of the 260827 bug-PR merge round (#2672 #2674 #2671 #2684)

devlog/_plan/260827_bug_pr_merge_round/000_intake.md

@@ -0,0 +1,53 @@
+# 260827 bug-PR merge round — intake
+
+Base: dev @ 9b838d062 (fast-forwarded from origin/dev on 2026-08-27).
+Scope: the 12 open bug-labelled PRs named by the user.
+Lanes: L1 commit-then-merge, L2 close + squash-merge, L3 cherry-pick, L4 reimplement.
+
+## Method
+
+Every PR head was fetched to a local branch (`pr<n>-check`), checked out into an
+isolated worktree under `/tmp/ocx-tc-<n>`, and compiled with `bun x tsc --noEmit`
+against the repository's own `node_modules`. Note this compiles the PR HEAD, which is
+behind dev by 4 to 294 commits depending on the PR; the merged-tree gate a merge round
+actually needs is in 005. This is the gate the repository's
+`resolve-pr`-only CI does NOT run for draft PRs: a draft here gets
+`enforce-target`, `hygiene`, `label`, `resolve-pr` and CodeRabbit, none of which
+compile the tree. Two PRs (#2672, #2674) carry the full matrix because they are
+authored by a maintainer.
+
+## Compile gate result (2026-08-27, local, bun 1.4.0)
+
+| PR | tsc --noEmit | note |
+|---|---|---|
+| #2694 | **FAIL (5 errors)** | see 001 |
+| #2693 | OK | test-only diff |
+| #2690 | OK | |
+| #2684 | OK | |
+| #2674 | OK | full CI green |
+| #2672 | OK | full CI green |
+| #2671 | OK | |
+| #2663 | OK | |
+| #2647 | OK | branch CONFLICTING against dev |
+| #2639 | OK | but its own change fails an existing suite, see 002 |
+| #2638 | OK | |
+| #2497 | OK | branch CONFLICTING against dev |
+
+Evidence: `/tmp/ocx-pr-typecheck.txt`, produced by `/tmp/ocx-tc-all.sh`.
+
+## Mergeability and CI as reported by GitHub
+
+| PR | draft | mergeable | review | checks of note |
+|---|---|---|---|---|
+| #2694 | ready | MERGEABLE | REVIEW_REQUIRED | all 5 pass |
+| #2693 | draft | MERGEABLE | REVIEW_REQUIRED | CodeRabbit pending |
+| #2690 | draft | MERGEABLE | REVIEW_REQUIRED | enforce-target FAIL |
+| #2684 | draft | MERGEABLE | REVIEW_REQUIRED | enforce-target FAIL, label FAIL |
+| #2674 | draft | MERGEABLE | — | full matrix PASS; base is #2672's head |
+| #2672 | draft | MERGEABLE | REVIEW_REQUIRED | full matrix PASS |
+| #2671 | ready | MERGEABLE | CHANGES_REQUESTED | all pass |
+| #2663 | ready | MERGEABLE | REVIEW_REQUIRED | all pass |
+| #2647 | ready | **CONFLICTING** | CHANGES_REQUESTED | all pass |
+| #2639 | ready | MERGEABLE | CHANGES_REQUESTED | ci FAIL, macos FAIL, test 4/4 FAIL |
+| #2638 | draft | MERGEABLE | CHANGES_REQUESTED | enforce-target FAIL, hygiene FAIL |
+| #2497 | draft | **CONFLICTING** | REVIEW_REQUIRED | enforce-target FAIL, hygiene FAIL |

