fix: audit wave 2026-08-15 — docs align, backlog tests, card invalidation, fingerprint verdict - #51
Merged
Merged
Conversation
Restore fine-grained same-host live convergence for the open Advisor
settings card (audit finding 003 / residual R3). The 20260811 dsh
snapshot removed the settings/changed + models/changed host passthroughs
from the client runtime Events vocabulary, leaving only connection/reset.
Probe (Task 0, pinned ^0.1.0-rc.6, installed rc.6 — both ends confirmed):
- settings/document-updated(ns, revision): void — forwarded Host event,
dsh-api-remotes API_REMOTE_FORWARDED_EVENTS allowlist (rc.6
remote-events.d.ts:16; source packages/api/remotes/src/remote-events.ts:28);
payload typing at dsh-settings types.d.ts:43.
- llm/adapters-updated(): void — same allowlist (:27); typing at
dsh-llm types.d.ts:21. Fires after provider/model registry mutations
(llm/src/index.ts:302).
- Consumption surface is NOT ctx.on: both arrive on the client remote
face via ctx.remote.$on (TypertClientRemote, dsh-typert-protocol
types.d.ts:202; legal key set = TypertRemoteEvent). connection/reset
stays on ctx.on. Upstream reference: dsh-client-ui-settings
SettingsScopeBinder (lib/client.js:216) uses the same dual plane.
Change: the invalidation ctx.effect now registers remote.$on for both
granular events alongside ctx.on('connection/reset'), sharing the
existing microtask debounce (bursts coalesce; refreshIfLoaded keeps an
unopened card idle). remote is resolved via ctx.get (not injected) and
feature-detected: a shell without the service keeps reset-only behavior,
no throw on registration. Type face imported type-only from the declared
peer dsh-typert-protocol (erased at build; bundle purity re-verified).
Tests: fakeRuntime gains a remote $on mock; 3 new apply-wiring tests
(subscription + burst coalescing + separate-tick refresh; idle store no
fetch; graceful degrade when remote absent). 329/329 suite, typecheck,
build green.
Manual QA (QA gate): open Advisor card, change model on Models page —
card model list updates without reconnect; unopened card does not fetch.
…on needed) Benchmark-gated audit finding 004: fingerprintOf is O(prefix) per DeltaRenderer update (replay check :280 + tail assignment :290). Vitest bench on the real public API (tests/bench-fingerprint.bench.ts, Apple M1 Max, Node v24.18.0, vitest 3.2.7, 16-char message ids, 4 runs): N full fingerprint (2x hash) incremental append (1 event) 500 0.14-0.16 ms/op 0.07-0.08 ms/op 2000 0.57-0.64 ms/op 0.28-0.32 ms/op 10000 2.78-3.19 ms/op 1.40-1.59 ms/op Spec-004 Task 1 STOP rule: append-path fingerprint work < 1 ms/op at N=2000 -> no optimization. Measured upper bound (full two-hash recompute, the exact cost the hot append path pays) is ~0.6 ms/op at N=2000, below threshold with ~40% margin; incremental append is ~0.3 ms/op. The fingerprint is a defensive fallback - authoritative rewrite triggers (compact/*, surfaceOp replace) reset without it. Verdict: no-op; no src/transcript.ts change.
…e tests, bench header, peer pin
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Executes all four findings from the 2026-08-15 codebase audit (
.mstar/plans/audit-2026-08-15/) in one round.autoInstallPeers: true+~/.npmrcauth,prepare: pnpm build); stalesettings/changed/models/changedcomments inadvisor-store.tsnow describeconnection/reset → refreshIfLoaded → load(); knowledge docs annotated superseded. Zero behavior change.maxQueueddrop-newest + FIFO order (gate-driven drain, no wall-clock flake). Test-only; also fixed an off-by-one in the audit plan's arithmetic.ctx.remote.$on('settings/document-updated')+('llm/adapters-updated')(probe-corrected: forwarded host events on the rc.6 allowlist, dual plane withconnection/reset), feature-detected and gracefully degrading. Closes residual R3.src/transcript.tsuntouched; reproducible bench kept (tests/bench-fingerprint.bench.ts, excluded from the run suite).Gates
Test plan
pnpm typecheckcleanpnpm test— 330 passed (326 baseline + 4 new)pnpm build— clean, bundle purity intact (type-only peer import)