fix(agent): execute decoded JSON after escaped-nonascii resample budget - #4627
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
3353a67 to
a2d1a5c
Compare
|
Rebased onto current
|
|
Digest correction on the exact head The PR body now carries this digest (single verdict line). Verification matrix unchanged: 127 + 782 + 106 tests pass, per-package checks clean, build/smoke ok, binary base |
a2d1a5c to
ae592d8
Compare
|
Second reconstruction onto live
|
probepark
left a comment
probepark
left a comment
There was a problem hiding this comment.
Independent maintainer review — merge blocked. This trades a false positive for a real safety regression.
major — the terminal guard is removed for every tool, not just ask
packages/agent/src/agent-loop.ts:2361-2364,3473-3491 drops terminal escaped-argument validation globally. After two unmanaged resamples the decoded arguments are executed as-is, so a single mistyped nibble can silently alter a non-ASCII path, source text, regex, or shell argument and then run a mutating tool. The em-dash false positive does not justify executing still-unverified arguments.
major — the encoder exemption is far too broad
packages/ai/src/utils/json-parse.ts:28-37,203-206 treats all of \p{P}, \p{S}, and \p{Z} as harmless. Currency and math symbols, full-width punctuation, and separators are semantically significant and nibble-sensitive in arbitrary tool arguments.
Fix the em-dash case narrowly — evidence-backed, non-mutating fields only — and keep the terminal path fail-closed.
conflict with #4632
#4632 touches the same hunks with the opposite design (keep the guard, add transient steering so the model re-emits literal UTF-8). The two are mutually exclusive. I recommend landing #4632's direction and reducing this PR to just the em-dash false-positive fix.
…nly tools Restore the fail-closed terminal escapedNonAsciiArguments rejection for every tool, then carve out exactly the motivating false positive: a tool that declares displaySafeEscapedArgs (user-facing question text that names no path, command, or identifier — currently only ask) executes without resampling when its decoded arguments contain nothing but benign typographic punctuation (curated set: U+2014 EM DASH). The json-parse scanner stays strict and still flags every non-ASCII escape; mutating tools and every other escaped character keep the two-resample budget and terminal rejection. Composes with the retained-guard + steering direction of #4632, which owns transient recovery steering. Red-team regressions cover: em-dash executes only on display-safe tools; the same payload on a mutating tool never executes; the nibble-adjacent en-dash (U+2013) and currency/math/full-width/separator/letter/emoji escapes stay rejected even on display-safe tools. Lore-id: 0f3c2a91 Constraint: mutating tools must never execute unverified \\uXXXX payloads Constraint: scanner stays evidence-based; the exemption is decided on decoded args at execution time Rejected: broad \p{P}\p{S}\p{Z} exemption | semantically significant nibble-sensitive symbols re-execute Rejected: execute decoded args after budget globally | review 4957008249 major blocker Confidence: high Scope-risk: narrow Reversibility: trivial Tested: 28 escaped-nonascii agent tests, 787 agent suite, 125 targeted matrix, 100 ai targeted Not-tested: none material Closes: #4627 review blockers
ae592d8 to
03a3338
Compare
|
Review resolution for 4957008249 — new exact head Blocker 1 — terminal guard removed globally → RESTORED. The fail-closed Blocker 2 — broad Blocker 3 — conflict with #4632 → COMPOSES. #4632 retains the guard and adds transient recovery steering (its lane owns that); this PR adds only the bounded display-safe carve-out on disjoint logic — a Verification on Fresh exact-head re-review requested: @probepark @snowykr. — |
…nly tools Restore the fail-closed terminal escapedNonAsciiArguments rejection for every tool, then carve out exactly the motivating false positive: a tool that declares displaySafeEscapedArgs (user-facing question text that names no path, command, or identifier — currently only ask) executes without resampling when its decoded arguments contain nothing but benign typographic punctuation (curated set: U+2014 EM DASH). The json-parse scanner stays strict and still flags every non-ASCII escape; mutating tools and every other escaped character keep the two-resample budget and terminal rejection. Composes with the retained-guard + steering direction of #4632, which owns transient recovery steering. Red-team regressions cover: em-dash executes only on display-safe tools; the same payload on a mutating tool never executes; the nibble-adjacent en-dash (U+2013) and currency/math/full-width/separator/letter/emoji escapes stay rejected even on display-safe tools. Lore-id: 0f3c2a91 Constraint: mutating tools must never execute unverified \\uXXXX payloads Constraint: scanner stays evidence-based; the exemption is decided on decoded args at execution time Rejected: broad \p{P}\p{S}\p{Z} exemption | semantically significant nibble-sensitive symbols re-execute Rejected: execute decoded args after budget globally | review 4957008249 major blocker Confidence: high Scope-risk: narrow Reversibility: trivial Tested: 28 escaped-nonascii agent tests, 787 agent suite, 125 targeted matrix, 100 ai targeted Not-tested: none material Closes: #4627 review blockers
03a3338 to
c0d1bf9
Compare
|
Reconstructed onto live dev — exact head Verification re-run on the new head: 125/0 targeted escaped-nonascii matrix, 787/0 full The review-resolution comment below (all three blockers of 4957008249) applies verbatim to this head — the change set is identical. Fresh exact-head re-review still requested: @probepark @snowykr. On a fresh non-author approval the verdict flips to — |
probepark
left a comment
probepark
left a comment
There was a problem hiding this comment.
