docs(devlog): plan and record the 260806 stacked bug campaign - #1147
docs(devlog): plan and record the 260806 stacked bug campaign#1147lidge-jun wants to merge 9 commits into
Conversation
…ttribution Freeze the 2026-08-06 cutoff (49 open issues, 34 open PRs against origin/dev=e9d957bf6), triage every item with path:line proof on the current tree, and write the diff-level roadmap for a 15-phase stacked PR chain that credits every contributor whose work it carries.
Audit returned FAIL with 3 blockers. Corrections: - PR count was 34, actual live count is 32 (#1129 merged mid-triage and is recorded separately rather than counted). - Phases 080 and 100 cited line numbers from the contributors' patched trees, not dev. Both defects re-verified against dev=e9d957bf6 and rewritten with real anchors: the vision rawbody sync function does not exist on dev, and openai-chat has no response_format handling at all. - Phase 050 narrowed so the client-facing selector is set only on the Anthropic rewrite branch, with a regression test pinning that other providers are unchanged. - Phase 060 now adopts #1111's real module and test paths instead of inventing names; phase 160 gained the disposition-matrix schema it was missing. - Citation drift corrected in 001 and 070 (relay buffer, selectEagerPath).
Round 2 found the phase docs fixed but the triage tables still carrying the old anchors, plus two honesty defects. - 001/002 anchors re-verified against dev=e9d957bf6 by symbol: relay buffer append (:382/:540), runOwnedStageSweep -> sweepStages -> sweepStagesLocked, applyFinalRouteRequestNormalization (:856), the github-copilot entry's openai-chat adapter with per-model modelWireDefaults, and the freeform custom-tool parameter shape. - 060 now names #1111's real files (github-copilot-responses-repair.ts and its two test files) instead of deferring path discovery to P, and flags the sse-inspector-bounds.test.ts overlap with phase 010. - 002 no longer says a reimplementation is 'landed' in a phase that has not run; the roadmap states plainly that landed state lives only in the disposition matrix with commit evidence.
bun run privacy:scan fails on a committed contributor address, and it is right to: devlog/ is a public directory. The attribution table now records the login and display name and documents how to read the exact identity from the PR head at implementation time, so Co-authored-by trailers stay accurate in git history without publishing addresses in a doc.
Audit round 3 blockers: - 090 pointed at tests/google-hardening.test.ts:380-391 in a 346-line file; the real neighbour is the direct-AI-Studio thinkingLevel test at :284. - 110/120/130/140 used globs, so implementation would have had to rediscover the fix. Each now carries the exact file list from gh pr diff (1036, 1126, 1093, 1092, 1085) with ADOPT/ADAPT/DROP per file, including which of the contributor's own files are deliberately not taken.
Audit round 4: phase 140 dropped 'src/combos/*' from #1085 while adopting src/combos/index.ts and types.ts from #1092 in the same phase — ambiguous in exactly the place it matters. Both files are now named explicitly with the rule stated: adopt the #1092 hunks, skip the #1085 direct-mode filtering hunks, do not revert the file.
📝 WalkthroughWalkthroughChangesThe pull request adds documentation for a stacked bug campaign. It defines campaign scope, triages 49 issues and 32 open pull requests, documents 17 remediation phases, and records final dispositions, attribution audits, and CI status. Stacked bug campaign
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2456ace098
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| not safe as written: the endpoint reads a client-supplied correlation header at | ||
| the public admitted surface (`src/server/index.ts:957`), so **any admitted | ||
| client can forge a regex-shaped "guard-issued" ingress span**. Persisted |
There was a problem hiding this comment.
While the ingress-span proposal remains withheld and unresolved, this publishes the precise trust boundary and forgery mechanism in the tracked public _plan directory. This is new bypass reasoning rather than a record of an already shipped fix, so retain only a neutral statement that the hunk was omitted pending security review and move the detailed analysis to .tmp/ or another untracked scratch path.
AGENTS.md reference: AGENTS.md:L61-L68
Useful? React with 👍 / 👎.
| | Snapshot base | `origin/dev` = `43a1fdc45` | | ||
| | Working base | `origin/dev` = `e9d957bf6` (advanced during triage when #1129 merged) | | ||
| | Stack branch prefix | `codex/260806-stackNN-<slug>` | | ||
| | Open at cutoff | 49 issues, 34 PRs | |
There was a problem hiding this comment.
The cutoff is recorded here as 34 PRs, but 002_pr_triage.md:1-8 lists and independently states that exactly 32 PRs were open at this same cutoff, and 160_phase17_closeout.md:51-52 uses 32 as the required reconciliation total. Leaving 34 here makes the campaign's frozen base internally inconsistent, so update this value to 32.
