3.0

Adjusted Signal

3.0

Raw Pattern Score

100%

Time Factor

2026-11-01

Last Push

18.1K

Stars

TypeScript

Language

2.6M

Lines of Code

12.6K

Files

7.3K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 7139 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 109 finding(s).

Agent Over-Engineering Ratio 12.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 6530 finding(s).

PR Review Velocity Impact 13.6/100 · LOW

Which changes need focused human review? 7278 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 10HIGH 5MEDIUM 157LOW 7106

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 7278 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers6500 hits · 6806 pts

Severity	File	Line	Snippet	Context
LOW	…2_and_history_perf/040_phase4_config_alias_and_docs.md	66	export function hasConflictingAgentsThreadKeys(configPath?: string): boolean	CODE
LOW	…vlog/_plan/261009_L1-desktop-cli/020_command_guards.md	68	export function assertNoDesktopSupervision(inspect: SupervisionInspector = inspectDesktopSupervision): void {	CODE
LOW	…vlog/_plan/261009_L1-desktop-cli/020_command_guards.md	73	export function desktopServiceCommandRefusal(	CODE
LOW	…vlog/_plan/261009_L1-desktop-cli/020_command_guards.md	170	export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled, supervision }) {	CODE
LOW	…vlog/_plan/261009_L1-desktop-cli/020_command_guards.md	410	export function runDesktopAwareProxyRestart(	CODE
LOW	…61028_oauth_provider_parity/020_phase2_codex_parity.md	67	+export function deriveCodexAccountInstallationId(chatgptAccountId: string, callerInstallationId: string): string {	CODE
LOW	…61028_oauth_provider_parity/020_phase2_codex_parity.md	84	+export function rewriteTurnMetadataInstallationId(rawMetadata: string, chatgptAccountId: string): string {	CODE
LOW	…61028_oauth_provider_parity/020_phase2_codex_parity.md	96	+export function isolateCodexPoolAccountHeaders(headers: Headers, chatgptAccountId: string): void {	CODE
LOW	…61028_oauth_provider_parity/020_phase2_codex_parity.md	109	+export function isolateCodexPoolClientMetadata(body: unknown, chatgptAccountId: string \| undefined): unknown {	CODE
LOW	…1028_oauth_provider_parity/010_phase1_claude_parity.md	118	+export function deriveAnthropicAccountDeviceId(accountUuid: string): string {	CODE
LOW	…1028_oauth_provider_parity/010_phase1_claude_parity.md	122	+export function extractAnthropicCallerSessionId(body: Readonly<Rec>): string \| undefined {	CODE
LOW	…1028_oauth_provider_parity/010_phase1_claude_parity.md	136	export function bindAnthropicAccountMetadata(body: Rec, providerAccountUuid: string \| undefined): Rec {	CODE
LOW	…1028_oauth_provider_parity/010_phase1_claude_parity.md	173	export function anthropicBaseRequestHeaders(stream: boolean \| undefined): Record<string, string> {	CODE
LOW	…1028_oauth_provider_parity/010_phase1_claude_parity.md	184	+export function resolveTranslatedAnthropicSessionKey(parsed: OcxParsedRequest, incoming?: IncomingMeta): string \| undef	CODE
LOW	…61009_n4_responses_quota/020_main_quota_observation.md	78	+function selectedMainQuotaDispatch(selected: Headers): MainQuotaDispatch \| undefined {	CODE
LOW	…61009_n4_responses_quota/020_main_quota_observation.md	85	export function materializeCodexUpstreamAuth(...): Headers {	CODE
LOW	…61009_n4_responses_quota/020_main_quota_observation.md	105	export async function materializeCodexUpstreamAuthAsync(...): Promise<Headers> {	CODE
LOW	…009_n4_responses_quota/010_spill_admission_headroom.md	59	function enforceSpilledResponseBudget(requiredHeadroomBytes?: number): number {	CODE
LOW	…009_n4_responses_quota/010_spill_admission_headroom.md	157	+export function setResponseSpillUnlinkFailureObserver(next: SpillUnlinkFailureObserver \| null): void {	CODE
LOW	…009_n4_responses_quota/010_spill_admission_headroom.md	192	+export function resetSpillCountersForTests(): void {	CODE
LOW	…g/_plan/260909_bulk_closeout_249/002_lane_bug_prs_b.md	85	`/tmp/ocx-249.xGQnxl/wt/src/codex/app-server-processes.ts:1061` — `export function resetCodexAppServerCatalogStateCache(	CODE
LOW	…plan/260909_bulk_closeout_249/003_lane_small_nonbug.md	164	export function captureProviderApiKeySelection(provider: OcxProviderConfig): ProviderApiKeySelection {	CODE
LOW	…/_plan/260909_bulk_closeout_249/008_lane_stale_tail.md	82	export function finalizeAutoReviewModelOverride(	CODE
LOW	…/_plan/260909_bulk_closeout_249/008_lane_stale_tail.md	104	export function readConfiguredAutoReviewModel(): string \| null {	CODE
LOW	…/_plan/260909_bulk_closeout_249/008_lane_stale_tail.md	579	export function collectOrcaCodexHomeDiagnostic(deps: OrcaCodexHomeDeps = {}): OrcaCodexHomeDiagnostic {	CODE
