lidge-jun · lidge-jun · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026
@@ -0,0 +1,69 @@
+# 000 — Wave 0/1/2 closeout research
+
+Source roadmap: external audit conversation (2026-08-16) that produced a six-wave plan over the open `bug` issue/PR set. This unit executes Wave 0, Wave 1 and Wave 2 only. Waves 3-5 stay out of scope.
+
+Baseline: `origin/dev` = `b81314cd29b78fecb447df882dc4fc1a987434b9`.
+
+## Wave scope as received
+
+Wave 0 (triage only, no issue closes):
+
+- `#1802` needs the `bug` label (currently `cli` only).
+- `#92` / `#417` stay out of the release-blocker count as `upstream-tracking`.
+- PR `#1822` label review (`bug` vs GUI UX follow-up).
+- `#1049` records `#1798` / `#1802` as independent acceptance cases.
+
+Wave 1 (low-risk merges): `#1805`, `#1806` then close `#1786`, `#1741`, `#1825` then close/reclassify `#1824`, absorb `#1801` tests into `#1817` then close `#1801`.
+
+Wave 2 (blocker work): `#1819` to `#1785`, `#1788` to `#1700`, `#1780` to `#1767`, `#1792` to `#1668`, `#1703` to `#1697`.
+
+## Verified triage state (gh, 2026-08-16)
+
+| Item | State | Labels |
+|---|---|---|
+| `#1802` | OPEN | `cli` |
+| `#92` | OPEN | `bug`, `upstream-tracking`, `tools` |
+| `#417` | OPEN | `bug`, `upstream-tracking`, `cli` |
+| `#1049` | OPEN | `bug`, `cli` |
+| `#1798` | OPEN | `bug`, `cli` |
+| PR `#1822` | OPEN | `bug` |
+
+`#92` and `#417` already carry `upstream-tracking`, so Wave 0 for them is a reporting convention, not a label mutation. The repository label set already contains `upstream-tracking`, `provider-compatibility`, `needs-info`, `maintainer-sponsored` and `intake: hygiene-blocked`; no new label needs creating.
+
+Target issues, all OPEN at baseline: `#1786`, `#1824`, `#1785`, `#1700`, `#1767`, `#1668`, `#1697`. `#1795` stays open (live SenseNova/Kimi reproduction still missing).
+
+## Audit findings per PR (5 parallel read-only audits)
+
+`#1805` — head `8946a1026120c59870310575c1623873a3660f4f`. Windows test-sandbox profile shape in `scripts/test.ts` plus two Windows-only regressions in `tests/test-runner.test.ts`. No diff-level blocker; only `REVIEW_REQUIRED` governance.
+
+`#1806` — head `960013e312970494e6eb7a3209b33491627f4316`. Makes `currentCodexSqliteHomeAbsolute()` target-aware in `src/service.ts:112` so POSIX artifacts keep `/var/...` literals on a Windows host. Body says `Closes #1786`. Live blocker: `tests/service.test.ts:692` ("still absolutizes a relative sqlite home") never asserts absoluteness — it only rejects one exact raw string, so it stays green for an arbitrary non-absolute transform.
+
+`#1741` — head `9118aef00e537f2abb09a3de3445f0cfd6b9bb18`. Request-local map for tool-call name recovery in `src/chat/inbound.ts` plus a 1,000-call linearity regression. No diff blocker; exact-head Cross-platform CI and React Doctor are `action_required` (never executed).
+
+`#1825` — head `65dac3fe651ea091f4ccf924b6691929002789fc`. Classifies malformed provider tool calls as `502` / `upstream_error` and adds bounded, debug-gated structural fingerprints. Exact-head Cross-platform CI green. No diff blocker. History note: commit `c8d136c21` temporarily added a `contents: write` workflow that `2e28fb2cc` removed; the final aggregate diff has no `.github/` change.
+
+`#1817` — head `b8cea1d0d2f33a5bce8277425461ab245efeda28`. Shared tool-catalog nudge contract plus `apply_patch`-scoped envelope guidance. Exact-head CI green. `src/bridge.ts` is untouched (identical blob), so fail-closed 502 enforcement is preserved. No diff blocker.
+
+`#1801` — head `f1db2592b398b5a49ec875c75c140a981542356f`, draft. Cursor Code Mode guidance with a real correctness blocker at `src/adapters/cursor/tool-definitions.ts:217`: `cursorRequestUsesCodeMode()` returns true whenever freeform `exec` is visible without a bare shell bridge, even when another non-shell top-level tool is also visible, and the guidance then declares those tools non-top-level. Its three tests are unique coverage, not duplicates of `#1817`.