Useful? React with 👍 / 👎.
| | #1049 | issue | deferred | — | — | Crash-safe adoption is migration-grade work with its own recovery matrix | | ||
| | #92, #417, #1100 | issue | upstream | — | — | Fernet task body, Korean realtime U+FFFD, Codex summary-flag gating — all client-side | | ||
| | #1128, #1024, #994, #904, #796, #418 | issue | needs-info | — | — | Not reproducible on the current tree; each row in `001` cites the code that refutes or cannot confirm the report | | ||
| | 30 further issues | issue | feature | — | — | Enumerated in `001_issue_triage.md`; enhancement or roadmap, not bugs | |
There was a problem hiding this comment.
This placeholder collapses 30 issues into one row, despite 160_phase17_closeout.md:32-46 defining the final matrix as one row per item with an item-specific final state, credit, and evidence. The grouped rows above have the same problem, so the claimed final reconciliation cannot be audited from this matrix; expand every issue into its own row as required.
Useful? React with 👍 / 👎.
| does not close contributor PRs. | ||
|
|
||
| Target PRs: #1114, #1124, #1130, #1115, #1122, #1121, #1111, #947, #1047, #978, | ||
| #985, #1036, #1126, #1093, #1092, #1085, #997, #999. |
There was a problem hiding this comment.
This target list includes #1092, #1085, #997, and #999, but 170_dispositions.md:63-64 records all four as deferred with no carrier because phases 140 and 150 were not executed. The required comment cannot truthfully name the stack PR carrying their work or say that authorship was preserved, so running this closeout step would send contributors false landing notices; omit these PRs until their phases actually land.
Useful? React with 👍 / 👎.
|
|
||
| ## PR | ||
|
|
||
| Stack 14, base = stack 13 head. Credits Eachann and n3wr1ch, and lists what was |
There was a problem hiding this comment.
When the deferred phase is resumed, this instruction refers to a nonexistent stack 13: 170_dispositions.md:10-19 shows that the produced chain ends at stack 10/#1144, while lines 89-90 explicitly identify phases 140 and 150 as the next work. Update this base to the actual top of the chain (and align phase 150 accordingly), otherwise the documented execution sequence cannot be followed.
Useful? React with 👍 / 👎.
| - Phases 140 and 150 are specified at diff level but not executed. They are the | ||
| natural next work-phases, not blockers. |
There was a problem hiding this comment.
160_phase17_closeout.md:61-66 requires the final record to report DONE only when every condition holds, or otherwise record BUDGET_EXHAUSTED, BLOCKED, or NEEDS_HUMAN with evidence. This final matrix instead notes that two phases were not executed and that some CI was unfinished, but never supplies any terminal outcome, leaving the campaign status ambiguous; add the applicable non-DONE outcome and its evidence.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@devlog/_plan/260806_stacked_bug_campaign/000_plan.md`:
- Line 24: Reconcile the campaign totals in
devlog/_plan/260806_stacked_bug_campaign/000_plan.md:24 by changing the cutoff
count to 32 open PRs. Update
devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md:72-73 to report 13
landed or reimplemented, 1 credited-only, 1 rejected, and 17 deferred open PRs,
and identify `#1129` as already merged.
- Around line 50-53: Update the stack-unit definition in the cxc-loop/cxc-pabcd
plan, including the corresponding section at the later referenced lines, to
match the final chain: define a stack slice as the unit, or split the combined
phase entries so phases 10/11, 9/14, and 12/13 map to their respective stack
PRs.
In `@devlog/_plan/260806_stacked_bug_campaign/001_issue_triage.md`:
- Line 21: Update the line reference for trackSseForRequestLog in the triage row
from 353 to its actual declaration line, 354, while preserving the existing
issue description and related inspectChunk and relaySseWithHeartbeat references.
In `@devlog/_plan/260806_stacked_bug_campaign/002_pr_triage.md`:
- Line 22: Fix the Markdown syntax issues across all listed campaign documents:
label the shell fences as sh or bash in 002_pr_triage.md:22 and
150_phase16_test_isolation_and_allowlist_docs.md:43; label the schema fence as
markdown or text in 160_phase17_closeout.md:35; and update the cited references
to “PR `#1036`'s” at 110_phase12_cursor_structured_edits.md:16, “PR `#950`” at
120_phase13_reasoning_replay_empty_delta.md:48, “PR `#999`” and “PR `#241`” at
150_phase16_test_isolation_and_allowlist_docs.md:5 and :56, and “PR `#1126`” and
“PR `#1010`” at 160_phase17_closeout.md:18 and :21.