Independent maintainer review at exact head c0d1bf9d — merge blocked. The design moved in the right direction since my last review, but the code does not do what the title says.
what improved
The global terminal-guard removal is gone. The retry counter is bounded (MAX_ESCAPED_NONASCII_RESAMPLES = 2), malformed decoded JSON is caught first via incompleteArguments (agent-loop.ts:3528-3547) and produces a defined terminal error, schema validation still runs before dispatch (3582-3593), and completed surrogate pairs are treated as a single escaped scalar (json-parse.ts:153-164) so astral characters are rejected rather than split or executed. The broad \p{P}/\p{S}/\p{Z} exemption I blocked on is gone. Public types are not breakingly reshaped — packages/ai/src/types.ts is documentation-only, packages/agent/src/types.ts adds one optional property.
major 1 — the exemption runs before the budget, not after it
packages/agent/src/agent-loop.ts:2418-2430: the new message.content.every(...) clause skips the resample gate entirely for eligible calls. Zero resamples, straight to decoded execution.
The PR is titled "execute decoded JSON after escaped-nonascii resample budget". This is not that. It also contradicts AgentTool.displaySafeEscapedArgs's own documentation at packages/agent/src/types.ts:704-710. The whole justification for tolerating hand-escaped arguments is that the model was given its two chances to emit literal UTF-8 first; deleting that step removes the pressure that makes the fallback rare and turns it into the default path.
Move the exemption to terminal execution, after MAX_ESCAPED_NONASCII_RESAMPLES is exhausted.
major 2 — Ask opts its entire argument object into a display-only contract
packages/coding-agent/src/tools/ask.ts:737-743. The contract claims the data is display-only. Ask arguments are not: they carry IDs, deep-interview metadata, intent contracts and reviews, references, and workflow-gate metadata (ask-contract.ts:64-143), and some of it is persisted at ask.ts:767-805.
Because agent-loop.ts:219-239 accepts U+2014 anywhere in any nested key or value, an escaped em dash appearing in durable metadata now bypasses the guard too. A nibble error there corrupts recorded consent evidence, not a rendered question.
Make the exemption field/path-aware and scope it to actual question and option display strings. The Ask coupling does belong in this PR — a concrete tool has to opt in for the mechanism to mean anything — but not at whole-object granularity.
nit
agent-loop.ts:219: AgentTool<any> violates the no-any contract. Use AgentTool or a narrow structural type.
coverage — the one positive test pins the wrong behavior
packages/agent/test/agent-loop-escaped-nonascii-toolcall.test.ts:952-977 fails against the prior loop, so it is doing work, but it asserts mock.calls length 2 — it explicitly pins the zero-resample shortcut. Once major 1 is fixed this test must change.
There is no test where two escaped responses consume the budget and a third decoded response executes, which is the entire claimed behavior. The mutating-tool, en-dash, and currency/math/full-width/separator/letter/emoji rejection tests all pass on the prior fail-closed implementation. The added packages/ai/test/json-parse.test.ts scanner test also passes without source changes, since the scanner is intentionally unchanged.
merge precondition
Head conflicts with dev — packages/ai/CHANGELOG.md only, no code conflict. Rebase and recompute the digest; the verdict is bound to c0d1bf9d.
