Conversation
….21.1) (#122) Two fixes from Cursor Bugbot findings on PR #120 / #121 that should have blocked the 0.21.0 ship and didn't because the orchestrator treated Bugbot's in_progress state as non-blocking. The findings are real and the medium-severity one is a prod regression vs pre-refactor behavior. Bug #1 (medium) — Stop-word filtering silently drops canon vocab keywords: - parseCheckColumn called tokenize(m[1]) with default STOP_WORDS filter. Canon vocab includes 'from' (in source-named) and 'to' (inside 'according to'); STOP_WORDS includes both. Result: 'from' is dropped from stemmedTokens; the runtime call site applied the same filter to inputStems so 'from' is dropped there too. - Pre-refactor regex evaluator matched 'from' literally as new RegExp('\\bfrom\\b', 'i') against raw input. Inputs like 'I learned this from my colleague' passed source-named pre-refactor and fail post-refactor — the strictly-additive invariant the 0.21.0 CHANGELOG and PR description claimed is broken. - Latent landmine: any prereq whose canon vocab is entirely stop-words would have stemmedTokens.size === 0 and trigger the conservative length>=20 fallback inappropriately (false positive). Not currently exploited by canon but the structural risk is there. - Fix: pass new Set() (empty stop-words) to both tokenize() calls so canon keywords survive on both sides and shape matches. Bug #2 (low) — DRY violation in BasePrerequisite: - 0.21.0 introduced PrereqMatchVocab interface to share shape between BasePrerequisite and ChallengeTypeDef.prerequisiteOverlays[]. The inline type on prerequisiteOverlays uses '& PrereqMatchVocab' intersection; BasePrerequisite re-listed all five fields manually. Future PrereqMatchVocab additions would not propagate to BasePrerequisite — defeats the DRY purpose. - Fix: split into BasePrerequisiteCore (3 core fields) and type BasePrerequisite = BasePrerequisiteCore & PrereqMatchVocab. Verification: - Typecheck clean - governance-parser.test.mjs 105/105 pass - 2 new regression assertions in canon-tool-envelope.smoke.mjs: (10) source-named via 'from'-only canon keyword (11) source-named via 'according to' multi-word phrase - Bugbot Autofix preview diff for PR #121 used as the basis for the Bug #1 fix (cherry-picked the change locally rather than applying via Autofix UI to keep the audit trail in this branch). Process post-mortem to follow in P1.3.3 closeout ledger.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
oddkit | d17bc0c | Commit Preview URL Branch Preview URL |
Apr 20 2026, 05:05 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes oddkit 0.21.1 from main to prod.
What ships
parseCheckColumnand runtime call site both passnew Set()totokenize(), restoring the strictly-additive invariant. Canon vocab keywords that are also stop-words (frominsource-named) survive on both sides of the matcher.BasePrerequisite = BasePrerequisiteCore & PrereqMatchVocabintersection eliminates the DRY violation introduced in 0.21.0.from-only source attribution andaccording tomulti-word phrase, both anchoring the fix at preview/main/prod.Release Validation Gate compliance
Per
klappy://canon/constraints/release-validation-gate(now live in canon asee9aee4):Rule 1 — Active reviews:
9d09fe4)Rule 2 — Independent validator (load-bearing surface:
orchestrate.ts):sesn_011CaERPjHi1CV4TrvKW68jBagent_011CaERLniErdgxJagniRtNP(claude-sonnet-4-6)klappy.dev#126merged before this promotion opens, satisfying validator's only conditional)Rule 3 — Canon outranks session artifacts:
klappy://canon/constraints/release-validation-gateandklappy://canon/principles/contract-governs-handoff-drift. This promotion follows canon Rule 2 (validator dispatch), not the session ledger's Option-A recommendation.Attestation
from-only input fails source-named (bug confirmed in prod)from-only input passes source-named (fix confirmed)Sweep status after promotion
oddkit_encodeoddkit_challengeoddkit_gateRefs
d17bc0c)ee9aee4) — release-validation-gate + contract-governs-handoff-drift + bootstrap hook33ca5bf), promotion PR promote 0.21.0 to prod (P1.3.3 challenge canon parity) #121 (merged25ad719)Note
Medium Risk
Touches
oddkit_challengeprerequisite matching logic inworkers/src/orchestrate.ts, which directly affects gating behavior for user inputs; changes are small but can alter pass/fail outcomes. Added smoke regressions reduce risk by locking in the intended matching behavior.Overview
Restores
oddkit_challenge’s strictly-additive prerequisite-matching behavior by disabling stop-word filtering in both parse-time (parseCheckColumn) and runtime (tokenize(input, new Set())) tokenization so canon keywords likefromaren’t dropped.Refactors types to remove DRY drift by defining
BasePrerequisiteasBasePrerequisiteCore & PrereqMatchVocab, and adds two smoke regressions incanon-tool-envelope.smoke.mjscoveringfrom-only andaccording tocases. Bumps versions to0.21.1and documents the fixes inCHANGELOG.md.Reviewed by Cursor Bugbot for commit d17bc0c. Bugbot is set up for automated code reviews on this repo. Configure here.