LOW	…an/260909_bulk_closeout_249/040_wp4_bug_issue_fixes.md	111	@@ -1414,6 +1414,13 @@ export function catalogHintsFromModelsApiItem(providerName: string, item: Provid	CODE
LOW	…an/260909_bulk_closeout_249/040_wp4_bug_issue_fixes.md	306	+export function clearPersistedCodexRuntime(deps: ResolveCodexRuntimeDeps = {}): void {	CODE
LOW	…an/260909_bulk_closeout_249/040_wp4_bug_issue_fixes.md	328	@@ -654,6 +673,20 @@ export function resolveAndPersistCodexRuntime(	CODE
LOW	…an/260909_bulk_closeout_249/040_wp4_bug_issue_fixes.md	446	@@ -3860,10 +3860,28 @@ export async function installFreshWindowsSchedulerSafely(	CODE
LOW	…an/260909_bulk_closeout_249/040_wp4_bug_issue_fixes.md	447	export function installedServiceRespawnRisk(	CODE
LOW	…g/_plan/260909_bulk_closeout_249/001_lane_bug_prs_a.md	198	export function isDeclaredReasoningEffort(effort: string): boolean {	CODE
LOW	…009_n1_catalog_client/020_autorefresh_client_fanout.md	36	export function setCatalogAutoRefreshClientFanout(fanout: CatalogChangedClientFanout \| null): void {	CODE
LOW	…009_n1_catalog_client/020_autorefresh_client_fanout.md	64	async function refreshConnectedClientsAfterCatalogChange(isCurrent: () => boolean) {	CODE
LOW	…61009_L7-ci-infra/010_wp1_windows_removal_ownership.md	126	export async function drainAndRemoveFixtureRoots(plan: FixtureTeardownPlan, deps?: Partial<FixtureTeardownDeps>): Promis	CODE
LOW	…8_ocx_agentic_control/050_phase_account_attribution.md	130	function accountLabelForAttribution(provider: string, explicit: unknown): string \| null {	CODE
LOW	…8_ocx_agentic_control/050_phase_account_attribution.md	147	function accountLabelForAttribution(provider: string, explicit: unknown): string \| null {	CODE
LOW	…61001_quota_send_lock_split/010_hard_lock_hardening.md	79	export function getMainAccountExternalUsageWarning(identityKey: string \| undefined, now = Date.now()):	CODE
LOW	…61001_quota_send_lock_split/010_hard_lock_hardening.md	81	export function resetMainAccountExternalUsageForTests(): void;	CODE
LOW	…train/625_pages_integrations_IntegrationsOverview_b.md	104	export function IntegrationsOverviewContent({	CODE
LOW	…lan/260905_now_split_train/100_adapters_anthropic_b.md	133	export function createAnthropicStreamParser(provider: OcxProviderConfig, toolNames: { fromWire: (name: string) => string	CODE
LOW	…lan/260905_now_split_train/100_adapters_anthropic_b.md	151	export function createAnthropicResponseParser(provider: OcxProviderConfig, toolNames: { fromWire: (name: string) => stri	CODE
LOW	…1009_claude_1m_default/020_long_context_eligibility.md	72	export function claudeSurfaceSupportsOneMillion(provider: string, window: number \| undefined): boolean {	CODE
LOW	…1009_claude_1m_default/010_prompt_too_long_envelope.md	51	export function claudePromptTooLongMessage(message: string): string {	CODE
LOW	…009_claude_1m_default/030_context_accounting_policy.md	78	export function withSubagentContextMarker(selector: string, windows: Record<string, number>, mode: AutoContextMode = UNP	CODE
LOW	…windows_stability_program/020_wrapper_killer_dedupe.md	13	export function killWindowsSchedulerWrappers(opts: {	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	32	def test_plain_omitted_filter(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	37	def test_explicit_all_provider_mode(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	41	def test_preserves_envelope_metadata(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	47	def test_preserves_all_other_parameters(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	54	def test_explicit_filter_preserved(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	58	def test_explicit_empty_filter_preserved(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	62	def test_explicit_null_filter_preserved(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	66	def test_missing_params_created(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	70	def test_non_object_params_preserved(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	76	def test_resume_and_other_methods_unchanged(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	82	def test_notification_without_id_unchanged(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	86	def test_request_id_preserved_exactly(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	92	def test_response_like_object_unchanged(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	96	def test_relation_query_bypass_preserved(self):	CODE
LOW⚡	…928_remote_thread_provider_policy/probes/test_probe.py	102	def test_null_relation_does_not_block(self):	CODE
6440 more matches not shown…

