From 667f3547d8c13ec3992597335aad0ee790807931 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sat, 29 Aug 2026 07:41:13 +0900 Subject: [PATCH] docs(devlog): close bug-PR zero-remaining campaign --- .../260829_bugpr_zero_remaining/000_plan.md | 59 ++++++++ .../001_audit_round1_synthesis.md | 6 + .../002_audit_round3_synthesis.md | 15 +- .../010_wp8_version_line_keystone.md | 20 +++ .../020_wp2_lane_a_clean_merges.md | 18 +++ .../030_wp3_lane_b_stale_rebase.md | 13 ++ .../040_wp4_lane_c_oauth_429_rotation.md | 17 +++ .../050_wp5_lane_d_reimplementation.md | 26 ++++ .../060_wp6_lane_e_prless_bug_issues.md | 12 ++ .../070_wp7_closeout.md | 58 ++++++++ .../080_wp9_current_head_reaudit.md | 19 +++ .../260829_bugpr_zero_remaining/000_plan.md | 136 ------------------ .../010_wp8_version_line_keystone.md | 95 ------------ .../020_wp2_lane_a_clean_merges.md | 73 ---------- .../030_wp3_lane_b_stale_rebase.md | 34 ----- .../040_wp4_lane_c_oauth_429_rotation.md | 31 ---- .../050_wp5_lane_d_reimplementation.md | 117 --------------- .../060_wp6_lane_e_prless_bug_issues.md | 44 ------ .../070_wp7_closeout.md | 22 --- .../080_wp9_current_head_reaudit.md | 59 -------- 20 files changed, 259 insertions(+), 615 deletions(-) create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/000_plan.md rename devlog/{_plan => _fin}/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md (95%) rename devlog/{_plan => _fin}/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md (82%) create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/070_wp7_closeout.md create mode 100644 devlog/_fin/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/000_plan.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/070_wp7_closeout.md delete mode 100644 devlog/_plan/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md diff --git a/devlog/_fin/260829_bugpr_zero_remaining/000_plan.md b/devlog/_fin/260829_bugpr_zero_remaining/000_plan.md new file mode 100644 index 0000000000..145c81390f --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/000_plan.md @@ -0,0 +1,59 @@ +# 260829 — Bug-PR zero-remaining campaign + +This unit records a completed campaign. The repository began with sixteen open pull +requests carrying the `bug` label and ended with none. All changes traveled through pull +requests targeting `dev`; neither `main` nor `preview` moved as part of this work. + +## Terminal outcome + +Fifteen bug-fix pull requests landed on `dev`: #2835, #2822, #2821, #2785, #2839, +#2845, #2843, #2842, #2846, #2849, #2850, #2847, #2844, #2841, and #2848. Five +campaign-enabling or corrective pull requests also landed: the version-line keystone +#2836, CI cleanup #2840, the roadmap and review gate #2837, and the independent-review +follow-ups #2852 and #2851. + +Contributor branches that were superseded by current-`dev` landings were closed with +credit and cross-references: #2799, #2798, #2638, #2828, #2812, #2796, #2797, #2793, +#2744, #2497, and #2807. + +Issues #2717, #2810, #2706, #2718, #2830, and #2221 were closed after their fixes +reached `dev`. Issue #2713 remains open because #2844 addressed only part of its scope. +Issue #2833 was closed by its reporter, and #2813 was recorded as unreproducible. + +## What changed the campaign + +The campaign initially looked like a collection of unrelated red branches. In fact, +`package.json` on `dev` was behind an already-published preview tag, so +`tests/release-version-line.test.ts` failed on every descendant commit. Six bug pull +requests inherited the same failure. Landing #2836 first removed that shared false signal +and was more valuable than repairing any one branch in isolation. + +Approved contributor work was carried forward with `git cherry-pick -x`. Before a +replacement landed, its author patch was compared with `git patch-id --stable`. This +preserved authorship and avoided force-pushing fork branches, which would have invalidated +their enforce-target review-readiness checklists. + +Independent adversarial review repeatedly found defects after the work appeared complete. +It found seven fail-open paths in the review gate, including pagination data combined with +`jq add` in a way that merged review objects and erased reviewers. It found three more +cross-account origin sites in the 429 recovery work and found caller credentials sharing +the operator account's `__main__` health state. It also found a #2830 repair that could not +execute because it sat behind `orphans.length === 0`, a recovery test that passed on +unrelated plaintext, and secret bytes written before temporary-file permissions were +hardened. Each defect was fixed in public history. Mutation checks that restored the bug +and required the regression test to fail supplied evidence that ordinary green CI did not. + +## Open governance gap + +Every credential-surface merge in this campaign lacked a formal non-author approval. All +available repository credentials authenticated as the repository owner, and GitHub rejects +self-review. Independent findings were posted as pull-request comments and were repaired, +but comments are not the non-author security approval required by `MAINTAINERS.md`. This is +an unresolved governance gap, not a completed review requirement. + +## Record map + +The numbered documents preserve the investigation and lane history. `001` and `002` +record the audit corrections. `010` records the version-line keystone. `020` through `060` +record the merge and reimplementation lanes. `070` is the final disposition ledger, and +`080` records the current-head re-audit of #2638 and #2828. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md b/devlog/_fin/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md similarity index 95% rename from devlog/_plan/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md rename to devlog/_fin/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md index 77a7061712..4ad9316afe 100644 --- a/devlog/_plan/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md +++ b/devlog/_fin/260829_bugpr_zero_remaining/001_audit_round1_synthesis.md @@ -5,6 +5,12 @@ returned `VERDICT: FAIL` with 8 blockers. Each is recorded below with its dispos Two were verified independently before acceptance, because a reviewer claim is evidence to check, not a verdict to copy. +This document preserves the first audit round as historical evidence. Later rounds found +additional defects in the executable review gate and repaired them in #2837. The campaign +still closed with an open governance gap: credential-surface merges had independent review +comments, but no formal non-author approval, because every available credential resolved to +the repository owner and GitHub refused self-review. + ## B1 (Critical) — inventory was stale: 16 bug PRs, not 14. ACCEPTED Live query returns 16: the 14 triaged, plus **#2744** (missed) and **#2836** (the keystone diff --git a/devlog/_plan/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md b/devlog/_fin/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md similarity index 82% rename from devlog/_plan/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md rename to devlog/_fin/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md index d231f5517c..6e963fe75d 100644 --- a/devlog/_plan/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md +++ b/devlog/_fin/260829_bugpr_zero_remaining/002_audit_round3_synthesis.md @@ -4,6 +4,11 @@ Round 3 returned `VERDICT: FAIL` with one Critical blocker, and it was a genuine code I had just written and called a gate. Recording it plainly, because a gate that is trusted without being attacked is decoration. +This was not the last correction. A later adversarial pass found seven reachable fail-open +paths in the gate, including pagination results combined with `jq add` so review objects +were merged and reviewers disappeared. Those defects were fixed publicly in #2837 and +covered by mutation checks that made the tests fail when the faulty logic was restored. + ## The blocker (accepted in full) `scripts/ci/assert-mergeable-review.sh` v1 selected **any historical** `APPROVED` review at @@ -79,8 +84,10 @@ PRs are back to the state their approvals describe. The lesson is now an orderin dependent rebase is pushed only after its base commit is an ancestor of `dev`. Verifying a rebase locally in a scratch worktree is free; publishing it early is not. -## Residual, stated rather than closed +## Governance result at campaign close -GitHub cannot mark an approval as specifically a *security* review. For security-boundary -PRs the reviewer's own words are read to confirm the approval addressed that surface. The -script cannot make that judgment and does not pretend to. +GitHub cannot mark an approval as specifically a security review, and the campaign had a +more basic identity problem: every available credential authenticated as the repository +owner, so GitHub rejected formal self-review. Findings were posted as comments and fixed, +but credential-surface merges still lacked the required non-author approval. The review +gate work improved enforcement without closing that governance gap. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md b/devlog/_fin/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md new file mode 100644 index 0000000000..4bf5f81a18 --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md @@ -0,0 +1,20 @@ +# wp8 — Version-line keystone + +This phase completed in #2836 and ran first because it repaired the shared base rather +than any individual bug branch. + +At campaign start, `dev` still declared version 2.35.0 while the published preview line +had reached `v2.36.0-preview.20260829`. The invariant in +`tests/release-version-line.test.ts` therefore failed on every descendant commit. Six +otherwise unrelated bug pull requests inherited that red result, making their own changes +look suspect. + +#2836 advanced the `dev` version line to 2.36.0. That value followed repository precedent: +after a published preview, `dev` carries the next stable version rather than duplicating +the preview identifier. The change touched only the version field and did not promote +`preview` or `main` or alter release automation. + +The focused version-line test passed after the change, and the inherited failures cleared +on the downstream pull requests. The practical lesson is to test a repeated failure +against the common base before repairing each branch independently. One stale line in the +base had more leverage than any individual merge. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md b/devlog/_fin/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md new file mode 100644 index 0000000000..363bfcb8f6 --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md @@ -0,0 +1,18 @@ +# wp2 — Contributor patch preservation + +This lane completed through #2839, which landed the credited patches from contributor pull +requests #2799 and #2798. Both contributor pull requests were then closed as landed with +cross-references. + +The campaign did not force-push the contributor fork branches. A force-push would have +reset the enforce-target four-box readiness checklist and detached the existing review +evidence from the branch state. Instead, the approved commits were applied to a +maintainer-owned current-`dev` branch with `git cherry-pick -x`. + +Before landing, the original and carried-forward patches were compared with +`git patch-id --stable`; authorship and patch intent were preserved. Focused tests covered +the catalog verbosity behavior from #2799 and the destination-policy behavior from #2798. + +#2798 touched a credential destination boundary. Its findings were addressed, but it is +part of the campaign-wide governance gap recorded in `070_wp7_closeout.md`: no available +credential could provide a formal non-author approval. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md b/devlog/_fin/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md new file mode 100644 index 0000000000..35ca37d2be --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md @@ -0,0 +1,13 @@ +# wp3 — Stale and inherited-red branches + +This lane completed with #2822, #2821, and #2785 merged to `dev`. + +At triage, each branch looked blocked or unstable, but the relevant red checks were either +the inherited release-version failure or stale-base noise. After #2836 repaired the shared +base, the branch-specific focused checks and exact-head CI could be read as evidence about +the actual patch. + +Patch identity and changed-file scope were checked during the base movement. No unrelated +behavior was folded into these merges. This lane confirmed the keystone diagnosis: once +the common version-line defect was gone, the three independent fixes could be evaluated +and landed on their own merits. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md b/devlog/_fin/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md new file mode 100644 index 0000000000..182234363b --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md @@ -0,0 +1,17 @@ +# wp4 — OAuth 429 rotation closeout + +The stale #2807 branch was replaced by #2841, which landed the OAuth-origin rebind on +current `dev`; #2807 was closed as landed with a cross-reference. Independent review then +found three additional cross-account origin sites and found that caller credentials could +share the operator account's `__main__` health state. An invalid caller token could +therefore mark the operator's own account as needing reauthentication. + +Those defects were repaired and regression-tested before closeout. The tests were checked +for anti-vacuity by restoring the faulty behavior and confirming that the focused +regression turned red. The separate #2852 follow-up belongs to the shadow-call lane and is +recorded in `060_wp6_lane_e_prless_bug_issues.md`. + +This was a credential surface. The technical findings were posted publicly as review +comments and fixed, but the merge did not receive a formal non-author approval because all +available credentials authenticated as the repository owner. That remains a governance +gap rather than a satisfied review gate. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md b/devlog/_fin/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md new file mode 100644 index 0000000000..75243d7abf --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md @@ -0,0 +1,26 @@ +# wp5 — Current-`dev` reimplementations + +This lane replaced stale, overbroad, or partially correct branches with narrow changes on +current `dev`. + +#2842 carried the valid part of #2812 and closed #2810 without broadening the fake-IP +classification. #2843 replaced #2796 and closed #2717 with consistent AgentRouter identity +handling. #2844 replaced #2797 and made the doctor `env_key` check safe, but issue #2713 +remains open because that change covered only part of the issue's requested behavior. +#2835 landed its focused Kiro behavior without carrying the earlier host-identifying +measurement note. + +#2847 replaced the overbroad #2793 branch with the narrow #2718 keyring fix. #2848 replaced +the very stale #2497 branch with a current-`dev` repair for #2221. #2850 replaced #2744's +combo-recovery work without its unrelated version hunk, and #2851 repaired defects found by +the independent follow-up. + +The combo-recovery review found two important verification failures. One test passed when +unrelated plaintext was present, so it did not prove that the intended recovery path ran. +The implementation also wrote secret bytes before hardening the temporary file's +permissions. Both were fixed, and mutation runs demonstrated that the focused tests failed +when each defect was restored. + +Contributor pull requests #2812, #2796, #2797, #2793, #2744, and #2497 were closed only +after their replacements landed, with credit and cross-references. Credential-related +members share the unresolved formal-review gap described in `070_wp7_closeout.md`. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md b/devlog/_fin/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md new file mode 100644 index 0000000000..83ca7124fb --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md @@ -0,0 +1,12 @@ +# wp6 — Bug issues without a landing pull request at triage + +This lane ended with one landed repair, one reporter closure, and one unreproducible report. + +Issue #2706 was fixed by #2849. Independent review found a remaining defect in the +accumulated path, and #2852 supplied the follow-up before closeout. Issue #2833 was closed +by its reporter rather than claimed as a campaign fix. Issue #2813 could not be reproduced +and was recorded as unreproducible rather than closed as fixed. + +Other triage candidates remained outside this campaign when they could not be triggered and +observed in the available environment or overlapped work that required a different scope. +The campaign did not convert lack of reproduction into a success claim. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/070_wp7_closeout.md b/devlog/_fin/260829_bugpr_zero_remaining/070_wp7_closeout.md new file mode 100644 index 0000000000..4cfc2d86ef --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/070_wp7_closeout.md @@ -0,0 +1,58 @@ +# wp7 — Terminal closeout + +The campaign reached its terminal criterion: the open pull-request query for the `bug` +label returned an empty array after starting at sixteen. + +## Landed work + +The bug-fix train on `dev` consists of #2835, #2822, #2821, #2785, #2839 +(the credited cherry-picks from #2799 and #2798), #2845 (the credited #2638 +cherry-picks), #2843 (the #2717 AgentRouter repair), #2842 (the #2810 fake-IP repair), +#2846 (the credited #2828 cherry-picks plus the #2830 repair), #2849 (the #2706 shadow +call repair), #2850 (the #2744 combo-recovery replacement), #2847 (the #2718 keyring +repair), #2844 (the doctor `env_key` repair), #2841 (the #2807 OAuth-origin rebind), and +#2848 (the #2221 native-main refresh repair). + +The campaign also merged #2836 to repair the inherited version-line failure, #2840 to +clean up the CI namespace, #2837 for the roadmap and executable review gate, #2852 as the +independent follow-up to #2849, and #2851 as the independent security follow-up to #2850. + +## Contributor pull-request dispositions + +Pull requests #2799, #2798, #2638, #2828, #2812, #2796, #2797, #2793, #2744, #2497, +and #2807 were closed as landed through the replacement pull requests above. Their close +comments credited the original authors and linked the current-`dev` landing. + +The use of `git cherry-pick -x` and `git patch-id --stable` mattered here. It allowed +approved contributor patches to land with authorship intact, while leaving contributor +fork heads alone and avoiding enforce-target checklist resets caused by force-pushes. + +## Issue dispositions + +Issues #2717, #2810, #2706, #2718, #2830, and #2221 were closed with references to the +merged fixes. Issue #2713 remains open because the doctor change in #2844 covered only +part of the requested behavior. Issue #2833 was closed by its reporter. Issue #2813 was +unreproducible and was not closed as fixed. + +## Verification lessons + +The version-line keystone demonstrated that a shared base failure can make unrelated +branches look defective. Repairing that base first removed inherited red from six pull +requests and made later branch evidence meaningful. + +Green CI was repeatedly insufficient as a completion claim. Independent review found +seven fail-open paths in the review gate, three omitted cross-account origin sites in the +429 repair, caller credentials contaminating the operator's `__main__` health state, a +#2830 branch that never executed, a recovery test satisfied by unrelated plaintext, and a +temporary-file permission ordering flaw. All were fixed before closeout. The strongest +tests were anti-vacuity mutations: reintroduce the defect and confirm that the focused test +turns red. + +## Governance gap + +Credential-surface changes did not receive a formal non-author approval. Every credential +available in the campaign environment authenticated as the repository owner, and GitHub +does not permit self-review. Independent findings were left as comments and addressed by +follow-up commits and pull requests, but that does not satisfy the formal review rule in +`MAINTAINERS.md`. Future campaigns need a genuinely separate reviewer identity or another +enforceable governance mechanism. diff --git a/devlog/_fin/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md b/devlog/_fin/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md new file mode 100644 index 0000000000..0566757313 --- /dev/null +++ b/devlog/_fin/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md @@ -0,0 +1,19 @@ +# wp9 — Current-head re-audit of #2638 and #2828 + +This lane completed with both contributor branches preserved through credited +current-`dev` replacements. + +#2845 landed the relevant #2638 commits after current-head review and patch-equivalence +checks. #2846 landed the relevant #2828 commits and added the #2830 repair. The original +pull requests were closed as landed with cross-references rather than being judged from +reviews attached to superseded heads. + +Independent review of #2846 found that the first #2830 repair never executed because it +was placed behind `orphans.length === 0`. The branch condition was corrected, and an +anti-vacuity mutation restored the unreachable arrangement to prove the regression test +would fail. + +This lane reinforced two campaign rules. Review evidence belongs to the exact head it +examined, and green tests are not enough when the test can pass without activating the +changed branch. Credential-surface findings were fixed and posted as comments, while the +lack of a formal non-author approval remains recorded as an open governance gap. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/000_plan.md b/devlog/_plan/260829_bugpr_zero_remaining/000_plan.md deleted file mode 100644 index 7c343bb56b..