[coji]

What changed

• Require an application-defined scope for authenticated global run SSE, invoke configured authorization hooks when the authenticated context is undefined, and reject malformed or unrepresentable scopes before streaming.
• Remove discarded trigger input and labels from the HTTP run:coalesced event while preserving the in-process event; treat explicit empty run filters as matching no runs.
• Hash every dependency symlink hop in the Shannon audit, improve unsupported-layout errors and interrupt behavior, and add regressions for these paths.
• Update API references, guides, examples, generated llms.txt, and accepted ADR-0036. Narrow the documentation checker to maintained docs and examples.

Finding dispositions

The archived Shannon run reported zero exploit-confirmed findings and eight static-analysis leads. Source review confirmed four reachable causes under the documented preconditions: coalesced HTTP payload crossing label scopes (SARIF 1–2), auth hooks skipped for an undefined context (3–5), list-scope fallback or missing global stream scope (6–7), and empty filter arrays widening access (8). All four are addressed with regression tests.

PR #300 review candidates LS-1, RB-1, XF-1, EF-1, CV-1, and SIG-1 are addressed. RU-1 was a refactor request without a demonstrated defect; ALT-1 was an external quota condition later cleared; the external dependency-root candidate was refuted because the resolved root was already walked and hashed. The full evidence and dispositions are in the task-directory triage report kept outside the branch diff.

Verification

• pnpm validate — pass (32/32 Turbo tasks; audit script 19/19 tests)
• .claude/skills/doc-check/scripts/find-stale.sh — pass
• Acceptance review — APPROVE for implementation; Draft-to-Ready checks follow below
• Simplification review — no concrete change needed
• ADR-0036 and index — accepted

Base SHA: 2fc40d812f943d19a945d3f8d86a8e1c0d2b4fcd
Head SHA: be61d35e683f225a5da4a5655612006800fdb288

Round 1 independent Codex and Opus reviews identified a confirmed P2 interrupt window, now fixed in 5f51218. The follow-up also aligns empty React run filters, updates the scope hook TSDoc, and replaces a vacuous interrupt test with deterministic boundary tests. Round 2 independent review found no blockers; its GO applied to the prior head. Three confirmed P3 follow-ups (test title, cleanup assertions, and unnecessary listeners for an empty authorized stream) were fixed in be61d35. Round 3 reviewed the delta and affected callers at the current head. Codex completed eight perspectives with no new candidates; Opus and an independent Codex verifier found only two nonblocking P3 future-regression test coverage gaps. The exact-head Draft-to-Ready gate reached GO, with all five reported PR checks passing.

Remaining nonblocking review notes

• scanStarted may be set just before the scanner begins, so cleanup can query a workspace that never started. This remains a plausible P3; Shannon's known “No scan found” response is handled quietly, and no material failure was established.
• The empty-scope SSE test verifies that no events arrive but does not count listeners. The implementation takes the listener-free path.
• The interrupt cleanup test verifies removal commands but does not explicitly assert each creation preceded its removal. The implementation calls the hook after resource creation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
durably-demo	Ready	Preview	Oct 18, 2026 1:55pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
durably-demo-vercel-turso	Ignored	Preview	Oct 18, 2026 1:55pm UTC