Over-Commented Block472 hits · 457 pts

Severity	File	Line	Snippet	Context
LOW	bunfig.toml	1	# Scope `bun test` discovery to opencodex's own suite.	COMMENT
LOW	bunfig.toml	21	# The write guard now arms itself from the test-file entry in that case (src/lib/test-home-guard.ts),	COMMENT
LOW	…60720_toks_speed_price_columns/010_phase1_cost_core.md	181	/**	COMMENT
LOW	…/260803_ci_dev_lane_sharding/010_linux_shard_matrix.md	201	#	COMMENT
LOW	…og/_fin/260725_macos_menubar_app/040_phase4_release.md	41	#!/usr/bin/env bash	COMMENT
LOW	…og/_fin/260725_macos_menubar_app/040_phase4_release.md	61	# `link -> ../../outside` became `<repo>/../../outside`, passed the `<repo>/*`	COMMENT
LOW	devlog/_fin/260912_v2_contracts/020_recovery.md	21		COMMENT
LOW	devlog/_fin/260912_history_containment/000_plan.md	21	#4311 containment only: ordinal/history_mode records and migratable stores refuse external relabel; config/profile/journ	COMMENT
LOW	…60706_remote-compaction-v2-routed/000_investigation.md	61	## investigation). All file/line references verified 2026-07-06 against	COMMENT
LOW	…18_cursor_call_integration/cursor-call-integration.zsh	1	#!/usr/bin/env zsh	COMMENT
LOW	devlog/_fin/260724_bugfix_train/030_shim_autorestore.md	401	): GuardedRefreshOperation[] \| null {	COMMENT
LOW	…fin/260923_p5_ci_release_gaps/010_release_preflight.md	81	\| --- \| --- \|	COMMENT
LOW	…60923_p5_ci_release_gaps/020_release_outcome_report.md	81	`attach-release` already holds `contents: write` for the upload; the report only reads	COMMENT
LOW	…og/_fin/260923_p5_ci_release_gaps/030_shard_balance.md	41	\| round-robin (today) \| 364 / 394 / 248 / 254 \| 74 \| 33 each (plus serial singletons) \|	COMMENT
LOW	…0924_claude_desktop_picker_mode/020_wp3_picker_core.md	101	export interface SecurityResult { code: number \| null; stdout: string; stderr: string }	COMMENT
LOW	…g/_fin/260722_pr_review_strategy/003_merge_strategy.md	101		COMMENT
LOW	…60913_chat_refusal_translator/020_fix_refusal_scope.md	1	# 020 — wp2: 거절 장부를 거절에만 건다	COMMENT
LOW	devlog/_fin/260804_stacked_pr_ci/010_ci_trigger.md	81	# The #951-#955 stack merged with `enforce-target`, `label`, and	COMMENT
LOW	devlog/_fin/260804_stacked_pr_ci/010_ci_trigger.md	121	And add, after the `push.branches` assertion:	COMMENT
LOW	…/260909_post249_scope_cleanup/030_issue_disposition.md	41	## IMPROVEMENT (32)	COMMENT
LOW	devlog/_fin/260731_structure_sot_refresh/004_measure.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…70_codex-multi-account-auth/80_phase8-e2e-hardening.md	41	### 5. Invalid chatgptAccountId in import	COMMENT
LOW	…lti-account-auth/70_phase7-quota-capture-autoswitch.md	21		COMMENT
LOW	…_kiro_text_control_guard/010_phase1_guard_narrowing.md	41		COMMENT
LOW	…0904_priority65_closeout/010_wp2_responses_boundary.md	281	// (schema.ts:106) accepts a tool item whose strict schema failed only for a missing call_id. A	COMMENT
LOW	…fin/260815_roadmap_closeout/000_source_capture_raw.txt	101	#1774 bug 추가	COMMENT
LOW	app/Package.swift	21	swiftSettings: [	COMMENT
LOW	app/Sources/MenuBarCoreTests/Harness.swift	1	import Foundation	COMMENT
LOW	app/Sources/MenuBarCore/Keychain.swift	1	import Foundation	COMMENT
LOW	app/Sources/MenuBarCore/ProxyClient.swift	121	/// Three states, not two. "Did not get a usable answer" and "nothing is listening"	COMMENT
LOW	app/Sources/MenuBarCore/ProxyClient.swift	161	public func isReachable() async -> Bool {	COMMENT
LOW	app/Sources/MenuBarCore/ProxyModels.swift	201		COMMENT
LOW	app/Sources/MenuBarCore/ProxyModels.swift	241	}	COMMENT
LOW	tests/preload.ts	41	} from "../scripts/test-run-lock";	COMMENT
LOW	tests/preload.ts	61	// guard, and the assertion that would have caught the omission — never ran. The worker	COMMENT
LOW	tests/oauth/generic-oauth-failover.test.ts	381		COMMENT
LOW	tests/oauth/generic-oauth-failover.test.ts	561	//	COMMENT
LOW	tests/oauth/generic-oauth-failover.test.ts	621	// Antigravity: a rotated account with no project must abort the rotation, NOT inherit the	COMMENT
LOW	tests/providers/devin-adapter.test.ts	241	// `oauthConfig("devin-cli")` entry would throw at module load, and a live	COMMENT
LOW	tests/providers/devin-adapter.test.ts	541	// slot together at startup, so until that migration runs a row already named	COMMENT
LOW	tests/providers/devin-login.test.ts	281		COMMENT
LOW	tests/providers/provider-registry-parity.test.ts	681	//	COMMENT
LOW	tests/providers/provider-registry-parity.test.ts	781	// response. The earlier version of this test read the models.json sample on	COMMENT
LOW	tests/providers/command-code-fakeip-discovery.test.ts	1	import { afterEach, describe, expect, mock, test } from "bun:test";	COMMENT
LOW	tests/providers/model-rename-migration.test.ts	581	expect(live.providers.untouched).toBe(liveUntouched);	COMMENT
LOW	tests/providers/cursor/cursor-desktop-exec.test.ts	141	expect(reply.message.value.result.case).toBe("failure");	COMMENT
LOW	tests/providers/cursor/cursor-stream-health.test.ts	361		COMMENT
LOW	…providers/cursor/cursor-tool-result-invocation.test.ts	741	//	COMMENT
LOW	…providers/cursor/cursor-tool-result-invocation.test.ts	821	expect(root).not.toContain("\uFFFD");	COMMENT
LOW	tests/providers/xai/grok-lifecycle.test.ts	221	const stopFn = sliceFn(CLI_SOURCE, "async function handleStop(", "async function handleUninstall(");	COMMENT
LOW	tests/providers/xai/grok-lifecycle.test.ts	241	expect(stopFn).toContain("const exact = discovered ?? endpointOf(readRuntimePort(pid));");	COMMENT
LOW	tests/providers/kiro/kiro-stream.test.ts	1681	// context percentage, and the NEXT request for the same conversation is estimated higher for	COMMENT
LOW	tests/providers/kiro/kiro-stream.test.ts	1881	const large = await build(84);	COMMENT
LOW	tests/claude-integration/claude-auth-mode.test.ts	481	expect(env.ANTHROPIC_API_KEY).toBeUndefined();	COMMENT
LOW	tests/claude-integration/claude-outbound.test.ts	361		COMMENT
LOW	tests/responses/responses-pool-401-refresh.test.ts	1421	});	COMMENT
LOW	tests/responses/responses-send-budget-counts.test.ts	361	const response = await handleResponses(responsesRequest("combo/fan"), comboOverTargets(3), logCtx);	COMMENT
LOW	tests/responses/namespace-tool-compat.test.ts	141	});	COMMENT
LOW	tests/server/server-auth.test.ts	3381	//	COMMENT
LOW	tests/server/api-usage.test.ts	81	resetUsageSummaryCacheForTests();	COMMENT
412 more matches not shown…