Reviewed by @probepark — method: detached worktree at c0d1bf9d, full read of the resample loop and terminal path in agent-loop.ts, surrogate-pair handling trace in json-parse.ts, exemption-surface audit against ask-contract.ts field inventory and the ask.ts persistence path, per-test would-this-fail-on-base analysis. Tests not executed.
gajae.pr-review-verdict.v1 merge-blocked sha256:ef034f5af2ca2621d773dd01b59135ebc7f4290ce343e8b05bde541d8c12cf9f reviewer:human reviewer-id:probepark evidence:exact-head-c0d1bf9d-exemption-applied-pre-budget-and-whole-object-ask-optin
…ack continuation Review of the reconstructed change found the steering installed only after the fallbackManaged branch returns, so coding-agent sessions (which run managed and own their retry through the session policy) kept re-issuing the defective request blind. The deterministic Hangul escaper cited in the PR body never saw the instruction. The typed escaped_arguments_discarded outcome now reports whether the discarded attempt still lacked a transient recovery instruction, and the session's retry continuation attaches exactly one such instruction through a new transientRecoveryMessage prompt option, consumed by the loop as a one-shot synthetic recovery on the first assistant request of the continuation. The instruction stays provider-only (never durable history, never a later request) and the terminal per-call rejection remains fail-closed; Yeachan-Heo#4627's decode-and-execute direction is still rejected. Lore-id: b7d2e4f1 Constraint: instruction must never enter durable history -- rides the existing synthetic recoveryMode path Constraint: steering is one-shot per logical turn; never re-attach after a steered attempt was itself discarded Rejected: steering every managed retry | a steered attempt that still escapes proves the instruction is not working; repeating it burns budget on identical requests Rejected: decoding the escapes and executing | one mistyped nibble is unverifiable after parse Confidence: high Scope-risk: narrow Reversibility: trivial Tested: managed AgentSession regression (fails without the fix); all 25 agent escaped-guard tests; 790 agent package tests Not-tested: none known
…nly tools Restore the fail-closed terminal escapedNonAsciiArguments rejection for every tool, then carve out exactly the motivating false positive: a tool that declares displaySafeEscapedArgs (user-facing question text that names no path, command, or identifier — currently only ask) executes without resampling when its decoded arguments contain nothing but benign typographic punctuation (curated set: U+2014 EM DASH). The json-parse scanner stays strict and still flags every non-ASCII escape; mutating tools and every other escaped character keep the two-resample budget and terminal rejection. Composes with the retained-guard + steering direction of #4632, which owns transient recovery steering. Red-team regressions cover: em-dash executes only on display-safe tools; the same payload on a mutating tool never executes; the nibble-adjacent en-dash (U+2013) and currency/math/full-width/separator/letter/emoji escapes stay rejected even on display-safe tools. Lore-id: 0f3c2a91 Constraint: mutating tools must never execute unverified \\uXXXX payloads Constraint: scanner stays evidence-based; the exemption is decided on decoded args at execution time Rejected: broad \p{P}\p{S}\p{Z} exemption | semantically significant nibble-sensitive symbols re-execute Rejected: execute decoded args after budget globally | review 4957008249 major blocker Confidence: high Scope-risk: narrow Reversibility: trivial Tested: 28 escaped-nonascii agent tests, 787 agent suite, 125 targeted matrix, 100 ai targeted Not-tested: none material Closes: #4627 review blockers
…ack continuation Review of the reconstructed change found the steering installed only after the fallbackManaged branch returns, so coding-agent sessions (which run managed and own their retry through the session policy) kept re-issuing the defective request blind. The deterministic Hangul escaper cited in the PR body never saw the instruction. The typed escaped_arguments_discarded outcome now reports whether the discarded attempt still lacked a transient recovery instruction, and the session's retry continuation attaches exactly one such instruction through a new transientRecoveryMessage prompt option, consumed by the loop as a one-shot synthetic recovery on the first assistant request of the continuation. The instruction stays provider-only (never durable history, never a later request) and the terminal per-call rejection remains fail-closed; Yeachan-Heo#4627's decode-and-execute direction is still rejected. Lore-id: b7d2e4f1 Constraint: instruction must never enter durable history -- rides the existing synthetic recoveryMode path Constraint: steering is one-shot per logical turn; never re-attach after a steered attempt was itself discarded Rejected: steering every managed retry | a steered attempt that still escapes proves the instruction is not working; repeating it burns budget on identical requests Rejected: decoding the escapes and executing | one mistyped nibble is unverifiable after parse Confidence: high Scope-risk: narrow Reversibility: trivial Tested: managed AgentSession regression (fails without the fix); all 25 agent escaped-guard tests; 790 agent package tests Not-tested: none known
c0d1bf9 to
a00ff6f
Compare
|
Review 4958187304 resolution — new exact head Major 1 (exemption ran before the budget) → FIXED. The Major 2 (whole-object ask opt-in) → FIXED. Nit ( Coverage. The zero-resample pin was replaced by the after-budget test. Mixed-batch behavior is pinned: the turn resamples (not every call display-safe), then per-call the benign Merge precondition → RESOLVED. Rebased onto Verification on Fresh exact-head re-review requested: @probepark @snowykr. — |
probepark
left a comment
probepark
left a comment
There was a problem hiding this comment.
