refactor(jev): share bounded System One exchange across decision questions

[geunwoojun99]

Summary

• P0-only refresh of refactor(jev): share bounded System One exchange across decision questions #6698, within [Feature]: Demand-level routing for JEV combos — orchestrator-chosen levels, per-session pinning, probability escalation (opt-in series on #6364) #6665; this does not close that proposal or activate P1–P11 features. Preserve published history, the prior layout repair and caller-cancellation fix, add a separate HTTP-cleanup cancellation bugfix, merge the specified dev, merge the next frozen dev and carry its shared endpoint-URL authority into the extracted exchange, then merge dev aeebf11e5a2c49b5f2edb2e0d8ecafd95e872119, later dev c15037b324dcd982f32ac3b86b2841ef127c393e and the current dev 68c9d354574ed240c17805493409f8c589682b91, each with no conflict and no P0 source change. This is not a behavior-identical refactor claim.
• Current head. eb3b75488a6a9c7af3074163af7ba5088a10669f (tree 062c83df79536e52d0c4ac7f963b2a8baffd2280) is a no-conflict merge of the prior head a03b44fba71ddcfd4daebd37bd7ffaef891ea757 and dev 68c9d354574ed240c17805493409f8c589682b91 (fix(desktop): point to a manual download when an update install fails #6789). It was exactly 12 commits behind dev before the merge and is 0 behind at the 2026-10-09 inspection. Published history is preserved: fast-forward push, no force push, rebase or amendment. The P0 delta against dev is still the same seven files (872 insertions / 234 deletions); the merge left five of them byte-identical and brought upstream layout entries into the other two (scripts/test-layout/layout.json and tests/fixtures/test-layout-expected.json), keeping the P0 exchange-test registration. Exact-head local validation passed again (below); no remote CI or human security approval is claimed.
• Keep exchangeJevDecision(options, prepare, parse) as the question-agnostic public seam. Builders receive only { model, descriptiveCriteria }; route state, choices, probability validation, fallbacks, and accounting remain route-owned. Canonical hosted URL/model, destination denial before key/state reads, self-hosted credential ownership, inclusive 65,536-byte caps, deadline normalization, ordinary redirect/HTTP/network gates, and golden route request bytes remain unchanged.
• Endpoint URL authority (feat(jev): allow arbitrary HTTPS decision endpoints (carry #6384) #6731). The four newer dev commits include feat(jev): allow arbitrary HTTPS decision endpoints (carry #6384) #6731, which made jevDecisionEndpointUrl plus isSystemOneEndpoint the shared authority: an arbitrary HTTPS path is sent exactly as configured (trailing slash kept), only a /systemone path keeps trailing-slash normalization, and query, fragment, userinfo, control characters, non-HTTPS public hosts and non-local cleartext are refused. Management uses both jevDecisionEndpointUrl (URL derivation) and isSystemOneEndpoint (admission); combo vetting and the GUI use the isSystemOneEndpoint predicate, not the URL helper. The extracted exchange resolver was the only divergent inline copy (it stripped every trailing slash and accepted only /systemone); a separate commit now calls the shared helper with no local normalization. No guessed rule is added.
• Fix caller-cancellation precedence at the exported entry, endpoint resolution/refusal/throw, preparation/refusal/throw, redirect inspection, parser throw, and synchronous HTTP error-body cleanup. An observed aborted caller rejects with its exact reason object at these checkpoints rather than a gate or callback error. HTTP cleanup stays best effort and non-waiting, including throwing and nonsettling cleanup controls. Already-aborted callers cause no authorization, credential, preparation, or POST work; preparation-triggered abort prevents POST. An authorizer that aborts then allows can still finish synchronous credential resolution before the endpoint checkpoint. Caller cancellation stays separate from deadline expiry (timeout); this is not per-instruction interruption or a universal prompt-settlement guarantee for arbitrary injected callbacks. The inherited redirect helper's waiting cleanup is not redesigned.
• The entry/prepare gaps are new seam defects; parser abort-plus-throw and HTTP cleanup masking are inherited from earlier dev. The matched route differential uses the existing candidate getter during parsing, not a fabricated public route-parser callback. Intentional cancellation differences and upstream endpoint changes are separated from invariant behavior below.
• Keep the additive layout repair in history. scripts/test-layout/layout.json is 1,980 lines at this head (threshold 2,000, so 20 lines of margin; upstream growth has consumed 25 lines across the last two merges); against dev 68c9d3545… its only semantic delta is one exchange test registration, with two adjacent entries packed onto one line; the expected fixture agrees. No cap, exemption, guard, dependency or symlink is weakened. New cases live in the existing exchange sibling; no extra registration is needed.
• Update the owning structure/providers/jev-decision.md contract (including the endpoint-URL clause) and useful exported API docstrings. No new user configuration, GUI, docs-site, or live hosted-service claim. Preserve upstream feat(lifecycle): allow an explicit restart drain grace (carry #6703) #6724 restart grace and fix(anthropic): preserve reported thinking token usage #6721 thinking-token accounting; carry the shared-exchange attribution from feat(combos): JEV quota signals and level decision mode #6423 without importing its older endpoint resolver or level/quota work.

