mirror of
https://github.com/dtzp555-max/olp.git
synced 2026-07-21 21:15:10 +00:00
cold-audit catch from 2026-05-24 (round 5)
Round-5 cold-audit cleanup batch. 8 items + 1 release-discipline
reconciliation. Largest batch by line count (582+/39-) but every item
is small-and-focused. 3 P2 items (F1/F3/F5 of which F3 + F1 are real
correctness/observability fixes; F5 backfills /health to spec).
Changes (10 files, +583/-39):
**P2 fixes**
1. **F1 — ALIGNMENT.md mistral authority pin self-contradicted plugin**
(ALIGNMENT.md): row cited `vibe --prompt --output json` but mistral.mjs
uses `--output streaming` (the plugin header at lines 360-369 even
justifies WHY: `--output json` emits single blob, breaks NDJSON
line-buffered parser). Constitution self-contradicting itself —
missed across 4 prior rounds. Pin updated to `--output streaming`
with DOCS-1 reference.
2. **F3 — Deterministic function_call synth ID**
(lib/ir/openai-to-ir.mjs): deprecated `function_call` translation
produced `id: \`fc-${Date.now()}\`` → ID flows into normalized
tool_calls → cache key SHA-256. Two identical requests separated
by ≥1ms → different cache keys → cache always misses for
`function_call` request shape. Violates ADR 0005 invariant
"same inputs → same key, no random, no timestamp."
Fixed: id is now `fc-<16-hex>` from SHA-256 of `${name}\0${arguments}`.
NUL separator prevents the (name='ab',args='c') vs (name='a',args='bc')
collision. 2^64 collision resistance is more than sufficient for
tool_call ID disambiguation (per-request semantic key, not crypto
primitive).
**P3 fixes**
3. **F5 — /health invokes per-plugin healthCheck()** (server.mjs +
docs/openai-spec-pin.md): ADR 0002 says "healthCheck — startup AND
/health endpoint use this." Pre-D33 /health returned only
{enabled, available} counts. Now async, iterates loadedProviders,
awaits each plugin's healthCheck() in try/catch. Returns
`providers: {enabled, available, status: {<name>: {ok, latencyMs?, error?}}}`.
4. **F8 — X-OLP-Cache reports fallback-hop cache hits** (server.mjs):
pre-D33 cacheStatus computed from `preCheckHit && fallbackHops === 0`
— only counted primary-hop cache hits. When fallback fires + the
fallback hop's getOrCompute returns from cache, header reported
`miss` despite no spawn happening.
Fixed: peek BEFORE getOrCompute inside executeHopFn, set
`lastHopWasCached` closure variable on every hop (last-write-wins
= serving hop's state). cacheStatus combines
`lastHopWasCached || (preCheckHit && fallbackHops === 0)`.
F8 chose option (b) peek-then-getOrCompute over option (a)
getOrCompute API change because option (a) would break ~15 test
callsites for marginal benefit. Accepted race window same as
existing preCheckHit pattern.
5. **F9 — validateProvider hints error message updated** (lib/providers/
base.mjs): pre-D33 message listed cacheable as missing and
maxSpawnTimeMs as required. Now: `'hints must be an object with
{ requiresTTY, concurrentSpawnSafe, maxConcurrent } + optional
{ maxSpawnTimeMs, cacheable }'`.
6. **F10 — Dead cache-write branch removed** (server.mjs): the
`if (hasStopChunk)` check in the streaming stop-less exhaustion
branch was unreachable (the stop-chunk completion path returns
earlier inside the for-await loop). Removed the dead code + added
a comment documenting the invariant.
**Governance/policy**
7. **F11 — Phase rolling mode policy formalized** (CLAUDE.md +
CHANGELOG.md): 22+ D-day commits accumulated under "Unreleased"
without per-D version bumps — Iron Rule 5 (release-kit bump-before-
push) appeared to be silently violated. Reality: per-D bumps would
produce 30+ noise tags during Phase 1. F11 formalizes the policy:
intra-Phase D-day commits accumulate under Unreleased; bump+tag
fires explicitly at Phase close (maintainer-triggered, not
automated). CLAUDE.md release_kit overlay gains `phase_rolling_mode`
block documenting the exception with self-pointer ("if Rule 5
appears silently violated, check this section first"). CHANGELOG
"Unreleased" gets a notice at top.
**No version bump, no git tag in D33** — policy formalization only.
8. **F12 — /v1/models created is stable per-model timestamp**
(models-registry.json + lib/providers/index.mjs + server.mjs +
docs/openai-spec-pin.md): pre-D33 used Math.floor(Date.now()/1000)
per request — violates OpenAI spec which treats `created` as
per-model attribute. Clients caching models by created would see
spurious updates on every poll.
Fixed: models-registry.json gains `bootstrapCreated: 1778630400`
top-level constant + per-model `created` fields where known
(anthropic claude-{opus,sonnet,haiku} with estimated release dates;
devstral models from "25-12" suffix; codex models pinned to
bootstrap pending verified release dates). handleModels uses
`getModelCreated(modelId)` helper from lib/providers/index.mjs.
Aliases share canonical's timestamp.
**Tests** (test-features.mjs): 401 → 414 (+13):
- F3 ×3 (same input → same id → same cache key; different name → different)
- F5 ×4 (empty/single/multi/throwing-plugin /health shapes)
- F8 ×1 (2-hop primary-fail + secondary-cache-hit → X-OLP-Cache: hit)
- F12 ×5 (stability/fallback/alias-equals-canonical)
Pre-commit fold-in (per evidence-first checkpoint #4):
- **D33 reviewer flagged F3 empty-args asymmetry** (Concern #1): hash
input used `?? ''` (empty stays) but emitted IR field used
`|| '{}'` (empty becomes '{}'). Consequence: `arguments: ''` and
`arguments: '{}'` emit identical IR but compute different ids →
different cache keys for semantically-identical requests. The exact
cache-stability bug F3 was supposed to fix.
Folded in: canonicalize empty-args to '{}' BEFORE hashing. Hash
input now matches IR emission exactly. Same line change resolves
the asymmetry.
Authority:
- ALIGNMENT.md self-amendment (F1 pin correction)
- ADR 0005 invariant "same inputs → same key, no random, no timestamp"
(F3 restoration)
- ADR 0002 § Provider contract "/health uses healthCheck" (F5)
- ADR 0004 § Observability headers (F8 X-OLP-Cache correctness)
- ADR 0005 § Cache write conditions item 1 (F10 truncation-not-cached
invariant explicit)
- Iron Rule 5 (F11 release-kit reconciliation)
- OpenAI /v1/models spec — `created` per-model stable (F12)
- CC 开发铁律 v1.6 § 10.x — Round-5 Cold Audit caught all 8
Reviewer (Iron Rule v1.6 § 10.x Mode A, fresh-context opus, independent
of drafter): APPROVE_WITH_MINOR. Verified:
- F1 plugin cross-reference (mistral.mjs:360-369) accurately documents
the rationale
- F3 collision resistance + NUL separator + restored cache invariant
- F5 all 4 cases (empty/single/multi/throwing) work
- F8 closure semantics across multi-hop chains (verified hop-fail +
fallback-hit case)
- F10 dead code removal preserves the stop-chunk completion path
- F11 phase_rolling_mode policy honest about what happened and what
the going-forward rule is
- F12 stability across consecutive /v1/models calls; alias-canonical
parity
- 414/414 tests pass
3 remaining non-blocking suggestions (F3-vs-modern-tool_calls path
canonicalization symmetry; F12 codex models explicit-vs-fallback
writeup mismatch; F8 servingHopWasCached naming) tracked as future
polish; not folded.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
218 lines
7.8 KiB
JavaScript
218 lines
7.8 KiB
JavaScript
/**
|
|
* lib/ir/openai-to-ir.mjs — OpenAI Chat Completions → IR v1.0 translation
|
|
*
|
|
* Authority: ADR 0003 § "Translation direction model" and § "Required/Optional fields"
|
|
* Entry-surface authority: OpenAI Chat Completions API
|
|
* https://platform.openai.com/docs/api-reference/chat/create
|
|
*
|
|
* This is the entry adapter — the single point where an OpenAI-shaped request
|
|
* is normalized into the IR. Provider plugins never see the OpenAI shape;
|
|
* they receive only the IR (ADR 0003 § "IR is not exposed externally").