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/000_plan.md +++ /dev/null @@ -1,136 +0,0 @@ -# 260829 — Bug-PR zero-remaining campaign - -Objective: no open pull request labeled `bug` remains on `lidge-jun/opencodex`. Every -bug PR reaches a terminal disposition backed by evidence, the 429 OAuth rotation work -(#2807) lands on `dev`, matching issues close with cross-references, and important -bug issues with no PR get a reimplementation merged. - -## Constraints - -- Every change travels through a PR targeting `dev`. No direct push to `dev`. -- CI-first evidence. The repository's own `ci`, `test N/4`, `macos`, `hygiene`, and - `gates` (privacy) checks on the exact head SHA are the primary proof. The full local - `bun run test` suite is not run; when a suite is genuinely needed it runs remotely - via `ssh lidge` + `ocx-run`. -- Commits and pushes use `--no-verify`. -- `--admin` merge is available (the operator holds admin) but never substitutes for the - `MAINTAINERS.md` non-author security review on authentication, credential, OAuth, - workflow, release, or dependency surfaces. -- Unfixed security reproduction detail stays in gitignored `.tmp/`, never `devlog/`. -- Unrelated dirty worktrees and the 10 existing stashes are preserved untouched. - -## Live triage (2026-08-29, four parallel Sol-high lanes) - -**Sixteen** open PRs carry the `bug` label. The first triage pass found fourteen; the A-gate -audit found that #2744 had been missed, and #2836 (this campaign's own keystone PR) is also -`bug`-labeled. The inventory is re-queried at the start of every work-phase and again at -closeout, because the set moves while the campaign runs — see -`001_audit_round1_synthesis.md`. Every row below is live evidence from -`gh pr view`/`gh pr checks`/`gh api compare` at triage time. - -| PR | author | head SHA | mergeable | behind dev | real gates | security surface | matching issue | -|----|--------|----------|-----------|-----------|------------|------------------|----------------| -| #2835 | lidge-jun | 0dc8704531 | MERGEABLE/BLOCKED | 0 | 6 pass / 1 fail | no | none | -| #2828 | luvs01 | 019c792607 | MERGEABLE/BLOCKED (draft) | 0 | 1 pass / 9 never started | yes (grok inject credential fields) | #2830 partially | -| #2822 | luvs01 | 450b1bc60c | MERGEABLE/UNSTABLE | 1 | 6 pass / 1 fail | no | none | -| #2821 | luvs01 | d21ad61d51 | MERGEABLE/UNSTABLE | 11 | 6 pass / 3 fail | no | none | -| #2812 | gaoran1209 | 220a9048ed | MERGEABLE/BLOCKED | 77 | 5 pass / 3 fail | no | #2810 | -| #2807 | lidge-jun | 1c61a7e8cd | CONFLICTING/DIRTY | 80 | 9 pass / 0 fail | yes (OAuth core) | none (Closes #2745 is a PR) | -| #2799 | adtumk | e9a7bb7bb0 | MERGEABLE/CLEAN | 94 | 7 pass / 0 fail | no | none | -| #2798 | olddonkey | 856ad72d41 | MERGEABLE/CLEAN | 97 | 8 pass / 0 fail | no | none | -| #2797 | rrmlima | edaa044f28 | MERGEABLE/BLOCKED (draft) | 97 | 6 pass / 1 fail | yes (doctor reads env_key) | #2713 (partial) | -| #2796 | rrmlima | 2328c16c76 | MERGEABLE/BLOCKED (draft) | 97 | 6 pass / 3 fail | yes (client fingerprint) | #2717 | -| #2793 | smileBeda | 3a6e600eda | MERGEABLE/BLOCKED (draft) | 97 | 4 pass / 3 fail, unsponsored_surface | yes (78 files, auth core) | #2718 | -| #2785 | DevonGithub | 107f2cbb28 | MERGEABLE/UNSTABLE | 97 | 5 pass / 1 fail | no | none | -| #2638 | luvs01 | c8556f3703 | MERGEABLE/BLOCKED | 13 | 4 pass / 4 fail | yes (auth-context, routing) | none | -| #2497 | MarcTCruz | 86a49e8525 | CONFLICTING/DIRTY (draft) | 496 | 6 pass / 2 fail | yes (20 files, auth core) | #2221 | -| #2744 | yxr1995-maker | 1d8e35462a | CONFLICTING/DIRTY (draft) | 140 | CHANGES_REQUESTED | yes (core.ts + package.json) | none | -| #2836 | lidge-jun | befcac3e10 | MERGEABLE (wp8 keystone) | 0 | 23 pass / 0 fail, macOS queued | package.json (maintainer-authored) | n/a | - -#2638 and #2828 moved after triage: both are now zero commits behind at rewritten heads -(`375e6f8fb8`, `019c792607`), so their recorded reviews no longer describe their current -diffs. They are handled by wp9, not by the reimplementation lane. - -## The keystone: `dev` trails its own published channel - -`test 2/4`, `test 3/4`, `test 4/4`, and `macos` fail on #2835, #2822, #2821, #2796, -#2797, and #2785 with one shared assertion, not with anything those PRs changed: - -``` -release version line > the in-tree version is never behind a released one -package.json version 2.35.0 is BEHIND the highest release tag v2.36.0-preview.20260829 -``` - -Live state at triage: - -| ref | package.json version | -|-----|----------------------| -| `dev` | 2.35.0 | -| `main` | 2.35.0 | -| `preview` | 2.36.0-preview.20260829 | -| tag `v2.36.0-preview.20260829` | 2.36.0-preview.20260829 | - -The preview bump was cut on the prerelease train and never came back to `dev`, which is -the exact failure mode `tests/release-version-line.test.ts` was written for — its own -header documents the previous occurrence (repaired by hand in `32529c2b2`, when `dev` -said 2.24.2 against a published 2.26.0). - -Consequence for this campaign: rebasing a stale bug PR onto `dev` does **not** turn its -CI green, because the failure is inherited from the base. The version line is therefore -work-phase wp8 and runs FIRST; every later lane rebases onto the repaired `dev`. - -## Merge lanes - -- **wp8 keystone** — repair `dev`'s version line so inherited red turns green. -- **wp2 Lane A** — approved and CI-clean: #2799, #2798. Rebase onto the repaired `dev`, - confirm exact-head green, merge. #2798 is **security-gated**: `src/lib/destination-policy.ts` - decides whether an OAuth bearer may be sent to an overridden destination, which - `MAINTAINERS.md` covers under "other security-boundary changes" even though the hygiene - gate's restricted-path list does not name it. Its approval must be re-earned on the - rebased head. -- **wp3 Lane B** — approved but stale or inherited-red: #2822, #2821, #2785. Same - treatment; patch integrity proven with `git patch-id --stable` and `git range-diff`. -- **wp4 Lane C** — #2807, the 429 OAuth rotation work. Conflicting, 80 behind, and - carrying one live reviewer blocker (a rotated bearer can still be paired with the - previous account's accepted origin). Reimplement on current `dev` with an executable - A→429→B regression, then non-author security review. -- **wp5 Lane D** — reimplementation lane for PRs whose intent is right but whose branch - cannot land as-is: #2812 (reviewer rejected the equivalence assumption), #2796, #2797, - #2835 (host-identity disclosure in devlog), #2793, #2497, #2744. #2828 and #2638 were - moved OUT of this lane into wp9 after the audit found their reviews bound to superseded - heads. Every member that touches `src/server/responses/core.ts` (#2497, #2793, #2744) runs - AFTER wp4 and re-verifies against the accumulated file. -- **wp9 re-audit** — #2638 and #2828 at their current heads, sequenced after wp4 because - #2638 touches `src/server/responses/core.ts`. -- **wp6 Lane E** — PR-less bug issues worth reimplementing, chosen in wp1 from the 16 - open `bug` issues. -- **wp7 closeout** — issue closure with cross-references and the zero-open-bug-PR proof. - -## Verifier reality check (PLAN-VERIFIER-REAL-01) - -Corrected after the A-gate audit ran each command rather than trusting the plan. - -- **Bootstrap first:** this worktree had no `node_modules`, which made `bun x tsc --noEmit` - exit 1 with `TS2688: Cannot find type definition file for 'bun-types'` — an environment - gap, not a type error. After `bun install`, `bun x tsc --noEmit` exits 0. A fresh rebase - worktree needs `bun install` before its tests mean anything (a missing install surfaced as - `Cannot find module 'zod/v4'` on #2799's rebase). -- `gh pr checks --repo lidge-jun/opencodex` — exists, ran during triage, reads the - exact PR head. This is the campaign's primary verifier. -- `bun x tsc --noEmit` and focused `bun test tests/` — exist in `package.json` - (`typecheck`); used for local implementation loops only, after the bootstrap above. -- `scripts/ci/assert-mergeable-review.sh ` — the executable pre-merge review gate added - by this campaign. Fails closed unless an `APPROVED` review is bound to the exact current - head, authored by someone other than the PR author, and listed as a current maintainer in - `MAINTAINERS.md`. Proven non-vacuous: exit 0 on #2798 (real exact-head approval from - Ingwannu), exit 1 on #2836 and #2812. -- `bun run skill:surface:check` — the read-only verifier. `bun run skill:surface` is a - GENERATOR (`scripts/generate-ocx-skill-surface.ts` calls `writeFileSync`) and must never - be cited as a gate. -- `bun run test` (full suite) — deliberately NOT used locally per the operator's - instruction; the remote equivalent is `ssh lidge 'export PATH=$HOME/bin:$PATH; ocx-run - '`, confirmed present at - `/home/lidgeai/bin/ocx-run`. Remote evidence counts only when the recorded workdir is - proven to sit at the exact head SHA and the child command exercises the change; a bare - `rc=0` from an unrelated directory proves nothing. -- `bun run privacy:scan` — runs inside the `gates` check on every PR head. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md b/devlog/_plan/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md deleted file mode 100644 index 007883d006..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/010_wp8_version_line_keystone.md +++ /dev/null @@ -1,95 +0,0 @@ -# wp8 — Keystone: repair `dev`'s version line - -Dependency position: FIRST. Every other work-phase rebases onto the `dev` this phase -produces, because the red `test N/4`/`macos` shards on six bug PRs are inherited from -the base and cannot be repaired by rebasing onto an unrepaired `dev`. - -## Defect - -`tests/release-version-line.test.ts` asserts the in-tree version is never behind the -highest local release tag. Live state: - -- `dev` `package.json`: `2.35.0` -- highest release tag: `v2.36.0-preview.20260829` (published 2026-08-28T16:09:12Z) -- `preview` `package.json`: `2.36.0-preview.20260829` - -`compareReleaseTags("v2.35.0", "v2.36.0-preview.20260829") < 0`, so the assertion fails -on every commit whose tree descends from `dev`. - -## Change map - -``` -MODIFY package.json "version": "2.35.0" -> "2.36.0-preview.20260829" -``` - -One line. No source, test, or workflow change. - -### Why that exact string - -Candidates were RUN through the repository's own comparator rather than reasoned about -(`.tmp/bugpr-campaign/probe.ts` importing `scripts/release-notes.ts`; positive means -ahead of the highest tag `v2.36.0-preview.20260829`): - -``` -2.35.0 -1 -2.35.1 -1 -2.36.0 1 -2.36.0-preview.20260829 0 -2.36.0-preview.20260829.1 1 -2.36.0-preview.20260830 1 -2.37.0-preview.1 1 -``` - -`2.36.0-preview.20260829` returns 0, and the test's equality branch is legal only on the -commit the tag names (`tagPointsAtHead`) — a `dev` merge commit is not that commit, so -equality fails as a duplicate claim. That leaves the strictly-ahead options, and repository -precedent decides between them: `dev` carries the next STABLE version after a release, -never a preview suffix. - -- `e4a85d134` set `dev` to `2.34.0` when it trailed a published `2.33.0`. -- `076ad3036` set `dev` to `2.35.0` immediately after `v2.34.0` shipped. -- `32529c2b2` set `dev` to `2.27.0` when it trailed `2.26.0`. - -So the value is the next stable minor: - -``` -MODIFY package.json "version": "2.35.0" -> "2.36.0" -``` - -Availability confirmed live: `npm view @bitkyc08/opencodex@2.36.0` returns -`E404 No match found for version 2.36.0`, `git tag --list v2.36.0` is empty, and the -published dist-tags are `latest=2.35.0`, `preview=2.36.0-preview.20260829`. Minor rather -than patch follows the same precedent: the range since `v2.35.0` carries behavior -changes, not only fixes. - -## Accept criteria - -1. `bun test tests/release-version-line.test.ts` passes locally on the branch (3/3). -2. Activation scenario (C-ACTIVATION-GROUNDING-01): the failing assertion is the - trigger. Before the change it fails with the quoted BEHIND message; after it passes. - Both runs are recorded. -3. The PR's own `test N/4` and `macos` checks pass on the exact head SHA. -4. `scripts/release.ts` channel logic is untouched, so no release behavior changes. -5. **Review (added after the A-gate audit).** `package.json` is a restricted path in - `.github/scripts/pr-sponsored-surface.cjs` (under `// Dependency surfaces.`). The - `hygiene` gate passes here only because `assessSponsoredSurface` short-circuits when - `authorHasPushPermission` is true, and the PR is maintainer-authored — that is an - exemption from the SPONSORSHIP label, not from review. `MAINTAINERS.md` still requires a - maintainer approval and forbids self-approval, and `gh pr view 2836 --json reviewDecision` - returns `REVIEW_REQUIRED`. - - The gate is executable, not a promise: `scripts/ci/assert-mergeable-review.sh 2836` must - exit 0 before merge, and the merge uses `--match-head-commit ` so a race - cannot land a different tree than the one verified. At the time of writing it exits 1 - (`no maintainer approval bound to head befcac3e10...`), so #2836 is NOT merge-ready. - - The audit's round-2 position is recorded and adopted: there is no admin-merge alternative - for this criterion. An earlier draft of the synthesis offered "or an explicit recorded - operator decision to admin-merge"; that is exactly the bypass the criterion exists to - close, and it is withdrawn. If the approval cannot be obtained, wp8 reports BLOCKED and - the operator decides — the campaign does not decide for them. - -## Out of scope - -- Any promotion to `preview` or `main`. -- Any change to `scripts/release.ts` or `.github/workflows/release.yml`. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md b/devlog/_plan/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md deleted file mode 100644 index ee04321a70..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/020_wp2_lane_a_clean_merges.md +++ /dev/null @@ -1,73 +0,0 @@ -# wp2 — Lane A: approved, CI-clean bug PRs (#2798 security-gated) - -Dependency position: after wp8. These two PRs are the cheapest correct merges in the -campaign, and they are the ones that prove the repaired base actually turns inherited red -into green. - -## Members - -| PR | head SHA | behind dev | state at triage | reviewer | -|----|----------|-----------|-----------------|----------| -| #2799 drop default_verbosity when verbosity is unsupported | e9a7bb7bb00f2ab73b9eee1479fbb115f544ebae | 94 | MERGEABLE/CLEAN, 7 real gates pass / 0 fail | Ingwannu APPROVED (exact head) | -| #2798 classify NAT64-embedded IPv4 instead of refusing the wrapper | 856ad72d414f27556729d70ed077e04494bb7336 | 97 | MERGEABLE/CLEAN, 8 real gates pass / 0 fail | Ingwannu APPROVED, "No reportable security issue remains in this diff." | - -Both ship their own regression tests (tests/catalog-verbosity-default.test.ts, -tests/destination-policy-resolved.test.ts). - -Neither is flagged by the hygiene gate's restricted-path list — running that predicate -returns `restricted=NONE` for both. **But #2799 and #2798 are not equivalent in risk, and -an earlier draft of this doc wrongly called both non-security.