In
`@devlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.md`:
- Around line 33-35: Label each unlabeled git command fence with bash or shell
in devlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.md
lines 33-35, 020_phase3_native_profile_empty_sweep.md lines 43-45,
030_phase4_native_main_acl_timeout.md lines 32-34, and
040_phase5_bounded_rollout_inspection.md lines 30-32; make no other changes.
In
`@devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md`:
- Around line 40-41: Update the campaign records to use exact test-file lists
instead of wildcard or prose-only scopes: in
devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md
lines 40-41, expand the image and web-search scopes and repeat the same list in
verification; in
devlog/_plan/260806_stacked_bug_campaign/060_phase7_copilot_responses_normalization.md
lines 52-56, replace tests/github-copilot-*.test.ts with the exact change-table
files; in
devlog/_plan/260806_stacked_bug_campaign/080_phase9_vision_rawbody_sync.md lines
44-48, list the exact vision test files; and in
devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md
lines 44-48, replace the suite description with exact filenames.
- Line 24: Prefix paragraph-start references with the requested labels: change
PR `#1122` at lines 24 and 44 in
devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md,
PR `#1111` at line 20 in
devlog/_plan/260806_stacked_bug_campaign/060_phase7_copilot_responses_normalization.md,
Issue `#1025` at line 15 in
devlog/_plan/260806_stacked_bug_campaign/070_phase8_darwin_eager_rewrite.md, PR
`#1047` at line 22 in
devlog/_plan/260806_stacked_bug_campaign/080_phase9_vision_rawbody_sync.md, and
PR `#985` at line 21 in
devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md.
In
`@devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md`:
- Around line 34-41: Update the shared core.ts composition guidance to preserve
the Anthropic, Copilot, and Darwin rewrites when applying Phase 11 by symbol and
ordering, marking its change as ADAPT rather than ADOPT in
devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md
lines 34-41. Update
devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md
lines 56-59, 060_phase7_copilot_responses_normalization.md lines 34-35, and
070_phase8_darwin_eager_rewrite.md lines 30-31 to include Phase 11 in their
shared core.ts overlap guidance or replace the partial phase lists with the
common symbol-based rule; no other sites require direct implementation changes.
In `@devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md`:
- Around line 17-18: Update the “Target PRs” list in the phase17 closeout plan
to include only landed or reimplemented work, removing deferred PRs `#1092`,
`#1085`, `#997`, and `#999`. Keep `#1121` only with a diagnosis-only attribution message
rather than claiming preserved authorship or naming it as a stack carrier.
- Around line 39-46: Align the “Final state” schema with the disposition matrix
by either defining the additional states used there—credited-only,
reimplemented-stack09, rejected-unsafe, and partial landed states—or replacing
those matrix values with the currently declared states. Ensure every matrix
disposition has an explicitly allowed and consistently defined final-state
value.
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md`:
- Around line 93-100: Update the “CI state at close” section to report the final
CI result for each of stacks 07-10, replacing the unresolved “still completing
or hit an outage” wording with their terminal statuses and evidence. Add an
explicit overall terminal outcome using DONE only if all required stack CI
results are green; otherwise use BUDGET_EXHAUSTED, BLOCKED, or NEEDS_HUMAN with
supporting evidence.
- Around line 38-40: Expand the issue matrix in the disposition document so
every issue and PR identifier has its own row, including the grouped entries in
the shown rows and rows 63–69. Preserve each item’s carrier, credit, evidence,
and final-state information while using the existing details to reconcile each
identifier independently.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c88c1825-1608-4556-a35c-23b230506c55
📒 Files selected for processing (20)
devlog/_plan/260806_stacked_bug_campaign/000_plan.mddevlog/_plan/260806_stacked_bug_campaign/001_issue_triage.mddevlog/_plan/260806_stacked_bug_campaign/002_pr_triage.mddevlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.mddevlog/_plan/260806_stacked_bug_campaign/020_phase3_native_profile_empty_sweep.mddevlog/_plan/260806_stacked_bug_campaign/030_phase4_native_main_acl_timeout.mddevlog/_plan/260806_stacked_bug_campaign/040_phase5_bounded_rollout_inspection.mddevlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.mddevlog/_plan/260806_stacked_bug_campaign/060_phase7_copilot_responses_normalization.mddevlog/_plan/260806_stacked_bug_campaign/070_phase8_darwin_eager_rewrite.mddevlog/_plan/260806_stacked_bug_campaign/080_phase9_vision_rawbody_sync.mddevlog/_plan/260806_stacked_bug_campaign/090_phase10_gemini_effort_docs.mddevlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.mddevlog/_plan/260806_stacked_bug_campaign/110_phase12_cursor_structured_edits.mddevlog/_plan/260806_stacked_bug_campaign/120_phase13_reasoning_replay_empty_delta.mddevlog/_plan/260806_stacked_bug_campaign/130_phase14_usage_attempt_persistence.mddevlog/_plan/260806_stacked_bug_campaign/140_phase15_effort_picker_and_pi_export.mddevlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.mddevlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.mddevlog/_plan/260806_stacked_bug_campaign/170_dispositions.md
| `cxc-loop` HOTL over `cxc-pabcd`. Work-phase 1 (this unit) is docs-only: freeze | ||
| the snapshot, triage everything, and write every implementation phase's decade | ||
| doc to diff-level precision. Implementation begins at work-phase 2, one decade | ||
| doc per PABCD cycle, one stack PR per cycle. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Align the stack-unit definition with the final chain.
These lines define one stack PR per phase. The final disposition combines phases 10 and 11 in #1137, phases 9 and 14 in #1139, and phases 12 and 13 in #1144. Define a stack slice as the unit, or split the combined stack entries.
Also applies to: 76-77
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/000_plan.md` around lines 50 - 53,
Update the stack-unit definition in the cxc-loop/cxc-pabcd plan, including the
corresponding section at the later referenced lines, to match the final chain:
define a stack slice as the unit, or split the combined phase entries so phases
10/11, 9/14, and 12/13 map to their respective stack PRs.
|
|
||
| | # | Reporter | Class | Proof on the current tree | Phase | | ||
| |---|----------|-------|---------------------------|-------| | ||
| | 1112 | lidge-jun | FIXABLE | `trackSseForRequestLog` (`src/server/relay.ts:353`) appends into `buffer` inside `inspectChunk` at `:382` with no cap and re-parses each payload through three string helpers; `relaySseWithHeartbeat` (`:498`) repeats the same unbounded append at `:540` | 010 | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the trackSseForRequestLog anchor.
The supplied source context starts trackSseForRequestLog at src/server/relay.ts:354, but this row cites line 353. Use the exact symbol line so the triage evidence remains directly verifiable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/001_issue_triage.md` at line 21,
Update the line reference for trackSseForRequestLog in the triage row from 353
to its actual declaration line, 354, while preserving the existing issue
description and related inspectChunk and relaySseWithHeartbeat references.
| contributor address. The **real** identity used for each `Co-authored-by:` | ||
| trailer is read at implementation time from the contributor's own commits: | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the reported Markdown syntax issues across the campaign documents.
devlog/_plan/260806_stacked_bug_campaign/002_pr_triage.md#L22-L22: label the shell fenceshorbash.devlog/_plan/260806_stacked_bug_campaign/110_phase12_cursor_structured_edits.md#L16-L16: writePRfix(cursor): structured edit tools convert to valid apply_patch calls (#1017) #1036's.devlog/_plan/260806_stacked_bug_campaign/120_phase13_reasoning_replay_empty_delta.md#L48-L48: writePR[Bug] OpenCode Go DeepSeek V4 Flash intermittently drops reasoning_content on tool-call continuation #950``.devlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.md#L5-L5: writePRdocs(codex-app-models): document Desktop remote allowlist limitation (#241) #999``.devlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.md#L43-L43: label the shell fence.devlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.md#L56-L56: writePR[Bug]: Routed models are loaded by Codex app-server but missing from Desktop model picker #241``.devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md#L18-L18: writePRfix(responses): make reasoning replay restart-safe and observable (#950) #1126``.devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md#L21-L21: writePRfeat(usage): user-configurable per-model cost overlay (providers.<name>.modelCosts) #1010``.devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md#L35-L35: label the schema fencemarkdownortext.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 22-22: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
📍 Affects 5 files
devlog/_plan/260806_stacked_bug_campaign/002_pr_triage.md#L22-L22(this comment)devlog/_plan/260806_stacked_bug_campaign/110_phase12_cursor_structured_edits.md#L16-L16devlog/_plan/260806_stacked_bug_campaign/120_phase13_reasoning_replay_empty_delta.md#L48-L48devlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.md#L5-L5devlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.md#L43-L43devlog/_plan/260806_stacked_bug_campaign/150_phase16_test_isolation_and_allowlist_docs.md#L56-L56devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md#L18-L18devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md#L21-L21devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md#L35-L35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/002_pr_triage.md` at line 22, Fix
the Markdown syntax issues across all listed campaign documents: label the shell
fences as sh or bash in 002_pr_triage.md:22 and
150_phase16_test_isolation_and_allowlist_docs.md:43; label the schema fence as
markdown or text in 160_phase17_closeout.md:35; and update the cited references
to “PR `#1036`'s” at 110_phase12_cursor_structured_edits.md:16, “PR `#950`” at
120_phase13_reasoning_replay_empty_delta.md:48, “PR `#999`” and “PR `#241`” at
150_phase16_test_isolation_and_allowlist_docs.md:5 and :56, and “PR `#1126`” and
“PR `#1010`” at 160_phase17_closeout.md:18 and :21.
Source: Linters/SAST tools
| ``` | ||
| git checkout -b codex/260806-stack01-bounded-sse origin/dev | ||
| git cherry-pick 73706d3b2 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Label all shell command fences.
The four campaign files contain unlabeled shell fences. Add bash or shell to each fence so Markdown lint can identify the command blocks.
devlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.md#L33-L35: label thegitcommand fence.devlog/_plan/260806_stacked_bug_campaign/020_phase3_native_profile_empty_sweep.md#L43-L45: label thegitcommand fence.devlog/_plan/260806_stacked_bug_campaign/030_phase4_native_main_acl_timeout.md#L32-L34: label thegitcommand fence.devlog/_plan/260806_stacked_bug_campaign/040_phase5_bounded_rollout_inspection.md#L30-L32: label thegitcommand fence.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 33-33: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
📍 Affects 4 files
devlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.md#L33-L35(this comment)devlog/_plan/260806_stacked_bug_campaign/020_phase3_native_profile_empty_sweep.md#L43-L45devlog/_plan/260806_stacked_bug_campaign/030_phase4_native_main_acl_timeout.md#L32-L34devlog/_plan/260806_stacked_bug_campaign/040_phase5_bounded_rollout_inspection.md#L30-L32
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@devlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.md`
around lines 33 - 35, Label each unlabeled git command fence with bash or shell
in devlog/_plan/260806_stacked_bug_campaign/010_phase2_bounded_sse_inspection.md
lines 33-35, 020_phase3_native_profile_empty_sweep.md lines 43-45,
030_phase4_native_main_acl_timeout.md lines 32-34, and
040_phase5_bounded_rollout_inspection.md lines 30-32; make no other changes.
Source: Linters/SAST tools
| | Path | Op | Content | | ||
| |------|----|---------| | ||
| | `src/responses/parser.ts` | ADOPT | Replace `detectStructuredOutput` with `parseTextFormat` returning the format object; set `options.textFormat`; derive `_structuredOutput` from it (~`:668-711` as authored) | | ||
| | `src/types.ts` | ADOPT | `textFormat` on `OcxRequestOptions` (+14 as authored) | | ||
| | `src/adapters/openai-chat.ts` | ADAPT | Add the `response_format` mapping after the `promptCacheKey` block (~`:820`). **Change from #985:** enter the `json_schema` branch whenever `type === "json_schema"`, adding the `schema` member conditionally instead of gating the whole branch on it | | ||
| | `src/adapters/openai-responses.ts`, `src/server/responses/core.ts`, `src/server/chat-completions.ts` | ADOPT | As authored | | ||
| | `tests/openai-chat-hardening.test.ts` | ADAPT | Authored cases plus a schema-less `json_schema` case asserting `response_format.type === "json_schema"` is still sent | | ||
| | `tests/responses-parser.test.ts`, `tests/chat-completions-endpoint.test.ts`, `tests/responses-compaction-routing.test.ts`, `tests/kiro-adapter.test.ts`, `tests/server-kiro-completion-e2e.test.ts` | ADOPT | As authored | |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Preserve the shared src/server/responses/core.ts composition contract.
Phase 11 is applied after three phases that already modify the same rewrite composition point. The current documents do not provide one complete overlap rule, and Phase 11 says to adopt core.ts “as authored.” A direct cherry-pick can drop an earlier rewrite hook or change rewrite ordering.
devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md#L34-L41: mark thecore.tschange as an adaptation; reapply it by symbol and preserve the Anthropic, Copilot, and Darwin rewrites.devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md#L56-L59: include Phase 11 in the list of phases that editcore.ts.devlog/_plan/260806_stacked_bug_campaign/060_phase7_copilot_responses_normalization.md#L34-L35: include Phase 11 or replace the partial phase list with the shared symbol-based rule.devlog/_plan/260806_stacked_bug_campaign/070_phase8_darwin_eager_rewrite.md#L30-L31: include Phase 11 or replace the partial phase list with the shared symbol-based rule.