Re-review at exact head a00ff6f4 — approved. Both majors are fixed, and fixed properly rather than argued away. This is a materially different PR from the one I blocked.
major 1 — exemption is now genuinely post-budget
The message.content.every(...) clause is gone from the resample gate. agent-loop.ts:2442-2448 now reads exactly as before the PR: any escaped tool call consumes a resample, unconditionally, up to MAX_ESCAPED_NONASCII_RESAMPLES. The model always gets its chances to re-emit literal UTF-8.
The exemption moved to agent-loop.ts:3565, inside executeToolCalls — a path only reached once the budget is spent. That is what the PR title claimed all along and now what the code does.
major 2 — the opt-in is field-scoped, and tighter than I asked for
ask.ts declares displaySafeEscapedArgFields = ["questions.question", "questions.options.label"]. Ids, deep-interview metadata, intent contracts and reviews, references, and workflow-gate metadata all stay fail-closed, including on the persisted path. That was the whole of my objection.
But the part I want to credit properly is DISPLAY_SAFE_ESCAPED_CODEPOINTS = new Set([0x2014]).
My original argument against tolerating primitives was that a mistyped nibble silently becomes a different valid character. A one-element allowlist closes that by construction: mistype any nibble of \u2014 and you get a codepoint that is not U+2014, which is not in the set, so the call is rejected. The failure mode I was defending against cannot occur. Combined with the path check — every non-ASCII character must be in a declared display field and be that one codepoint — the residual surface is a single typographic dash in text the user is about to read.
That is a real answer to the objection, not a narrower version of the same bet.
relationship to #4632
I approved #4632 (transient steering, guard fully fail-closed) earlier today, and these two touch the same hunks, so whichever lands second needs a rebase.
They are complementary rather than competing now: #4632 removes most escaped payloads before they ever reach terminal, and this PR handles the residue where the only offender is an em dash in display text — so a user's turn is not killed by a dash the model refused to stop escaping. I would land #4632 first, since it fixes the cause, then rebase this on top; the exemption gets exercised less often but is still the right terminal behavior.
I am withdrawing my earlier recommendation to close this in favor of #4632. At the head I reviewed then, that was the right call. At this head it is not.
coverage
The tests are the strongest part of the change:
- executes the benign em-dash ask case AFTER the resample budget on a display-safe tool
- never exempts escaped non-ASCII outside the declared display fields
- never executes the same em-dash payload when the tool is not display-safe
- rejects a nibble-adjacent symbol escape even on a display-safe tool
- rejects currency, math, full-width, separator, letter, and emoji escapes on a display-safe tool
- the
json-parsescanner still flags em dash and everything else — the exemption lives in the loop, not the scanner
The fourth one is the test I would have demanded, and it is there. The last one correctly pins that the scanner stays evidence-based, so the exemption cannot leak into a lower layer.
Ran locally: bun test packages/agent/test/agent-loop-escaped-nonascii-toolcall.test.ts packages/ai/test/json-parse.test.ts — 68 pass, 0 fail, 215 assertions.
sweep
No added any, ReturnType<>, inline dynamic imports, console.*, or mock.module(). Both changelog entries under ## [Unreleased].