** #2799 changes -`src/codex/catalog/parsing.ts`, which is genuinely not a security surface. #2798 changes -`src/lib/destination-policy.ts`, which governs whether an OAuth bearer may be sent to an -overridden destination — a security boundary under `MAINTAINERS.md`'s "other -security-boundary changes", regardless of the mechanical list. #2798 is therefore -security-gated in this lane and needs its approval re-earned on the rebased head. - -## Pre-verification already completed (2026-08-29) - -Both were rebased onto the keystone branch in isolated /tmp worktrees before any push, and -the author patches survived byte-identically: - -| PR | patch-id before | patch-id after | range-diff | -|----|-----------------|----------------|------------| -| #2799 | 358ba635ce5545fd280508f152d9b46c628db98b | 358ba635ce5545fd280508f152d9b46c628db98b | both commits `=` | -| #2798 | c1f9650e04863ecb64a981928091c9a582641ef1 | c1f9650e04863ecb64a981928091c9a582641ef1 | single commit `=` | - -Tests on the repaired base (after `bun install` in each worktree): - -``` -#2799 tests/catalog-verbosity-default.test.ts 4 pass 0 fail -#2798 tests/destination-policy-resolved.test.ts + - tests/release-version-line.test.ts 39 pass 0 fail -``` - -## Procedure per PR - -1. Create a rebase worktree under /tmp (never the session worktree): - git worktree add /tmp/ocx-lane-a- -2. Record the author patch identity BEFORE rebasing: - git diff-tree -p .. | git patch-id --stable -3. git rebase origin/dev (the repaired dev from wp8). -4. Prove the author patch survived: git range-diff .. origin/dev..HEAD - must show only base movement, and git diff --name-only origin/dev...HEAD must list the - same files as before. -5. Push the rebased head with --no-verify to the PR's own branch, then wait for exact-head - CI. Merge only when ci, all four test N/4, macos, hygiene, and gates are green. -6. Merge with a merge commit (preserving the author commits), then record the merged SHA. - -## Accept criteria - -1. Both PRs merged into dev; gh pr view --json state,mergedAt,mergeCommit confirms. -2. patch-id --stable before and after rebase is recorded for each; a changed patch id must - be explained, not silently accepted. -3. Exact-head CI green per required check, quoted from gh pr checks. -4. Both authors keep authorship in git log on dev. -5. `bash scripts/ci/assert-mergeable-review.sh ` exits 0 on the FINAL head, and the merge - uses `--match-head-commit`. A pre-rebase approval does not satisfy this: the repository - ruleset has `dismiss_stale_reviews_on_push: false`, so GitHub keeps approvals that no - longer describe the code. - -## Out of scope - -Any behavioral change to either patch. If a rebase produces a semantic conflict, the PR -leaves this lane and joins wp5. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md b/devlog/_plan/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md deleted file mode 100644 index f4aa4c760b..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/030_wp3_lane_b_stale_rebase.md +++ /dev/null @@ -1,34 +0,0 @@ -# wp3 — Lane B: approved but stale or inherited-red - -Dependency position: after wp8, sequenced after wp2 so the first merged rebase confirms -the repaired base before three more follow. - -## Members - -| PR | head SHA | behind dev | blocking condition | -|----|----------|-----------|--------------------| -| #2822 fold only message-shaped system items | 450b1bc60ccf58f80abcea5905085683ae9575bf | 1 | approved; test 2/4 red on the inherited version line only | -| #2821 scope model removal selectors to provider | d21ad61d51f2a4ae30447f951ced3c20ba9a7edb | 11 | approved; ci/macos/test 2/4 red on release version line only | -| #2785 raise Muse Spark context window to 1M | 107f2cbb281ae4db506471e911127cc2fc8fbb8b | 97 | approved; test 4/4 red, macOS never completed | - -All three carry an exact-head APPROVED from Ingwannu conditioned on green exact-head CI. -None touches a security surface: src/adapters/openai-responses.ts, src/cli/models.ts, -src/providers/registry.ts respectively, each with its own test file. - -## Per-PR verification obligation - -#2821 and #2822 fail ONLY the release version line assertion, which wp8 repairs. That -claim is checked, not assumed: after rebasing, the failing assertion must pass and the -previously failing shard must go green on the exact head. If a shard still fails for a -different reason, the PR moves to wp5 rather than being merged on the assumption that the -base explained everything. - -#2785 test 4/4 needs its own read: the reviewer called a duplicate final test -non-blocking, which is a claim to verify against the actual failing assertion before merge. - -## Accept criteria - -1. Each PR merged with recorded pre-merge head SHA and merged SHA. -2. For each, the specific pre-rebase failing assertion is quoted, and its post-rebase pass - is quoted from the exact-head run. -3. patch-id --stable + range-diff evidence recorded. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md b/devlog/_plan/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md deleted file mode 100644 index 0b1d4800bc..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/040_wp4_lane_c_oauth_429_rotation.md +++ /dev/null @@ -1,31 +0,0 @@ -# wp4 — Lane C: #2807, the 429 OAuth rotation identity rebind - -Dependency position: after wp8. The operator requires this work to land as a matter of -principle, so it gets its own work-phase rather than sharing a lane. - -## Current state - -- PR #2807, head 1c61a7e8cd3871b374b3dd55d3cd335ae3a9e862, CONFLICTING/DIRTY, 80 behind. -- Exact-head CI was fully green (9 real gates pass / 0 fail) BEFORE the base moved. -- Files: src/server/responses/core.ts (rebind of OAuth snapshot/replay/Cursor identity - during account rotation), tests/generic-oauth-failover.test.ts. -- Ingwannu review state on that head: CHANGES_REQUESTED, with one substantive blocker. - -## Working-detail boundary - -The unresolved security finding, reproduction, and remediation notes stay in gitignored -scratch space until a public fix ships. This tracked lane records only PR state, ordering, -and merge governance. Implementation begins from current dev rather than the stale branch. - -## Security review obligation - -src/server/responses/core.ts is an authentication/credential surface, and the PR author is -the repository owner, so MAINTAINERS.md forbids self-approval. Merge requires non-author -security review; --admin does not waive it. If that review cannot be obtained, this -work-phase closes BLOCKED naming the requirement rather than merging. - -## Accept criteria - -1. The current-dev replacement reaches a terminal disposition. -2. Focused verification and exact-head CI are green on the replacement PR. -3. Non-author security review is recorded, or the phase reports BLOCKED with the exact reason. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md b/devlog/_plan/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md deleted file mode 100644 index fc0a5167cf..