From 53d9ac235a579848cee60ae1e05bbdf4daf7e1fb Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 15:20:38 +0900 Subject: [PATCH 1/7] docs(devlog): roadmap for the contributor carry train Plan the carry of the 16 open contributor pull requests scored 60 or higher and the 8 unowned 60+ issues into dev, as eight wave-1 lanes and three wave-2 lanes. Two grok-4.6 reviewer passes gated this roadmap. The first returned FAIL on five blockers: H and I4 were prepared as peers though both write the routed Responses path, #4447 carried a security-review hold in one document while another tip-merged the lane containing it, lane I1 claimed a Windows CI leg that is workflow_dispatch-only, the core.ts toucher count called an issue a pull request, and the candidate table omitted #4409. All five are folded here; the second pass returned NEAR-PASS and its three wording residuals are folded too. --- .../000_plan.md | 137 ++++++++++++ .../001_candidate_inventory.md | 119 ++++++++++ .../010_wave1.md | 205 ++++++++++++++++++ .../020_wave1_merge.md | 71 ++++++ .../030_wave2.md | 86 ++++++++ .../040_wave2_merge_regression.md | 46 ++++ .../050_disposition.md | 73 +++++++ 7 files changed, 737 insertions(+) create mode 100644 devlog/_plan/260913_contributor_carry_train/000_plan.md create mode 100644 devlog/_plan/260913_contributor_carry_train/001_candidate_inventory.md create mode 100644 devlog/_plan/260913_contributor_carry_train/010_wave1.md create mode 100644 devlog/_plan/260913_contributor_carry_train/020_wave1_merge.md create mode 100644 devlog/_plan/260913_contributor_carry_train/030_wave2.md create mode 100644 devlog/_plan/260913_contributor_carry_train/040_wave2_merge_regression.md create mode 100644 devlog/_plan/260913_contributor_carry_train/050_disposition.md diff --git a/devlog/_plan/260913_contributor_carry_train/000_plan.md b/devlog/_plan/260913_contributor_carry_train/000_plan.md new file mode 100644 index 0000000000..d3b03d7fe3 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/000_plan.md @@ -0,0 +1,137 @@ +# Contributor carry train — 60+ scored work into dev + +## Objective + +Land the highest-value contributor work that is still open on this repository. +Seventeen open pull requests score 60 or higher by maintainer review once the +maintainer's own #4462 is set aside; 16 of them are dispatched here and #3389 is +deferred for a recorded reason. Eight issues score 60 or higher with no pull +request owning them. The goal also closes everything those landings actually +resolve. `origin/dev` was `2df82f412` when this roadmap was written. + +This unit follows the 36-PR lane-stack merge in +`devlog/_plan/260913_lane_stack_merge/`, which landed the maintainer-authored +backlog. That batch is the precedent for the mechanism here; what changes is the +authorship. Every branch in this train belongs to someone else, so attribution is +a correctness requirement rather than a courtesy. + +## Selection + +Candidates come from the maintainer's own `## 리뷰 · 우선순위 NN / 80` comments, +harvested live from every open issue and pull request through the GraphQL API on +2026-09-13. All 73 open pull requests and all 58 open issues carry a score, so +the 60 cut is a real threshold rather than a sample. + +The inventory and its verification live in `001_candidate_inventory.md`. + +## Attribution is a gate, not a footnote + +`AGENTS.md` requires a `Co-authored-by` trailer naming the original author on any +landing that reimplements, supersedes, carries, or rebases their pull request. +`CREDITS.md` records 27 landings that failed this and explains why prose credit is +not equivalent: GitHub reads the trailer, and nothing reads a sentence in a commit +body. + +Two rules follow for every lane in this unit: + +- The trailer address is taken from the author's GitHub account, in the numeric + `users.noreply.github.com` form, not from the commit metadata on their branch. +- The trailer is verified in the **actual landing commit** after the squash, not + in the pull request description. A custom squash message silently drops text + that was only in the body. + +## CI economy + +Unchanged from the previous batch and re-verified there. Each lane is a cumulative +stack: the bottom branch merges `origin/dev`, each branch above merges its parent's +resulting commit, so merging bottom-up produces shrinking diffs. Every non-tip head +commit carries `[skip ci]`, which suppresses `ci.yml`, `react-doctor`, +`service-lifecycle` and `issue-quality-tests`. Only `enforce-pr-target`, +`pr-hygiene` and `pr-labeler` still run, because `pull_request_target` ignores the +skip marker. + +Only the lane tip runs the full matrix, and that tip run is the merge gate for the +whole lane. Squash messages never contain `[skip ci]`, because the dev-branch run +each merge triggers is the regression gate. + +This is an owner-authorized deviation from the MAINTAINERS.md requirement that +every pull request carry its own successful required check. Each merge comment +states it explicitly: the owner authorization, the tip pull request and run id +that covers the branch, and the fact that this branch's own `ci` check never ran. + +## Common principles + +Pushes use `git push --no-verify`, fast-forward only. No `--force` anywhere. +Nothing is pushed to `dev`, `main` or `preview`. + +Local full-suite runs are forbidden. Allowed local checks are `bun run typecheck`, +`bun run structure:check`, `bun run privacy:scan`, and `bun test` limited to the +files a pull request touches. Hosted CI on the lane tip is the only suite proof +this goal accepts. + +Each lane thread works in its own managed worktree and may fan out unlimited +`xai/grok-4.6` subagents inside that worktree. Subagents share their parent's +checkout, so a lane's subagents never run branch-level git operations concurrently. + +Lane threads never merge, never mark a pull request ready, and never close +anything. They push and report. The main session performs every merge. + +Conflicts are resolved by reading both sides and judging which matches current +behavior. A genuinely ambiguous conflict stops that link and is reported with both +sides and the reasoning, never guessed past. + +## Lane map + +| Lane | Doc | Contents, bottom to top | Owner model | +| --- | --- | --- | --- | +| R responses/core | 010 | 4455, 4086, 4409, 4387 | anthropic/claude-opus-5 | +| C chat + adapters | 010 | 4438, 4389, 4457 | anthropic/claude-opus-5 | +| L cli + hub | 010 | 4382, 4413, 4170 | xai/grok-4.6 | +| B bridge + images + auth | 010 | 4381, 4388, 4460 | xai/grok-4.6 | +| S security-review hold | 010 | 4447 | xai/grok-4.6 | +| X small carries | 010 | 4077 copy fix, 4171 dedupe | xai/grok-4.6 | +| I1 Windows issues | 010 | 4425, 4442 | kimi/k3[1m] | +| I2 config + account issues | 010 | 4430, 4435 | xai/grok-4.6 | +| H context history | 030 | 3663 | anthropic/claude-opus-5 | +| I3 routing compatibility | 030 | 3775, 4436, 4429 | xai/grok-4.6 | +| I4 encrypted history regression | 030 | 4454 | anthropic/claude-opus-5 | + +Wave 1 prepares R, C, L, B, S, X, I1 and I2 in parallel. Wave 2 is I3, I4 and H. + +Wave 2 is not parallel throughout. I3 prepares alongside, but I4 and H must be +serialized in that order: both land in the routed Responses request path, so H +rebases onto I4 rather than preparing beside it. Preparing them as peers would +put two `src/server/responses/core.ts` writers in one wave, which is the exact +thing lane R exists to prevent. + +Lane S is prepared in wave 1 but is deliberately not merged in wp3. `#4447` +touches CORS and the management provider routes, which is inside the +MAINTAINERS.md security-review boundary, and a tip merge would have landed it on +a CI signal that was never meant to certify it. Splitting it out of lane B keeps +lane B's tip at `#4460` and keeps the hold visible at merge time rather than +three documents away. + +## Work phases + +wp1 is this roadmap. wp2 prepares wave 1, wp3 merges it, wp4 prepares wave 2 +against landed `dev`, wp5 merges wave 2 and confirms the dev regression run, and +wp6 closes what landed and records the outcome. + +## Risks + +Five of the carried pull requests touch `src/server/responses/core.ts`: #4455, +#4086, #4409 and #4387 in lane R, plus #3663 in lane H. Issue #4454 lands in the +same path without being a pull request at all. #3389 is a sixth `core.ts` +toucher and is deferred for an unrelated reason recorded in +`001_candidate_inventory.md`. Lane R serializes its four; H and I4 serialize +after