You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit a0d7a4a
Browse filesBrowse the repository at this point in the historyBrowse files
- Final code candidate: `b7cfd659fac99f533d44fff506977a98e28af437`
6
+
- Final code candidate: `d13f784786d03908b0147ac93c9ca7effdd19e78`
7
7
- Mode: full Council review plus final independent remediation pass
8
8
- Local verdict: **PASS**
9
9
- Remote gate: the final candidate must be pushed and fresh CI/bot review must finish
@@ -51,7 +51,8 @@ Post-Council review found and repaired:
51
51
- a static bridge assertion that could match the unclamped property-access form;
52
52
- empty base64 image data wrapped in a `URL` object escaping unsupported-media projection;
53
53
- positive sub-floor context windows being treated as placeholder metadata; and
54
-
- the fixed 512-token safety margin consuming an entire small but valid context or input limit.
54
+
- the fixed 512-token safety margin consuming an entire small but valid context or input limit; and
55
+
- separately transmitted system messages being flattened before estimation, omitting each entry's wire framing.
55
56
56
57
Each repair was centralized in the shared output-budget module or the existing pure media projection, then exercised through both request boundaries.
57
58
@@ -68,11 +69,11 @@ Batching the same parser would not remove its decompression/traversal boundary.
68
69
69
70
## Final independent remediation review
70
71
71
-
Two independent live Council seats re-reviewed the request-shape correction at `c78e1a61b6`, then reviewed all production deltas through `56dbc7e9b1`and the final test-fixture delta through exact branch head `b7cfd659fa`. The final production delta scales the safety margin against each authoritative small limit while retaining the 512-token minimum for normal windows. The branch-head delta only updates a processor test's artificial context window to remain compatible with that production enforcement. Neither changes PDF behavior.
72
+
Two independent live Council seats re-reviewed the request-shape correction at `c78e1a61b6`, the small-limit production delta through `56dbc7e9b1`, the test-fixture correction through `b7cfd659fa`, and the final system-framing correction at exact production head `d13f784786`. The last correction serializes non-empty system entries as the same array of `{ role: "system", content }` records sent by both applicable request paths. Empty arrays remain free, while OAuth and workflow paths continue to omit generated-system framing. None of these changes alter PDF behavior.
72
73
73
74
### Feynman seat — PASS
74
75
75
-
- Verified exact final production code head `56dbc7e9b1` and test-only branch head `b7cfd659fa`.
76
+
- Verified exact final production code head `d13f784786`.
76
77
- Confirmed `pdf-lib`, async parsing, page regex/policy, and transitive lock entries are absent.
77
78
- Confirmed lazy estimation is not evaluated when `maxOutputTokens` is omitted.
78
79
- Confirmed Mistral/Devstral projection matches the transport normalizer without mutating history.
@@ -86,11 +87,13 @@ Two independent live Council seats re-reviewed the request-shape correction at `
86
87
- Confirmed a one-token input/output request fits a 512-token context, while reserving the full 512-token output does not.
87
88
- Confirmed a 512-token dedicated input ceiling accepts input 501 with margin 11 and rejects input 502.
88
89
- Confirmed the processor fixture now uses context 20,000, exactly its default compaction headroom, while the former context 20 still raises `OutputTokenBudgetError`.
90
+
- Confirmed each system entry receives its own role/content framing in both the AI SDK and native request shapes, while OAuth/workflow callers still pass an empty system array.
91
+
- Reproduced the framing regression with 2,000 entries: the old flattened shape estimated 1,629 tokens and the corrected framed shape estimated 17,298 tokens, with linear bounded runtime.
89
92
- Re-ran provider, typecheck, diff, and bridge checks successfully.
90
93
91
94
### Musashi seat — PASS
92
95
93
-
- Verified exact final production code head `56dbc7e9b1` and test-only branch head `b7cfd659fa`.
96
+
- Verified exact final production code head `d13f784786`.
94
97
- Confirmed the parser experiment remains cleanly reverted and no PDF dependency returned.
95
98
- Confirmed synchronous lazy estimation, linear Mistral projection, and parity across both callers.
96
99
- Confirmed identical wire fields are counted separately while OAuth/workflow omissions are not double-counted.
@@ -100,26 +103,28 @@ Two independent live Council seats re-reviewed the request-shape correction at `
100
103
- Confirmed the exact 8,192-token context boundary: input 7,516 plus output 512 plus margin 164 fits, while one additional input token is rejected.
101
104
- Confirmed the exact 512-token input-limit boundary: input 501 plus margin 11 fits, while input 502 is rejected.
102
105
- Confirmed context and dedicated input limits receive independent margins while normal-window behavior remains unchanged.
103
-
- Confirmed the final branch delta changes only the processor fixture and comment, preserves the intended `base <= headroom` compaction guard, and does not mask the separate small-context admission regressions.
