fix(knowledge-work): close Dev release-readiness audit (#3179) - #3204
Conversation
Manual test plan — consolidated Dev knowledge-work auditUse the deterministic loopback
Completed local evidence on this SHA: real Google Chrome Computer Use journeys for the product flows above; hermetic Chromium regression lanes 1/1 Chat, 5/5 Prompt/Health/QI, 1/1 boot recovery, and 1/1 grounding refresh. |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Maintainer exception recorded: the operator explicitly authorizes additional distinct repair rounds beyond the default three-attempt limit until PR #3204 has zero unresolved actionable review threads and green required CI. Scope is limited to confirmed review/verification/CI defects on this epic head. Accepted process cost: repeated exact-head qualification may continue as new deterministic findings surface. This exception does not waive Definition of Ready, branch isolation, current-dev integration, security, budgets, timeouts, evidence freshness, required checks, human review, or the prohibition on agent merge into |
|
@Niko4417 Heads-up: we are taking this PR over to land it in the upcoming v0.3.9 release. Plan: #3208 (customer-critical Local Knowledge/gateway fixes) merges first, then we rebase this branch onto current |
Manual test plan — consolidated Dev knowledge-work auditUse the deterministic loopback model fixtures only; do not enter a real provider credential.
Exact-head evidence on
|
Regenerated inside the pinned Linux gates container after merging dev (#3208): b2.shipsTotalBytes moved from 1403398 to 1406597 with the combined UI changes. The in-container check:editor-release-evidence run passes on the regenerated document. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 43beb7be34
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ss epic Takeover hardening for #3204 after merging dev, addressing the Codex review rounds (12 of 13 findings fixed and red-proven; the 13th — structural chat creation release keys — is deferred to #3210 with its verified fix sketch): - chat-stream/chat-handlers: settle the admitted turn when pre-stream memory resolution throws (a pending clientTurnId answered every retry with CHAT_TURN_IN_PROGRESS forever); probe stream support and provider presence for LEGACY requests before admission persists the user message (no-op failDesktopChatTurn cannot settle turnless rejections; orphaned user messages restored the pre-#3182 invariant). - gateway-readiness: the chat probe now mirrors the production floor exactly (non-empty extracted text, content-part arrays accepted) instead of being looser AND stricter than the adapter in different directions; chat-only classification keys on EXECUTED probes so a failed feature probe can no longer re-stamp stale capability evidence with a fresh checkedAt. - conversation-readiness-admission: bind the callStream receiver (GatewayModelPort prototype method reads this.gateway — the unbound extract threw TypeError on the first streamed chunk). - gateway-setup: applying verified capabilities preserves the probe-only conversationReady evidence under the new generation (fields stay consume-once; replay still answers 409) so the just-verified model no longer vanishes from every chat picker. - useChatSession: a pending catalog refresh empties the picker without falsifying configuredModelsAvailable (AppShell mounted the gateway-setup modal over a configured workspace during every catalog read). - quality-intelligence: runtime judge failures (errored or unparseable judgements) now append a redacted judge stage failure so the terminal frame and projections report the run as degraded, not unqualified success; RunLauncher progress strings moved into the EN/DE i18n catalogs. - evidence: 3184/3186 fidelity proofs regenerated against the final sources (recorded source hashes had drifted across later refactors); the 3185 recovery assertion is now DERIVED from an observed rate-limited → recovery-success transition instead of being hard-coded; 1209 bundle evidence refreshed in the pinned Linux container for the dev-merged branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…epic diff - local-knowledge-grounded-qa: codePointAt over charCodeAt in the FNV-1a scope hash (S7758); unit-identical below the astral plane, ids are ephemeral wire scope identifiers. - RunLauncher: hoist the nested findings-plural ternary (S3358). - installable-memory-smoke: top-level await instead of void main() (S7785). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e02a480766
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ed24f18924