|
|
*/
|
|
|
|
import { createHash } from 'node:crypto';
|
|
import { IR_VERSION, validateIRRequest } from './types.mjs';
|
|
|
|
// ── Custom error ──────────────────────────────────────────────────────────
|
|
|
|
export class BadRequestError extends Error {
|
|
/** @param {string} message */
|
|
constructor(message) {
|
|
super(message);
|
|
this.name = 'BadRequestError';
|
|
this.statusCode = 400;
|
|
}
|
|
}
|
|
|
|
// ── Role normalization ────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* OpenAI deprecated role='function' in favour of role='tool'.
|
|
* Per ADR 0003, IR supports system/user/assistant/tool.
|
|
* @param {string} role
|
|
* @returns {string}
|
|
*/
|
|
function normalizeRole(role) {
|
|
if (role === 'function') return 'tool';
|
|
return role;
|
|
}
|
|
|
|
// ── Message translation ───────────────────────────────────────────────────
|
|
|
|
/**
|
|
* @param {object} msg - an OpenAI message object
|
|
* @returns {import('./types.mjs').IRMessage}
|
|
*/
|
|
function translateMessage(msg) {
|
|
if (!msg || typeof msg !== 'object') {
|
|
throw new BadRequestError('Each message must be an object');
|
|
}
|
|
|
|
const irMsg = {
|
|
role: normalizeRole(msg.role),
|
|
content: msg.content ?? '',
|
|
};
|
|
|
|
// content can be null for tool/function calls in OpenAI shape — normalise to ''
|
|
if (irMsg.content === null) {
|
|
irMsg.content = '';
|
|
}
|
|
|
|
if (msg.name !== undefined) {
|
|
irMsg.name = String(msg.name);
|
|
}
|
|
if (msg.tool_call_id !== undefined) {
|
|
irMsg.tool_call_id = String(msg.tool_call_id);
|
|
}
|
|
// OpenAI also uses function_call (deprecated) — treat as equivalent to tool_calls
|
|
if (Array.isArray(msg.tool_calls) && msg.tool_calls.length > 0) {
|
|
irMsg.tool_calls = msg.tool_calls.map(tc => ({
|
|
id: tc.id,
|
|
type: 'function',
|
|
function: {
|
|
name: tc.function?.name ?? '',
|
|
arguments: tc.function?.arguments ?? '',
|
|
},
|
|
}));
|
|
} else if (msg.function_call && typeof msg.function_call === 'object') {
|
|
// Deprecated OpenAI function_call field — map to single tool_calls entry.
|
|
// ID is deterministic: sha256(name + NUL + arguments).slice(0,16) so that
|
|
// two identical function_call requests produce the same IR → same cache key.
|
|
// Using Date.now() here would violate ADR 0005 invariant "same inputs → same key,
|
|
// no random, no timestamp" (F3 cold-audit finding, round-5).
|
|
const fcName = msg.function_call.name ?? '';
|
|
// Canonicalize empty-args to '{}' BEFORE hashing so the hash input matches the
|
|
// emitted IR field exactly. Otherwise `arguments: ''` and `arguments: '{}'` would
|
|
// emit identical IR but compute different ids → different cache keys for
|
|
// semantically-identical requests. Folded in per D33 F3 reviewer non-blocking #1.
|
|
const fcArgs = msg.function_call.arguments || '{}';
|
|
const fcKey = createHash('sha256')
|
|
.update(`${fcName}\0${fcArgs}`)
|
|
.digest('hex')
|
|
.slice(0, 16);
|
|
irMsg.tool_calls = [{
|
|
id: `fc-${fcKey}`, // deterministic — same input → same id
|
|
type: 'function',
|
|
function: {
|
|
name: fcName,
|
|
arguments: fcArgs,
|
|
},
|
|
}];
|
|
}
|
|
|
|
return irMsg;
|
|
}
|
|
|
|
// ── Tool definitions ──────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* @param {object[]} tools - OpenAI tools array
|
|
* @returns {import('./types.mjs').IRToolDefinition[]}
|
|
*/
|
|
function translateTools(tools) {
|
|
if (!Array.isArray(tools)) return [];
|
|
return tools.map((t, i) => {
|
|
if (t.type !== 'function' || !t.function) {
|
|
throw new BadRequestError(`tools[${i}]: only type='function' tools are supported in IR v1.0`);
|
|
}
|
|
return {
|
|
type: 'function',
|
|
function: {
|
|
name: t.function.name,
|
|
...(t.function.description !== undefined && { description: t.function.description }),
|
|
...(t.function.parameters !== undefined && { parameters: t.function.parameters }),
|
|
},
|
|
};
|
|
});
|
|
}
|
|
|
|
// ── Main translator ───────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Translates an OpenAI Chat Completions request body into IR v1.0.