📍 Affects 4 files
devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md#L34-L41(this comment)devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md#L56-L59devlog/_plan/260806_stacked_bug_campaign/060_phase7_copilot_responses_normalization.md#L34-L35devlog/_plan/260806_stacked_bug_campaign/070_phase8_darwin_eager_rewrite.md#L30-L31
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md`
around lines 34 - 41, Update the shared core.ts composition guidance to preserve
the Anthropic, Copilot, and Darwin rewrites when applying Phase 11 by symbol and
ordering, marking its change as ADAPT rather than ADOPT in
devlog/_plan/260806_stacked_bug_campaign/100_phase11_structured_output_schema.md
lines 34-41. Update
devlog/_plan/260806_stacked_bug_campaign/050_phase6_anthropic_response_identity.md
lines 56-59, 060_phase7_copilot_responses_normalization.md lines 34-35, and
070_phase8_darwin_eager_rewrite.md lines 30-31 to include Phase 11 in their
shared core.ts overlap guidance or replace the partial phase lists with the
common symbol-based rule; no other sites require direct implementation changes.
| Target PRs: #1114, #1124, #1130, #1115, #1122, #1121, #1111, #947, #1047, #978, | ||
| #985, #1036, #1126, #1093, #1092, #1085, #997, #999. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Restrict attribution comments to superseded work.
The final matrix marks #1092, #1085, #997, and #999 as deferred. It marks #1121 as credited-only. These entries do not satisfy the requirement to name a stack carrier and claim preserved authorship. Build this target list from landed or reimplemented work, and give #1121 a diagnosis-only attribution message.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 18-18: No space after hash on atx style heading
(MD018, no-missing-space-atx)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md` around
lines 17 - 18, Update the “Target PRs” list in the phase17 closeout plan to
include only landed or reimplemented work, removing deferred PRs `#1092`, `#1085`,
`#997`, and `#999`. Keep `#1121` only with a diagnosis-only attribution message rather
than claiming preserved authorship or naming it as a stack carrier.
| - **Item** — `#<number>` (issue or PR). | ||
| - **Kind** — `issue` or `pr`. | ||
| - **Final state** — one of `landed-stackNN`, `deferred`, `upstream`, | ||
| `needs-info`, `feature`, `already-merged`. | ||
| - **Carrier** — the stack PR number that carries the work, or `—`. | ||
| - **Credited** — the contributor display name, or `—`. | ||
| - **Evidence** — the commit SHA on the stack branch, or the reason string for a | ||
| non-landed state. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Align the final-state schema with the disposition matrix.
The schema allows only landed-stackNN, deferred, upstream, needs-info, feature, and already-merged. The final matrix also uses credited-only, reimplemented-stack09, rejected-unsafe, and partial landed states. Extend the schema with defined semantics, or normalize the matrix to the declared values.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/160_phase17_closeout.md` around
lines 39 - 46, Align the “Final state” schema with the disposition matrix by
either defining the additional states used there—credited-only,
reimplemented-stack09, rejected-unsafe, and partial landed states—or replacing
those matrix values with the currently declared states. Ensure every matrix
disposition has an explicitly allowed and consistently defined final-state
value.
| ## CI state at close | ||
|
|
||
| Stacks 01-06 fully green. Stacks 07-10 were still completing or hit a GitHub | ||
| Actions outage (`Failed to resolve action download info: Service Unavailable`) | ||
| that was rerun. One earlier `test 3/4` failure on #1133 was a Bun runtime | ||
| `EEXIST: epoll_ctl` between tests with **no assertion failure**, proven | ||
| incidental by #1134 — which contains the same commit — passing that shard; it | ||
| is green after rerun. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Record the final CI result and terminal outcome.
The closeout contract requires DONE only after the stack CI state is reported. Otherwise it requires BUDGET_EXHAUSTED, BLOCKED, or NEEDS_HUMAN with evidence. “Still completing or hit an outage” does not establish the final status of stacks 07-10. Add the final per-stack result and the explicit terminal outcome.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md` around lines 93
- 100, Update the “CI state at close” section to report the final CI result for
each of stacks 07-10, replacing the unresolved “still completing or hit an
outage” wording with their terminal statuses and evidence. Add an explicit
overall terminal outcome using DONE only if all required stack CI results are
green; otherwise use BUDGET_EXHAUSTED, BLOCKED, or NEEDS_HUMAN with supporting
evidence.