Verification

Exact additive history

• Published P0: b1c2fa0d0c2cce2feedae98b15a7a082c6066841.
• Real, conflict-free merge: be42b2747b3db0d9dc6e96d0030aeb48f7c39208; parents are published P0 and dev 1a8377dc7ca06027711ceda774eb0eb37365f4cb; tree 1593304bc5e4f962e5f9aa6378bbd597ccc203ed.
• Layout-only repair: 6fe6beb41701d0a67d52b7390377be7745625a61; parent is the merge. P0 source/test bytes are unchanged at this repair commit.
• Prior separate cancellation fix: 778a4c715623a10ed5e5dec0dfea67ab7c6f1478; parent 6fe6beb41701d0a67d52b7390377be7745625a61.
• Separate HTTP cleanup fix: da79f86245a42ab86b43744ecf499e2373a28a3f; only the exchange, its direct test, and the owning contract; the causal source repair is one caller check before the HTTP gate. This and the earlier cancellation fixes are kept unchanged in this refresh.
• Merge of specified dev c0f8165074d448b82a40443e19485c73e69bb724: 70aa296566eda3b825bb902ad46868ead0c87ccb; tree 618ccb061dbd2226377bb020cce29e6f09af116e.
• Merge of frozen dev b1e1735cdf7d51ed6f86edf85ca94602ca07a2fa: 7edeb1ab99bf1c2df66c82f6ed49b79b60b73157; parents are 70aa296… and b1e1735…; tree 1090fad90019aa1c7a5d696e0a805b8acf920dd5. The four newer upstream commits are 18a8cda (feat(jev): allow arbitrary HTTPS decision endpoints (carry #6384) #6731), 13348ce (fix(auth): require independent sessions and expire revealed API keys (carry #6672) #6729), 8d30945 (fix(runtime): ship Bun 1.4.2 and keep the CI test runner on 1.4.0 #6713) and b1e1735 (fix(responses): relay undeclared passthrough tool calls on chat and anthropic inbound #6732), preserved unchanged. The only content conflict was src/combos/jev.ts, where feat(jev): allow arbitrary HTTPS decision endpoints (carry #6384) #6731 edited the endpoint resolver that this branch had moved into the exchange. The merge keeps the P0 side byte for byte; the P0 exchange source, jev.ts and direct test are identical to 70aa296… at this commit. At this commit the exchange still carries the pre-feat(jev): allow arbitrary HTTPS decision endpoints (carry #6384) #6731 normalization (shown red below).
• Endpoint carry commit, last P0 behavior commit: 5d996bd2e6c7f84c38d857e04102c98dc2df537f; parent is the frozen-dev merge; tree cafa71fd2985f54e3e588f35f4a158abf36c0583. Three files (+69 / −6): the exchange resolver now takes the destination from jevDecisionEndpointUrl and admits it through isSystemOneEndpoint; the direct exchange test gains the URL-contract regressions; the owning contract gains one clause.
• Merge of dev aeebf11e5a2c49b5f2edb2e0d8ecafd95e872119: 6dfb61c4d0ebb45155c683185a70185e9bffb4e0; parents are 5d996bd2e… and aeebf11e5…; tree a9b00450ab6cb83320959d27227059897145b9e2. Three newer upstream commits, bf9ecf3 (fix(catalog): keep Codex's auto-review model so reviews stop falling back to the task model #6727), dfea21d (feat(clients): add native Command Code integration and catalog sync (carry #3833) #6728) and aeebf11 (feat: add Claude Haiku 5.5 pricing, catalog rows and request contract #6744), preserved unchanged: 110 files, 2,694 insertions / 170 deletions, none under the JEV combo or decision paths. Git merged scripts/test-layout/layout.json and tests/fixtures/test-layout-expected.json automatically with no conflict, keeping both upstream entries and the exchange test registration; no cap was raised. The exchange source, jev.ts, the direct test and the owning contract are byte-identical to 5d996bd2e….
• Merge of dev c15037b32…: a03b44fba71ddcfd4daebd37bd7ffaef891ea757; parents 0afe25013… and c15037b32…; tree ec325948483dabe1b01a35ce44b8b85cef4cba3f. Ten newer upstream commits merged with no conflict: 357 files, 21,109 insertions / 2,474 deletions against the previous head; five of the seven P0 files are byte-identical to the previous head and the two layout registries only gained upstream entries (the diff against dev c15037b32… is still exactly those seven files). The only dependency-manifest change is the upstream version bump 2.81.0 to 2.82.0 in package.json; bun.lock is unchanged. No cap or guard was altered.
• Merge of dev 68c9d354574ed240c17805493409f8c589682b91: eb3b75488a6a9c7af3074163af7ba5088a10669f; parents a03b44fba… and 68c9d3545…; tree 062c83df79536e52d0c4ac7f963b2a8baffd2280. Twelve newer upstream commits (through fix(desktop): point to a manual download when an update install fails #6789, including fix(claude): carry a provider's own encrypted reasoning, bound to its minting route (carry #6741) #6804, fix(compaction): keep hosted search history as bounded reference notes in portable summaries (carry #6746) #6799, fix(responses): keep external task input a user turn in raw-body repairs (carry #6769) #6795, fix(runtime): keep catalog probes async and release aborted translator budgets #6796, fix(test): drain ACL work and close history before Windows fixture removal #6797, fix(oauth): bound and classify ChatGPT token refresh failures #6792, fix(opencode-go): pin claude-haiku-5-5 to the Anthropic wire #6788, test(link): isolate the remote-prelude tests from a host-installed ocx #6787, fix(quota): read the Ollama Cloud quota from /api/balance #6786 and fix(codex): carry LazyCodex role-model fixes ([codex] mirror, routed effort ladder, omo tab) #6785) merged with no conflict: 170 files, 6,481 insertions / 734 deletions against the previous head; five of the seven P0 files are byte-identical to the previous head and the two layout registries only gained upstream entries (the diff against dev 68c9d3545… is still exactly those seven files). package.json and bun.lock are unchanged by this merge. No cap or guard was altered. Merge commit authorship uses the public noreply identity with the Claude Code co-author trailer.
• Documentation response: 0afe25013b1e9652249327a274eb94d89539c1e0; parent 6dfb61c4d…, tree e3c60a3a3720469e74e0ebe9eb85a1cc286808b2. Two files, eight added docstring lines, no executable statements changed. Bun 1.4.0 transpilation of each changed file is identical to its parent. Six exported route helpers document bounded state, state admission, candidate bounds, usage projection, answer validation and fallback metadata; two moved exchange helpers explain canonical-row policy and credential-reference recognition. The owning contract and both mapped general architecture documents were reviewed; their present-tense explanations remain accurate.
• Current delta against dev 68c9d3545…: seven P0 files, 872 insertions / 234 deletions (exchange, jev.ts, owning contract, transport inventory, layout map, expected layout fixture, direct test). Against published P0 b1c2fa0d0…: 710 files, 41,548 insertions / 4,020 deletions, including merged upstream work. Published ancestry, public noreply identities and human carry trailers are preserved. No rebase, amendment, or published-history rewrite.