devlog/_plan/260827_bug_pr_merge_round/001_pr2694_compile_break.md

@@ -0,0 +1,62 @@
+# #2694 — SenseNova code-mode exec alias: does not compile
+
+Head: `d6b2433453` (branch `fix/sensenova-code-mode-exec-alias`, author yxr1995-maker).
+GitHub shows all five checks green and the PR is marked review-ready with 4/4 boxes
+ticked, including "All CI tests are green on my local testing." That claim is false.
+
+## Evidence
+
+```
+$ cd /tmp/ocx-pr2694 && bun x tsc --noEmit
+src/bridge.ts(645,13): error TS2554: Expected 2-3 arguments, but got 1.
+src/bridge.ts(647,11): error TS2304: Cannot find name 'failMalformedCodeModeExecCommand'.
+src/server/responses/collaboration.ts(173,9): error TS2304: Cannot find name 'ToolBridgeMaps'.
+src/server/responses/core.ts(2946,11): error TS2353: Object literal may only specify known
+  properties, and 'requestId' does not exist in type '{ code?: ...; retryAfter?: ... }'.
+src/server/responses/core.ts(2946,37): error TS2339: Property 'requestId' does not exist on
+  type 'OcxRequestOptions'.
+```
+
+Four distinct defects:
+
+1. `failMalformedCodeModeExecCommand()` is CALLED at `src/bridge.ts:647` and defined
+   nowhere in the branch — `git grep -n 'failMalformed' pr2694-check -- src/` returns
+   exactly the one call site. It does not exist on dev either.
+2. `freeformInput` takes `(args, toolName, namespace)` on dev (`src/bridge.ts:247`);
+   the PR calls it with one argument.
+3. `ToolBridgeMaps` is used as a parameter type in the new exported function but is
+   never imported or declared. `buildToolBridgeMaps` returns an inline object type on
+   dev, so there is no such named type to import.
+4. `formatErrorResponse(..., { requestId })` — that options bag has no `requestId`,
+   and `OcxRequestOptions` has no such property.
+
+## Why CI did not catch it
+
+The PR ran only `CodeRabbit`, `enforce-target`, `hygiene`, `label`, `resolve-pr`.
+None of those compile or test the tree.
+
+An earlier version of this note claimed the full matrix "only appears on
+maintainer-authored PRs." That was wrong — see 007, finding 6. #2639 carries all 27
+checks and its author is not a maintainer, and `ci.yml` is `pull_request: {}` with no
+draft gating. Why some PRs here get five checks and others twenty-seven is not
+established; do not guess at it again.
+
+## Second problem: the provider id is wrong
+
+`src/server/responses/core.ts` gates the alias on `route.providerName === "sensenova"`.
+There is no `sensenova` provider in `src/providers/registry.ts`. The id appears only in
+`src/providers/free-directory.ts:141` as a free-directory entry
+(`https://token.sensenova.cn/v1`). Whether `route.providerName` ever equals
+`sensenova` for such a provider is unverified by the PR — it ships no test that
+exercises the gate. Its single test calls `bridgeToResponsesSSE` directly with a
+hand-built `toolNsMap`, so it never touches `enableSensenovaCodeModeExecCommandAlias`
+at all, and would pass even if the gate never fires in production.
+
+## Lane
+
+**L4 — reimplement.** The diagnosis (a provider emitting bare `exec_command` instead of
+the code-mode `exec` wrapper) is plausible and #2663 is independently solving the
+general version of it. This branch cannot be committed-and-merged because it does not
+build, and the missing function means there is no "small fix": the malformed-input
+failure path was never written. Sequence it AFTER #2663 lands and re-evaluate whether
+anything is still needed.

