From bc43654fe2ea2e95a2c27d4e9139c5b3cbf752f3 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sat, 15 Aug 2026 15:00:10 +0900 Subject: [PATCH 1/4] docs(devlog): 260815 old-draft triage plan and matrix --- .../_plan/260815_old_draft_triage/000_plan.md | 42 +++++++++++++++++++ .../010_triage_matrix.md | 42 +++++++++++++++++++ .../260815_old_draft_triage/020_execution.md | 3 ++ .../030_release_readiness.md | 3 ++ 4 files changed, 90 insertions(+) create mode 100644 devlog/_plan/260815_old_draft_triage/000_plan.md create mode 100644 devlog/_plan/260815_old_draft_triage/010_triage_matrix.md create mode 100644 devlog/_plan/260815_old_draft_triage/020_execution.md create mode 100644 devlog/_plan/260815_old_draft_triage/030_release_readiness.md diff --git a/devlog/_plan/260815_old_draft_triage/000_plan.md b/devlog/_plan/260815_old_draft_triage/000_plan.md new file mode 100644 index 0000000000..26464e6fa2 --- /dev/null +++ b/devlog/_plan/260815_old_draft_triage/000_plan.md @@ -0,0 +1,42 @@ +# 000 - 260815_old_draft_triage: Plan + +## Objective + +Triage the 18 older open drafts (#1703 #1669 #1664 #1660 #1655 #1652 #1645 #1644 #1624 #1584 #1569 #1557 #1552 #1526 #1521 #1498 #1367 #1165): land the worthwhile (provider additions prioritized), close the superseded, keep the rest drafted with named gaps. Then a release-readiness hardening loop on dev (no publish). + +## Loop-spec + +- Archetype: verifier-defined (gh state + lidge suite + dev CI). +- Write scope: GitHub PR state + devlog unit + repair branches. Out of scope: npm publish, tags, main/preview, issues. +- Bounds: one session; heavy repairs capped at one worker attempt each, else KEEP-DRAFT. +- Subagents: gpt-5.6-sol, medium effort (owner directive). + +## Evidence base + +4 sol/medium explorer verdicts (2026-08-15, diff-level + merge-tree + GraphQL threads) against origin/dev 420db6274. + +## Disposition summary (010 has full evidence) + +- CLOSE (2): #1498 (superseded by policy routing + #1702, 31 unresolved defects), #1367 (retired seam, 10 blockers). +- KEEP-DRAFT (6): #1552 (auth sponsorship), #1703 (unsafe routing design), #1645 (5 correctness/security blockers), #1557 (not fail-closed), #1526 (5748-line auth surface), #1624 (dormant contract). +- CHERRY-PICK light (6): #1664 MiniMax, #1669 modelPickerOrder, #1660 terminal guard, #1652 streamAborted, #1165 imageInput, #1644 droid docs. +- CHERRY-PICK heavy (4): #1655 empty-completion guard, #1569 native chat->chat, #1584 request pacing, #1521 service tiers. + +## Work-phase map + +| WP | Doc | Slice | +|----|-----|-------| +| wp1 | 010 | this matrix | +| wp2 | 020 | CLOSE 2 + KEEP-DRAFT 6 comments; dispatch 6 light repair workers | +| wp3 | 020 | integrate light six; lidge verify; land via admin PR; close source PRs with landed-SHA comment | +| wp4 | 020 | heavy four: one worker attempt each; land what passes, else KEEP-DRAFT | +| wp5 | 030 | release-readiness loop: lidge gates, dev CI, release.ts preflight, report | + +## Landing mechanics (from 260815_open_pr_triage, proven) + +Cherry-pick contributor commits (author preserved) onto repair branch off origin/dev, repair commits on top, integrate into int branch, lidge suite, open PR to dev, --admin merge, close source PR with landed-SHA comment. Direct dev push impossible (Protect dev ruleset, bypass=pull_request). + +## Accept criteria + +- c1 matrix; c2 18 dispositions executed; c3 lidge suite green on final tree; c4 readiness report; c5 privacy clean. + diff --git a/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md b/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md new file mode 100644 index 0000000000..f07e183d36 --- /dev/null +++ b/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md @@ -0,0 +1,42 @@ +# 010 - Old-draft triage matrix (wp1 deliverable) + +Evidence: 4 sol/medium subagents, 2026-08-15, against origin/dev 420db6274. All 18 are drafts. + +## CLOSE (2) + +| PR | Reason | +|----|--------| +| #1498 feat(combos) economy routing | Superseded by quota/cost policy routing (src/routing/evaluator.ts) + #1702; 31 unresolved threads with P1 accounting defects; 755 commits behind | +| #1367 feat(responses) bounded JSON fallback | Targets a retired seam (registry-only compat + terminal-repair architecture on dev); 10 unresolved blockers; 936 commits behind | + +## KEEP-DRAFT (6) + +| PR | Gaps | +|----|------| +| #1552 Command Code OAuth pool | 2565-line