Endpoint contract: controls and result

Oracle is the frozen dev source (shared helper) driven through the same injected-POST harness with a synthetic own key and a fixed clock; no network or service. Twenty-five baseUrl rows cover five control classes: trailing slash (arbitrary HTTPS path versus /systemone control), exact path (case, nested path, @ inside a path, /systemone prefix), query/fragment/userinfo/control character (including empty ?, #, @), admission (public HTTP, local HTTP with and without /systemone, ftp, non-URL, empty), and body independence (the serialized request, model and own-key Bearer header are identical for every admitted URL).

Source under the same rows	Result against the oracle
Frozen dev (oracle)	arbitrary HTTPS path and trailing slash sent exactly as configured; /systemone normalized
Pre-#6731 P0 (70aa296…)	14 pass / 13 fail: it sent query, userinfo, ftp, public-HTTP and control-character URLs and refused arbitrary HTTPS paths
Merge only (7edeb1ab…)	23 pass / 4 fail: admission fixed through the shared helper, but every trailing slash on an arbitrary HTTPS path (including a mixed-case path) was still stripped
Head 5d996bd2e (P0 bytes unchanged since)	27 pass / 0 fail: identical to the oracle on all 25 rows

The same URLs are asserted through both the direct exchange and the route resolver in the new regression block of the exchange test (50 tests in the file, 284 assertions): head 5d996bd2e 50 pass / 0 fail; the identical test bytes run against the merge-only exchange give 46 pass / 4 fail and against the pre-#6731 exchange 37 pass / 13 fail. The reds are retained; they are not edited into passes. As independent accepted-review evidence, upstream #6731's unchanged tests/routing/jev-decision-destination.test.ts also gives 15 pass / 1 fail on the head 5d996bd2e's merge-only parent (7edeb1ab…, the decisions/ case) and 16 pass / 0 fail on the head 5d996bd2e. Those reviewer runs are separate from the writer's 25-row differential and are not re-run for this correction.