Modern AI Meta-Vocabulary95 hits · 246 pts

Severity	File	Line	Snippet	Context
MEDIUM	CREDITS.md	73	\| [#1932](https://github.com/lidge-jun/opencodex/pull/1932) \| [@harryzhou2000](https://github.com/harryzhou2000) \| [`f2b	CODE
MEDIUM	README.md	173	<td>Thanks to <a href="https://www.orcarouter.ai/?utm_source=opencodex&utm_medium=readme">OrcaRouter</a> for sponsoring	CODE
MEDIUM	README.md	410	ocx v2 <...> # multi-agent v1/v2 surface controls	CODE
MEDIUM	…cs-site/src/content/docs/ru/guides/codex-app-models.md	123	## Режим multi-agent surface	COMMENT
MEDIUM	…cs-site/src/content/docs/fr/guides/codex-app-models.md	176	## Mode de surface multi-agent	COMMENT
MEDIUM	…816_codexrs_multiagent_v2_and_history_perf/000_plan.md	1	# 260816 — codex-rs multi-agent v2 + history performance: opencodex response	COMMENT
MEDIUM	…history_perf/010_phase1_catalog_capability_contract.md	1	# Phase 1 — catalog multi-agent capability contract	COMMENT
MEDIUM	…nd_history_perf/001_upstream_multiagent_v2_evidence.md	1	# Lane A — upstream multi-agent v2 wire surface	COMMENT
MEDIUM	…_v2_and_history_perf/008_origin_main_reverification.md	65	- `395723b23` (#38619) "Source multi-agent instructions from the model catalog" — 멀티에이전트	CODE
MEDIUM	…vlog/_plan/261009_L1-desktop-cli/020_command_guards.md	113	### MODIFY `src/service/orchestration.ts`	COMMENT
MEDIUM	…/_plan/260920_meaning_preservation_batch/050_lane_e.md	22	output cap and #3 is the context window, and collapsing them would ask Cognition to	CODE
MEDIUM	…lan/800_agent-fabric/010_live_repository_assessment.md	61	Inspected open issues/PRs. Visible items are provider-preset additions (PR #923 "Command Code preset") and routing/compa	CODE
MEDIUM	…_plan/260909_bulk_closeout_249/010_wp1_luvs01_train.md	183	\| #4034 \| `src/server/responses/collaboration.ts` (+4/-9), `tests/codex-integration/multi-agent-compat.test.ts` (+50/-4)	CODE
MEDIUM	…_plan/260909_bulk_closeout_249/010_wp1_luvs01_train.md	780	\| #4034 \| wp1 \| LAND_AS_IS \| merge-in-place \| #4034 \| eb835fe33 \| RUN \| SHA \| multi-agent-compat 63/0 \| - \| after #4043	CODE
MEDIUM	…g/_plan/260909_bulk_closeout_249/001_lane_bug_prs_a.md	19	\| PR #4034 \| LAND_AS_IS \| Replaces duplicated v1 multi-agent text with the shared policy constant; RED (3 fail) -> GREEN	CODE
MEDIUM	devlog/_plan/260828_ocx_agentic_control/000_plan.md	1	# 000 — ocx as a complete agentic control surface	COMMENT
MEDIUM	…_plan/260905_now_split_train/030_lib_upstream_retry.md	65	- Expected source churn: 130 additions + 125 deletions = 255; no #b required. Highest-consumer fetch/recovery symbols re	CODE
MEDIUM	devlog/_fin/260725_pr-issue-triage.md	15	\| #365 \| [WRONG BRANCH] fix: multi-agent guidance dedupe \| `main` 타겟, draft, CONFLICTING \| 클로즈 + dev 리타겟 안내 \|	CODE
MEDIUM	…4_astra_release_alignment/010_wp2_catalog_alignment.md	15	## Approach: pin the real row, drop the alias scaffolding	COMMENT
MEDIUM	devlog/_fin/260709_ultra_reasoning_spec/000_plan.md	6	- Trigger: upstream codex-rs series — df1199fdd `[codex] Add Ultra reasoning effort (#29899)`, 80f54d126 `Treat max	CODE
MEDIUM	…807_untouched_bug_stack/110_context_window_controls.md	1	# 110 — #1073: metadata 없는 프로바이더의 context window 를 GUI 에서 정할 수 없다	COMMENT
MEDIUM	…350_cursor-provider-add/20_readonly-cursor-mvp-plan.md	341	### Phase 1: restore safe scaffold	COMMENT
MEDIUM	…ui_grok_improvements/030_grok_native_context_window.md	1	# 030 — WP3: native models reach Grok with no context window, so Sol shows 200k	COMMENT
MEDIUM	devlog/_fin/260908_bug6_manual_stack/030_v2_guidance.md	9	Source: [pinned collaboration implementation](https://github.com/lidge-jun/opencodex/blob/6fb0fc6f1d34c77b98a74fe817e5bd	CODE
MEDIUM	devlog/_fin/260908_bug6_manual_stack/030_v2_guidance.md	9	Source: [pinned collaboration implementation](https://github.com/lidge-jun/opencodex/blob/6fb0fc6f1d34c77b98a74fe817e5bd	CODE
MEDIUM	devlog/_fin/260908_bug6_manual_stack/040_v2_preset.md	56	GUI cases, pinned [subagents-ultra-mode.test.tsx:126-318](https://github.com/lidge-jun/opencodex/blob/db502d486c8d8de80c	CODE
MEDIUM	devlog/_fin/260927_merge_train_3/097_batch11.md	7	\| #6078 \| rhomat27 (draft) \| The Claude Desktop Code-tab picker marks routes with a context window of at least 1M with `	CODE
MEDIUM	…og/_fin/260927_release_train_4/gui-ux/001_inventory.md	7	\| #6058 \| `0798999c6f` \| 51 \| none \| Routed model capability editor; lane-owned. Current CodeRabbit finding permits a po	CODE
MEDIUM	…_fin/260727_pr536_glm_rework/000_state_and_evidence.md	77	### B3 — no context window, so Codex compacts early	COMMENT
MEDIUM	devlog/_fin/260928_release_train_5/000_roadmap.md	20	\| 040 reasoning-zen \| #6123 narrowed carry (#6122), #5995 carry \| Raw chain-of-thought exposure on iOS remote; keyless Z	CODE