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…on apply; refresh QI evidence Review round on the takeover pushes: - local-knowledge-grounded-qa: FNV scope hash iterates by code point (for...of), so an astral character contributes exactly once — codePointAt over unit indices consumed the pair at the high surrogate and hashed the low surrogate again (ids are ephemeral wire scope identifiers). - gateway-setup: applying verified capabilities snapshots EVERY configured model's conversationReady observation before set() wipes the map and re-records each under the new generation — previously only the applied model survived and every other ready model fell out of the chat pickers. - evidence 3184/3186: fidelity proofs regenerated LAST, after all source changes (the RunLauncher hash had drifted again through the Sonar ternary fix); recorded hashes re-verified byte-exact against the committed sources. - ChatWindow first-open behavior stays as designed and pinned (reopen-refresh is the staleness bound; failure recovery on the next reopen) — the finding is answered in-thread with the design evidence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74c322c7bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Resolving the selection against the emptied pending list reset a non-default choice every time the picker was opened; the success path already re-validates the kept id against the refreshed catalog. Red-proven in the pending-presence regression. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: af7fca1e3f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ult model, judge budget degradation - The pending catalog clear keeps the pinned synchronous invalidation but remembers the user's choice as restorableModelId; the success path restores it when the refreshed catalog still contains it, instead of falling back to the first ready model on every picker open. Chat switches rebind the memo to the opened chat. - createDesktopChat with an omitted modelId prefers a conversation-ready chat model; readiness only reorders the preference so the precise unready 400 remains when nothing is ready. - Oversized judge prompts now count toward the persisted judge stage failure (QI-DEG-01): a run whose every judge prompt exceeds the model budget is no longer presented as an unqualified success. All three red-proven; UI suppressions register untouched via selectionForChatSwitch extraction. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 065de523e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
Merged with admin override by owner decision to unblock the v0.3.9 release train: all 27 required checks are green on 065de52; the three review threads opened after the final push (legacy post-admission orphan, delayed-focus invalidation, standalone German travel wording) are confirmed valid and are being fixed in an immediate follow-up PR against dev — each thread will be answered with its fix reference there before being resolved. 🤖 Addressed by Claude Code Approved-for-publish: @oscharko-dev/keiko@0.3.9 |
…ollow-up - Restore the pre-provider cancellation settle after buffered memory resolution (my prior extraction dropped it): resolveBufferedMemory now checks and settles cancellation before assembly/model.call, discarding a legacy row. Red-proven by the aborting-vault pin (499, provider never called, row gone). - Discarding a rejected legacy row now also restores chats.updated_at (MAX of the pre-admission value and surviving message activity, only when the delete hit), so a rejected request cannot promote its chat in recency-ordered history or become the session-resume candidate. Three store pins, red-proven. - The relocated route pin now asserts persist-BEFORE-retrieval inside the failing vault callback itself (user row visible at retrieval time) plus the discard afterwards — strengthened, not relaxed. - WindowFrame: raiseWindowForInteraction centralizes the interaction token with the raise; resize-handle grabs and the maximize traffic button route through it (full api.focus call-site audit in the PR thread). Red-proven resize pin. - Prompt enhancer: the travel cue requires planning intent — possessive (meine/unsere Reise) or a planning verb within a 40-char window on either side of standalone reise, Unicode lookarounds throughout. Non-planning mentions (definition/translation) stay unframed; Preise/Abreise/Reisepass excluded. Input-space pins: empty, control-only, combining-diacritics, ZWSP smuggling, punctuation boundaries, compounds. Refs #3204 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Recency rollback is now OWNED: the legacy admission captures the exact updated_at its createMessage touch wrote (synchronous SQLite, no interleave) and the store restore compare-and-sets on it — a rename that lands while retrieval is in flight keeps its newer recency. Red-proven store pin. - WindowFrame maximize: the interaction token advances on the primary pointerdown (press time), maximize stays on click with no second bump — a press-and-hold across the 180 ms delay can no longer let the stale timer re-raise the armed window. Red-proven hold pin (90/90). - Travel cue: the possessive-only needle is removed — every pinned positive already rides the planning-verb window needles, and possession alone proved quotable non-intent (Übersetze „meine Reise" ins Englische). Red-proven negative pin (52/52). Refs #3204 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…w findings (#3212) * fix(server,ui,model-gateway): repair the three post-merge #3204 review findings - Legacy post-admission orphan (server): a turn rejected after admission but before any provider output now settles through settleRejectedDesktopChatTurn — ledger turns settle via the turn record, legacy turns (no clientTurnId) get their just-admitted user row discarded through the narrow, fail-closed discardLegacyTurnUserMessage store operation. Covers the streamed readiness re-resolution, the pre-stream cancel, and the buffered memory/boundary arm. The #2977-era route pin is relocated to the new terminal state; its persist-before-retrieval ordering assertion is unchanged. - WindowFrame delayed focus (ui): a module-scope interaction token invalidates the 180ms delayed raise when a later interaction already raised another window, closing the preventDefault gap in the DOM-focus predicate. - Prompt enhancer (model-gateway): standalone German "Reise" matches the travel rule again via Unicode word-boundary lookarounds; "Preise" stays excluded. All three red-proven; local env failures (java probe, DNS posture, QA matrix) reproduced identically on the clean tree. Refs #3204 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(server,ui,model-gateway): close the five review clusters on the follow-up - Restore the pre-provider cancellation settle after buffered memory resolution (my prior extraction dropped it): resolveBufferedMemory now checks and settles cancellation before assembly/model.call, discarding a legacy row. Red-proven by the aborting-vault pin (499, provider never called, row gone). - Discarding a rejected legacy row now also restores chats.updated_at (MAX of the pre-admission value and surviving message activity, only when the delete hit), so a rejected request cannot promote its chat in recency-ordered history or become the session-resume candidate. Three store pins, red-proven. - The relocated route pin now asserts persist-BEFORE-retrieval inside the failing vault callback itself (user row visible at retrieval time) plus the discard afterwards — strengthened, not relaxed. - WindowFrame: raiseWindowForInteraction centralizes the interaction token with the raise; resize-handle grabs and the maximize traffic button route through it (full api.focus call-site audit in the PR thread). Red-proven resize pin. - Prompt enhancer: the travel cue requires planning intent — possessive (meine/unsere Reise) or a planning verb within a 40-char window on either side of standalone reise, Unicode lookarounds throughout. Non-planning mentions (definition/translation) stay unframed; Preise/Abreise/Reisepass excluded. Input-space pins: empty, control-only, combining-diacritics, ZWSP smuggling, punctuation boundaries, compounds. Refs #3204 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(server,ui,model-gateway): harden the three refinement findings - Recency rollback is now OWNED: the legacy admission captures the exact updated_at its createMessage touch wrote (synchronous SQLite, no interleave) and the store restore compare-and-sets on it — a rename that lands while retrieval is in flight keeps its newer recency. Red-proven store pin. - WindowFrame maximize: the interaction token advances on the primary pointerdown (press time), maximize stays on click with no second bump — a press-and-hold across the 180 ms delay can no longer let the stale timer re-raise the armed window. Red-proven hold pin (90/90). - Travel cue: the possessive-only needle is removed — every pinned positive already rides the planning-verb window needles, and possession alone proved quotable non-intent (Übersetze „meine Reise" ins Englische). Red-proven negative pin (52/52). Refs #3204 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* release: prepare 0.3.9 customer hardening Bump every workspace package, the exported KEIKO_*_VERSION constants, and the lockfile to 0.3.9; add the release-impact catalog entry for the customer- hardening release (LiteLLM first-run indexing remediation #3208, Dev knowledge- work readiness stack #3204, post-merge review-finding repair wave #3212). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): bound a branch-creating push's quality range at the head parent A push that creates a branch delivers the zero SHA as its before-pointer; the resolver fell back to the repository root and swept the entire history into the secret scan (918 commits on release/0.3.9), failing the gate on long-accepted historical fixtures. The head's parent is the honest bound for the pushed work; the pull_request run still covers the full PR range from its non-zero base. Red-proven in resolve-quality-range.test.mjs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): bound branch-creating pushes at the merge-base with dev head^ only covered the final commit of a multi-commit branch creation — a secret introduced and deleted again before the head escaped the promised history inspection. Both quality-range consumers (secret scan, semantic duplication) now fetch dev and pass QUALITY_FALLBACK_BASE_REF; the resolver takes the merge-base with that ref and fails closed without it. The five zizmor cache-poisoning anchors shift +12 for the inserted workflow lines. Red-proven in resolve-quality-range.test.mjs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): validate the fallback base ref shape and pin hostile inputs A leading dash would reach git merge-base as an OPTION (--fork-point) instead of a ref; whitespace and control characters have no place in a workflow- provided ref. The resolver now rejects anything but a plain ref name before any git invocation, red-proven across option-like, whitespace, control- character, and dash-terminated values plus the empty-string boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2 participants
Summary
Closes the consolidated Dev knowledge-work release-readiness audit across intent classification, memory provenance, model readiness, conversation lifecycle, grounding freshness, Health Scan truth, Quality Intelligence terminal truth, boot recovery, and restored-chat routing.
The branch is integrated with Dev baseline
934e8580029f31967ba2a05c3ac6535e993cbc98. All model-backed manual journeys used a deterministic loopbackgpt-4o-minigateway; no real provider credential or credit was consumed.Refs #3179
Resolves #3180
Resolves #3181
Resolves #3182
Resolves #3183
Resolves #3184
Resolves #3185
Resolves #3186
Resolves #3187
Resolves #3203
Scope
Preise.dev; this PR requires green CI and human review.Reuse And No-Duplication
Delivery Board
Keiko Product Deliveryproject.Parent Epic: #3179and native sub-issue relationships.devpush, force-push, finding dismissal, or required-gate bypass occurred.dev.Ready for Human Reviewon the current green head.Product Impact
Update Impact
fixes.high.Verification
Required:
npm run gates:sonarreported no local finding. Local execution was attempted on the integrated QI slice but was blocked by the known Docker registry authentication state; the required GitHub Sonar/Coverage check must settle green.npm run check:ui-i18npasses.Local verification:
Real Google Chrome Computer Use journeys:
Gateway setup and same-page readiness-to-chat eligibility.
Streamed chat response, fresh Chat A/Chat B isolation, and model picker reopen.
Exact German Prompt Enhancer decision boundary.
Health Scan rate-limit error without stale success count.
QI unparseable-model fallback shown as
Degraded,Quality: Unavailable, with persisted stage evidence.Local Knowledge fails closed without an embedding model.
MemoriaViva does not fabricate a memory from unsupported model output.
Persisted multi-window chat restoration produces no React maximum-update-depth loop.
Opening Settings immediately after focusing a persisted chat keeps its readiness controls topmost and operable.
UI behavior manually verified and covered by tests.
Core logic covered by unit, integration, fixture, and browser tests.
Security-sensitive changes reviewed for trust boundaries, secrets, model egress, and generated artifacts.
Supply-chain and package-surface changes verified by repository gates.
Documentation and evidence artifacts verified by targeted and repository checks.
Release-impacting behavior is described above.
Review And Closure
Ready for Human Reviewafter exact-head CI is green.dev.Risk Notes
b2.shipsTotalBytesobserved as both1403398and1406597). After three distinct CI repair attempts, autonomous repair stopped per repository policy. Follow-up fix(ci): make editor release evidence deterministic across clean builds #3205 owns deterministic evidence generation; no workflow, timeout, bundle budget, or evidence strictness was weakened.