Current-head isolated validation (eb3b75488, 2026-10-09)

The official Bun 1.4.0 Linux x64 archive was verified against both the release's SHASUMS256.txt and GitHub asset digest (sha256:2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452). It runs outside node_modules, with no global installation or persistent PATH change. A detached worktree at the exact current head has its own dependency directory, populated by bun install --frozen-lockfile --ignore-scripts (106 packages at first install; the install log for this head was not retained). The same command set was first run at 0afe25013, then at a03b44fba, each with identical pass/fail counts; those logs are retained as historical receipts. The frozen-lockfile install at eb3b75488 (package.json and bun.lock unchanged by the latest merge): the install log for this head was not retained, so no install result is claimed for it. No tracked package/lockfile changed and no shared dependency directory or symlink was mutated.

The four previously mismatched packages now match the lock: @modelcontextprotocol/sdk 1.31.0, proxy-addr 2.0.8, fast-uri 3.1.8 and ip-address 10.7.1. TypeScript is 7.0.2. Installation scripts remain intentionally unexecuted: this is not a packaged Bun 1.4.2, native-keyring, optional-transport or full installed-byte attestation.

Each command runs in that detached worktree, with a credential-free synthetic HOME/config/cache/temp environment, the repository test-home guard intact, and an external 120-second deadline. $BUN denotes the verified Bun 1.4.0. Test commands use this exact prefix, followed by the repository-relative paths in the tables:

"$BUN" --no-install test --no-orphans --preload "$REPO/tests/preload.ts" --isolate --timeout=10000

Check / actual command	Result at eb3b75488
"$BUN" --no-install run --bun typecheck (repository script: bun x tsc --noEmit)	exit 0; no diagnostics
"$BUN" x --no-install tsc --noEmit -p tests/tsconfig.doctor-service-memory-contract.json	exit 0; no diagnostics
"$BUN" x --no-install tsc --ignoreConfig --noEmit --strict --target ESNext --module ESNext --moduleResolution bundler --types bun-types --skipLibCheck scripts/ci/docker-smoke.ts	exit 0; no diagnostics; no Docker process executed
All 14 focused JEV paths enumerated in the historical table below, using the prefix above	217 pass / 0 fail, 1,222 assertions, 14 files; exit 0
tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts	28 pass / 0 fail, 643 assertions, 3 files; exit 0. The previously red pinned-runner case now passes
All six adjacent usage/envelope/bounded-body/thinking-usage paths enumerated below, using the same prefix	85 pass / 0 fail, 317 assertions, 6 files; exit 0
--test-name-pattern 'blocks an unsafe POST destination|requires HTTPS before invoking|admits a cleartext POST only|never sends a cleartext POST' tests/providers/provider-outbound.test.ts	4 pass / 0 fail, 35 filtered, 64 assertions; exit 0
"$BUN" --no-install run --bun privacy:scan	passed; exit 0
"$BUN" --no-install run --bun structure:check	passed; exit 0
"$BUN" --no-install scripts/file-size-ratchet.ts	passed; exit 0
"$BUN" x --no-install tsc --noEmit -p <scoped exchange config> (src plus tests/routing/jev-service-exchange.test.ts)	exit 0; no diagnostics
git diff 68c9d354574ed240c17805493409f8c589682b91 --check (dev tip)	exit 0; no output

Total bounded tests: 334 pass / 0 fail across 24 files. This supersedes the current-environment runner/dependency gap, not the historical red results below. The custom historical endpoint/differential probes were not rerun: the P0 source and test inputs they exercise are unchanged by the latest merge (only the two layout registries gained upstream entries). Current-head commands, versions, exits and log hashes are retained as local execution receipts, not as remote CI evidence.

Full-suite exception: the root AGENTS.md policy permits focused regression validation where a full run is disproportionately costly, including concurrent-worktree contention. This P0 seam is covered directly and through its route/management consumers, the source/golden/layout oracles, cancellation checkpoints, byte boundaries, endpoint admission and outbound controls above. Changed/full discovery was not run: its wrapper can acquire GUI dependencies and its broad selection reaches subprocess, live-service-manager and storage domains while other worktrees are active. Required CI remains the broader coverage owner; the exact omissions are listed below. The older broad red logs are not erased, diagnosed or counted as green by these narrower results.