The independent audit returned FAIL on two points, both recorded rather than smoothed over: - #1144 credited NexusCore in prose while git showed only Agent59353, the identity on #1126's head. A PR that claims credit git does not record fails the contract this campaign exists to uphold. All seven commits now carry a Co-authored-by trailer for NexusCore; tree byte-identical, suites still 32/0. - #1115 is closed - by its author Simon-Opopeee, verified from the timeline, not by any campaign action. Also recorded what the audit confirmed: dev untouched, all withheld-work claims true by diff, the Anthropic narrowing genuinely gated, and no PR body claiming green over a failing code check.
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md`:
- Around line 108-113: Redact the exposed email addresses in the attribution
evidence by replacing each full address with <redacted-email>, while preserving
the display names, commit references, and attribution details in the surrounding
text.
- Line 109: Update the sentence beginning with “#1126” so the issue identifier
is enclosed in inline code, preventing Markdown from interpreting it as a
heading while preserving the sentence’s meaning.
- Line 52: Update the campaign closure statements around the `#1115` entry and the
referenced sections to scope claims to campaign actions: state that the campaign
did not merge or close issues or PRs, and did not force-push. Retain the
existing record that Simon-Opopeee closed `#1115` independently.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d1ab20b8-b13d-4686-ac71-b576becd3f1c
📒 Files selected for processing (1)
devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md
| | #1114 | pr | landed-stack01 | #1133 | ingwannu | cherry-picked, authorship preserved; comment 5206431175 | | ||
| | #1124 | pr | landed-stack02 | #1134 | ingwannu | cherry-picked; comment 5206431146 | | ||
| | #1130 | pr | landed-stack03 | #1135 | luvs01 | cherry-picked; comment 5206434180 | | ||
| | #1115 | pr | landed-stack04 | #1136 | Simon | 5 commits cherry-picked; comment 5206434197. **Closed by the author** (`Simon-Opopeee`, 2026-08-06T15:15:19Z, not merged) after the attribution comment — their decision, not a campaign action | |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Scope closure statements to campaign actions.
The document records that #1115 was closed by Simon-Opopeee, but the blanket statements say that no contributor PR or any issue or PR was closed. Rewrite those statements as “the campaign did not merge or close...” and “the campaign did not force-push...” while retaining the author-closure record.
Also applies to: 81-83, 87-88, 118-123
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md` at line 52,
Update the campaign closure statements around the `#1115` entry and the referenced
sections to scope claims to campaign actions: state that the campaign did not
merge or close issues or PRs, and did not force-push. Retain the existing record
that Simon-Opopeee closed `#1115` independently.
| are authored by `Agent59353 <agent59353@taskmarket.dev>` — the identity on | ||
| #1126's head — and nothing in the commit metadata named ZachDreamZ/NexusCore. | ||
| A PR body that claims credit while git does not record it fails the campaign's | ||
| own attribution contract, which is the entire point of this campaign. | ||
| **Fixed:** all seven commits on `codex/260806-stack10-cursor-replay` now carry | ||
| `Co-authored-by: NexusCore <22769595+ZachDreamZ@users.noreply.github.com>`, |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact email addresses from the public document.
Lines 108 and 113 expose full email addresses. Replace each address with <redacted-email> while preserving the display names and attribution evidence.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 109-109: No space after hash on atx style heading
(MD018, no-missing-space-atx)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md` around lines
108 - 113, Redact the exposed email addresses in the attribution evidence by
replacing each full address with <redacted-email>, while preserving the display
names, commit references, and attribution details in the surrounding text.
|
|
||
| **1. #1144 credited NexusCore in prose but not in git.** The carried commits | ||
| are authored by `Agent59353 <agent59353@taskmarket.dev>` — the identity on | ||
| #1126's head — and nothing in the commit metadata named ZachDreamZ/NexusCore. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Prevent #1126 from becoming a malformed heading.
Line 109 starts with #1126, so Markdown parses it as an atx heading. Rewrite it as inline code, for example: the head of \#1126``.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 109-109: No space after hash on atx style heading
(MD018, no-missing-space-atx)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md` at line 109,
Update the sentence beginning with “#1126” so the issue identifier is enclosed
in inline code, preventing Markdown from interpreting it as a heading while
preserving the sentence’s meaning.
Source: Linters/SAST tools
|
✅ Deterministic PR hygiene checks passed. |
Both remaining phases executed: #1150 (Yuxin Qiao, test isolation + Desktop allowlist docs) and #1151 (Eachann + n3wr1ch, effort picker + Pi loopback export). 16 contributor PRs landed across 12 stack PRs. Also records the one in-scope deviation: phase 140 marked tests/cli-export-command.test.ts as DROP, but the Pi fix made two of its assertions stale - they expected the exact output #1085 reports as the bug. Updating them beat shipping a red suite; the no-secret-in-stdout property is unchanged.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md (1)
84-88: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAdd all credited contributors to the contributor list.