+
+`#1819` — head `65822b008740af75cd2568595cb60602de80d899`, draft. All four claimed blockers verified at head:
+
+1. `configDiagnosticsFromRaw` still returns `getDefaultConfig()` with `source: "fallback"` (`src/config.ts:2479`); the salvage added to `loadConfig` (`src/config.ts:2175-2195`) has no diagnostics counterpart, and the file comment says that result can be persisted over providers/keys.
+2. Salvage is one-pass (`src/config.ts:2179-2198`): dropping an invalid combo can invalidate a routing profile that referenced it, and the second parse failure discards the whole config.
+3. Raw operator-controlled entry IDs reach `console.error` (`src/config.ts:3505-3523`) without `redactSecretString`.
+4. No management-auth regression accompanies the new fallback path.
+
+`#1788` — head `cfbb3cdec5bc85154bfe8a672d9e34f9acceb2f6`, draft. No-catalog passthrough, caller/outbound catalog union and non-streaming state exclusion are correct. Remaining blocker: `rememberPassthroughResponseChecked` (`src/server/responses/core.ts:2311-2320`) only inspects the terminal response `output`, so a stream that emits an undeclared `apply_patch` in `response.output_item.added` and then a `response.completed` with `output: []` can still enter continuation state after the client received `response.failed`.
+
+`#1780` — head `388c4c25174ff5a709c5e1ca15ef625b55a6e9e8`. Three verified defects: `?? rawId` restores empty IDs (`src/adapters/anthropic.ts:578` and `:649`); `requiredIds` holds normalized IDs but the result scan compares raw ones (`src/adapters/anthropic.ts:660-667`), so every rewritten pair produces an orphan plus a synthetic missing result; and the stateless transform is not injective (`src/adapters/tool-call-id.ts:6,20`).
+
+`#1792` — head `8f41eb78e9a751fadb9a9043a7ed3e9e35d9c956`, draft, `CHANGES_REQUESTED`. The loader rejects `null` (`src/config.ts:738`) while the management validator accepts it (`src/config.ts:917`) and POST persists the provider as submitted (`src/server/management/provider-routes.ts:475,547`); PATCH already deletes the key. It also touches `src/server/auth-cors.ts`, which is on the restricted list in `.github/scripts/pr-sponsored-surface.cjs`, so PR hygiene fails with `unsponsored_surface` and the PR carries `intake: hygiene-blocked`.
+
+`#1703` — head `52cdbfc81adef7e3cc17a5e43a1b17428661fffc`, draft. Affinity comes from static `claudeCode.model` (`src/claude/inbound.ts:75`), classifier detection is slug-only (`:28`), and `src/router.ts:699` picks the first enabled Anthropic-adapter provider by object insertion order with no model-availability check. That is the silent provider/privacy/billing crossing the issue warns about; the PR is on design hold.
+
+## Cross-cutting facts
+
+- Contributor branches show `action_required` CI: workflow runs need maintainer authorization before any exact-head test matrix exists. `gh pr checks --required` reporting "no required checks" is not evidence of a green suite.
+- Full-suite validation runs on `ssh lidge` (`/home/lidgeai/Developer/opencodex`, `bun test --isolate tests`), never on the local workstation.
+- `main` promotion, tags and npm publish are out of scope. Issues and PRs are closed under maintainer authority once the fix is on `dev`, with a release-pending note.
+
@@ -0,0 +1,23 @@
+# 010 — Wave 0: triage mutations
+
+Status: **executed 2026-08-16**. Every action below is already reflected on GitHub; the section is retained as the record. Re-running it would duplicate external communication, so treat each step as complete and verify state instead of re-posting.
+
+No issue is closed in this phase. GitHub metadata only; no repository code.
+
+## Actions
+
+1. `#1802` — add label `bug`. It currently has `cli` only, yet its title and body describe a real regression (`ocx sync` overwriting a hand-edited config from stale server memory). Keeps the release-blocker count honest at 27 rather than 26.
+2. `#92`, `#417` — already labelled `upstream-tracking`. No mutation; record in this unit that they are excluded from the release-blocker statistic, and post one short comment on each confirming they remain upstream trackers and are not counted as ocx release blockers.
+3. PR `#1822` — `bug` label review. The PR clarifies Log Guard storage UX and adds a write-load poster; that is GUI UX follow-up, not a defect fix. Replace `bug` with `gui`.
+4. `#1049` — post a comment linking `#1798` and `#1802` as independent acceptance cases under the write-coordinator umbrella, stating explicitly that closing `#1049` does not close either.