Historical re-checks on merge head 6dfb61c4d

Same local environment and prefix as the historical table below (Bun 1.3.14 and the existing TypeScript 7.0.2 compiler, no installation, preload after test). Only the checks sensitive to the new merge were re-run; the P0 source and test bytes did not change, so the other historical rows were not repeated.

Check	Result at 6dfb61c4d
The same 14 focused JEV files listed in the historical table	217 pass / 0 fail, 1,222 assertions, 14 files; exit 0
tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts	27 pass / 1 fail, 28 tests, 3 files. The single failure is the same pinned-Bun 1.4.0 case (domain verification launches isolate tests through the pinned runner) that cannot pass on 1.3.14; no other failure
Existing tsc --noEmit -p tsconfig.json	exit 0; no diagnostics
scripts/privacy-scan.ts, scripts/structure-ssot.ts, scripts/file-size-ratchet.ts	each passed
git diff aeebf11e5a2c49b5f2edb2e0d8ecafd95e872119 --check	exit 0; no output

Historical note from the 0afe25013 run (not the current head): the first scratch tsconfig for the scoped exchange typecheck omitted the node_modules type root and failed with TS2688 for bun-types; correcting only that external config resolved it. No repository change was required.

Historical final-byte bounded checks at 5d996bd2e (before the latest dev merge)

Native Bun 1.3.14 and the existing TypeScript 7.0.2 native compiler run directly, without installation, package wrappers, bun x, bunx, or npx. Each run has a credential-free synthetic HOME/config/cache/temp environment and an external deadline; native tests also use --no-orphans and the inspected repository preload. JavaScript guards are not process-tree containment; native compiler child scope is not contained. These are local fixture checks, not sandbox certification, formal security approval, or live-service validation.

All native tests use this prefix, with preload after test:

"$BUN" --no-install test --no-orphans --preload "$REPO/tests/preload.ts" --isolate --timeout=10000

Rows marked historical below were run on 5d996bd2e and are not relabeled as runs of the refreshed head. Execution receipts retain exact absolute argument lists, runtime versions, exits, input/log hashes bound to the head 5d996bd2e, synthetic environments, deadlines, and the original reds. Public examples below use repository-relative arguments; $BUN, $REPO, $EXISTING_TSC, and $SCRATCH name the inspected local inputs, not a package-resolution wrapper.

Check / arguments	Historical result at 5d996bd2e	Outer deadline
tests/routing/jev-decision-destination.test.ts tests/routing/jev-decision-model-config.test.ts tests/routing/jev-decision-provider-combo.test.ts tests/routing/jev-decision.test.ts tests/routing/jev-model-backend.test.ts tests/routing/jev-service-exchange.test.ts tests/routing/jev-typesafe-golden.test.ts tests/server/jev-decision-scope.test.ts tests/server/server-jev-model-decision-e2e.test.ts tests/server/server-jev-combo-e2e.test.ts tests/providers/jev-provider.test.ts tests/server/decision-routes.test.ts tests/server/decision-discovery.test.ts tests/gui/combo-workspace-jev-decision.test.ts	217 pass / 0 fail, 1,222 assertions, 14 files; exit 0	120s
Endpoint-URL differential on head 5d996bd2e (25 rows, four variants)	27 pass / 0 fail; exit 0	120s
Classified route differential: frozen dev / specified dev / pre-cancellation-fix P0 / head 5d996bd2e	1 pass / 0 fail, 1,940 assertions; 628 classified matrix cases, including 192 upstream endpoint-change cases, plus 21 classified scenarios; exit 0	120s
tests/usage/jev-stats.test.ts tests/usage/request-log-jev.test.ts tests/claude-integration/claude-source-envelope.test.ts tests/server/bounded-body.test.ts tests/claude-integration/claude-inbound-token-footer.test.ts tests/adapters/anthropic/anthropic-thinking-usage.test.ts	85 pass / 0 fail, 317 assertions, 6 files; exit 0	120s
tests/providers/provider-outbound.test.ts --test-name-pattern 'blocks an unsafe POST destination|requires HTTPS before invoking|admits a cleartext POST only|never sends a cleartext POST' (pattern precedes path in executed argv)	4 pass / 0 fail, 35 filtered, 64 assertions; exit 0	120s
tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts	27 pass / 1 fail, 640 assertions; exit 1. The failure is domain verification launches isolate tests through the pinned runner, which asserts the test itself runs on the pinned Bun 1.4.0 (#6713) and cannot pass on 1.3.14. The same case fails identically on an extracted pristine frozen-dev tree under the same Bun (control). The repository-scan ratchet case passes	120s
"$EXISTING_TSC" --noEmit -p "$REPO/tsconfig.json"	exit 0; no diagnostics	120s
"$EXISTING_TSC" --noEmit -p "$SCRATCH/tsconfig.p0-check.json" (source plus direct exchange test)	exit 0; no diagnostics	120s
"$BUN" --no-install "$REPO/scripts/privacy-scan.ts"	passed; exit 0	120s
"$BUN" --no-install "$REPO/scripts/structure-ssot.ts"	SSOT checks passed; exit 0	120s
"$BUN" --no-install "$REPO/scripts/file-size-ratchet.ts"	passed; exit 0	120s
git diff b1e1735cdf7d51ed6f86edf85ca94602ca07a2fa --check and git diff 70aa296566eda3b825bb902ad46868ead0c87ccb --check	exit 0; no output	120s