The stack and PR tables credit
Yuxin Qiao,Eachann, andn3wr1ch. Lines 86-88 omit all three. Add them to preserve the campaign’s attribution record.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md` around lines 84 - 88, Add Yuxin Qiao, Eachann, and n3wr1ch to the “Contributors credited” list alongside the existing contributor names, preserving the campaign’s attribution record.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md`:
- Around line 76-82: Update the PR reconciliation summary to count 16 landed, 1
credited-only, 1 reimplemented, 1 rejected, and 13 deferred entries. Explicitly
include the reimplemented category and avoid describing `#947` as a deferred or
unlanded item.
---
Outside diff comments:
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md`:
- Around line 84-88: Add Yuxin Qiao, Eachann, and n3wr1ch to the “Contributors
credited” list alongside the existing contributor names, preserving the
campaign’s attribution record.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ff93fce9-181f-4fcd-b616-a2e44d08eba0
📒 Files selected for processing (1)
devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md
| **PR total: 16 landed + 1 credited-only + 1 rejected + 14 deferred = 32 open, | ||
| + #1129 already merged.** | ||
|
|
||
| With phases 140 and 150 executed, every phase in the roadmap has run. The | ||
| remaining 14 deferrals are feature programs, maintainer-owned in-flight PRs, | ||
| and the two reimplementations judged not worth landing as written — each with | ||
| its reason in `002_pr_triage.md`. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Correct the PR reconciliation totals.
The matrix shows 32 open PR entries as:
- 16
landed-stackentries. - 1
credited-onlyentry. - 1
reimplemented-stack09entry for#947. - 1
rejected-unsafeentry. - 13
deferredentries.
Update the summary to include reimplemented and 13 deferred. Do not describe #947 as an unlanded deferral.
Proposed correction
-**PR total: 16 landed + 1 credited-only + 1 rejected + 14 deferred = 32 open,
+**PR total: 16 landed + 1 credited-only + 1 reimplemented + 1 rejected + 13 deferred = 32 open,
+ `#1129` already merged.**🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_stacked_bug_campaign/170_dispositions.md` around lines 76
- 82, Update the PR reconciliation summary to count 16 landed, 1 credited-only,
1 reimplemented, 1 rejected, and 13 deferred entries. Explicitly include the
reimplemented category and avoid describing `#947` as a deferred or unlanded item.
1 participant
Summary
The planning unit for the 2026-08-06 stacked bug campaign:
devlog/_plan/260806_stacked_bug_campaign/. Documentation only — no runtime code.At the 2026-08-06 cutoff there were 49 open issues and 32 open PRs. This unit triages every one of them, then specifies a stacked PR chain that lands the fixable bugs with the original contributors credited by name rather than merging their branches.
Contents:
000_plan.md— objective, scope freeze, attribution contract, work-phase map001_issue_triage.md— all 49 issues classified, each verdict citing the code that proves or refutes the report002_pr_triage.md— all 32 PRs with contributor identities and ADOPT / ADAPT / REIMPLEMENT / DEFER dispositions010–160— one diff-level decade doc per implementation phase170_dispositions.md— the final matrix with evidence per itemThe stack it produced: #1133 → #1134 → #1135 → #1136 → #1137 → #1138 → #1139 → #1141 → #1142 → #1144, linear, with #1133 targeting
dev.Why the attribution matters
Twelve contributor PRs are represented in that chain. Six were cherry-picked with the contributor's authorship intact —
git logshows them as the author. The rest were adapted or reimplemented and carryCo-authored-by:trailers, with the PR body naming what was changed and why. Each source PR received a comment explaining where the work landed, and none were merged, closed, or force-pushed.Where a contributor's patch was narrowed, the reason is recorded rather than silently applied — for example #1093's ingress spans were withheld because an admitted client could forge them, and #1126's on-disk reasoning persistence was withheld because it changes a documented memory-only privacy contract.
Notes for review
Contributor emails are redacted in the docs as
<email from PR head>;bun run privacy:scanfails on a committed address, anddevlog/is public.002_pr_triage.mddocuments thegit log -1 --format='%an <%ae>' pr-<n>command used to recover the real identity for trailers, so attribution stays exact in git history.The roadmap passed an independent review gate after five rounds. The audit caught three blockers worth mentioning: an inflated PR count, and two phases whose citations pointed at line numbers from the contributors' patched trees rather than
dev— a plan built on those would not have been executable.Verification
bun run privacy:scan— passedbun run typecheck— exit 0devlog/Checklist
Summary by CodeRabbit