106
+
- Confirmed the processor-fixture delta changes only that fixture and comment, preserves the intended `base <= headroom` compaction guard, and does not mask the separate small-context admission regressions.
107
+
- Confirmed discrete system-entry framing matches both request lowerings, empty arrays remain free, and OAuth/workflow caller projections are unchanged.
108
+
- Reproduced a 15,669-token increase over flattened text for 2,000 tiny entries in roughly 2.4 ms.
104
109
- Confirmed focused tests, typecheck, and diff checks pass.
105
110
106
111
### Degraded seat
107
112
108
113
The original chairman seat was rejected twice by the service safety filter because its retained conversation context included the earlier parser stress case. It produced no contrary code finding on the final head. The thread limit prevented replacing that retained seat with a new fourth thread.
109
114
110
-
Consensus therefore rests on two independent live PASS votes on exact final branch head `b7cfd659fa`, the primary review, the complete changed-file inspection, and sealed zero-finding Codex Security scans through the final production change. The degraded seat is disclosed rather than silently counted as agreement.
115
+
Consensus therefore rests on two independent live PASS votes on exact final production head `d13f784786`, the primary review, the complete changed-file inspection, and sealed zero-finding Codex Security scans through the final production change. The degraded seat is disclosed rather than silently counted as agreement.
The parser-free remediation scan was sealed once as scan `80591880-0a17-454c-b312-92c32a38f5ff`. The final request-shape and edge-case scans were sealed once each as `1dcbce9e-587e-4495-94ff-6d3291e5e1d6`, `bfa1cc4a-7d87-463d-8fc9-822e1624f8b1`, `19f139b0-8c4c-48cc-adca-a60d41920664`, and `5111b689-e4ad-4243-a7cb-86845b30ca6d`. Their authoritative results contain no deferred work, no open question, and zero findings.
41
+
The parser-free remediation scan was sealed once as scan `80591880-0a17-454c-b312-92c32a38f5ff`. The final request-shape and edge-case scans were sealed once each as `1dcbce9e-587e-4495-94ff-6d3291e5e1d6`, `bfa1cc4a-7d87-463d-8fc9-822e1624f8b1`, `19f139b0-8c4c-48cc-adca-a60d41920664`, `5111b689-e4ad-4243-a7cb-86845b30ca6d`, and `33ec5c89-fce8-434d-b8a6-2baba941ff27`. Their authoritative results contain no deferred work, no open question, and zero findings.
41
42
42
43
## Findings discovered and resolved
43
44
@@ -69,13 +70,19 @@ A follow-up review correctly found that enforcing every positive limit with an u
69
70
70
71
The subsequent branch-head delta changes only an artificial processor test context from 20 to 20,000 tokens. That value exactly equals the existing default compaction headroom and preserves the fixture's intended guard path; the separate production admission regressions continue to exercise 1-, 512-, and 1,024-token contexts.
71
72
73
+
### 6. System-message framing matches the request transport
74
+
75
+
A final bot review found that the estimator joined separately transmitted system strings with newlines. Both applicable request paths instead lower each entry to its own `{ role: "system", content }` record, so a plugin emitting many short entries could omit substantial role/content and JSON framing from the estimate.
76
+
77
+
The final candidate serializes the exact framed array before token estimation. Empty arrays still contribute zero, and OAuth/workflow paths still pass an empty system array while counting their provider instructions separately. A 2,000-entry regression fails under the old flattening and confirms linear, bounded execution under the corrected shape. The exact production delta was sealed as a complete zero-finding security scan.
78
+
72
79
## Final trust and data flow
73
80
74
81
Both production request paths use the same sequence:
2. If no output reservation or credible limit exists, return without serializing the prompt.
78
-
3. Lazily estimate text, schemas, semantic media allowances, decoded inline payload size, and every system/instruction wire occurrence.
85
+
3. Lazily estimate text, schemas, semantic media allowances, decoded inline payload size, each separately framed system entry, and every provider-instruction wire occurrence.
79
86
4. Enforce a dedicated input limit when declared.
80
87
5. Clamp the output reservation against the shared context window with a safety margin.
81
88
6. Reconcile fixed reasoning budgets with the final reservation.
@@ -85,15 +92,15 @@ Codebase graph tracing found exactly two production callers of the centralized c
- Prettier: all changed files pass except `provider/provider.ts` and `provider/transform.ts`; both fail identically at `origin/main`, so no unrelated whole-file rewrite was introduced.
95
102
-`git diff --check origin/main...HEAD`: passed.
96
-
- Final request-shape Codex Security scans: complete coverage, **0 findings**.
103
+
- Final request-shape Codex Security scans, including `cedd33a866..d13f784786`: complete coverage, **0 findings**.
0 commit comments