auth-boundary change; needs maintainer security sponsorship, real GUI screenshot, rebase | +| #1703 claude classifier affinity | Real defect but implementation can silently cross provider privacy/billing boundaries; maintainer design hold | +| #1645 vision chat/Google sidecars | 5 verified blockers incl. OAuth-over-HTTP loopback and missing image-boundary checks | +| #1557 least-privilege catalog endpoint | Response not projected through closed allowlist DTO; not fail-closed; unsponsored auth-cors surface | +| #1526 reset-credit operation identity | Real idempotency gap but 5748-line auth/persistence authority; needs split or exceptional security review | +| #1624 quota recovery policy contract | Sound but dormant no-op contract; land only with the #657 runtime slice | + +## CHERRY-PICK light (6) - repair then land + +| PR | Repair scope | +|----|--------------| +| #1664 MiniMax Code/CLI | Replace detached-startup argv construction with compiled-aware launcher (src/cli/minimax.ts:261); rebase (124 behind); full gates | +| #1669 modelPickerOrder | Fail-soft string-array normalization + malformed-input regression + docs contradiction fix | +| #1660 terminal guard openai-chat | Resolve src/types.ts conflict; add explicit-false + combo/routed-compaction exclusion tests; provider-option docs | +| #1652 streamAborted | Cover WS finalize + relay-eager paths; fix trackSseForRequestLog cancellation race; drop unrelated fixture churn | +| #1165 imageInput combo control | Fix double expansion of combo continuations; combo set round-trip; add Turkish/zh-TW locale keys; test coverage | +| #1644 Factory Droid docs | Name the droid provider id in config; define text-only accepted schema + rejection behavior (EN+KO); docs build | + +## CHERRY-PICK heavy (4) - one worker attempt each + +| PR | Repair scope | +|----|--------------| +| #1655 empty-completion guard | Reimplement on current core.ts: bound retained events/bytes, usage preservation, guard composition, retry-cause record, integration tests; currently CI-red | +| #1569 native chat->chat | Rebuild around shared openai-chat request builder + bounded SSE parser; redactSecretString on structured provider errors; URL normalization | +| #1584 request pacing | Reconcile 4 conflicting files (ProviderSettings, responses/core, fetch-helpers, policy-fallback); remove real-timer flake tests; 358 behind | +| #1521 service tiers | Port per-model resolver across 4 conflicts (openai-chat adapter, provider-fetch, 2 test files) onto current service-tier gating; #1436 | + diff --git a/devlog/_plan/260815_old_draft_triage/020_execution.md b/devlog/_plan/260815_old_draft_triage/020_execution.md new file mode 100644 index 0000000000..46bda5a6b1 --- /dev/null +++ b/devlog/_plan/260815_old_draft_triage/020_execution.md @@ -0,0 +1,3 @@ +# 020 - Execution record (wp2-wp4) + +(pending) diff --git a/devlog/_plan/260815_old_draft_triage/030_release_readiness.md b/devlog/_plan/260815_old_draft_triage/030_release_readiness.md new file mode 100644 index 0000000000..489d660854 --- /dev/null +++ b/devlog/_plan/260815_old_draft_triage/030_release_readiness.md @@ -0,0 +1,3 @@ +# 030 - Release-readiness record (wp5) + +(pending) From 596beed8a538de252d118a118d6841005e47cd13 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sat, 15 Aug 2026 15:08:38 +0900 Subject: [PATCH 2/4] docs(devlog): old-draft matrix A-audit amendments (no closes) --- .../010_triage_matrix.md | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md b/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md index f07e183d36..2ca091cca1 100644 --- a/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md +++ b/devlog/_plan/260815_old_draft_triage/010_triage_matrix.md @@ -1,21 +1,18 @@ # 010 - Old-draft triage matrix (wp1 deliverable) -Evidence: 4 sol/medium subagents, 2026-08-15, against origin/dev 420db6274. All 18 are drafts. +Evidence: 4 sol/medium subagents + A-audit (GO-WITH-FIXES, 2 blockers folded), 2026-08-15, against origin/dev 420db6274. All 18 are drafts. -## CLOSE (2) +A-audit amendment: both CLOSE calls were revised to KEEP-DRAFT. #1498 is NOT superseded (current policy routing lacks allowance snapshots, reservations, settlement, pre-dispatch quota/cost evidence; assemble.ts passes neither codexAccountId nor accountRef). #1367's failure class is NOT covered (terminal repair is a narrower registry-controlled case; no custom-provider