devlog/_plan/260827_bug_pr_merge_round/002_pr2639_regression.md

@@ -0,0 +1,55 @@
+# #2639 — status/created_at backfill: real defect, real regression
+
+Head: `aa385f9746` (branch `fix/responses-backfill-status-and-created-at`, author bet4it).
+Diff: `src/server/responses/responses-field-backfill.ts` +114/-15, plus 343 lines of new
+tests. It compiles clean, and its own suite passes (37/37).
+
+## The defect is real
+
+Strict Responses decoders require `status` on `OutputMessage` and `created_at: u64` on
+the response object. An upstream relay that omits either makes such a client fail with
+`missing field`. The PR backfills both, infers the message status from the event type,
+and maps response-level `failed`/`cancelled` to `incomplete` rather than `completed` —
+that last choice is right, since claiming `completed` would let a client treat a
+truncated message as whole.
+
+## The regression is also real, and it is caused by this PR
+
+```
+$ cd /tmp/ocx-tc-2639 && bun test ./tests/server-combo-failover-e2e.test.ts
+(fail) server combo failover 030 activation matrix > cross-adapter chat 503 to Responses 200
+       returns the exact backup response
+ 73 pass, 1 fail
+```
+
+On clean dev the same file is 74 pass / 0 fail, so this is not a pre-existing flake.
+
+The diff of the failing assertion:
+
+```
+  {
++   "created_at": 1787801315,
+    "id": "resp-m2",
+```
+
+`tests/server-combo-failover-e2e.test.ts:1323` asserts the proxy returns the backup
+provider's JSON **exactly** (`expect(await response.json()).toEqual(exact)`). The
+`created_at` backfill injects a field the upstream never sent, so a passthrough body is
+no longer byte-identical.
+
+This is a genuine contract conflict, not a stale test. The combo-failover contract says
+a passthrough backup response is returned unchanged; the backfill says a response
+missing `created_at` gets one. Both cannot hold for the same body.
+
+## Resolution direction
+
+The `status` half is uncontroversial and stays. For `created_at`, the backfill must not
+apply to a passthrough body that is being relayed verbatim — scope it to the
+translated/bridged path, or make the combo passthrough exempt. Deciding which of the two
+contracts yields is a maintainer call and belongs in the lane doc, not here.
+
+## Lane
+
+**L3 — cherry-pick.** Take the `status` backfill and its tests; hold `created_at` until
+the passthrough-exactness conflict is resolved, then land it as its own change with the
+combo test updated deliberately.

devlog/_plan/260827_bug_pr_merge_round/003_disposition_matrix.md

@@ -0,0 +1,29 @@
+# Disposition matrix — all 12 PRs
+
+| PR | title | lane | reason |
+|---|---|---|---|
+| #2672 | normalize canonical forward prompt envelope | **L1** | maintainer-authored, full CI matrix green, destination-scoped, manifest version bumped, docs updated. Merge first — it is the base of #2674. |
+| #2674 | normalize Posit tool continuations | **L1** | stacked child of #2672, full CI matrix green. Merge second, retarget to dev after the parent lands. |
+| #2671 | Muse Spark image input on OpenCode Go | **L1** | five-line registry declaration on an existing mechanism, four focused tests, CodeRabbit clean, review recommends merge. Add the reviewer's requested test (live row advertises `["text"]`, config still wins) before merging. |
+| #2693 | Gemini 3 thought-signature fallback | **L4** | 15 lines, test-only — and the test FAILS on its own branch because the implementation was never written (see 004). Needs an upstream fact before it can be implemented or closed. |
+| #2684 | Azure Model Router function schemas | **L1** | 92 lines, self-contained, host-scoped to Azure endpoints, reuses the existing Zen flattening helper, ships a negative test proving non-Azure targets are untouched. Fix the label/enforce-target hygiene, then merge. |
+| #2639 | backfill status and created_at | **L3** | `status` half is correct; `created_at` breaks `tests/server-combo-failover-e2e.test.ts:1323` (proven, see 002). Cherry-pick `status`, hold `created_at`. |
+| #2647 | Command Code reasoning presets | **L3** | content is three table rows and is fine, but the branch conflicts with dev on `src/providers/command-code-efforts.ts` and its test rewrites a catalog snapshot count 51 -> 60 that must be re-verified live. Re-apply the rows on a dev-based branch. |
+| #2690 | normalize xAI Responses root tool schemas | **L4** | 926/289 across 8 files. Reclassified from L3 at audit round 2: the fix imports the extracted module, so "fix minus refactor" is incoherent (007, finding 9). It also conflicts with the now-merged #2684 on `openai-chat.ts`. Either rebase and land whole, or reimplement against the existing helper. |
+| #2663 | bridge code-mode helpers through exec | **L2** | 528/68 across 12 files with substantive tests, CI green, compiles. Too broad to merge as a single review-required commit on its own head; land squashed with a written summary and close. Sequence before #2694. |
+| #2694 | SenseNova bare exec_command wrapper | **L4** | does not compile: 5 tsc errors, one call to a function that does not exist (see 001). Gate keys on a provider id absent from the registry. Reimplement minimally after #2663, or close as NOOP if #2663 subsumes it. |
+| #2638 | close drain routing follow-ups | **L4** | 1341/119 across 7 files, hygiene FAIL, enforce-target FAIL, CHANGES_REQUESTED. Touches `src/server/responses/core.ts` and subagent fallback — shared runtime. Rewrite the actual routing fix minimally. |
+| #2497 | native main token refresh and replay | **L4** | 2622/76 across 20 files, CONFLICTING on 5 files including `src/server/responses/core.ts`, hygiene FAIL. Touches OAuth token refresh = credential boundary, so it needs explicit security review per MAINTAINERS.md before any rewrite lands. |
+
+## Order
+
+L1 first (#2672 -> #2674 -> #2671 -> #2684): each is small, green, and independent of
+the others except the declared stack.
+
+L3 second (#2639 -> #2647 -> #2690): each needs a dev-based branch and a decision
+about which part travels.
+
+L2 third (#2663): large but healthy; landing it changes the answer for #2694.
+
+L4 last (#2693 -> #2694 -> #2638 -> #2497): each is a rewrite. #2693 is blocked on an
+upstream provider fact and #2497 additionally needs a human security decision.