R. A lane merged out of order defeats the shrinking-diff property. + +GitHub had not computed `mergeable` for most of these branches when the roadmap +was written, so lane assignment rests on file overlap rather than a proven +conflict-free merge. Each lane thread discovers its real conflicts at prepare time +and reports them. + +All four issue lanes — I1, I2, I3 and I4 — have no branch to carry at all. Those +are ordinary implementations by the lane thread, and they carry no +`Co-authored-by` trailer because there is no source branch; the reporter is +credited in the description instead. diff --git a/devlog/_plan/260913_contributor_carry_train/001_candidate_inventory.md b/devlog/_plan/260913_contributor_carry_train/001_candidate_inventory.md new file mode 100644 index 0000000000..ce5c04a0f0 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/001_candidate_inventory.md @@ -0,0 +1,119 @@ +# Candidate inventory and its verification + +## How the scores were collected + +The maintainer leaves a `## 리뷰 · 우선순위 NN / 80` line in a comment on triaged +issues and pull requests. This unit harvested that line from every open item on +2026-09-13 through the GraphQL API. + +The first attempt was wrong in a way worth recording. `gh api graphql --paginate` +only advances a query whose cursor variable is named `$endCursor`; a query using +`$cursor` re-requests page one forever. That run produced a 230 MB file of 472 +identical pages and, worse, a plausible-looking result: deduplicating by number +hid the loop and returned a correct-but-partial page-one answer. Five candidates +at 61 to 68 were missing from it. + +The corrected collection covers 73 open pull requests and 58 open issues. Every +one carries a score, so nothing in this inventory is an unscored guess. + +Seventeen open pull requests score 60 or higher once the maintainer's own #4462 +is set aside. Sixteen are dispatched here; #3389 is deferred for a reason +recorded below. + +## Pull request candidates, 60 and above + +| Score | PR | Author | Domain | Lane | +| --- | --- | --- | --- | --- | +| 74 | #4457 | jeongjin0 | devin adapter tool identity | C | +| 73 | #4381 | luvs01 | bridge truncated terminal | B | +| 71 | #4387 | luvs01 | web-search continuation key binding | R | +| 70 | #4455 | jeongjin0 | code-mode view_image | R | +| 69 | #4388 | luvs01 | images loop buffering bound | B | +| 68 | #3389 | Yum-wu | zero-output retry | deferred | +| 68 | #4382 | luvs01 | hub status credentials | L | +| 67 | #4438 | Yongzhaooo | OCG DeepSeek timeline instructions | C | +| 66 | #4389 | olddonkey | stream memory allocations, 44 files | C | +| 66 | #4413 | rrmlima | authenticated remote catalog pull | L | +| 66 | #4460 | AgenticLab-SH | model availability vs auth failure | B | +| 64 | #4077 | laerad777 | xAI Fast catalog copy, residue only | X | +| 63 | #4086 | Eleven-is-cool | routed continuation after replay miss | R | +| 61 | #4409 | yxr1995-maker | routed effort ladders from models.dev | R | +| 61 | #3663 | y2ambition-ai | context history relay, 19 files | H | +| 61 | #4170 | yeongjunyoo | stop refusal cause | L | +| 61 | #4447 | Veritas-7 | field-masked provider writes | S | + +`#4462` also scores 74 but is maintainer-authored and belongs to the sub-agent +surface work, not this train. + +`#3389` is deferred by prior judgment, not by score. The 2026-09-04 priority-65 +closeout recorded `NEEDS_DESIGN`: its zero-output premise was disproved by +experiment. Reviving it needs a design decision first, so it is not dispatched +here. + +## Issue candidates with no owning pull request + +| Score | Issue | Reporter | Lane | +| --- | --- | --- | --- | +| 76 | #4425 | wanjinxingoo-bot | I1 | +| 76 | #4430 | samwang0041-star | I2 | +| 73 | #4454 | 321sssrt-bit | I4 | +| 71 | #3775 | leonclab | I3 | +| 70 | #4429 | mdwsk88 | I3 | +| 67 | #4442 | SeanChengN | I1 | +| 66 | #4436 | jaychou0642-create | I3 | +| 64 | #4435 | ren-min-wan-sui | I2 | + +The remaining 60+ issues are excluded for a stated reason rather than by +oversight. #4456, #4412 and #4439 already have an owning pull request in this +train (#4457, #4455, #4438). #4191, #4311, #3661, #3781, #4312 and #3506 are +partially landed: the merged work references them with `Refs` and each landing +states in its own description that the issue stays open. #3375, #3376 and #3377 +are maintainer feature issues under separate execution. + +## Supersede closures already executed + +Before this train was planned, nine contributor pull requests were closed because +the previous batch had already absorbed them. Each carrier's merge commit was +verified as an ancestor of `origin/dev` at `2df82f412` before the close, and each +close carries a comment naming the carrier, the merge commit, and the fact that +the carry preserved the author's trailer. + +| Closed | Author | Carrier | Merge commit | +| --- | --- | --- | --- | +| #4319 | ke-1t | #4346 | `b551b524f` | +| #4310 | yxr1995-maker | #4354 | `b474013` | +| #3652 | itismyfield | #4355 | `c6372ca` | +| #4229 | yansigit | #4363 | `37bc1a0` | +| #4216 | ildunari | #4367 | `c240534` | +| #4119 | DamnUi | #4366 | `90667e5` | +| #4317 | cortes-ventures | #4402 | `8acd73b` | +| #4080 | terrytan95 | #4369 | `c27eeec` | +| #3458 | Ingwannu | #4362, #4372 | `19601ea`, `7874900` | + +## The half-superseded case + +`#4077` was not closed, and the reason generalizes. Its registry half landed +independently through `#4431` (`7ca00ffe7`), which classified the xAI OAuth lane +from its own live probe and deliberately excluded `grok-4.20-multi-agent-0309` +because the gateway answers `service_tier: "default"` when sent `priority`. That +branch flips the same model to `true`, so the landed scope is narrower on +evidence. + +Its third point is still unlanded and now more visible than when it was filed: +`src/providers/registry.ts` still reads +`fastTierDescription: "Priority processing, 2x token price"`, and `#4431` opened +the OAuth subscription rows where no per-token price exists. Lane X carries that +correction with the author's trailer. + +`#4431` landed without referencing `#4077` and without a trailer for its author. +That is the `missing_coauthor_credit` pattern `CREDITS.md` exists to stop +repeating, and it is why lane X exists as its own slice rather than as a footnote +in another lane. + +## Duplicate to collapse + +`#4171` (rrmlima, `CHANGES_REQUESTED`) and `#4455` (jeongjin0) both answer issue +`#4412` and both touch `src/responses/code-mode-helper-compat.ts` and +`src/types/tools.ts`. `#4455` is the 8-file superset. Lane R carries `#4455` with +trailers for both authors; lane X closes `#4171` after that landing is verified on +`dev`. diff --git a/devlog/_plan/260913_contributor_carry_train/010_wave1.md b/devlog/_plan/260913_contributor_carry_train/010_wave1.md new file mode 100644 index 0000000000..c016253407 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/010_wave1.md @@ -0,0 +1,205 @@ +# wp2 — Wave 1 lane preparation + +Eight worktree threads prepare in parallel. Every head in this train lives on a +contributor fork, so no lane pushes to a source branch. Each lane creates its own +`codex/260913-carry-*` branches in `lidge-jun/opencodex` and opens new pull +requests that carry the work with attribution. + +## The carry shape, identical for every link + +1. Branch from `origin/dev` for the bottom link, or from the previous link's + pushed head for every link above it. +2. Fetch the source head directly: `git fetch https://github.com//opencodex `. + The fork is not a configured remote in a fresh worktree. +3. Apply the source content. Cherry-pick when it is clean, reimplement when the + branch is stale against current `dev`. Either way the result is judged against + current behavior, not against the branch's original base. +4. Fold in the review findings already on the source pull request. A + `CHANGES_REQUESTED` review is not an approval and its findings are not optional. +5. Add `Co-authored-by: ` to the commit + that will survive the squash, taking the address from the author's GitHub + account rather than from their commit metadata. +6. Non-tip head commit subjects carry `[skip ci]`. The tip does not. +7. Push with `git push --no-verify`, fast-forward only. +8. Open the pull request against `dev` for the bottom link and against the parent + link's branch for every link above, filling every section of + `.github/PULL_REQUEST_TEMPLATE.md`. + +A lane reports: each new pull request number, the tip head