escape hatch exists on dev). Closing would discard real requirements with no preservation mechanism in scope. -| PR | Reason | -|----|--------| -| #1498 feat(combos) economy routing | Superseded by quota/cost policy routing (src/routing/evaluator.ts) + #1702; 31 unresolved threads with P1 accounting defects; 755 commits behind | -| #1367 feat(responses) bounded JSON fallback | Targets a retired seam (registry-only compat + terminal-repair architecture on dev); 10 unresolved blockers; 936 commits behind | - -## KEEP-DRAFT (6) +## KEEP-DRAFT (8) | PR | Gaps | |----|------| +| #1498 economy combo routing | Defective as written (31 unresolved threads, conflicts, 755 behind) but its allowance/reservation/settlement semantics remain unimplemented; preserve until a scoped runtime follow-up exists | +| #1367 bounded JSON fallback | Redesign around current registry-only compat + terminal-repair architecture; 10 unresolved blockers | | #1552 Command Code OAuth pool | 2565-line auth-boundary change; needs maintainer security sponsorship, real GUI screenshot, rebase | | #1703 claude classifier affinity | Real defect but implementation can silently cross provider privacy/billing boundaries; maintainer design hold | -| #1645 vision chat/Google sidecars | 5 verified blockers incl. OAuth-over-HTTP loopback and missing image-boundary checks | +| #1645 vision chat/Google sidecars | 5 verified blockers incl. OAuth-over-HTTP loopback (describe-chat.ts:25) and missing image-boundary checks | | #1557 least-privilege catalog endpoint | Response not projected through closed allowlist DTO; not fail-closed; unsponsored auth-cors surface | | #1526 reset-credit operation identity | Real idempotency gap but 5748-line auth/persistence authority; needs split or exceptional security review | | #1624 quota recovery policy contract | Sound but dormant no-op contract; land only with the #657 runtime slice | @@ -24,7 +21,7 @@ Evidence: 4 sol/medium subagents, 2026-08-15, against origin/dev 420db6274. All | PR | Repair scope | |----|--------------| -| #1664 MiniMax Code/CLI | Replace detached-startup argv construction with compiled-aware launcher (src/cli/minimax.ts:261); rebase (124 behind); full gates | +| #1664 MiniMax Code/CLI | Shared compiled-aware argv builder (Bun.isStandaloneExecutable) replacing spawn(execPath,[argv[1]]) - repo-wide launcher debt (index.ts/opencode.ts/claude.ts), not MiniMax-only; rebase (124 behind); full gates | | #1669 modelPickerOrder | Fail-soft string-array normalization + malformed-input regression + docs contradiction fix | | #1660 terminal guard openai-chat | Resolve src/types.ts conflict; add explicit-false + combo/routed-compaction exclusion tests; provider-option docs | | #1652 streamAborted | Cover WS finalize + relay-eager paths; fix trackSseForRequestLog cancellation race; drop unrelated fixture churn | From baa85e73d0dc9e1e94422455758965d623524e58 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sat, 15 Aug 2026 15:10:30 +0900 Subject: [PATCH 3/4] docs(devlog): wp2 worker packets --- .../260815_old_draft_triage/020_execution.md | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/devlog/_plan/260815_old_draft_triage/020_execution.md b/devlog/_plan/260815_old_draft_triage/020_execution.md index 46bda5a6b1..19f3f79803 100644 --- a/devlog/_plan/260815_old_draft_triage/020_execution.md +++ b/devlog/_plan/260815_old_draft_triage/020_execution.md @@ -1,3 +1,53 @@ # 020 - Execution record (wp2-wp4) +## wp2 worker packets (P artifact) + +Shared mechanics for every worker (sol/medium, forked session): + +1. git worktree add /tmp/ocx-repair- -b repair/260815-pr- origin/dev (run from the main checkout) +2. cd /tmp/ocx-repair-; git fetch origin pull//head; cherry-pick the PR commits (author preserved); resolve conflicts +3. Apply the named repairs only - no drive-by refactors +4. bun install at root (plus cd gui && bun install when touching gui/) +5. bun run typecheck MUST pass; run ONLY focused tests for touched/added files; NEVER the full suite (owner runs it remotely) +6. Commit with clear messages; DO NOT push; DO NOT touch the main checkout working tree +7. Report: branch, commits, files changed, test tails, rejected repairs + reasons + +### repair/260815-pr-1664 (MiniMax Code/CLI, 3 commits) + +Cherry-pick pull/1664/head commits. Repairs: +- Introduce ONE shared compiled-aware launcher argv helper (Bun.isStandaloneExecutable