devlog/_plan/260827_bug_pr_merge_round/004_pr2693_missing_implementation.md

@@ -0,0 +1,47 @@
+# #2693 — Gemini 3 thought-signature fallback: test without implementation
+
+Head branch `fix/gemini-thought-signature-bypass`, author yxr1995-maker. The diff is
+15 added lines in ONE file: `tests/google-antigravity-replay.test.ts`. No source file
+is touched.
+
+The test asserts that when the replay cache misses, the first `functionCall` part gets
+`thoughtSignature = "skip_thought_signature_validator"`:
+
+```
+$ cd /tmp/ocx-tc-2693 && bun test ./tests/google-antigravity-replay.test.ts
+(fail) durable antigravity replay snapshot > fallback to skip_thought_signature_validator
+       on the first functionCall when replay cache misses
+ 61 pass, 1 fail
+
+  1015 | expect(parts[0].thoughtSignature).toBe("skip_thought_signature_validator");
+  Expected: "skip_thought_signature_validator"
+  Received: undefined
+```
+
+The string `skip_thought_signature_validator` appears nowhere under `src/`:
+`grep -c` returns 0 for `google-antigravity-replay.ts`, `google.ts`, and
+`google-antigravity-wire.ts`. `applyAntigravityReplay` only assigns a signature it
+actually has cached (`src/adapters/google-antigravity-replay.ts`), so on a cache miss
+the part is left alone by design.
+
+So the PR is a red test for an unimplemented behavior. It is still a DRAFT with
+CodeRabbit pending, which is consistent — the author may not have pushed the source
+half yet.
+
+## Is the underlying claim right?
+
+Plausible but unverified here. CLIProxyAPI uses that sentinel to bypass Gemini's
+signature validator when it has nothing genuine to replay. The existing dev design
+takes the opposite position — `src/adapters/google-antigravity-wire.ts` deliberately
+refuses to forward a non-genuine signature, because "sending a foreign id as `n`
+breaks" continuity. A sentinel that upstream treats as "skip validation" is a
+different thing from a forged signature, but that distinction needs an upstream fact
+to settle, and nothing in this repository establishes it.
+
+## Lane
+
+**L4 — reimplement**, downgraded from the initial L1 read. Either implement the
+fallback in `applyAntigravityReplay` and keep the test, or close the PR as
+not-reproducible. Deciding needs one external fact: whether Gemini 3 on Antigravity
+actually honors `skip_thought_signature_validator` on a functionCall part. Until that
+is answered the PR is BLOCKED on an upstream provider fact, not on our implementation.