Reviewed by @probepark — method: detached worktree at a00ff6f4, verification that the resample gate no longer short-circuits, confirmation the exemption sits in executeToolCalls past the budget, read of the codepoint set and path matcher to test the mistyped-nibble argument against the new design, field-inventory cross-check against ask-contract.ts, focused test run.
gajae.pr-review-verdict.v1 merge-approved sha256:3342ae3f566af11dd51da79d35e6bba3ebb8aa5da4d5119b2d1b1df36d5a2313 reviewer:human reviewer-id:probepark evidence:exact-head-a00ff6f4-exemption-post-budget-single-codepoint-allowlist-closes-nibble-argument-68-pass-0-fail
|
TERMINAL: merged to
Terminal verdict line for the record: Lane retired. No release/tag/publish performed. — |
…ack continuation Review of the reconstructed change found the steering installed only after the fallbackManaged branch returns, so coding-agent sessions (which run managed and own their retry through the session policy) kept re-issuing the defective request blind. The deterministic Hangul escaper cited in the PR body never saw the instruction. The typed escaped_arguments_discarded outcome now reports whether the discarded attempt still lacked a transient recovery instruction, and the session's retry continuation attaches exactly one such instruction through a new transientRecoveryMessage prompt option, consumed by the loop as a one-shot synthetic recovery on the first assistant request of the continuation. The instruction stays provider-only (never durable history, never a later request) and the terminal per-call rejection remains fail-closed; Yeachan-Heo#4627's decode-and-execute direction is still rejected. Lore-id: b7d2e4f1 Constraint: instruction must never enter durable history -- rides the existing synthetic recoveryMode path Constraint: steering is one-shot per logical turn; never re-attach after a steered attempt was itself discarded Rejected: steering every managed retry | a steered attempt that still escapes proves the instruction is not working; repeating it burns budget on identical requests Rejected: decoding the escapes and executing | one mistyped nibble is unverifiable after parse Confidence: high Scope-risk: narrow Reversibility: trivial Tested: managed AgentSession regression (fails without the fix); all 25 agent escaped-guard tests; 790 agent package tests Not-tested: none known
…ack continuation Review of the reconstructed change found the steering installed only after the fallbackManaged branch returns, so coding-agent sessions (which run managed and own their retry through the session policy) kept re-issuing the defective request blind. The deterministic Hangul escaper cited in the PR body never saw the instruction. The typed escaped_arguments_discarded outcome now reports whether the discarded attempt still lacked a transient recovery instruction, and the session's retry continuation attaches exactly one such instruction through a new transientRecoveryMessage prompt option, consumed by the loop as a one-shot synthetic recovery on the first assistant request of the continuation. The instruction stays provider-only (never durable history, never a later request) and the terminal per-call rejection remains fail-closed; Yeachan-Heo#4627's decode-and-execute direction is still rejected. Lore-id: b7d2e4f1 Constraint: instruction must never enter durable history -- rides the existing synthetic recoveryMode path Constraint: steering is one-shot per logical turn; never re-attach after a steered attempt was itself discarded Rejected: steering every managed retry | a steered attempt that still escapes proves the instruction is not working; repeating it burns budget on identical requests Rejected: decoding the escapes and executing | one mistyped nibble is unverifiable after parse Confidence: high Scope-risk: narrow Reversibility: trivial Tested: managed AgentSession regression (fails without the fix); all 25 agent escaped-guard tests; 790 agent package tests Not-tested: none known
…nly tools (Yeachan-Heo#4627) Restore the fail-closed terminal escapedNonAsciiArguments rejection for every tool, then carve out exactly the motivating false positive: a tool that declares displaySafeEscapedArgs (user-facing question text that names no path, command, or identifier — currently only ask) executes without resampling when its decoded arguments contain nothing but benign typographic punctuation (curated set: U+2014 EM DASH). The json-parse scanner stays strict and still flags every non-ASCII escape; mutating tools and every other escaped character keep the two-resample budget and terminal rejection. Composes with the retained-guard + steering direction of Yeachan-Heo#4632, which owns transient recovery steering. Red-team regressions cover: em-dash executes only on display-safe tools; the same payload on a mutating tool never executes; the nibble-adjacent en-dash (U+2013) and currency/math/full-width/separator/letter/emoji escapes stay rejected even on display-safe tools. Lore-id: 0f3c2a91 Constraint: mutating tools must never execute unverified \\uXXXX payloads Constraint: scanner stays evidence-based; the exemption is decided on decoded args at execution time Rejected: broad \p{P}\p{S}\p{Z} exemption | semantically significant nibble-sensitive symbols re-execute Rejected: execute decoded args after budget globally | review 4957008249 major blocker Confidence: high Scope-risk: narrow Reversibility: trivial Tested: 28 escaped-nonascii agent tests, 787 agent suite, 125 targeted matrix, 100 ai targeted Not-tested: none material Closes: Yeachan-Heo#4627 review blockers Co-authored-by: Yeachan-Heo <yeachan-heo@gajae.dev>