MEDIUM	…t_v1_default_encryption_guard/060_upstream_evidence.md	11	\| #36892 Support leaf models in multi-agent v2 \| merged \| Fixed the Sol/Terra plus Luna case. Does not touch cross-provi	CODE
MEDIUM	…tract_quality_fixes/030_carried_catalog_and_gui_prs.md	62	## U5 — custom-model context window validation (PR #4863, @codingbooo)	COMMENT
MEDIUM	…og/_fin/260911_lane_dispatch_round/020_lane_packets.md	218	2. #4190 — vendor CLI agent scaffolding leaks into routed output for `qoder`. **Decision: fix it	CODE
MEDIUM	…/_fin/500_storage-page-session-cleanup/10_epic_plan.md	15	### 2. Decade-numbered devlog scaffold (inside 500_ folder)	COMMENT
MEDIUM	…60717_pr139_140_stacked_rebuild/002_conflict_matrix.md	13	\| `gui/src/pages/Providers.tsx` \| 040-100 then 130 \| Never choose either whole file. Reapply #140 query/diagnostic delta	CODE
MEDIUM	devlog/_fin/260724_bugfix_train/050_pr336_takeover.md	183	### MODIFY `tests/multi-agent-compat.test.ts`	COMMENT
MEDIUM	…vlog/_fin/260724_bugfix_train/010_passthrough_state.md	10	- Trigger: issue #334 reports that native Responses SSE persistence loses completed output items when `response.comp	CODE
MEDIUM	…log/_fin/260917_l5_cursor_stabilization/000_roadmap.md	19	\| U4 \| #4852 (re-opens #4596) \| new `codex/` branch off `dev` \| `src/adapters/codebuddy/scaffold-guard.ts` \|	CODE
MEDIUM	…rsor_stabilization/040_u4_codebuddy_bare_tool_names.md	1	# U4 — CodeBuddy scaffold guard misses bare tool names (#4852)	COMMENT
MEDIUM	…11_l6_streaming_tools/020_4190_qoder_scaffold_guard.md	1	# 020 — #4190: refuse vendor scaffolding on the qoder route	COMMENT
MEDIUM	devlog/_fin/260911_l6_streaming_tools/000_packet.md	79	2. #4190 — vendor CLI agent scaffolding leaks into routed output for `qoder`. **Decision: fix it	CODE
MEDIUM	…g/_fin/260911_devin_two_providers/003_live_evidence.md	123	#2 is the output cap and #3 is the context window; we had them swapped. A	CODE
MEDIUM	devlog/_fin/260923_gpt6_catalog_lanes/000_plan.md	12	- openai/codex `deb0a08f2` (#47085, 2026-09-21) describes GPT-5.6-Sol as "Reliable agentic workhorse for everyday tasks.	CODE
MEDIUM	…fin/260723_large_file_restructure/020_catalog_split.md	135	### `sync.ts` — orchestration: entry build/merge, backup/persistence, subagent roster (imports bundled.ts; no longer own	COMMENT
MEDIUM	…n/10_runtime-resilient-tool-identity-and-patch-plan.md	370	`https://geminicli.com/docs/cli/gemini-md/`, and Google Code Assist agentic	CODE
MEDIUM	…ve_handoff/002_upstream_v2_and_realtime_v3_behavior.md	1	# 002 — Upstream multi-agent v2 and realtime v3 behavior	COMMENT
MEDIUM	…ve_handoff/002_upstream_v2_and_realtime_v3_behavior.md	6	## Part A — multi-agent v2	COMMENT
MEDIUM	…og/_fin/260826_cursor_responses_gap/020_gap_summary.md	16	### G1 — History replay representation destroys agentic turn state (CRITICAL, ADAPTER)	COMMENT
MEDIUM	…g/_fin/260709_v2_gated_ultra/010_multi_agent_compat.md	1	# 060 — multi-agent compat: v1 ultra prompt + encrypted-slot sanitizer (260709)	COMMENT
MEDIUM	…g/_fin/260709_v2_gated_ultra/010_multi_agent_compat.md	32	## Shipped (src/server/responses.ts, tests/multi-agent-compat.test.ts)	COMMENT
MEDIUM	…/_fin/260822_senpi_cursor_transfer/007_cli_fallback.md	9	It spawns official `cursor-agent -p --output-format stream-json --stream-partial-output --trust` ([spawn-args.ts L18-34]	CODE
MEDIUM	…/_fin/260822_senpi_cursor_transfer/007_cli_fallback.md	9	It spawns official `cursor-agent -p --output-format stream-json --stream-partial-output --trust` ([spawn-args.ts L18-34]	CODE
MEDIUM	…indows_suite_stabilization/020_defect_launcher_argv.md	50	### MODIFY `tests/multi-agent-keep-native-v1.test.ts`	COMMENT
MEDIUM	devlog/_fin/260723_issue_triage/000_plan.md	100	\| 6 \| #290 #288 \| `007_investigation_290_288_spawn_agent.md` \| src/server/responses.ts spawn surface, src/config.ts, src	CODE
MEDIUM	…723_issue_triage/003_investigation_295_300_guidance.md	1	# 003 — Investigation: issues #295 / #300 multi-agent guidance accuracy and kill switch	COMMENT
MEDIUM	…723_issue_triage/003_investigation_295_300_guidance.md	7	Issues: #295, “Multi-agent guidance can advertise rejected spawn models”; #300, “Add a supported kill switch for repeate	CODE
MEDIUM	…723_issue_triage/003_investigation_295_300_guidance.md	436	#295 — confirmed OpenCodex bug; keep Bucket 2. The proxy generates inaccurate absolute schema wording and computes g	CODE
MEDIUM	…60723_issue_triage/041_fix_300_guidance_kill_switch.md	1	# 041 — Fix issue #300: multi-agent guidance kill switch	COMMENT
MEDIUM	…60723_issue_triage/041_fix_300_guidance_kill_switch.md	681	### 8.7 `tests/multi-agent-compat.test.ts` cases 9–11	COMMENT
MEDIUM	…g/_fin/260723_issue_triage/040_fix_295_300_guidance.md	1	# 040 — Fix issue #295: accurate multi-agent guidance roster	COMMENT
35 more matches not shown…