devlog/_plan/260827_bug_pr_merge_round/005_audit_corrections.md

@@ -0,0 +1,103 @@
+# Audit corrections to the intake (A-gate round 1)
+
+An independent reviewer audited the unit at c3ef63023 and produced two findings that
+the plan got wrong. Both are confirmed here by direct command output, and the affected
+documents are corrected rather than defended.
+
+## Correction 1 — the compile gate ran against stale heads
+
+Every PR head is behind current dev, some by a lot:
+
+```
+$ for n in ...; do git rev-list --count pr${n}-check..origin/dev; done
+2694 26   2693 26   2690 4    2684 84
+2674 87   2672 87   2671 87   2663 96
+2647 84   2639 4    2638 87   2497 294
+```
+
+So `TYPECHECK_OK` on a PR head proved that head compiles, not that the MERGED tree
+compiles. That is the number a merge round actually needs.
+
+Re-ran the gate on the merge result (`git merge origin/dev + pr<n>-check`, then
+`bun x tsc --noEmit`), recorded in `/tmp/ocx-merged-typecheck.txt`:
+
+```
+2672 MERGED_TYPECHECK_OK   2671 MERGED_TYPECHECK_OK
+2684 MERGED_TYPECHECK_OK   2663 MERGED_TYPECHECK_OK
+2690 MERGED_TYPECHECK_OK   2639 MERGED_TYPECHECK_OK
+2638 MERGED_TYPECHECK_OK
+```
+
+The conclusions in 000 survive, but they now rest on the right evidence. #2694's
+failure is unaffected: a call to an undefined function does not become defined by
+merging dev.
+
+## Correction 2 — #2684 and #2690 DO conflict
+
+020 stated they "do not textually conflict (different helper, different call site)."
+That is false:
+
+```
+$ git merge-tree --write-tree pr2684-check pr2690-check
+exit=1
+100644 ... 1  src/adapters/openai-chat.ts
+100644 ... 2  src/adapters/openai-chat.ts
+100644 ... 3  src/adapters/openai-chat.ts
+```
+
+The reason is structural, not incidental. #2690 DELETES the region #2684 edits:
+
+```
+$ git diff origin/dev...pr2690-check -- src/adapters/openai-chat.ts
+@@ -922,16 +927,6 @@   -function isXaiSchemaTarget(...)
+@@ -1212,265 +1207,6 @@  -function normalizeXaiToolParameters(...)  (+14 more)
+```
+
+#2690 moves ~269 lines of xAI schema logic out of `openai-chat.ts` into the new
+`src/adapters/xai-tool-schema.ts`, while #2684 adds its Azure helper right beside
+`shouldSanitizeZenToolParameters` in the same file and rewrites
+`toolsToChatFormatForProvider`, which #2690 also touches.
+
+Consequence for sequencing: whichever lands second must be re-applied by hand, not
+merged. Land #2684 FIRST — it is 92 lines with a containment test and a merged-tree
+OK — then rebase #2690's extraction on top, where the conflict is resolved once by the
+party doing the extraction. The L3 plan for #2690 (take the normalization, leave the
+refactor) becomes more attractive, since the refactor is exactly the conflicting half.
+
+## Correction 3 — "#2663 CI green" means less than it sounds
+
+The reviewer turned the plan's own #2694 argument back on it. 030 justifies squashing
+#2663 partly on "CI is green". But #2663 ran EXACTLY the same five checks #2694 did:
+
+```
+$ gh pr checks 2663
+CodeRabbit=pass  enforce-target=pass  hygiene=pass  label=pass  resolve-pr=pass
+```
+
+None of those compile or test the tree — which is precisely why #2694 shipped five tsc
+errors behind five green checks. So "#2663 is CI green" is not evidence of health; it
+is the same non-evidence, and the plan should not have leaned on it.
+
+What IS evidence for #2663: it typechecks at its head (`TYPECHECK_OK`) and in the
+merged tree (`MERGED_TYPECHECK_OK`). That covers compilation, not behavior. Its 12-file
+diff touching `src/server/responses/core.ts` still needs the full suite green on the
+merged tree before the squash lands, per 030's own gate — that gate is now the ONLY
+thing standing behind this PR, so it is not optional.
+
+Note for whoever runs it: `bun test` here takes a machine-wide lock
+(`bare Bun worker N is waiting for test run pid M to release the machine lock`), so
+concurrent suite runs serialize. Run the full suite once, on `ssh lidge-ai` via
+`ocx-run`, rather than racing several locally.
+
+## What this says about the round
+
+Three claims were wrong in the plan, all in the same direction: stated more confidently
+than the evidence supported. The lane assignments themselves survive, but three rules
+now bind the rest of the round:
+
+1. The merged-tree compile gate is the standard, not the PR-head gate.
+2. Cross-PR conflicts are checked pairwise with `git merge-tree` before any merge,
+   never inferred from "different helper, different call site."
+3. "Checks are green" is never evidence of health on this repository unless the check
+   list actually includes `ci` / `test N/4` / `macos`. For draft and contributor PRs
+   it usually does not.