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/050_wp5_lane_d_reimplementation.md +++ /dev/null @@ -1,117 +0,0 @@ -# wp5 — Lane D: reimplementation lane - -Dependency position: after wp8, wp2, wp3. These PRs have correct intent but a branch that -cannot land as-is: a rejected assumption, an unresolved reviewer finding, a hygiene block, -or a base so old that a rebase is a rewrite. - -Each member below runs as its OWN full PABCD cycle inside this lane's sequence. One decade -doc holds the lane because the members share one procedure; the one-work-phase-one-cycle -invariant is satisfied by appending a work-phase per member at wp5's P (LOOP-UNIT-CHAIN-01) -rather than building several members in one B. - -## Members and the specific defect to carry forward - -### #2812 — IPv4-mapped IPv6 with an explicit zero group (issue #2810) - -Author widened the mapped-IPv6 regex in src/lib/destination-policy.ts. Ingwannu requested -changes on the exact head: the central equivalence assumption is wrong, because a RESERVED -IPv6 address whose tail merely resembles a public IPv4 would then be admitted as public -(::ffff:0:5db8:d822 must stay blocked). The wanted behavior is the narrow benchmark case, -not a general equivalence. Reimplement on current dev with tests that pin BOTH directions: -::ffff:0:c612:1b classified, ::ffff:0:5db8:d822 still refused. Closes #2810. - -Note the ordering dependency: #2798 (wp2) also edits src/lib/destination-policy.ts, so this -member is implemented AFTER #2798 lands and re-reads the merged file. - -### #2796 — AgentRouter openai-chat client fingerprint (issue #2717) - -Reviewer found the patch incomplete on its own terms: src/adapters/anthropic.ts imports the -shared framing helpers but never applies agentRouterDefaultHeaders, so AgentRouter Anthropic -requests can still omit the required originator. Reimplement so every supported adapter -applies the shared identity policy, with an idempotence test. Closes #2717. - -### #2797 — doctor env_key readiness (issue #2713) - -Two findings: src/cli/doctor.ts can throw when env_key is an inherited Object.prototype key -such as toString (truthy but no own .trim()), and the PR claims Closes #2713 while only -diagnosing the condition. Reimplement the diagnostic with an own-property guard and a test -for the prototype-key case; do NOT claim #2713 closed, since that issue asks for -shim-independent injection. - -### #2835 — Kiro one visible answer - -The code/test change is current and focused (src/adapters/kiro.ts + two tests), but the same -commit publishes host identity in devlog/.../030_wp1_live_measurement.md: hostname, internal -address, PID, uptime, flagged P1. Reimplement as a code-and-test-only PR with the -measurement doc redacted or omitted. The disclosure detail itself stays out of any tracked -file. - -### #2828 and #2638 — MOVED OUT of this lane to wp9 - -The A-gate audit found both had advanced since triage: #2828 is now non-draft at -`019c792607` with zero commits behind dev, and #2638 is at a rewritten `375e6f8fb8`, also -zero behind. In both cases the recorded CHANGES_REQUESTED review is bound to a SUPERSEDED -head (#2828: `1031a509a9`; #2638: `c8556f3703`), so the findings that put them in a -reimplementation lane may already be fixed on the current head. Discarding a contributor's -branch over a stale finding is both wasteful and unfair, so they get a current-head re-audit -first: see `080_wp9_current_head_reaudit.md`. Reimplementation stays available if the -current head still fails review. - -### #2744 — Recover encrypted agent tasks on the combo path (added after the audit) - -Missed by the first triage pass. Draft, CONFLICTING/DIRTY, 140 behind, CHANGES_REQUESTED, -head `1d8e35462a`. Four files: `package.json`, `src/server/responses/core.ts`, and two -agent-task-recovery tests. - -Two hard constraints on its replacement: - -1. **The `package.json` hunk must NOT be carried forward.** The stale branch bumps - `2.34.0 -> 2.36.0`, which happens to converge on wp8's value, but a version bump has no - business in an agent-task-recovery fix, and carrying it forward would re-litigate wp8's - restricted-surface decision inside an unrelated PR. The replacement touches core plus - tests only. -2. It touches `src/server/responses/core.ts`, so it runs AFTER wp4 and re-verifies against - the accumulated file. - -Its unresolved security finding and remediation notes remain in gitignored scratch until a -public fix ships. The replacement still requires non-author security review. - -## Ordering constraint for this lane (from the audit) - -`src/server/responses/core.ts` is touched by #2807 (wp4), #2497, #2793, and #2744. wp4 lands -FIRST, then each core-touching member rebases onto the accumulated core and re-runs its own -regression rather than trusting a result obtained against an older file. #2807's test scans -`core.ts` and counts rotation sites, so a later core merge can silently invalidate that -assertion — which is exactly why wp4 goes first rather than last. - -The verifier for a stale generated surface is `bun run skill:surface:check` (read-only); -`bun run skill:surface` WRITES the file and is a generator, not a gate. - -### #2793 — Codex keyring passthrough (issue #2718) - -78 files, +2211/-238, 97 behind, hygiene-blocked as unsponsored_surface, with seven unresolved -current-diff findings. This is not a rebase candidate. Extract only the defect issue #2718 -actually reports and implement that narrowly; the WebSocket/quota/GUI work is out of scope -for a bug campaign. Security-sensitive review detail remains in gitignored scratch until the -fix ships. - -### #2497 — native main token refresh (issue #2221) - -496 behind, CONFLICTING, and 20 files across the credential core. The previous campaign -already aborted a rebase here on semantic conflicts, so this is a narrow current-dev -reimplementation rather than a rebase. Unresolved security findings and remediation notes -remain in gitignored scratch until a public fix ships. Non-author security review is required -before merge. - -## Disposition rule for this lane - -A member is only closed as superseded once its replacement PR is MERGED, never on the -promise of one. The close comment names the replacement PR and the merged SHA, and credits -the original author. - -## Accept criteria - -1. Every member reaches merged-replacement or explicitly-closed-with-reason. -2. Security-surface members carry non-author review, or are reported BLOCKED with the - MAINTAINERS.md requirement quoted. -3. No security reproduction detail for an unfixed defect is written into devlog/. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md b/devlog/_plan/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md deleted file mode 100644 index 974c873e69..