Hallucination Indicators10 hits · 100 pts

Severity	File	Line	Snippet	Context
CRITICAL	tests/clients/t3code-client.test.ts	93	expect(applied.providerInstances.opencodex.config.customModels.map((model: { slug: string }) => model.slug))	CODE
CRITICAL	tests/providers/kiro/kiro-stream.test.ts	358	expect(retry.currentMessage.userInputMessage.userInputMessageContext.tools.map(	CODE
CRITICAL	tests/server/server-kiro-completion-e2e.test.ts	111	return request.conversationState.currentMessage.userInputMessage.userInputMessageContext.tools.map(	CODE
CRITICAL	tests/codex-integration/codex-cli-update-apply.test.ts	678	const sibling = join(f.prefix, "lib", "node_modules", ...f.old.artifacts.backing.installName.split("/"));	CODE
CRITICAL	tests/codex-integration/codex-cli-update-apply.test.ts	680	renameSync(sibling, join(nestedScope, f.old.artifacts.backing.installName.split("/")[1]!));	CODE
CRITICAL	tests/codex-integration/codex-cli-update-apply.test.ts	703	const auxiliary = join(f.prefix, "lib", "node_modules", ...f.target.artifacts.backing.installName.split("/"), "v	CODE
CRITICAL	tests/codex-integration/codex-cli-update-apply.test.ts	706	if (scenario === "native-nonexecutable") chmodSync(join(f.prefix, "lib", "node_modules", ...f.target.artifacts.b	CODE
CRITICAL	tests/codex-integration/codex-cli-update-apply.test.ts	718	chmodSync(join(f.prefix, "lib", "node_modules", ...f.target.artifacts.backing.installName.split("/"),	CODE
CRITICAL	tests/codex-integration/codex-cli-update-apply.test.ts	774	const native = join(f.prefix, "lib", "node_modules", ...f.old.artifacts.backing.installName.split("/"),	CODE
CRITICAL	src/cli/index.ts	1845	console.log(` Removed efforts: ${status.json.codexRuntime.catalogClamp.removedEfforts.join(", ")}`);	CODE