SHA, the tip CI run id +and its conclusion, and every conflict it resolved with the reasoning. + +## Lane R — responses/core, serialized + +Owner `anthropic/claude-opus-5`. Order is fixed because all four touch +`src/server/responses/core.ts`. + +| # | Source | Author | Fork branch | Head | +| --- | --- | --- | --- | --- | +| 1 | #4455 | jeongjin0 | `codex/code-mode-view-image-helper` | `61b9aefc3` | +| 2 | #4086 | Eleven-is-cool | `fix/routed-continuation-replay` | `0c39bc608` | +| 3 | #4409 | yxr1995-maker | `feat/reasoning-metadata` | `7de03fb06` | +| 4 | #4387 | luvs01 | `agent/web-search-key-binding-20260912` | `2a1b3c307` | + +`#4455` carries two trailers. It answers issue #4412 together with `#4171` +(rrmlima), whose four files are a strict subset of its eight, so both authors are +named. Lane X closes `#4171` after this lands. + +`#4409` adds `scripts/test-layout/layout.json` and +`tests/fixtures/test-layout-expected.json` entries. `tests/test-layout.test.ts` +and `tests/test-layout-tooling.test.ts` enforce both; a new test file missing +from either is a hard failure, not a lint warning. + +`#4387` touches fifteen `structure/` documents. `bun run structure:check` is a +required local check for this link. + +## Lane C — chat and adapters + +Owner `anthropic/claude-opus-5`. `#4438` and `#4389` share +`src/adapters/openai-chat.ts`, so the order is fixed. + +| # | Source | Author | Fork branch | Head | +| --- | --- | --- | --- | --- | +| 1 | #4438 | Yongzhaooo | `codex/ocg-deepseek-system-order` | `9ebbcad26` | +| 2 | #4389 | olddonkey | `codex/memory-stream-optimizations` | `176cbbd2e` | +| 3 | #4457 | jeongjin0 | `codex/devin-restore-tool-names` | `edc6db3ff` | + +`#4389` is the cost of this lane: 44 files, +1491/-268, touching four adapters, +the chat outbound path, admission, the translator budget and request +decompression. It is a performance change, so the audit question is whether any +allocation removal changes observable behavior on a truncated or folded stream. + +`#4438` closes issue #4439 and `#4457` closes issue #4456 once landed; both +closures belong to wp6, not to the lane. + +## Lane L — cli and hub + +Owner `xai/grok-4.6`. Three links with no shared file at all. They are chained +only to collapse three CI runs into one; no ordering dependency exists between +them. + +| # | Source | Author | Fork branch | Head | +| --- | --- | --- | --- | --- | +| 1 | #4382 | luvs01 | `agent/status-hub-binding-20260912` | `094f12713` | +| 2 | #4413 | rrmlima | `feat/remote-catalog-pull` | `2aa821dff` | +| 3 | #4170 | yeongjunyoo | `fix/4169-stop-refusal-cause` | `4d72ef010` | + +`#4413` adds a CLI command, so `bun run skill:surface` must be regenerated and +`bun run skill:surface:check` must pass — `tests/ci-workflows/skill-ocx.test.ts` +fails on a committed map that drifts from `src/cli/capabilities.ts`, and it also +fails on a documented command the registry does not have. + +`#4413` duplicates its author's own issue #3729. That issue closes with this +landing. + +## Lane B — bridge, images, auth + +Owner `xai/grok-4.6`. + +| # | Source | Author | Fork branch | Head | +| --- | --- | --- | --- | --- | +| 1 | #4381 | luvs01 | `agent/content-filter-terminal-20260912` | `aad1d75bc` | +| 2 | #4388 | luvs01 | `agent/media-loop-bounds-20260912` | `9518b5281` | +| 3 | #4460 | AgenticLab-SH | `codex/260913-model-capacity-errors-dev` | `eefa07442` | + +`#4460` ships a `devlog/_fin/` document on its branch. A `_fin` unit records work +already visible in public git history, so the carry either moves it to `_plan` or +drops it; it does not land a `_fin` record for work that has not landed. + +The lane tip is `#4460`. + +## Lane S — security-review hold + +Owner `xai/grok-4.6`. One link: `#4447` (Veritas-7, fork branch +`fix/openai-patch-operator-overlays`, head `ed9655286`), letting field-masked +writes reach canonical OpenAI past stored overlays. + +It is its own lane rather than the top of lane B for a reason that is easy to get +wrong. It touches `src/server/auth-cors.ts` and +`src/server/management/provider-routes.ts`, which is inside the MAINTAINERS.md +security-review boundary. If it sat on top of lane B, merging that lane's tip in +wp3 would land the CORS and management change as a side effect of a lane merge, +on a CI signal that was never meant to certify it. + +`#4447` targets `main`, which is why its own title says `[WRONG BRANCH]`. The +carry lands on `dev` like everything else; the source pull request is left for +wp6 disposition rather than retargeted underneath its author. + +This lane prepares in wave 1 and does not merge in wp3. It merges in wp5 only +after maintainer security review, or it is recorded as deferred with that reason. + +## Lane X — small carries and dedupe + +Owner `xai/grok-4.6`. One branch, two obligations. + +The carry is the residue of `#4077` (laerad777, fork branch +`fix/xai-oauth-service-tier`, head `a071c67a1`, currently `CONFLICTING`): change +`fastTierDescription` on the xai registry entry away from +`"Priority processing, 2x token price"`, because `#4431` opened OAuth subscription +rows that have no per-token price. The registry classification in that branch is +already landed and is **not** re-applied; in particular +`grok-4.20-multi-agent-0309` keeps `forwardCallerServiceTier: false`, since a live +probe recorded the gateway downgrading it to `default`. + +The pins that read this string must move with it. The lane finds them rather than +assuming: `rg fastTierDescription` across `src/`, `tests/` and `docs-site/`. + +The dedupe is `#4171`, which wp6 closes after lane R's `#4455` carry is verified +on `dev`. Lane X does not close it. + +## Lane I1 — Windows issues, no source branch + +Owner `kimi/k3[1m]`. Two implementations, no carry, so no `Co-authored-by`; the +reporters are credited in the descriptions and the issues are linked. + +`#4425` (76): a non-elevated `ocx service install` fails because the generated +`LogonTrigger` omits `UserId`, and the resulting `Access is denied` is reported as +a permission problem, which is a misdiagnosis. The fix emits `UserId` and the +diagnostic stops blaming elevation. + +`#4442` (67): the Windows history manifest integrity check treats `C:\...` and +`\\?\C:\...` as different paths, so the check fails after sessions are archived. +The fix normalizes the extended-length prefix before comparison. + +Both are Windows-only paths that this lane cannot execute locally, and the obvious +evidence is not available by default: `platform-windows` in +`.github/workflows/ci.yml` is gated on `github.event_name == 'workflow_dispatch'`, +so a pull-request tip run never executes it. The gate for this lane is therefore +an explicit `workflow_dispatch` run on the exact tip SHA, plus focused tests that +encode the path and trigger shapes directly. If the dispatch run is not obtainable, +the lane says so instead of implying a Windows leg ran. + +## Lane I2 — configuration and account issues, no source branch + +Owner `xai/grok-4.6`. + +`#4430` (76): 2.52.0 treats `claudeCode.desktopProfile.appliedFingerprint=null` as +fatal and replaces the entire configuration with defaults. Losing a user's whole +config on a nullable field is the severe part; the fix accepts `null` and, more +generally, stops a single invalid field from triggering a whole-config reset. + +`#4435` (64): a second Kiro account disappears shortly after a successful login. +The lane reproduces against the account store before proposing a fix, because a +disappearing second account is equally consistent with a write collision, a +single-slot overwrite, and a projection that keys on a non-unique identifier. + +## Dispatch packet + +Every thread receives the same frame, with its lane table substituted: + +- Worktree environment, this repository, base `dev`. +- The common principles from `000_plan.md`, quoted rather than referenced. +- Unlimited `xai/grok-4.6` subagents may be fanned out inside the lane's own + worktree, in parallel. They share that worktree's checkout, so they need + non-overlapping write scopes and must never run branch-level git operations + concurrently. +- Do not merge, do not mark ready, do not close anything, do not push to `dev`, + `main` or `preview`. +- Report the pull request numbers, the tip head SHA, the tip run id and + conclusion, and every conflict resolution with its reasoning. + +## Exit criteria + +Every wave-1 lane has its chain pushed, its pull requests open with complete +descriptions, and a hosted run on its exact tip head. A lane whose tip run is red +for a reason belonging to the lane fixes it before wp3; a lane whose tip is red +because `dev` drifted re-merges `origin/dev` at its tip and re-runs. diff --git a/devlog/_plan/260913_contributor_carry_train/020_wave1_merge.md b/devlog/_plan/260913_contributor_carry_train/020_wave1_merge.md new file mode 100644 index 0000000000..7b0ea43350 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/020_wave1_merge.md @@ -0,0 +1,71 @@ +# wp3 — Wave 1 integration + +The main session performs every merge. No lane thread merges anything. + +## Order + +Lanes merge one at a time, smallest blast radius first, so that each later lane +re-merges a dev that already contains the earlier ones: + +X, I1, I2, L, B, C, R. Lane S does not merge here. + +X is first because it is a single-file registry correction. R is last because its +four links all rewrite src/server/responses/core.ts, which is the file every other +lane is most likely to have touched indirectly through +structure/transports/responses.md. + +## The wave-1 hold + +Lane S (#4447) prepares in wave 1 and is deliberately excluded from this merge +order. It touches CORS and the management provider routes, which is inside the +MAINTAINERS.md security-review boundary, so it merges in wp5 after review or is +recorded as deferred. Lane B's tip is #4460; if a merge attempt on lane B would +carry #4447, the lane was assembled wrong and is fixed before merging rather than +merged and reverted. + +## Per-lane merge procedure + +1. git fetch origin dev and re-read the head. dev moves during this batch. +2. Read the lane tip current head SHA with gh pr view --json headRefOid. +3. Confirm the hosted run that concluded success ran on that exact SHA. A green + run on an earlier head is not evidence for the head being merged. +4. If the tip re-merged origin/dev after its green run, verify the resolution by + reading it and re-run bun run typecheck, bun run structure:check and + bun run privacy:scan before merging. This happened twice in the previous batch + and both times the re-merge was mechanical; that is a finding to reconfirm, + not to assume. +5. Merge the tip. A cumulative lane merges as one merge commit on the tip, which + lands every link beneath it. A lane whose links must appear separately in + history squash-merges bottom-up instead. +6. Verify the landing rather than trusting the merge report: + git merge-base --is-ancestor origin/dev. +7. Verify attribution in the landed commit: git log -1 --format=%B + must show the Co-authored-by trailers for every carried author. A trailer that + lived only in the pull request body is gone after a custom squash message, and + that is exactly the failure CREDITS.md documents. + +## Merge comment + +Every merge comment names three things explicitly, so the deviation stays a +recorded owner decision rather than an inferred one: + +- the owner authorization for tip-only CI in this batch, +- the tip pull request and run id that covers this branch, +- the fact that this branch own ci check never ran. + +## The screenshot gate + +enforce-target fails with missing UI screenshot on any pull request whose title or +description merely mentions gui. No wave-1 source pull request touches gui/, so +the gate is expected to be quiet here — but it reads the text, not the diff, so a +description that mentions the dashboard trips it anyway. Where a real rendered +state exists, capture it. A control that only renders against a real expired +credential is covered by its tests, and that limitation is stated in the +description rather than faked with a fixture. + +## Exit criteria + +Every wave-1 lane except S reports MERGED with its own merge commit, every merge +commit is a verified ancestor of origin/dev, and every carried author trailer is +present in the landed commit. Lane S exits wp3 prepared, green and unmerged; that +is its success state here, not a failure to land. diff --git a/devlog/_plan/260913_contributor_carry_train/030_wave2.md b/devlog/_plan/260913_contributor_carry_train/030_wave2.md new file mode 100644 index 0000000000..48f94727de --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/030_wave2.md @@ -0,0 +1,86 @@ +# wp4 — Wave 2 lane preparation + +Three lanes were held out of wave 1 because each collides with wave-1 work on a +file wave 1 rewrites. They prepare against landed dev, not against the heads they +would have started from. + +They are not all parallel. I3 prepares on its own. I4 and H both land in the +routed Responses request path, so they run in that order and H rebases onto I4. +Preparing them as peers would put two writers on src/server/responses/core.ts in +one wave, which is precisely what lane R exists to prevent. + +## Lane H — context history relay + +Owner anthropic/claude-opus-5. Source #3663 (y2ambition-ai, fork branch +feat/codex-context-history, head 8e0b53b0f), 19 files, +1249/-15. + +It is deferred because it touches src/server/responses/core.ts, +src/server/index.ts and src/server/live.ts at once. Lane R rewrites the first and +lane B touches the third, so preparing it in parallel would mean resolving the +same conflicts twice. + +src/server/index.ts carries a hard constraint that a large carry can break +silently. It is the composition root, and the window between the Bun.serve call +and the labActivationRequired check must stay synchronous: a scan in that file +fails on any await added to that window and on startServer being declared async. +The reason is not style — the synchronous subagent-fallback chain has nowhere to +await, so an await there reroutes subagents to a different model than the +operator configured. + +The lane also adds test-layout entries and must keep +tests/lab/core-lab-boundary.test.ts green: src/server/responses/core.ts may not +reach src/lab/ even transitively. + +## Lane I3 — routing compatibility, no source branch + +Owner xai/grok-4.6. Three issues in the model and route capability area, deferred +because #3775 overlaps lane R #4409 effort-ladder work. + +#3775 (71): Codex 0.153.4 rejects minimal and none on custom models mapped to +gpt-6-astra. #4349 landed effort ceilings enforced independently of model pins, so +this lane starts by determining what that already fixed; the honest outcome may be +a narrower fix than the issue describes. + +#4436 (66): deepseek-flash accepts native image input on both Chat and Responses, +but the registry still routes it through the vision sidecar. The fix is a +capability declaration, and #4374 and #4376 already landed the per-model +capability contract this should use rather than a new special case. + +#4429 (70): a key-auth Responses gateway (Kimi K3) echoes hosted web_search as a +client function_call, and webSearchBridge only has an Ollama executor. This is the +largest of the three and may split into its own work-phase if the executor +abstraction turns out to be Ollama-shaped rather than merely Ollama-only. + +## Lane I4 — encrypted history regression + +Owner anthropic/claude-opus-5. #4454 (73) is an issue, not a pull request: there +is no branch to carry and no Co-authored-by trailer. Reported by 321sssrt-bit, +mixed encrypted agent_message history bypasses the routed Responses fail-closed +path. + +Deferred behind lane R because it lands in the same request path, and it is a +regression in a fail-closed boundary, which makes it the highest-risk single item +in the train. A bypass of fail-closed is a security-boundary defect: it reports +for maintainer review per MAINTAINERS.md rather than being treated as ordinary +once CI is green. Lane H starts from this lane's pushed head, not from dev. + +#4364 bounded multipart encrypted task recovery and #4351 restored opt-in +plaintext V2 messages; both explicitly state they do not close #3661. This lane +establishes whether #4454 is a distinct defect or the same envelope problem seen +from the other side before writing a fix. + +## Exit criteria + +Each wave-2 lane has its chain pushed against landed dev, its pull requests open, +and a hosted run concluded on its exact tip head. I4 reaches that state before H +starts. + +## Conditional closures + +Two of these lanes may find that the reported defect is already fixed or is a +restatement of another open issue. #3775 may be covered by the effort ceilings +#4349 landed, and #4454 may be the same envelope problem as #3661 seen from the +other side. In either case the honest outcome is a comment