The registered HTTP-cleanup regression was causally red before its repair (26 pass / 1 fail) and green after it, and removing only the HTTP caller check from the repaired source reproduced 26 pass / 1 fail; that removal run was made on the prior head and is not repeated here (the check is retained unchanged and the regression is green in the 50-test run above). Earlier causal evidence stays historical and is not relabeled as a final-head run: the original cancellation matrix improved from 3 pass / 6 fail to 9 pass / 0 fail; pre-fix direct source produced 19 pass / 5 fail; each of six earlier single-check removals produced 23 pass / 1 fail; the independent HTTP direct and actual-route probes were red on the unrepaired variants. The original adversarial control retains its 5 pass / 1 fail after the prior fix: it expects both routes to return invalid after parser-triggered abort, but repaired P0 rejects with the caller reason. This superseded expectation is disclosed, not edited away or counted as a passing suite.

Expected differences versus invariants

The 628 matrix cases compare thirteen endpoint/scope configurations, six deadline settings, eight response variants, plus four abort phases. Nine configurations are invariant: requests, headers, destination/policy flags, gates, target/effort, usage, normalized deadlines, and abort identity agree across frozen dev, specified dev and pre-fix P0 with the head 5d996bd2e, with a fixed latency clock. The other four are upstream endpoint-contract changes (#6731): a non-/systemone HTTPS path, an arbitrary HTTPS path with a trailing slash, a /systemone URL with a query, and a public HTTP /systemone URL. Specified dev and pre-fix P0 agree with each other and differ from frozen dev; the head 5d996bd2e equals frozen dev in all 192 of those cases. Exact 65,536-byte success and 65,537-byte rejection remain pinned; TypeSafe golden serialized bytes are unchanged.

The additional 21 scenarios contain 13 intentional bugfix cases and eight invariant controls; these are unchanged from the earlier refresh and re-run against the new base:

• Eleven outcome differences: authorizer abort then deny (invalid) or throw (own error); credential abort then foreign-reference refusal (missing_key) or throw (own error); state extraction abort then no usable state (no_state) or throw (invalid); parser abort then throw (invalid); redirect-body cancel abort (redirect); HTTP cleanup abort with normal return, throw or nonsettling promise (http). Frozen dev, specified dev and pre-fix P0 agree; the head 5d996bd2e rejects by exact caller-reason identity.
• Two work-avoidance differences with the same eventual reason: authorizer abort then allow avoids state extraction/POST, and state extraction abort with valid state avoids POST. Credential resolution can still finish synchronously after an allowing authorizer abort.
• Eight unchanged controls, including counters: route-level pre-abort, authorizer throw without abort, invalid answer without abort, deadline-only expiry (timeout), simultaneous caller/deadline abort (caller reason wins), and the three HTTP cleanup modes without caller cancellation (http, no cleanup wait).

The differential does not claim every race, microtask-by-microtask equivalence, or real hosted behavior.

Coverage left to CI

All coverage below is pending maintainer-approved exact-head CI at eb3b75488…. At the 2026-10-09 inspection right after the push, Cross-platform CI and React Doctor had completed as action_required (fork PR awaiting maintainer approval; no build/test job ran); the CodeRabbit status was pending. Administrative gates (PR hygiene, PR Labeler, Enforce PR target branch) re-run on each push and body edit; some runs are cancelled and superseded by later ones, so their live state is the source of truth and no point-in-time count is given here. No build/test CI has run or passed for this head and none is claimed. This is the explicit full-suite exception coverage, not additional local green evidence:

• Three CI compiler checks: all three compiler argument sets now passed locally as recorded above; the two auxiliary checks use bun x --no-install to forbid package acquisition. The hosted CI jobs themselves remain unrun, and compilation is not Docker execution or platform validation.
• Four Linux test shards (test 1/4–test 4/4): NOT run. The bounded focused sets above are not full shard coverage.
• Dedicated storage policy and API usage jobs: NOT run. No storage-crash investigation accompanies this exception.
• GUI build and GUI test suite: NOT run. The focused combo-workspace fixture above is not the GUI suite or build; GUI lint remains pending where selected by CI.
• Docker smoke, npm-global smoke and platform jobs (macOS/Windows and applicable platform controls): NOT run. Their selection and results remain pending exact-head CI; no build, packaging, platform or locked-graph success is inferred from local checks.

Review notes and limits

• Management, vetting, the GUI and the probe/default path were read against the shared contract. decision-routes calls both the URL helper jevDecisionEndpointUrl and the admission predicate isSystemOneEndpoint; combos/types and the GUI service call only the predicate. The connection probe goes through the same exchange resolver, which uses both. Not changed here: the System One discovery hint builder derives a suggested URL from a provider prefix with its own slash handling (it does not choose the URL a request is sent to), and the localized GUI strings still say the base URL must end in /systemone. Both are upstream; no broad cleanup was done.
• Historical runtime/locked-dependency gap, now superseded locally: earlier rows used Bun 1.3.14 and a shared installed tree with four version mismatches. The current-head isolated frozen install and verified Bun 1.4.0 resolve those gaps for the commands above. The shipped Bun dependency remains 1.4.2 and its installation/packaging smoke is not run; the test-runner and shipped-runtime pins are not interchangeable. Historical failures remain historical, not relabeled passes.
• Remote CI is not green build/test evidence: the retained snapshot of the previously published head had Cross-platform CI and React Doctor at action_required; Cross-platform CI had zero jobs. This is a fork PR, so a maintainer has to approve CI runs on the new head; until they run, results for this head are missing or awaiting approval and are not passing evidence. PR hygiene/target/label successes are administrative checks, not build/test success.
• Changed/full suite deliberately skipped: its wrapper can acquire GUI dependencies; unrestricted discovery reaches unaudited subprocess, live/service-manager, package-acquisition, and storage domains while concurrent worktrees are active. Only inspected bounded domains run here. Inspected historical broad logs remain red (91 failures / 5 errors and 58 failures / 1 error); narrow greens neither resolve nor erase them. Storage-crash investigation, unrestricted refreshed-upstream feature tests (fix(auth): require independent sessions and expire revealed API keys (carry #6672) #6729 session/key-reveal and fix(responses): relay undeclared passthrough tool calls on chat and anthropic inbound #6732 passthrough tool-call changes were merged but not exercised beyond the bounded sets above), compiler-platform/Node, live hosted services and every scheduling race remain outside scope. No daemon, backend, auth/config, update, or restart is operated. No P8 work is changed or validated.
• Docstring warning resolved: the pre-response CodeRabbit report was 60.00% against 80.00% (the older report was 62.50%). Eight meaningful contracts were added in 0afe25013 without analyzer or threshold changes and explained in the review-response comment. The completed exact-head CodeRabbit review reports 83.33% against 80.00%, 18 functions across three files, all five pre-merge checks passed, and no actionable comments. The 83.33% review was for 0afe25013; at eb3b75488 the CodeRabbit status was still pending ("Review in progress") when inspected, so no CodeRabbit result for this head is claimed. REST reviews, inline comments and GraphQL threads contained no findings or human questions at the 2026-10-09 inspection. The bot separately retains pending human security review and exact-head CI as merge requirements.
• Human security review is separate: formal maintainer review remains required before merge for destination/credential boundaries, now including the widened (arbitrary HTTPS path) self-hosted destination. Author readiness, tests, code inspection, and AI analysis are not security sign-off.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

All four author attestations are true at eb3b75488: local validation passed under the documented AGENTS.md full-suite exception; the branch is 0 behind dev 68c9d3545… after the merge; all earlier Codex/CodeRabbit findings were answered and no thread or review finding is open; and the bounded P0 change is ready for maintainer review. This is author readiness, not merge authorization: required remote CI and formal human security review remain merge blockers. The security checklist above intentionally remains unchecked.

Co-authored-by: SeongwoongCho 35558061+SeongwoongCho@users.noreply.github.com
Co-authored-by: lidge-jun 243035832+lidge-jun@users.noreply.github.com

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • JEV decisions can now use supported self-hosted decision endpoints as well as the standard service.
  • Decision requests have bounded processing times and payload sizes, and respect cancellation.
• Reliability
  • Invalid destinations, credentials, and responses are handled with clearer fallback outcomes.
  • Updated guidance reflects where JEV connection settings are managed.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ee0808f9-09d8-44bc-beed-52e129f39906

📥 Commits

Reviewing files that changed from the base of the PR and between a03b44f and eb3b754.

📒 Files selected for processing (2)

• scripts/test-layout/layout.json
• tests/fixtures/test-layout-expected.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The change moves JEV endpoint selection and bounded HTTP exchange into a shared service. Route decision handling supplies request preparation and response parsing. Tests cover endpoint checks, transport limits, failure gates, cancellation, and deadlines.

Changes

JEV Decision Exchange

Layer / File(s)	Summary
Endpoint and credential resolution src/combos/jev-service-exchange.ts	The shared exchange defines endpoint and timeout contracts. It resolves canonical or self-hosted endpoints and checks destination permissions and credentials.
Route integration and bounded exchange src/combos/jev.ts, src/combos/jev-service-exchange.ts	resolveJevDecision delegates exchange and response parsing to the shared service while retaining route-specific choice and state checks. The exchange limits request and response sizes, handles redirects, and maps failures to gates.
Exchange validation and supporting updates tests/routing/jev-service-exchange.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json, structure/providers/jev-decision.md, structure/transports/inventory.md	Tests cover endpoint and credential rules, request and response handling, cancellation, and deadlines. The test-layout entries and documentation identify the shared exchange and its behavior.

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Route as resolveJevDecision
  participant Exchange as exchangeJevDecision
  participant Endpoint as JEV decision endpoint
  Route->>Exchange: Provide request preparation and response parsing callbacks
  Exchange->>Endpoint: Resolve endpoint and credentials
  Endpoint-->>Exchange: Return endpoint details
  Exchange->>Route: Request preparation with model and criteria
  Route-->>Exchange: Return request body
  Exchange->>Endpoint: Send bounded decision request
  Endpoint-->>Exchange: Return response
  Exchange->>Route: Return parsed value or failure gate

Loading

Merge Risk: ⚪ Minimal · up to eb3b7

The new test is registered consistently in both routing layouts. No actionable merge risk introduced by these changes is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 3 files. (2 skipped: 2 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: extracting a bounded, shared System One exchange for JEV decision questions. It matches the changes in jev-service-exchange.ts and jev.ts.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[geunwoojun99]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[geunwoojun99]

@coderabbitai review

[geunwoojun99]

The branch is refreshed on the latest dev (a fast-forward of the previous head, no force push). Because this is a fork PR, could a maintainer approve the CI runs for the new head? The destination and credential boundary of the self-hosted System One exchange also still needs its separate human security review before merge. The PR stays Draft and nothing here is a readiness or CI-passed claim.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[geunwoojun99]

@coderabbitai review

Addressing the docstring-coverage warning: 0afe25013 adds useful contracts for six exported route helpers (bounded state, admission, candidate bounds, usage, answer validation, fallback metadata) and the two moved endpoint/credential-reference helpers. No executable statements, thresholds, or analyzer configuration changed. The latest report was 60%, not the older 62.5%; I am not claiming a new percentage before your rerun.

Exact-head validation now uses checksum-verified Bun 1.4.0 and a separate frozen-lockfile dependency tree: typecheck passed; focused JEV 217/0, layout/ratchet 28/0, adjacent contracts 85/0, outbound controls 4/0; privacy, structure, and file-size gates passed. This removes the prior pinned-runner failure and four installed-version mismatches without changing shared dependencies. Full-suite exception and remaining CI coverage will be updated in the description. Human security review and maintainer-approved exact-head CI remain required before merge.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[geunwoojun99]

Current-head evidence is now in the description. All three CI compiler argument sets and the separately scoped exchange regression typecheck pass, in addition to 334 bounded tests and the privacy/structure/ratchet gates. The full-suite resource exception and exact omissions remain explicit.

Two readiness attestations are checked: local validation under that exception, and the branch is 0 behind the current dev. The documentation rerun is still in progress, so the findings/final-readiness boxes remain open and the PR stays Draft. No human questions or inline findings were present to resolve. Before merge, maintainer approval of the exact-head fork CI runs and separate human security review are still needed.

[geunwoojun99]

The exact-head CodeRabbit rerun is complete: docstring coverage is 83.33% (threshold 80%), all five pre-merge checks passed, and no actionable comments were generated. The documentation warning is addressed; there were no inline threads to resolve.

All four author readiness boxes are now checked at 0afe25013, and the PR is Ready for Review. Local validation passed under the documented full-suite exception; the branch is 0 behind dev. This supersedes the draft/pending status in my earlier update, not the historical test results.

Merge still requires maintainer-approved exact-head CI and explicit human security review of the destination/credential boundary. Neither is claimed as complete, and the security checklist remains unchecked.

[lidge-jun]

Thank you, @geunwoojun99! This change landed on dev through the maintainer carry #6791 (squash commit e80ff79), which credits you with a Co-authored-by trailer. The carry keeps your shared bounded System One exchange and removes a timing-based assertion that was flaky in CI. Closing this PR as superseded by #6791.