+
+## Evidence (captured)
+
+- `gh issue view 1802 --json labels` → `bug,cli`.
+- `gh pr view 1822 --json labels` → `gui`.
+- `#1049` comment `5307288259`, `#92` comment `5307288327`, `#417` comment `5307288395`.
+
+## Non-goals
+
+- Do not close `#92`, `#417`, `#1049`, `#1798`, `#1802`.
+- Do not retitle anything.
@@ -0,0 +1,46 @@
+# 020 — Wave 1: #1805, #1806, close #1786
+
+## 020.1 #1805 (no code change needed)
+
+Head `8946a1026120c59870310575c1623873a3660f4f`. `scripts/test.ts` creates `AppData/Local` and `AppData/Roaming` inside the disposable sandbox root before exporting `USERPROFILE`; `tests/test-runner.test.ts` gains two Windows-only regressions, one of which drives the actual PowerShell/.NET known-folder expression.
+
+Disposition: merge as-is. Production runtime untouched.
+
+## 020.2 #1806 blocker fix
+
+Head `960013e312970494e6eb7a3209b33491627f4316`. `src/service.ts` change is correct: `currentCodexSqliteHomeAbsolute()` becomes target-aware and uses `path.posix` for native/POSIX targets, so `/var/lib/opencodex/codex-sqlite` survives generation on a Windows host.
+
+Blocker is test-only, at `tests/service.test.ts` in the case named "still absolutizes a relative sqlite home". With input `relative-sqlite-home` it asserts only `plist` contains `<key>CODEX_SQLITE_HOME</key>` and does not contain `<string>relative-sqlite-home</string>`. That stays green for any non-empty transformed value, absolute or not.
+
+The two artifact formats are different and must be asserted separately — launchd emits XML (`<key>K</key><string>V</string>`), systemd emits `Environment="K=V"`. A single `K=` line scan finds nothing in the plist and keeps a trailing quote in the unit.
+
+Required diff (test file only):
+
+```diff
+   const plist = buildPlist();
+-  expect(plist).toContain("<key>CODEX_SQLITE_HOME</key>");
+-  expect(plist).not.toContain("<string>relative-sqlite-home</string>");
++  const plistValue = /<key>CODEX_SQLITE_HOME<\/key>\s*<string>([^<]*)<\/string>/.exec(plist)?.[1];
++  expect(plistValue).toBeDefined();
++  expect(isAbsolute(plistValue!) || posix.isAbsolute(plistValue!) || win32.isAbsolute(plistValue!)).toBe(true);
++  expect(plistValue!.endsWith("relative-sqlite-home")).toBe(true);
++
++  const unit = buildUnit();
++  const unitValue = /Environment="CODEX_SQLITE_HOME=([^"]*)"/.exec(unit)?.[1];
++  expect(unitValue).toBeDefined();
++  expect(isAbsolute(unitValue!) || posix.isAbsolute(unitValue!) || win32.isAbsolute(unitValue!)).toBe(true);
++  expect(unitValue!.endsWith("relative-sqlite-home")).toBe(true);
+```
+
+Import `isAbsolute` plus `posix` and `win32` from `node:path` at the top of the test file. The absolute check accepts either separator family because this test runs on both POSIX hosts and native Windows.
+
+## 020.3 Merge and close
+
+Both PRs change Windows-specific behavior, so a Linux/macOS run — including the `ssh lidge` suite — is not equivalent evidence. Native Windows CI must run at the exact head.
+
+1. Authorize the pending workflow runs so Cross-platform CI (including the Windows shards) executes at each exact head.
+2. Push the strengthened oracle onto the `#1806` head branch, then re-authorize CI for the new head.
+3. Record maintainer approval on each PR before merging; do not merge on `action_required` CI.
+4. Merge `#1805`, then `#1806`.
+5. Focused evidence: `bun test tests/service.test.ts tests/test-runner.test.ts` plus the Windows shard result at the merged head.
+6. Close `#1786` with a comment naming the merged commit and stating release is pending.
@@ -0,0 +1,23 @@
+# 030 — Wave 1: #1741, #1825, close/reclassify #1824
+
+## 030.1 #1741
+
+Head `9118aef00e537f2abb09a3de3445f0cfd6b9bb18`. `toolCallsToItems` now takes one request-local `Map` instead of rescanning previously translated items, turning quadratic name recovery into linear. Equivalence holds because every emitted function call is indexed immediately before `input.push`.
+
+No diff blocker. The only gap is that exact-head Cross-platform CI is `action_required`. Substitute evidence: focused run of `tests/chat-completions-endpoint.test.ts` plus the `ssh lidge` full suite after the merge lands on `dev`.