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/060_wp6_lane_e_prless_bug_issues.md +++ /dev/null @@ -1,44 +0,0 @@ -# wp6 — Lane E: important bug issues with no PR - -Dependency position: after wp5, because several wp5 reimplementations already close the -issue that would otherwise appear here (#2810, #2717, #2718, #2221, #2830). - -## Candidate pool (16 open bug-labeled issues at triage) - -Already covered by a wp5 member, so NOT re-picked here: #2810, #2717, #2718, #2221, #2830. - -Remaining, with the selection judgment: - -| issue | title | pick | reason | -|-------|-------|------|--------| -| #2833 | Unable to compact v1 | yes | compaction failure blocks ordinary sessions; user-visible and reproducible from the report | -| #2706 | Shadow Call Intercept forces effort low on every gpt-5.6-luna request | yes | silently downgrades max turns for a whole model; concrete and testable | -| #2813 | Codex Luna Reserve disables routed models after 5-hour quota exhausted | yes | routing regression that disables working capacity | -| #2723 | Quota-limited previous-model compact blocks Sol to routed DeepSeek handoff | candidate | overlaps #2833's compact path; decide after #2833 is diagnosed | -| #2792 | Loading index.js causes ERR_CONTENT_LENGTH_MISMATCH | candidate | GUI asset serving defect; needs a repro before planning | -| #2791 | /api/log timeout loop in Chrome desktop | candidate | same subsystem as #2792; likely one root cause | -| #2804 | Windows tray icon exits after 3s | no (this campaign) | Windows-host-specific; cannot be verified from this macOS session, so a fix would ship unproven | -| #2800 | Second OpenCodex home cannot pass admitCodexWrite under Task Scheduler | no | same Windows verification limit | -| #2686 | codex context issue (Chinese, sparse) | no | needs-info in substance; not actionable without reproduction | -| #1527 | Cursor adapter large-context turns collapse | no | prior session found this needs live Cursor account probing, not a code-only fix | -| #1419 | Bundled Bun SIGTRAP after connection reset | no | labeled needs-info; upstream runtime crash without a local repro | - -Selection rule applied: pick issues whose defect can be TRIGGERED and OBSERVED from this -environment (C-ACTIVATION-GROUNDING-01). An issue whose fix cannot be shown firing is not a -candidate for a blind patch; it is left open with that stated, which is honest rather than -silently skipped. - -## Procedure per picked issue - -1. Reproduce from the report: name the exact code path, quote the failing behavior. -2. Write the failing test FIRST, observe it fail. -3. Fix narrowly; observe the test pass. -4. Open a PR targeting dev with Closes # in the description, filling every section of - .github/PULL_REQUEST_TEMPLATE.md (Summary, Verification, Checklist). -5. Merge on green exact-head CI; then close the issue manually with the merged SHA, because - GitHub only auto-closes on merges into the default branch (main) and these target dev. - -## Accept criteria - -1. Each picked issue has a merged PR whose test drives the reported condition. -2. Each unpicked issue has a recorded reason (above) rather than silence. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/070_wp7_closeout.md b/devlog/_plan/260829_bugpr_zero_remaining/070_wp7_closeout.md deleted file mode 100644 index b63cb9577d..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/070_wp7_closeout.md +++ /dev/null @@ -1,22 +0,0 @@ -# wp7 — Closeout: issue closure and the zero-open-bug-PR proof - -Dependency position: last. - -## Obligations - -1. For every landed fix, close its matching issue with a cross-reference comment naming the - merged SHA and the PR. PRs here target dev, so GitHub does not auto-close: each closure is - an explicit action. -2. For every bug PR that did not land, post the disposition reason on the PR itself before - closing it, crediting the original author and naming the replacement PR when one exists. -3. Produce the campaign proof: - gh pr list --repo lidge-jun/opencodex --state open --label bug --json number - must return an empty array. This is the c-1 criterion and the campaign's terminal check. -4. Record the final disposition table in this unit, then move the unit to devlog/_fin/. - -## Honest-reporting rule - -A PR left open for a required non-author security review is reported BLOCKED with the -MAINTAINERS.md quote, not counted as done. If any bug PR remains open at closeout, the -campaign's terminal outcome is not DONE, and the D summary says so plainly with the exact -PR numbers and reasons. diff --git a/devlog/_plan/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md b/devlog/_plan/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md deleted file mode 100644 index f658cbfd04..0000000000 --- a/devlog/_plan/260829_bugpr_zero_remaining/080_wp9_current_head_reaudit.md +++ /dev/null @@ -1,59 +0,0 @@ -# wp9 — Current-head re-audit: #2638 and #2828 - -Dependency position: **after wp4**, because #2638 touches `src/server/responses/core.ts` and -wp4 (#2807) is serialized ahead of every core-touching member. #2828 does not touch core and -may be audited independently of that ordering; only its merge waits on its own review. - -## Why this lane exists - -Both PRs were originally placed in the reimplementation lane on the strength of a -`CHANGES_REQUESTED` review. The A-gate audit established that in both cases the review is -bound to a head that no longer exists: - -| PR | reviewed head | current head | ahead / behind dev | draft | -|----|---------------|--------------|--------------------|-------| -| #2638 | `c8556f3703` | `375e6f8fb8` | 6 / 0 | no | -| #2828 | `1031a509a9` (maintainer), `387d9f2b10` (bot) | `019c792607` | 5 / 0 | no (was draft) | - -A finding against a superseded commit is not evidence about the current diff. Reimplementing -over a contributor's already-repaired branch would discard their work for no reason, so the -audit happens first and the disposition follows the evidence. - -## Procedure per PR - -1. Read the CURRENT diff, not the review thread: `gh pr diff `. -2. Take each blocker from the old review and check it against the current head - line-by-line. Record for each: still present, fixed, or no longer applicable — with the - file:line that proves it. -3. Dispatch an independent reviewer on the current diff (fresh reviewer, not the one whose - verdict is being re-examined). -4. Disposition: - - all old blockers fixed and no new ones -> request exact-head maintainer review and merge - through `scripts/ci/assert-mergeable-review.sh`; - - some still present -> either the author fixes them, or the PR moves to reimplementation - in wp5 with a non-sensitive status recorded; - - new blockers -> same disposition. Unresolved security detail stays in gitignored scratch - until a public fix ships. - -## Known state to re-verify, not to assume - -- #2638's `gates` failure at triage was a stale generated ocx skill surface. The verifier is - `bun run skill:surface:check` (read-only); `bun run skill:surface` regenerates and is not a - gate. Whether the current head still fails it is an open question for this lane. -- #2638 touches `src/codex/auth-context.ts`, which IS on the hygiene gate's restricted list, - and its earlier security approval was explicitly scoped to `e06ffbaa8a8e`. Non-author - security review on the exact final head is mandatory. -- #2828 touches `src/grok/inject.ts` and remains subject to current-head maintainer review. - Any unresolved security finding and remediation detail stays in gitignored scratch until - a public fix ships. -- #2828 was earlier assessed as NOT satisfying issue #2830 (excluded-model reference - clearing). Re-check that claim against the current head before deciding whether #2830 needs - separate work. - -## Accept criteria - -1. Each PR has a recorded current-head blocker table (present / fixed / n/a with evidence). -2. Each PR reaches merge, author-fix, or documented reimplementation — never a stale-review - verdict. -3. Security-surface merges carry non-author maintainer approval bound to the final head, - verified by the executable gate.