on the issue naming +what was found, not a closure claimed against a fix that was not written here. +050_disposition.md lists the expected closures; a lane finding no defect +overrides that list. diff --git a/devlog/_plan/260913_contributor_carry_train/040_wave2_merge_regression.md b/devlog/_plan/260913_contributor_carry_train/040_wave2_merge_regression.md new file mode 100644 index 0000000000..fbbcfc1597 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/040_wave2_merge_regression.md @@ -0,0 +1,46 @@ +# wp5 — Wave 2 integration and the dev regression gate + +## Order + +S, I3, I4, H. Lane S is first because it has been waiting since wave 1 and is a +single link. H is last because it is the largest diff and the one most exposed to +everything that landed before it, and because it was prepared on top of I4. + +The merge procedure is identical to 020_wave1_merge.md, including the exact-head +CI check, the ancestry verification, the trailer check in the landed commit, and +the three-part merge comment. + +## Security-review holds + +Two lanes do not merge on green CI alone. Lane S (#4447) touches CORS and the +management provider routes; lane I4 (#4454) repairs a fail-closed bypass. Both are +inside the MAINTAINERS.md security-review boundary. If review is not available +within this goal, they are recorded as deferred with the reason rather than merged +on a CI signal that was never meant to certify them. + +Deferring lane I4 has a consequence worth stating up front: lane H was prepared on +top of it. If I4 is held, H is rebased onto dev without it before merging, or H is +held too. H is not merged with an unmerged parent silently folded in. + +## The regression gate + +A merge report is not a regression proof. The gate is a dev workflow run that +concluded success on a commit that contains the whole batch. + +Two distinctions carried over from the previous batch, both learned the hard way: + +- A run that ends cancelled is not a pass. Merges inside one concurrency group + supersede each other, which is the workflow behaving as configured; the evidence + is the completed run on a descendant commit. +- The commit the run executed on must be an ancestor-verified descendant of the + last merge. git merge-base --is-ancestor is the check. + +If the final run is red, the failure is triaged before any completion claim. A +failure that belongs to a landed lane is fixed as a follow-up pull request in this +same goal, not recorded as an acceptable residue. + +## Exit criteria + +Every lane is merged or explicitly deferred with a stated reason, and one dev run +has concluded success on a batch-containing commit, recorded by run id and head +SHA. diff --git a/devlog/_plan/260913_contributor_carry_train/050_disposition.md b/devlog/_plan/260913_contributor_carry_train/050_disposition.md new file mode 100644 index 0000000000..3d9cd97c58 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/050_disposition.md @@ -0,0 +1,73 @@ +# wp6 — Disposition and outcome + +## What closes, and on what evidence + +A merged pull request does not prove its linked issue is resolved. The rule from +the previous batch holds: Refs #N is not Closes #N, and a description stating the +issue stays open outranks any topical similarity. + +GitHub auto-closes linked issues only on merge into the default branch. These +merge into dev, so every closure here is manual. + +### Source pull requests carried by this train + +Each source is closed only after its carry is verified on dev by +git merge-base --is-ancestor, with a comment naming the carry, its merge commit, +and the trailer that preserved the author credit. + +| Source | Author | Carried by lane | +| --- | --- | --- | +| #4455, #4086, #4409, #4387 | jeongjin0, Eleven-is-cool, yxr1995-maker, luvs01 | R | +| #4438, #4389, #4457 | Yongzhaooo, olddonkey, jeongjin0 | C | +| #4382, #4413, #4170 | luvs01, rrmlima, yeongjunyoo | L | +| #4381, #4388, #4460 | luvs01, luvs01, AgenticLab-SH | B | +| #4447 | Veritas-7 | S | +| #4077 | laerad777 | X | +| #3663 | y2ambition-ai | H | + +#4171 (rrmlima) closes against lane R #4455 carry as a duplicate, with both +authors named in that landing. + +### Issues expected to close, and three that are conditional + +#4412 with lane R, #4439 and #4456 with lane C, #3729 with lane L, #4425 and +#4442 with lane I1, #4430 and #4435 with lane I2, and #4429 with lane I3. + +#3775 and #4436 in lane I3, and #4454 in lane I4, are conditional rather than +expected, for the reasons below. + +Each closure is re-verified against landed dev before it is executed, because the +map above is written while the lanes are still in flight. + +Three of those closures are conditional rather than expected. #3775 may already be +covered by the effort ceilings #4349 landed, #4436 may reduce to a capability +declaration on the contract #4374 and #4376 established, and #4454 may be the same +envelope defect as #3661 seen from the other side. If a lane finds no defect to +fix, the issue gets a comment naming what was found and stays open. A closure is +never claimed against a fix that was not written. + +### Issues that stay open + +#4191, #4311, #3661, #3781, #4312 and #3506 are partially landed. They receive a +comment naming what landed and what remains, and they stay open. The previous +batch checked 24 closure candidates and every one came back KEEP for exactly this +reason: related work had shipped, but the actual ask had not been met. + +## Credit repair + +#4431 landed the xAI OAuth Fast classification without a trailer for the author of +#4077, who had proposed the registry change first. The landing was independently +derived from a live probe, so this is not a silent carry, but CREDITS.md is the +place that distinction gets recorded rather than left to memory. wp6 adds the +entry. + +## Outcome document + +060_outcome.md records, for a reader who was not in the loop: what landed and how, +the run ids that prove it, what the tips caught that per-link CI would have caught +earlier, what did not land and why, and the honest limits of the proof — +specifically that non-tip pull requests merged without their own ci check under a +recorded owner authorization. + +LOOP-PESSIMIST-01 applies to that document: it also records which hypothesis died +and what evidence would show the tip-only CI economy is the wrong trade. From 442e6cadb6e3e6cca3268fbd156391ce16359f08 Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 17:26:20 +0900 Subject: [PATCH 2/7] docs(devlog): record the wave-1 outcome of the contributor carry train Seven of eight wave-1 lanes are on dev; lane S stays green and unmerged pending security review. Records the credit defect the wave surfaced: contributor draft #4465 proposed the #4442 fix after the candidate harvest and before the lane, so the I1 landing carries a Co-authored-by trailer for its author. Also records the two planned carries that were already satisfied on dev, both found by attempting the work rather than by reading the plan. --- .../011_wave1_outcome.md | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md diff --git a/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md b/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md new file mode 100644 index 0000000000..d4dd83cbee --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md @@ -0,0 +1,78 @@ +# wp2/wp3 — Wave 1 outcome + +Seven of the eight wave-1 lanes are on dev. Lane S is prepared, green and +deliberately unmerged. + +## What landed + +| Lane | Tip | Merge commit | Carried | +| --- | --- | --- | --- | +| L | #4481 | d865aacf93 | #4382 luvs01, #4413 rrmlima | +| B | #4480 | 2af30c2d0e | #4381 luvs01, #4388 luvs01, #4460 AgenticLab-SH | +| X | #4474 | 2296e485d6 | #4077 laerad777, residue only | +| I1 | #4486 | a3ca64f605 | issues #4425, #4442 | +| I2 | #4482 | 990cd8cce5 | issues #4430, #4435 | +| C | #4487 | 55bb9f3fef | #4438 Yongzhaooo, #4389 olddonkey, #4457 jeongjin0 | +| R | #4489 | 3f76ce415d | #4455 jeongjin0, #4409 yxr1995-maker, #4387 luvs01 | + +Every merge was gated the same way: a Cross-platform CI run concluded success on +the exact tip head SHA, the merge commit was verified with +git merge-base --is-ancestor against origin/dev afterwards, and the +Co-authored-by trailers were read out of the landed commits rather than the pull +request bodies. + +## Lane S is held, not late + +#4477 has been green on df7cbd5b7b since early in the wave. It carries #4447, +which touches src/server/auth-cors.ts and