…ack continuation Review of the reconstructed change found the steering installed only after the fallbackManaged branch returns, so coding-agent sessions (which run managed and own their retry through the session policy) kept re-issuing the defective request blind. The deterministic Hangul escaper cited in the PR body never saw the instruction. The typed escaped_arguments_discarded outcome now reports whether the discarded attempt still lacked a transient recovery instruction, and the session's retry continuation attaches exactly one such instruction through a new transientRecoveryMessage prompt option, consumed by the loop as a one-shot synthetic recovery on the first assistant request of the continuation. The instruction stays provider-only (never durable history, never a later request) and the terminal per-call rejection remains fail-closed; Yeachan-Heo#4627's decode-and-execute direction is still rejected. Lore-id: b7d2e4f1 Constraint: instruction must never enter durable history -- rides the existing synthetic recoveryMode path Constraint: steering is one-shot per logical turn; never re-attach after a steered attempt was itself discarded Rejected: steering every managed retry | a steered attempt that still escapes proves the instruction is not working; repeating it burns budget on identical requests Rejected: decoding the escapes and executing | one mistyped nibble is unverifiable after parse Confidence: high Scope-risk: narrow Reversibility: trivial Tested: managed AgentSession regression (fails without the fix); all 25 agent escaped-guard tests; 790 agent package tests Not-tested: none known
2 participants
What
The escaped-non-ASCII argument guard keeps its fail-closed terminal rejection and its unconditional two-resample budget for every tool and every field. After the budget is spent, a tool that enumerated its user-facing display fields (
displaySafeEscapedArgFields;askexempts onlyquestions.questionandquestions.options.label) executes when every non-ASCII character lives inside those fields and is benign typographic punctuation (curated set: U+2014 EM DASH only).Why
Deep-interview
askprompts whose only non-ASCII was an em-dash were rejected after two resamples, so the user never saw the question. Both maintainer reviews (4957008249, 4958187304) shaped this reduction:\uXXXXpayloads.MAX_ESCAPED_NONASCII_RESAMPLES; the gate skip is gone (major 1 resolved).askopts in onlyquestions.questionandquestions.options.label; ids, deep-interview metadata (intent contracts/reviews/references), and workflow-gate metadata keep the fail-closed rejection, and any escaped non-ASCII outside the enumerated fields rejects (major 2 resolved). Non-ASCII object keys are never exempted.any— the helper takesAgentTool<TSchema>(nit resolved).dev(ceb31349); thepackages/ai/CHANGELOG.mdconflict is resolved keeping both entries (merge precondition resolved).Behavior after this change
askquestion: 1 original + 2 resamples, then executes (question reaches the user) — the motivating fix.\uXXXXrejection.deepInterview/ids/any non-display field ofask: budget, then terminal rejection (field-scoped).ask.askcall executes while the non-safe call rejects terminally, per-call.Testing
29 tests in the escaped-nonascii suite (4 original red-team + after-budget execution + field-scope negative + mixed-batch), plus a 9-case external adversarial harness (astral emoji, non-ASCII object keys, deep nesting, mixed batches, unknown tool fail-closed, nibble-adjacent dashes, lone surrogate, schema-ordering) — all pass.
Binary SHA-256 (same builder/toolchain): base
ceb31349→e6e53364…lineage; heada00ff6f4→a30aab82…053.Attribution: single commit authored as
Yeachan-Heo <yeachan-heo@gajae.dev>on livedev(ceb31349). Every earlier head (3353a67,a2d1a5c8,ae592d88,03a33380,c0d1bf9d), verdict, and CI run is void.GJC verdict
Fresh exact head
a00ff6f431dd6333f8aeed5f7e7b01a13a49cf29, baseceb31349c2d024c75825c819cb530d5060f49380. No approving review on this head yet.Approved by @probepark at exact head
a00ff6f4(authenticated review 4963160294,writeauthority, independent non-author) with the merge-approved verdict line quoted above.devbun checkpasses (per-packagerun check= biome + tsc, all three touched packages clean)