Fake / Example Data90 hits · 94 pts

Severity	File	Line	Snippet	Context
LOW	devlog/_fin/260725_macos_menubar_app/020_phase2_ui.md	264	dash (`003` §6). Conflating the two is the fake-data tell.	CODE
LOW	…02_cursor_integrations_tab/010_layer1_server_status.md	41	gateway: { baseUrl: string; apiKeyMode: "credential" \| "placeholder"; placeholder: string };	CODE
LOW	…02_cursor_integrations_tab/010_layer1_server_status.md	50	else "placeholder" = "opencodex-loopback". readRuntimePort is src/config/process-state.ts:75	CODE
LOW	…_pr139_140_stacked_rebuild/040_pr139_management_api.md	9	- /api/providers/test connectivity probe (H249-portion): TAKE with repairs (mechanism pinned per A-audit). The s	CODE
LOW	…_pr139_140_stacked_rebuild/040_pr139_management_api.md	23	- NEW `tests/provider-connection-test.test.ts`: unreachable `127.0.0.1:1` + static catalog and fake-key cases cannot rep	CODE
LOW	app/Sources/MenuBarCoreTests/FormattingSuite.swift	43	// Unknown and zero are different facts. Rendering nil as "0" is the fake-data	COMMENT
LOW	tests/oauth/chatgpt-oauth.test.ts	101	expect(extractEmail(jwt)).toBe("user@example.com");	CODE
LOW	tests/oauth/dsh-login.test.ts	107	email: "user@example.com",	CODE
LOW	tests/oauth/dsh-login.test.ts	120	expect(res.email).toBe("user@example.com");	CODE
LOW	tests/oauth/oauth-account-attribution.test.ts	100	for (const bad of ["", "o", "oZZZZZZ", "ozzzzzz", "oabc12", "oabc1234", "xabc123", "acct-1", "user@example.com", nul	CODE
LOW	tests/oauth/oauth-account-attribution.test.ts	115	const label = oauthAccountLogLabel("user@example.com");	CODE
LOW	tests/oauth/oauth-account-attribution.test.ts	121	expect(oauthAccountLogLabel("user@example.com")).toBe(label);	CODE
LOW	tests/update/update-job.test.ts	415	expect(persisted).not.toContain("Jane Doe");	CODE
LOW	tests/update/update-job.test.ts	438	expect(persisted).not.toContain("Jane Doe");	CODE
LOW	tests/update/update-job.test.ts	448	renamed.name = "Jane Doe";	CODE
LOW	tests/update/update-job.test.ts	465	expect(persisted).not.toContain("Jane Doe");	CODE
LOW	tests/update/update-job.test.ts	490	expect(summary).not.toContain("Jane Doe");	CODE
LOW	tests/update/update-job.test.ts	502	expect(notFound).not.toContain("Jane Doe");	CODE
LOW	tests/update/update-job.test.ts	535	expect(summary).not.toContain("Jane Doe");	CODE
LOW	tests/update/update-home-worker.test.ts	122	const command = { bin: "placeholder", args: [] as string[], display: "" };	CODE
LOW	tests/update/update-home-worker.test.ts	169	const command = { bin: "placeholder", args: [] as string[], display: "" };	CODE
LOW	tests/update/update-home-worker.test.ts	182	const npm = { bin: "placeholder", args: ["C:\\ocx\\bin\\ocx.mjs", "update", "--tag", "latest"], display: "" };	CODE
LOW	…sts/providers/cursor/cursor-integration-status.test.ts	175	expect(first.gateway.apiKeyMode).toBe("placeholder");	CODE
LOW	…sts/providers/cursor/cursor-integration-status.test.ts	289	apiKeyMode: "placeholder",	CODE
LOW	tests/claude-integration/claude-messages-thread.test.ts	57	"x-api-key": "placeholder",	CODE
LOW	…ts/claude-integration/claude-messages-endpoint.test.ts	132	"x-api-key": "placeholder",	CODE
LOW	…ts/claude-integration/claude-messages-endpoint.test.ts	1138	"x-api-key": "placeholder",	CODE
LOW	…ts/claude-integration/claude-messages-endpoint.test.ts	1452	"content-type": "application/json", "x-api-key": "placeholder",	CODE
LOW	…ts/claude-integration/claude-messages-endpoint.test.ts	1644	headers: { "content-type": "application/json", "x-api-key": "placeholder", "anthropic-version": "2023-06-01" },	CODE
LOW	…ts/claude-integration/claude-messages-endpoint.test.ts	1819	headers: { "content-type": "application/json", "x-api-key": "placeholder" },	CODE
LOW	…s/claude-integration/claude-native-passthrough.test.ts	809	const res2 = await postNative(String(server.url), "/v1/messages", toolRoundTrip(polluted, "placeholder"));	CODE
LOW	tests/claude-integration/claude-auth-detect.test.ts	33	readClaudeJson: () => ({ oauthAccount: { emailAddress: "user@example.com" } }),	CODE
LOW	tests/claude-integration/claude-auth-detect.test.ts	38	expect(JSON.stringify(result.sources)).not.toContain("user@example.com");	CODE
LOW	…s/claude-integration/claude-cli-picker-surface.test.ts	73	headers: { "content-type": "application/json", "x-api-key": "placeholder", "anthropic-version": "2023-06-01", "u	CODE
LOW	…esponses/responses-chatgpt-web-replay-metadata.test.ts	97	apiKey: "dummy-key",	CODE
LOW	…esponses/responses-chatgpt-web-replay-metadata.test.ts	114	apiKey: "dummy-key",	CODE
LOW	tests/server/account-import.test.ts	31	return { email: "user@example.com", refresh_token: "refresh-safe", ...overrides };	CODE
LOW	tests/server/account-import.test.ts	41	records: [{ index: 0, record: { email: "user@example.com", refreshToken: "refresh-safe" } }],	CODE
LOW	tests/server/account-import.test.ts	67	record({ email: "user@example.com", refresh_token: "second" }),	CODE
LOW	tests/server/account-import.test.ts	73	{ index: 0, record: { email: "user@example.com", refreshToken: "first" } },	CODE
LOW⚡	tests/server/account-import.test.ts	132	email: "user@example.com",	CODE
LOW⚡	tests/server/account-import.test.ts	139	expect(await rejected.importRecord({ email: "user@example.com", refreshToken: CANARY }))	CODE
LOW⚡	tests/server/account-import.test.ts	146	expect(await mismatch.importRecord({ email: "user@example.com", refreshToken: CANARY }))	CODE
LOW⚡	tests/server/account-import.test.ts	153	expect(await noProviderEmail.importRecord({ email: "user@example.com", refreshToken: CANARY }))	CODE
LOW⚡	tests/server/account-import.test.ts	160	expect(await noProject.importRecord({ email: "user@example.com", refreshToken: CANARY }))	CODE
LOW⚡	tests/server/account-import.test.ts	167	const outcome = await writeFailure.importRecord({ email: "user@example.com", refreshToken: CANARY });	CODE
LOW	tests/server/account-import.test.ts	225	email: "user@example.com",	CODE
LOW	tests/server/account-import.test.ts	241	email: "user@example.com",	CODE
LOW	tests/server/account-import.test.ts	325	email: "user@example.com",	CODE
LOW	tests/server/account-import.test.ts	343	access: "access-two", refresh: "refresh-two", expires: 2, email: "user@example.com", projectId: "project-two",	CODE
LOW	tests/server/account-import.test.ts	355	email: "user@example.com",	CODE
LOW	tests/server/account-import.test.ts	367	email: "user@example.com",	CODE
LOW	tests/server/account-import-project-fallback.test.ts	18	return { access: "access-for-user", refresh: CANARY, expires: Date.now() + 60_000, email: "user@example.com", ...overr	CODE
LOW	tests/server/account-import-project-fallback.test.ts	38	const doc = (projectId?: unknown) => [{ email: "user@example.com", refresh_token: "refresh-safe", ...(projectId === unde	CODE
LOW	tests/server/account-import-project-fallback.test.ts	44	records: [{ index: 0, record: { email: "user@example.com", refreshToken: "refresh-safe", projectId: "aicode-consum	CODE
LOW	tests/server/account-import-project-fallback.test.ts	65	expect(h.writes[0]).toMatchObject({ projectId: "aicode-consumers", email: "user@example.com", source: "credential-fi	CODE
LOW	tests/usage/request-log-conversation.test.ts	47	expect(normalizeLogConversationId(" user@example.com ")).toBe(digest32("user@example.com"));	CODE
LOW	tests/cli/cli-provider.test.ts	551	deepseek: { adapter: "openai-chat", baseUrl: "https://api.deepseek.com/v1", apiKey: "test-dummy-key-for-masking"	CODE
LOW	tests/cli/cli-provider.test.ts	559	expect(result.stdout).not.toContain("test-dummy-key-for-masking");	CODE
LOW	tests/cli/cli-integration-cursor.test.ts	23	function status(apiKeyMode: "credential" \| "placeholder" = "placeholder"): CursorIntegrationStatus {	CODE
30 more matches not shown…