|
|
*
|
|
* Throws BadRequestError on validation failure.
|
|
*
|
|
* @param {object} openAIRequest - parsed JSON body from POST /v1/chat/completions
|
|
* @returns {import('./types.mjs').IRRequest}
|
|
*/
|
|
export function openAIToIR(openAIRequest) {
|
|
if (!openAIRequest || typeof openAIRequest !== 'object') {
|
|
throw new BadRequestError('Request body must be a JSON object');
|
|
}
|
|
|
|
if (!openAIRequest.model || typeof openAIRequest.model !== 'string') {
|
|
throw new BadRequestError('Request body must include a non-empty "model" string');
|
|
}
|
|
|
|
if (!Array.isArray(openAIRequest.messages) || openAIRequest.messages.length === 0) {
|
|
throw new BadRequestError('Request body must include a non-empty "messages" array');
|
|
}
|
|
|
|
/** @type {import('./types.mjs').IRRequest} */
|
|
const ir = {
|
|
irVersion: IR_VERSION,
|
|
model: openAIRequest.model,
|
|
stream: openAIRequest.stream === true,
|
|
messages: openAIRequest.messages.map((m, i) => {
|
|
try {
|
|
return translateMessage(m);
|
|
} catch (e) {
|
|
throw new BadRequestError(`messages[${i}]: ${e.message}`);
|
|
}
|
|
}),
|
|
};
|
|
|
|
// Optional numeric fields — type-coerce if needed
|
|
if (openAIRequest.max_tokens !== undefined && openAIRequest.max_tokens !== null) {
|
|
const v = Number(openAIRequest.max_tokens);
|
|
if (!Number.isInteger(v) || v <= 0) {
|
|
throw new BadRequestError('max_tokens must be a positive integer');
|
|
}
|
|
ir.max_tokens = v;
|
|
}
|
|
|
|
if (openAIRequest.temperature !== undefined && openAIRequest.temperature !== null) {
|
|
const v = Number(openAIRequest.temperature);
|
|
if (isNaN(v) || v < 0 || v > 2) {
|
|
throw new BadRequestError('temperature must be a number in [0, 2]');
|
|
}
|
|
ir.temperature = v;
|
|
}
|
|
|
|
if (openAIRequest.top_p !== undefined && openAIRequest.top_p !== null) {
|
|
const v = Number(openAIRequest.top_p);
|
|
if (isNaN(v) || v < 0 || v > 1) {
|
|
throw new BadRequestError('top_p must be a number in [0, 1]');
|
|
}
|
|
ir.top_p = v;
|
|
}
|
|
|
|
if (openAIRequest.stop !== undefined && openAIRequest.stop !== null) {
|
|
if (typeof openAIRequest.stop !== 'string' && !Array.isArray(openAIRequest.stop)) {
|
|
throw new BadRequestError('stop must be a string or array of strings');
|
|
}
|
|
ir.stop = openAIRequest.stop;
|
|
}
|
|
|
|
if (openAIRequest.tools !== undefined && openAIRequest.tools !== null) {
|
|
ir.tools = translateTools(openAIRequest.tools);
|
|
}
|
|
|
|
if (openAIRequest.tool_choice !== undefined && openAIRequest.tool_choice !== null) {
|
|
ir.tool_choice = openAIRequest.tool_choice;
|
|
}
|
|
|
|
if (openAIRequest.response_format !== undefined && openAIRequest.response_format !== null) {
|
|
ir.response_format = openAIRequest.response_format;
|
|
}
|
|
|
|
// Validate the constructed IR — belt-and-suspenders
|
|
const { valid, errors } = validateIRRequest(ir);
|
|
if (!valid) {
|
|
throw new BadRequestError(`IR validation failed: ${errors.join('; ')}`);
|
|
}
|
|
|
|
return ir;
|
|
}
|