Skip to content

fix(kiro): reject unverified output-limit enforcement - #1263

Merged
bloodf merged 10 commits into
mainfrom
v5/1078
Oct 21, 2026
Merged

bloodf merged 10 commits into
mainfrom
v5/1078

Conversation

@bloodf

@bloodf bloodf commented Oct 9, 2026 •

Copy link
Copy Markdown
Owner

Current integration checkpoint — 2026-10-21

Append-only head 32d5155658434ff12e80e1f1f43cfa64924d632b, base 517378cfdd34ed5109986278e2e0bcf96082d43e. Standalone output-ceiling rejection, no image PR bundled. Independent source review passed. Trusted external FULL:13,451 passed,0 failed,66 pending; lint/build/website/docs/catalog/inventory/commitlint passed, empty baseline. Receipt 64beb8921a4f1d0d7ed7e68139a7d34d0c8d2bc33c4dbe8a88ad7d21c4118379. Pending assertions not executed. Native passthrough unchanged; rejection is not enforcement support.

Current scope and review state — 2026-10-19

Reject explicit Kiro output ceilings that this transport cannot verify, while preserving uncapped behavior and native settings. Keep both Kiro and current-main Cursor output-limit coverage when reconciling the model matrix.

Repairs and reconciliation

Resolved the coverage-test conflict without dropping either Kiro or Cursor assertions; added public documentation of Kiro output-limit rejection.

This head also retains the shared macOS fixture repair originating at 42267fb63e70e5d7c49e571230347ff2beb88f29: canonicalize the child fixture working directory so /var and /private/var aliases do not cause a false boundary failure. This is a test-fixture correction, not a relaxation of the production boundary.

Verification and remaining gates

  • Final source review follow-up: six opt-in live-test dispatches still supplied ceilings that Kiro deliberately rejects. A shared pure test helper now omits those ceilings for Kiro positive cases while preserving other providers’ limits, all opt-in/skip guards, and explicit 400 rejection controls. The 24 extracted format builders retain their original construction. Offline regression reproduced 27 failures before repair; the reviewed working candidate then passed 164/164 assertions across five files, zero skips. Independent review bound those tested source bytes to final commit 55eac39a4a00fa7964ba4c5f4903ea78ce8f87d9; all nine changed files passed lint, and required pinned commit-range/title lint passed. Production code is unchanged. No live provider calls or live acceptance are claimed.
  • Preceding-head neighboring regression repair (ff69d66b5f21761f1d5753c97b6cbe5c97edc1ec): the earlier full run failed because an unrelated Kiro model-ID fixture supplied max_tokens: 128, now deliberately rejected by the source contract. The corrected positive case omits the ceiling and retains every model-ID assertion; added controls assert the exact 400 rejection in streaming and nonstreaming modes. Production code is unchanged. 282/282 assertions across five files passed with zero skips, plus focused lint and pinned commitlint. Independent review accepted the source contract, RED/GREEN oracle and committed bytes. The earlier failed full receipt remains recorded.
  • Preceding-head evidence: 24c8c014401b7fa9c338c7564a907f6f184ebb06 passed 833 expanded offline assertions across 62 files, with zero failures and exact executed-file inventory. Root lint, docs, and pinned commitlint also passed that preceding candidate. These counts do not certify the newer head above.
    Current-head full checkpoint: PASS. Independently authenticated 55eac39a4a00fa7964ba4c5f4903ea78ce8f87d9 against main e94884312ff6651f80d13f1c862e54a916bc870e: 1,424 eligible test files in four sequential batches; 12,668 passed, 0 failed, 65 reviewed conditional skips. Skipped assertions were not executed and are not counted as passes. Root lint, production build, repository consistency checks and pinned commit-range/title lint passed; website build/docs checks passed. Receipt SHA-256: 0fed5fa80327cf37e942c310e0b4927fb575e171d00317448372a1786157b54a. Runner SHA-256: 459ecc7a85ce5d2ea2b3dd8fdccdbd971f7135c800944d36219c601cba499d9c. Source continuity: exact first-comment normalization independently verified; all remaining bundle bytes match HEAD. The external reviewed runner reused only hash-verified independent copies of matching locked dependency installations. This is offline gate evidence; live-provider, deployment and other platform acceptance remain limited to separately recorded tests.
  • No new live-provider, browser, or platform-wide acceptance is inferred from offline tests. No baseline failures were added.

The GitHub ruleset requires zero approving reviews and requires resolved review threads. The repository’s independent local review contract still applies. Required exact-head V5 Local CI, strict up-to-date integration, and thread resolution must be satisfied before a later maintainer merge; Vercel success alone is insufficient.

Older statements below about draft publication, missing administrator/confinement proof, mandatory GitHub approving reviews, or unreconciled predecessor work are historical and are superseded by this current section. Older test counts and receipts apply only to their named heads.

Preserved prior PR description and historical evidence

The following is historical context; current scope and verification above supersede stale readiness, gate, dependency and environment claims. Earlier counts apply only to their named heads.

Scope

Kiro translator (openai-to-kiro.js) now rejects requests that rely on unverified output-limit enforcement; updates kiro, coverage-all-models and commandcode outbound validation tests.

Evidence

Local evidence (not CI): tests/.test-results.json in wt-1078: success=true, 12331/12397 passed, 0 failed. Source tests/lint/review passed previously per checkpoint; publication commitlint blocked locally (missing @commitlint/config-conventional); docs gate passed (wt1082).

Docs

No docs files changed in this commit.

Status

Draft. Not integrated; CI pending. No baseline additions. Not a claim that the full roadmap is complete.

Related issue: #1078. Acceptance remains tracked separately.

Review readiness update — 2026-10-09

Ready for review of the stated, finished PR scope; not ready to merge. This update supersedes earlier draft/parent-only publication wording without removing the original body or user notes.

  • Audited head: ba39f97698562f5fa5488e99c211e9049c5351ad; current main at audit: e51ab1c089800c2a70587822189997c482f53654.
  • Required V5 Local CI: missing. No success status is published by this update.
  • Merge requires actual full-CI success for the final exact head, strict up-to-date main, required reviews and resolved review threads. Any rebase or new head invalidates previous head-bound evidence.
  • Missing administrator/confinement proof blocks the serial full-CI/merge path, not review readiness. No gate is waived; no build or test was run for this update.

Retained implementation evidence supports review of the stated PR scope. Historical test counts and older successful checks do not establish integration with current main or a current full-CI pass. Prior local publication notes are historical; no gates were rerun by this delivery worker.

Return explicit client errors rather than silently replacing requested caps.
Refs #1078
@vercel

vercel Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
durindoor Ignored Ignored Preview Oct 21, 2026 8:35pm UTC

Request Review

@bloodf
bloodf marked this pull request as ready for review October 9, 2026 22:13
@bloodf bloodf added area:protocol Protocol correctness and client compatibility priority:P1 First: correctness, safety or accounting risk type:bug Verified existing behavior defect labels Oct 19, 2026 — with ChatGPT Codex Connector
@bloodf
bloodf merged commit d6fabe1 into main Oct 21, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:protocol Protocol correctness and client compatibility priority:P1 First: correctness, safety or accounting risk type:bug Verified existing behavior defect

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant