devlog: work-phase 2 record — one merged, three held on reproduced defects

[lidge-jun]

Summary

Records work-phase 2: four changes-requested PRs reviewed at their current heads. #2310 merged (b268d1814); #2350, #2351 and #2355 left open with blockers posted.

Each of the three holds does something its own description denies, and each one's tests pass either way:

• feat(adapters): annotate present-but-empty tool outputs (DeepSeek default) #2350 claims to annotate empty tool outputs. Its Responses emptiness check classifies any non-text part as empty, so a real input_image or encrypted_content payload is replaced with the annotation. The Chat half of the same PR guards correctly.
• feat(config): audit persisted config mutations (source, fields, redacted before/after) #2351 claims never to record a secret. apiKeys[].key lands verbatim in config-mutation.sqlite and is echoed by GET /api/config/mutations. Redaction keys off the last path segment and the sensitive-key pattern is anchored, so api_key matches but bare key does not.
• feat(status): warn when config.json diverges from the running proxy (CLI + GUI) #2355 claims to warn while the proxy serves stale config. An incidental loadConfig() from catalog sync or a token refresh clears the warning while the old snapshot is still served. residentConfigSha256 is a module global; the adjacent liveConfigBaseline is a WeakMap for exactly this reason.

All three were reproduced before being posted.

#2310 merged after confirming every recorded blocker is closed at 93b977d3 — the earlier objections were against a different implementation. Verified on a merge onto current dev: tsc exit 0, 216 pass / 0 fail, and an identity-revert fails 9 tests.

Verification

Docs only. Full suite on the remote host at the prior head: 14291 pass / 16 skip / 0 fail across 898 files, exit 0.

Checklist

• Docs-only
• No security triage in devlog/ — the feat(config): audit persisted config mutations (source, fields, redacted before/after) #2351 finding is already public on that PR
• Numbered lexicographic filename

Summary by CodeRabbit

• Documentation
  • Added an execution record covering the review and verification of four changes.
  • Documented one successfully verified change and three changes held due to reproducible defects.
  • Captured identified issues, testing gaps, and the rationale for pending reviews.
  • Summarized lessons from cases where existing tests passed despite behavior differing from documented expectations.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 08306505-6193-4da8-b280-d192c6aa4ae0

📥 Commits

Reviewing files that changed from the base of the PR and between b268d18 and d70b2d6.

📒 Files selected for processing (1)

• devlog/_plan/260822_backlog_disposition_program/021_wp2_execution_record.md

---

📝 Walkthrough

Walkthrough

The pull request adds a WP2 execution record. It documents one verified merge, three held pull requests, reproduced defects, test gaps, and the shared discrepancy between passing tests and stated behavior.

Changes

WP2 pull request disposition

Layer / File(s)	Summary
Execution findings and dispositions devlog/_plan/260822_backlog_disposition_program/021_wp2_execution_record.md	The record documents verification of #2310 and reproduced defects for #2350, #2351, and #2355. It describes affected code paths, test gaps, and the rationale for holding the three pull requests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ingwannu

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/wp2-record

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}