src/server/management/provider-routes.ts, +so MAINTAINERS.md requires explicit security review and a green tip is not that +review. Splitting it out of lane B is what made the hold enforceable: as lane B's +tip it would have landed as a side effect of a lane merge. + +## The credit defect this wave surfaced + +Lane I1 implemented #4442 as an ordinary fix, because the candidate harvest found +no pull request owning that issue. There was one: draft #4465 by maoxin1234, +opened 2026-09-13T05:43Z, after the harvest and before the lane. It proposed the +same normalization in the same two files. + +The landed implementation is a superset — it adds the backup-id compatibility +fallback, the native-residue path and the structure doc — but it supersedes a +contributor proposal that came first, which AGENTS.md treats as requiring a +trailer. The I1 merge commit therefore names maoxin1234, and #4465 was closed with +that stated rather than closed as a duplicate. + +The generalizable failure is the harvest, not the lane. A scored inventory is a +snapshot, and an issue lane must re-check for an owning pull request at dispatch +time rather than trusting the snapshot it was planned from. Wave 2 lanes I3 and I4 +do that check before implementing. + +## What #4086 turned out to be + +Lane R's fourth planned link was already on dev as d6723f7f3, with its own +Co-authored-by trailer for Eleven-is-cool. The lane attempted the carry before +concluding that, and the modify/delete conflict on +structure/04_transports-and-sidecars.md — a file the #4276 SSOT restructure had +deleted — is what prompted the check. The landed version is a superset of the +branch. + +That is the second time in this train that a planned carry was already satisfied +on dev; #4170 in lane L was the first. Both were found by attempting the work +rather than by reading the plan, which is the argument for lanes re-verifying +their own inputs. + +## Disposition executed + +Closed with evidence comments naming the landing pull request and merge commit: +source pull requests #4382, #4413, #4170, #4381, #4388, #4460, #4077, #4438, +#4389, #4457, #4455, #4409, #4387, #4171, #4086, #4465, plus the carry links that +GitHub did not auto-close (#4479, #4473, #4485). Issues #4425, #4442, #4430, +#4435, #4439, #4456, #4412 and #3729 were closed the same way. + +## Honest limits + +Non-tip pull requests merged without their own ci check, under the recorded owner +authorization for tip-only CI. Every dev run triggered by these merges ended +cancelled by the concurrency group as the next merge superseded it, which is the +workflow behaving as configured; the batch regression gate is a completed dev run +on a commit containing everything, and that belongs to wp5 rather than here. From 59aac5a6fcaf88068d83ba8935d78a5fa1e4071e Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 18:04:35 +0900 Subject: [PATCH 3/7] docs(devlog): close wave 1 with the lane S security review All eight wave-1 lanes are on dev. Records why the security hold was worth having: the review found that the canonical OpenAI seed defines only four keys, so overlay tolerance reached headers, which the PATCH mask writes and the forward adapter applies to the upstream ChatGPT request ahead of incoming headers. The fix denies headers on canonical openai and adds the regression that was missing. --- .../011_wave1_outcome.md | 50 ++++++++++++++++--- 1 file changed, 44 insertions(+), 6 deletions(-) diff --git a/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md b/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md index d4dd83cbee..a073b351ff 100644 --- a/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md +++ b/devlog/_plan/260913_contributor_carry_train/011_wave1_outcome.md @@ -1,7 +1,7 @@ # wp2/wp3 — Wave 1 outcome -Seven of the eight wave-1 lanes are on dev. Lane S is prepared, green and -deliberately unmerged. +All eight wave-1 lanes are on dev. Lane S landed last, after the security review +it was held for changed the diff. ## What landed @@ -14,6 +14,7 @@ deliberately unmerged. | I2 | #4482 | 990cd8cce5 | issues #4430, #4435 | | C | #4487 | 55bb9f3fef | #4438 Yongzhaooo, #4389 olddonkey, #4457 jeongjin0 | | R | #4489 | 3f76ce415d | #4455 jeongjin0, #4409 yxr1995-maker, #4387 luvs01 | +| S | #4477 | 981b53e7d0 | #4447 Veritas-7, plus the review fix c39098ba3d | Every merge was gated the same way: a Cross-platform CI run concluded success on the exact tip head SHA, the merge commit was verified with @@ -21,14 +22,51 @@ git merge-base --is-ancestor against origin/dev afterwards, and the Co-authored-by trailers were read out of the landed commits rather than the pull request bodies. -## Lane S is held, not late +## The security hold earned its keep -#4477 has been green on df7cbd5b7b since early in the wave. It carries #4447, -which touches src/server/auth-cors.ts and src/server/management/provider-routes.ts, -so MAINTAINERS.md requires explicit security review and a green tip is not that +#4477 was green on df7cbd5b7b for hours before it merged. It carries #4447, which +touches src/server/auth-cors.ts and src/server/management/provider-routes.ts, so +MAINTAINERS.md requires explicit security review and a green tip is not that review. Splitting it out of lane B is what made the hold enforceable: as lane B's tip it would have landed as a side effect of a lane merge. +The review changed the outcome, which is the argument for the hold existing at +all. The threat model established that overlay tolerance is openai-only, that the +destination and auth keys stay byte-pinned, and that PATCH is an explicit +per-field allowlist so a request cannot introduce a novel key. It also established +that the canonical OpenAI seed defines only four keys — adapter, authMode, baseUrl, +codexAccountMode — so "ignore keys the seed never defines" reaches nearly every +config key, which is a much wider door than the description implied. + +That width is where the finding was. The author had already denied +allowPrivateNetwork, correctly: it is patchable, it disables destination DNS +classification, and overlay tolerance would have persisted it on the ChatGPT +forward row. headers sits in exactly the same class and was not covered. Canonical +OpenAI has no registry staticHeaders, the PATCH field mask writes headers with a +shallow merge, and the forward adapter applies provider.headers to the upstream +request before the incoming forward headers — so a persisted value wins whenever +the caller omits that header. A dashboard-session +PATCH {"headers":{"chatgpt-account-id":"..."}} would have ridden every subsequent +ChatGPT request that did not carry the header itself. POST still refused it; PATCH, +the editor and reload did not. + +c39098ba3d denies headers on canonical openai the same way and adds the missing +PATCH regression. The test was driven red before it was accepted: removing the +guard fails exactly that case and nothing else in the file. + +Two process notes worth keeping. The finding came from an independent reviewer +rather than the main pass, which had stopped at the field-policy map and concluded +headers were redacted — true for editor admission, false for the PATCH mask, which +has its own allowlist. And the tip's first run failed in select-windows-runner with +no failing step; re-running the failed jobs on the same commit turned it green, so +the exact-head evidence survived rather than needing a new head. + +Recorded follow-up: the overlay tolerance is a denylist and denylists rot. +PROVIDER_CONFIG_FIELD_POLICY forces a new provider field to be classified but does +not force an overlay decision, so a future editor field touching a trust boundary +becomes silently reachable on the canonical row. codexToolMode is the current +example. The durable fix is an explicit overlay allowlist plus a guard test. + ## The credit defect this wave surfaced Lane I1 implemented #4442 as an ordinary fix, because the candidate harvest found From b27cb2d24b54567634b8fbce68c64623b32dca2b Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 18:37:36 +0900 Subject: [PATCH 4/7] docs(devlog): correct wave 2 after the dispatch-time ownership re-check #4436 has an owning contributor pull request, #4467 by jaychou0642-create, opened after the candidate harvest and before this lane. Lane I3 carries it with a trailer instead of implementing the fix fresh. This is the wave-1 #4465 lesson applied as a dispatch-time check rather than a note. --- .../030_wave2.md | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/devlog/_plan/260913_contributor_carry_train/030_wave2.md b/devlog/_plan/260913_contributor_carry_train/030_wave2.md index 48f94727de..4de7564867 100644 --- a/devlog/_plan/260913_contributor_carry_train/030_wave2.md +++ b/devlog/_plan/260913_contributor_carry_train/030_wave2.md @@ -42,9 +42,22 @@ this lane starts by determining what that already fixed; the honest outcome may a narrower fix than the issue describes. #4436 (66): deepseek-flash accepts native image input on both Chat and Responses, -but the registry still routes it through the vision sidecar. The fix is a -capability declaration, and #4374 and #4376 already landed the per-model -capability contract this should use rather than a new special case. +but the registry still routes it through the vision sidecar. This one is a CARRY, +not an implementation. The dispatch-time re-check found #4467 by +jaychou0642-create, opened 2026-09-13T06:06Z — after the candidate harvest and +before this lane — by the same person who filed the issue. It is ready rather than +draft, targets dev, and touches 13 files (+154/-15) centred on +src/providers/registry.ts, with locale docs and parity tests. + +Carry it with a Co-authored-by trailer naming +jaychou0642-create <283093853+jaychou0642-create@users.noreply.github.com>. The +review question is whether it declares the capability through the per-model +contract #4374 and #4376 landed, rather than adding a new special case. + +That this was caught at all is the wave-1 lesson applied: the scored inventory is +a snapshot, and lane I1 landed #4442 as an ordinary fix while contributor draft +#4465 already proposed it. Every issue lane re-checks for an owning pull request +at dispatch time now. #4429 (70): a key-auth Responses gateway (Kimi K3) echoes hosted web_search as a client function_call, and webSearchBridge only has an Ollama executor. This is the From 56118c981ec63bf661049e99d74462252829c319 Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 21:49:16 +0900 Subject: [PATCH 5/7] docs(devlog): record lane H as a noop and lane I5 as dev-based #3663 was already on dev as a33b51eb via #4360, carried from the same head with both trailers intact, so the lane had nothing to carry. It also disproved the predicted core.ts conflict: I4's strip and the context-history ownership recording are gated on complementary destination predicates and sit on opposite sides of dispatch. Third planned carry in this train found already satisfied on dev, after #4170 and #4086. --- .../030_wave2.md | 29 ++++++++++++++++++- .../050_disposition.md | 2 +- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/devlog/_plan/260913_contributor_carry_train/030_wave2.md b/devlog/_plan/260913_contributor_carry_train/030_wave2.md index 4de7564867..7b3625a1b2 100644 --- a/devlog/_plan/260913_contributor_carry_train/030_wave2.md +++ b/devlog/_plan/260913_contributor_carry_train/030_wave2.md @@ -9,11 +9,38 @@ routed Responses request path, so they run in that order and H rebases onto I4. Preparing them as peers would put two writers on src/server/responses/core.ts in one wave, which is precisely what lane R exists to prevent. -## Lane H — context history relay +## Lane H — context history relay: NOOP, already on dev Owner anthropic/claude-opus-5. Source #3663 (y2ambition-ai, fork branch feat/codex-context-history, head 8e0b53b0f), 19 files, +1249/-15. +Outcome: there was nothing to carry. The lane verified against landed dev before +writing anything and found the content already there as a33b51eb, landed through +#4360 on 2026-09-12 (merge 2526715fb2), carried from exactly this branch's head +with Co-authored-by trailers for both y2ambition-ai and nbbb26 intact. Five +hardening commits followed it; all 19 files are present on dev and every one is +larger there, so re-applying the branch would have been a downgrade. + +The lane also disproved the conflict this document predicted, and the reason is +stronger than "different regions". Lane I4's strip is gated on +adapter === "openai-responses" and not isCanonicalOpenAiForwardProvider, while +the context-history ownership recording is gated on isCanonicalOpenAiForwardProvider +and contextRelayActivated(). The predicates are complements on the same +destination question, so no request takes both paths, and they sit on opposite +sides of dispatch: one repairs the outbound body before the send, the other +records the account after upstream accepted it. + +This is the third planned carry in this train that turned out to be already +satisfied on dev, after #4170 in lane L and #4086 in lane R. All three were found +by attempting the work rather than by reading the plan. #3663 was closed with a +comment naming a33b51eb and #4360. + +Because lane H needed nothing, lane I5 branches from dev directly rather than +from lane H's head. + +The original deferral reasoning is kept below, because it is why the lane was +scheduled here at all. + It is deferred because it touches src/server/responses/core.ts, src/server/index.ts and src/server/live.ts at once. Lane R rewrites the first and lane B touches the third, so preparing it in parallel would mean resolving the diff --git a/devlog/_plan/260913_contributor_carry_train/050_disposition.md b/devlog/_plan/260913_contributor_carry_train/050_disposition.md index 3d9cd97c58..e447d56506 100644 --- a/devlog/_plan/260913_contributor_carry_train/050_disposition.md +++ b/devlog/_plan/260913_contributor_carry_train/050_disposition.md @@ -23,7 +23,7 @@ and the trailer that preserved the author credit. | #4381, #4388, #4460 | luvs01, luvs01, AgenticLab-SH | B | | #4447 | Veritas-7 | S | | #4077 | laerad777 | X | -| #3663 | y2ambition-ai | H | +| #3663 | y2ambition-ai | H — no carry needed; already on dev as a33b51eb via #4360 | #4171 (rrmlima) closes against lane R #4455 carry as a duplicate, with both authors named in that landing. From a7b72a16e7940cce553a609880dfb0110f801a00 Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 21:51:40 +0900 Subject: [PATCH 6/7] docs(credits): record the xAI Fast proposal overtaken by independent work #4077 proposed opening the Grok OAuth lane to service_tier priority and correcting the Fast-tier catalog copy. The registry half landed independently through #4431 with a narrower, live-probed scope and no reference to the proposal; the copy correction landed later through #4474 with a trailer. The first half is recorded as an acknowledgement rather than as carried code. Also records the gate's false-positive mode: a description that merely talks about a carry train fails missing_coauthor_credit even with no source author, which #4499 hit. Writing around it is cheaper than loosening the matcher. --- CREDITS.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/CREDITS.md b/CREDITS.md index 5de4f2f696..5737ed185e 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -243,6 +243,42 @@ unnecessary. If you find a landing that belongs on this page, open an issue. Being missed is the defect this file documents, not a claim you have to argue for. +### 2026-09-13: independent work that overtook an open proposal + +The gate fires on what a pull request *says*. It cannot fire on a landing that +never mentions the proposal it overtakes, which is how this one happened. + +[#4077](https://github.com/lidge-jun/opencodex/pull/4077) by +[@laerad777](https://github.com/laerad777) proposed opening the xAI Grok OAuth +lane to `service_tier: "priority"` and correcting the Fast-tier catalog copy. +The registry half landed independently through #4431 at `7ca00ffe7`, derived +from its own live probe, with no reference to #4077 and no trailer. The landed +scope is narrower on evidence — `grok-4.20-multi-agent-0309` stays excluded +because the gateway answers `service_tier: "default"` when sent `priority` — +so this is genuinely independent work rather than a silent carry. + +The copy correction was still unlanded, and it was the part #4077 identified +first. It landed through #4474 with a `Co-authored-by` trailer naming the +author. The registry half is recorded here as an acknowledgement rather than as +carried code, because that is what the evidence supports. + +The generalizable point: "independent" and "first" are different claims, and +only the second one is visible from the open queue. + +### 2026-09-13: the gate also fires on prose about carrying + +The matcher reads the description, so a pull request that merely *describes* a +carry train trips `missing_coauthor_credit` even when it has no source author. +[#4499](https://github.com/lidge-jun/opencodex/pull/4499) was an ordinary +implementation with no source branch; the phrases "contributor-carry train" and +"Head commit carries `[skip ci]`" were enough to fail the gate. Rewording +cleared it. + +That is a false positive rather than a defect worth loosening the matcher for. +A gate that occasionally asks an author to justify wording is cheaper than one +that misses a real uncredited carry, which is the failure this whole page +documents. Write around it. + ### A gap the gate does not close The gate checks that a trailer is **present**. It cannot check that the trailer From f0eb40ea2899f4ee068469f82c7147f18a1ce29a Mon Sep 17 00:00:00 2001 From: JUN Date: Sun, 13 Sep 2026 22:00:16 +0900 Subject: [PATCH 7/7] docs(devlog): record the contributor carry train outcome MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Eleven lanes landed, one needed nothing. Records what every audit round caught — the roadmap failing on two lanes prepared as peers that both write responses/core.ts, the packets failing on an unqualified "never merge" that would have blocked the required dev re-merge, lane S on a headers overlay that reached the upstream ChatGPT request, and lane I4 on the same defect wearing three different payloads. The lesson that repeated in both directions: three planned carries were already on dev, and two contributor pull requests were opened after the inventory snapshot. Neither is fixable with a better inventory; only the lane touching the code can tell. --- .../060_outcome.md | 123 ++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 devlog/_plan/260913_contributor_carry_train/060_outcome.md diff --git a/devlog/_plan/260913_contributor_carry_train/060_outcome.md b/devlog/_plan/260913_contributor_carry_train/060_outcome.md new file mode 100644 index 0000000000..3cd0ca6548 --- /dev/null +++ b/devlog/_plan/260913_contributor_carry_train/060_outcome.md @@ -0,0 +1,123 @@ +# Outcome — the contributor carry train + +Twelve lanes were dispatched to land the open contributor work scored 60 or +higher. Eleven landed, one needed nothing, and one is recorded separately below. + +## What landed + +| Wave | Lane | Tip | Merge commit | Carried | +| --- | --- | --- | --- | --- | +| 1 | L | #4481 | d865aacf93 | #4382 luvs01, #4413 rrmlima | +| 1 | B | #4480 | 2af30c2d0e | #4381 luvs01, #4388 luvs01, #4460 AgenticLab-SH | +| 1 | X | #4474 | 2296e485d6 | #4077 laerad777, copy residue only | +| 1 | I1 | #4486 | a3ca64f605 | issues #4425, #4442 | +| 1 | I2 | #4482 | 990cd8cce5 | issues #4430, #4435 | +| 1 | C | #4487 | 55bb9f3fef | #4438 Yongzhaooo, #4389 olddonkey, #4457 jeongjin0 | +| 1 | R | #4489 | 3f76ce415d | #4455 jeongjin0, #4409 yxr1995-maker, #4387 luvs01 | +| 1 | S | #4477 | 981b53e7d0 | #4447 Veritas-7 | +| 2 | I3 | #4500 | 94063d0798 | #4467 jaychou0642-create, issue #3775 | +| 2 | I4 | #4498 | 8e6c99608c | issue #4454 | +| 2 | H | — | — | nothing to carry; #3663 was already on dev | + +Every merge used the same gate: a Cross-platform CI run concluded success on the +exact tip head SHA, the merge commit was verified with +`git merge-base --is-ancestor` against `origin/dev` afterwards, and the +`Co-authored-by` trailers were read out of the landed commits rather than the +pull request bodies. + +## Dispositions + +Closed with evidence naming the landing and merge commit: source pull requests +#4382, #4413, #4170, #4381, #4388, #4460, #4077, #4438, #4389, #4457, #4455, +#4409, #4387, #4171, #4086, #4465, #4467, #3663, #4447, plus the carry links +GitHub did not auto-close (#4479, #4473, #4485). Issues #4425, #4442, #4430, +#4435, #4439, #4456, #4412, #3729, #4436, #3775 and #4454 were closed the same +way. + +Nine further contributor pull requests were closed before the train started, +because the previous 36-PR batch had already absorbed them: #4319, #4310, #3652, +#4229, #4216, #4119, #4317, #4080 and #3458. + +Six issues stay open with a status comment naming what landed and what remains: +#4191, #4311, #3661, #3781, #4312 and #3506. Each one has merged work that +references it and no merged work that closes it, which is the distinction the +previous batch learned to make. + +## What the reviews caught + +Every audit round in this train found something real, which is the argument for +running them rather than trusting a green tip. + +The roadmap itself failed its first audit on five blockers, including two lanes +prepared as peers that both write `src/server/responses/core.ts`, and a lane +claiming a Windows CI leg that only runs on `workflow_dispatch`. + +The dispatch packets failed their first audit on five more. The severe one was +an unqualified "never merge" in the common frame, which would have stopped every +lane from running the `git merge origin/dev` the roadmap requires at a drifted +tip. Another would have had lane X cherry-pick a commit that re-breaks an +evidence-based model exclusion. + +Lane S took two security rounds. The first found that the canonical OpenAI seed +defines only four keys, so "ignore keys the seed never defines" reached `headers` +— which the PATCH mask writes and the forward adapter applies to the upstream +ChatGPT request ahead of incoming headers. A dashboard-session PATCH would have +ridden every later request. + +Lane I4 took three. Rounds one and two each found the same defect wearing a +different payload: combo children bypassed the repair on their own cloned body, +and the matcher required a well-formed Fernet token so near-miss ciphertext fell +straight back into the original path. Round two then found the fix had traded +fail-open for data loss — `looksLikeBackendCiphertext` is length ≥ 64 over a +character class that a SHA-256 digest matches exactly. The landed version keeps +the two slot kinds asymmetric: an `encrypted_content` slot is stripped whatever +it holds, free text is matched strictly. + +## The lesson that repeated + +Three planned carries turned out to be already satisfied on dev: #4170 in lane L, +#4086 in lane R, and the whole of lane H. All three were found by attempting the +work, not by reading the plan. + +The inverse happened twice. #4465 proposed the #4442 fix before lane I1 existed +and was not in the scored inventory, because the inventory is a snapshot taken +before it was opened; the landing carries a trailer for its author. #4467 was +caught the same way, but at dispatch time rather than after the fact, because the +first incident turned into a standing check. + +Both directions are the same defect in the plan, not in the lanes: a snapshot of +the open queue is stale the moment it is taken, and only the lane touching the +code can tell. + +## Honest limits of the proof + +Non-tip pull requests merged without their own `ci` check, under the recorded +owner authorization for tip-only CI. What makes that defensible is that each lane +is cumulative, so the content of every link is a strict subset of what its tip's +green run executed; the evidence exists, attached to the tip. + +No local full test suite was run at any point. Every suite claim traces to a +hosted run id. + +Most `dev` runs triggered mid-batch ended `cancelled` as the next merge +superseded them inside the concurrency group. That is the workflow behaving as +configured, and the regression evidence is the completed runs on batch-containing +commits rather than those cancelled ones. + +## LOOP-PESSIMIST-01: what did not improve + +The hypothesis that died is that a scored inventory plus a written roadmap is +enough to dispatch from. It was wrong twice in each direction, and the correction +was not a better inventory — it was giving every lane the obligation to +re-verify its own inputs before writing code. + +What did not improve is lane-thread observability. `list_threads` is capped at +50 and the newest lane tasks fell outside it repeatedly, so reaching a lane +required reading session files off disk to recover its thread id. Coordination +worked anyway, but it worked around the tool rather than through it. + +What would show the tip-only CI economy is the wrong trade: a defect landing on +`dev` that a per-link run would have caught and the cumulative tip run did not. +No instance appeared in this batch or the previous one. That is not proof it +cannot happen — a lane whose links conflict semantically rather than textually +could still produce one — and it is the specific thing to watch for.