+
+## 030.2 #1825
+
+Head `65dac3fe651ea091f4ccf924b6691929002789fc`, exact-head Cross-platform CI green (shards 1-4, gates, macOS, keyring, npm-global). Reclassifies malformed provider tool calls to `502` / `upstream_error`, adds allowlisted structural fingerprints gated behind `isDebugEnabled()`, and keeps both stream and buffered rejection fail-closed.
+
+Security note for the record: the `.github/workflows/ocx-temp-apply-invalid-tool-call-fix.yml` file with `contents: write` existed only in intermediate commit `c8d136c21` and was removed by `2e28fb2cc`. The aggregate diff at head touches no workflow, so the restricted-surface concern does not apply to what lands.
+
+## 030.3 #1824 disposition
+
+`#1825` is mitigation plus diagnostics, not an upstream fix. It does not coerce, normalize or dispatch the malformed name, and it does not change what OpenCode Free / DeepSeek emit.
+
+Closing comment text:
+
+> Closing the OpenCodex-side scope via #1825. OpenCodex continues to reject object-valued function names without guessing executable intent, now classifies the malformed provider response as `502` / `upstream_error`, and exposes only bounded value-free diagnostics with optional privacy-safe structural fingerprints. This is a mitigation and diagnostics improvement; it does not normalize the provider payload or claim the upstream defect is fixed.
+
+Also add `provider-compatibility` so the remaining upstream defect stays discoverable.
@@ -0,0 +1,30 @@
+# 040 — Wave 1: absorb #1801 into #1817, close #1801
+
+## 040.1 What each PR is
+
+`#1817` (head `b8cea1d0d2f33a5bce8277425461ab245efeda28`, CI green) changes the shared surfaces: `src/adapters/tool-catalog-nudge.ts` gains three guidance sentences defining the complete top-level surface and routing nested helpers through their listed parent; `src/responses/parser.ts` scopes patch-envelope argument guidance to logical `apply_patch` only. `src/bridge.ts` is untouched, so fail-closed 502 enforcement survives.
+
+`#1801` (head `f1db2592b398b5a49ec875c75c140a981542356f`, draft) changes only `src/adapters/cursor/tool-definitions.ts` and its test. They are not diff duplicates; they are the same intent on two surfaces.
+
+## 040.2 The #1801 correctness blocker
+
+`cursorRequestUsesCodeMode()` (`src/adapters/cursor/tool-definitions.ts:217-223`) returns true when freeform `exec` is visible and no bare shell bridge exists — without requiring `exec` to be the only visible tool. The guidance block (`:608-615`) then says shell, file edits and MCP are nested helpers and "they are not separate top-level tools", contradicting the catalog prefix at `:603-604` that lists them as callable.
+
+The existing test at `tests/cursor-tool-definitions.test.ts:425-437` hides `exec` via `toolChoice`, so the mixed visible-catalog case is untested.
+
+## 040.3 Absorption plan
+
+Land, on top of `#1817` as it merges to `dev`:
+
+1. Port `isCursorCodeModeExecTool()` and `cursorRequestUsesCodeMode()` from `#1801`, with the fix: Code Mode nested-helper wording must be scoped to helpers described by `exec` itself, and every separately listed top-level tool must stay described as callable. Concretely, compute the set of visible non-`exec` top-level tools and, when non-empty, emit the nested-helper paragraph without the blanket "they are not separate top-level tools" sentence, naming the still-callable top-level tools instead.
+2. Port the three unique tests from `tests/cursor-tool-definitions.test.ts` in `#1801`:
+   - "detects code mode only when freeform exec has no bare shell bridge" (freeform/bare-bridge mutual exclusivity)
+   - "teaches the nested-helper contract instead of a top-level shell bridge" (V8 isolate, `await tools.<name>(...)`, `text(...)`, no `require`)
+   - "keeps flat-catalog shell-bridge guidance when a bare bridge is advertised" (opposite branch preserved)
+3. Add the missing mixed-catalog regression: visible `exec` plus a visible `mcp__fs__read_file` under automatic tool choice must not tell the model that `mcp__fs__read_file` is non-top-level.
+
+## 040.4 Close-out
+
+- Merge `#1817` into `dev`, then land the Cursor absorption commit on `dev`.
+- Close `#1801` as superseded by `#1817` plus the absorption commit, listing the three ported tests and the added mixed-catalog case.
+- Keep `#1795` OPEN: no live SenseNova/Kimi reproduction has been run against the guidance change.