split: standalone -> spawn(process.execPath, args); source -> spawn(process.execPath, [process.argv[1], ...args])) in a shared cli module. +- Migrate all four call sites: PR-head src/cli/minimax.ts:261 plus existing src/cli/index.ts:123, src/cli/opencode.ts:497, src/cli/claude.ts:272 (repo-wide debt, per A-audit). +- Unit tests for both modes. + +### repair/260815-pr-1669 (modelPickerOrder, 1 commit) + +- Runtime-normalize config value: fail-soft string-array filter before any .filter() use; malformed hand-edited values must not crash catalog sync. +- Malformed-input regression tests; fix docs contradiction in docs-site model-ordering guide. + +### repair/260815-pr-1660 (terminal guard openai-chat, 2 commits; conflict src/types.ts) + +- Resolve types.ts conflict against current dev. +- Add explicit-false activation test; combo-attempt and routed-compaction exclusion tests; document the provider option. + +### repair/260815-pr-1652 (streamAborted, 1 commit) + +- Mark streamAborted on the native Responses WebSocket finalize path and src/server/relay-eager.ts eager path (both currently omit it). +- Fix trackSseForRequestLog continuing terminal handling after cancellation. +- Drop the unrelated rate-limit test fixture mutation from the cherry-pick. + +### repair/260815-pr-1165 (imageInput combo control, 3 commits) + +- Fix double expansion of combo continuations (PR-head src/server/responses/core.ts:1261 area; re-locate on current dev). +- ocx combo set must not silently reset imageInput disabled mode (round-trip test). +- Add missing Turkish + zh-TW locale keys; stored-image replay coverage. + +### repair/260815-pr-1644 (Factory Droid docs, 1 commit) + +- Name the droid provider id in the config example so the verification command works. +- Define the text-only accepted input schema + explicit rejection behavior for images/tool items, in BOTH English and Korean guides. +- Run the docs-site build. + +## Execution log + (pending) + From 93b98c167581ab213d3d9a9dd3729fb8534f8314 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sat, 15 Aug 2026 15:18:27 +0900 Subject: [PATCH 4/4] docs(devlog): packet A-audit amendments --- devlog/_plan/260815_old_draft_triage/020_execution.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/devlog/_plan/260815_old_draft_triage/020_execution.md b/devlog/_plan/260815_old_draft_triage/020_execution.md index 19f3f79803..4248e60116 100644 --- a/devlog/_plan/260815_old_draft_triage/020_execution.md +++ b/devlog/_plan/260815_old_draft_triage/020_execution.md @@ -14,9 +14,12 @@ Shared mechanics for every worker (sol/medium, forked session): ### repair/260815-pr-1664 (MiniMax Code/CLI, 3 commits) -Cherry-pick pull/1664/head commits. Repairs: +Cherry-pick EXACTLY the two non-merge commits (A-audit: skip merge commit 50ac35d02, whose second-parent patch duplicates befd076f6): + git cherry-pick befd076f601f1c77a57406b93dabe10347013edb + git cherry-pick cd3c26a4c7a51937c4a58ced88a4cbb5a8519098 +Repairs: - Introduce ONE shared compiled-aware launcher argv helper (Bun.isStandaloneExecutable split: standalone -> spawn(process.execPath, args); source -> spawn(process.execPath, [process.argv[1], ...args])) in a shared cli module. -- Migrate all four call sites: PR-head src/cli/minimax.ts:261 plus existing src/cli/index.ts:123, src/cli/opencode.ts:497, src/cli/claude.ts:272 (repo-wide debt, per A-audit). +- Migrate ALL launcher call sites (A-audit expanded scope): PR-head src/cli/minimax.ts:261; existing src/cli/index.ts:123 (+consumers 471/518, dispatch injection 934-936), src/cli/opencode.ts:497, src/cli/claude.ts:272, src/server/management/system-restart.ts:216, src/update/index.ts (251, 301, 307, 331, 375), src/update/job.ts (1869, 1873). - Unit tests for both modes. ### repair/260815-pr-1669 (modelPickerOrder, 1 commit) @@ -37,7 +40,7 @@ Cherry-pick pull/1664/head commits. Repairs: ### repair/260815-pr-1165 (imageInput combo control, 3 commits) -- Fix double expansion of combo continuations (PR-head src/server/responses/core.ts:1261 area; re-locate on current dev). +- Preserve and regression-test the existing anti-double-expansion deletion (PR head deletes previous_response_id before child dispatch; A-audit: already correct - lock with a test, do not 'fix'). - ocx combo set must not silently reset imageInput disabled mode (round-trip test). - Add missing Turkish + zh-TW locale keys; stored-image replay coverage.