Decorative Section Separators30 hits · 89 pts

Severity	File	Line	Snippet	Context
MEDIUM	devlog/_fin/260725_pr_issue_rework/000_plan.md	160	WP3 #439 kiro ─────────────┘	CODE
MEDIUM	tests/claude-integration/claude-picker-ca.test.ts	62	// ── acceptsPickerAuthority trust-boundary fixtures ─────────────────────────────	COMMENT
MEDIUM	tests/server/server-live.test.ts	1391	// ── /readyz: per-server readiness gate ────────────────────────────────────────	COMMENT
MEDIUM	tests/server/server-live.test.ts	1605	// ── /readyz per-server gate isolation ─────────────────────────────────────────	COMMENT
MEDIUM	tests/server/proxy-liveness.test.ts	491	// ── findLiveProxy single-deadline candidate gating ───────────────────────────	COMMENT
MEDIUM	tests/server/proxy-liveness.test.ts	624	// ── per-server readiness gate (closure, no module-global state) ────────────────	COMMENT
MEDIUM	tests/server/proxy-liveness.test.ts	681	// ── runStartupReadinessSync drives the gate from the sync outcome ──────────────	COMMENT
MEDIUM	tests/server/proxy-liveness.test.ts	765	// ── validateReadyzBody: strict contract (pure) ─────────────────────────────────	COMMENT
MEDIUM	tests/server/proxy-liveness.test.ts	974	// ── probeReadiness: strict HTTP + contract enforcement ─────────────────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	24	// ── parseReadyArgs ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	108	// ── runReady over injected io ─────────────────────────────────────────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	362	// ── deadline correctness: timeout wins at/after the deadline ──────────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	517	// ── hard-deadline I/O gating (P1) ────────────────────────────────────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	636	// ── handleStart readinessGate wiring (source-level integration guard) ─────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	690	// ── P1: ready pre-parse before maybeAutoRestoreCodexShimAsync (source-level) ────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	772	// ── P1: invalid matrices never reach discovery/probe (counters) ───────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	814	// ── production findLiveProxy deadline wiring (source-level) ───────────────────	COMMENT
MEDIUM	tests/cli/cli-ready.test.ts	851	// ── handleStart service-wrapper exit guard (source-level) ─────────────────────	COMMENT
MEDIUM	…/codex-integration/codex-model-denial-evidence.test.ts	220	// ─── Credential generation (#4952) ───────────────────────────────────────────	COMMENT
MEDIUM	…/codex-integration/codex-model-denial-evidence.test.ts	220	// ─── Credential generation (#4952) ───────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/ci.yml	1	# ============================================================================	COMMENT
MEDIUM	.github/workflows/ci.yml	8	# ============================================================================	COMMENT
MEDIUM	src/oauth/nous.ts	130	// ── Durable refresh-intent (review blocker #2) ──────────────────────────────	COMMENT
MEDIUM	src/oauth/nous.ts	130	// ── Durable refresh-intent (review blocker #2) ──────────────────────────────	COMMENT
MEDIUM	src/claude/intercept/local-ca.ts	24	// ── DER encoding ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/claude/intercept/local-ca.ts	182	// ── Authority + leaves ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/claude/intercept/local-ca.ts	313	// ── Persistence ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/server/claude-messages.ts	218	// ── Native Anthropic passthrough (subscription OAuth pierce) ──────────────────────	COMMENT
MEDIUM	src/server/proxy-liveness.ts	680	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/server/proxy-liveness.ts	701	// ─────────────────────────────────────────────────────────────────────────────	COMMENT

AI Slop Vocabulary24 hits · 70 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/responses/chat-completions-deferred-tools.test.ts	13	* #4735: an OpenAI-compatible harness may declare part of its tool catalog and discover the rest	COMMENT
MEDIUM	tests/server/session-lane-recall-harness.test.ts	153	describe("#820 concurrent tool-recall session harness", () => {	CODE
MEDIUM	scripts/ci/select-test-lane.sh	10	# the import graph cannot follow (the harness itself, golden fixtures read as	COMMENT
MEDIUM	gui/tests/integration-marks.test.ts	65	* brand. openai.svg is #10A37F, deepseek-harness.svg is #4d6bfe and raycast.svg	COMMENT
MEDIUM	gui/tests/app-sidebar-actions.test.ts	41	// Splitting on the tag start is more robust than matching to a closing angle	COMMENT
MEDIUM	gui/src/hooks/useCodexAccountPool.ts	571	// the pin still naming `id`, which makes it order-robust: whichever response	COMMENT
MEDIUM	.github/workflows/codex-queue-helpers.yml	48	# accounts, services, downloads or model requests are used by this harness.	COMMENT
MEDIUM	.github/workflows/ci.yml	433	# ACL and process code, and the harness every Windows shard runs.	COMMENT
MEDIUM	.github/workflows/ci.yml	739	# harness. Keep the entire six-file family in one fresh process so a runtime	COMMENT
MEDIUM⚡	src/codex/data/upstream-models.json	75	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/upstream-models.json	75	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM	src/codex/data/upstream-models.json	837	"instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	77	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	77	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	176	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	176	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	252	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	252	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	351	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	351	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	432	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	432	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	608	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	608	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE

Structural Annotation Overuse14 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW	…vlog/_fin/260815_open_pr_triage/020_merge_execution.md	10	### Step 1 - retarget stacked children to dev (gh pr edit --base dev)	COMMENT
LOW	…vlog/_fin/260815_open_pr_triage/020_merge_execution.md	15	### Step 2 - integration branch	COMMENT
LOW⚡	…vlog/_fin/260815_open_pr_triage/020_merge_execution.md	33	### Step 3 - devlog unit onto int	COMMENT
LOW⚡	…vlog/_fin/260815_open_pr_triage/020_merge_execution.md	37	### Step 4 - validate	COMMENT
LOW⚡	…vlog/_fin/260815_open_pr_triage/020_merge_execution.md	43	### Step 5 - land	COMMENT
LOW	…n/260814_bug_resolution_campaign/060_wave6_ci_bun14.md	44	### Step 5: Release suite 확장	COMMENT
LOW	…n/260814_bug_resolution_campaign/060_wave6_ci_bun14.md	53	### Step 6: Bun 1.4 승격	COMMENT
LOW⚡	tests/responses/responses-compaction-routing.test.ts	1744	// Step 1: an ordinary combo turn succeeds, populating the recall map.	COMMENT
LOW⚡	tests/responses/responses-compaction-routing.test.ts	1752	// Step 2: compaction arrives with the bare native model on the same lane.	COMMENT
LOW⚡	tests/adapters/google/google-antigravity-replay.test.ts	183	// Step 1: FC1 returns sig A.	COMMENT
LOW⚡	tests/adapters/google/google-antigravity-replay.test.ts	185	// Step 2: FC2 returns sig B (different identity, same partIndex 0).	COMMENT
LOW⚡	src/lib/windows-secret-acl.ts	1095	// Step 1: grant current user full control BEFORE any destructive ACL change.	COMMENT
LOW⚡	src/lib/windows-secret-acl.ts	1099	// Step 2: disable inheritance and remove inherited ACEs. The explicit owner ACE	COMMENT
LOW⚡	src/lib/windows-secret-acl.ts	1103	// Step 3: remove broad explicit grants using stable SIDs (not localized names).	COMMENT

Slop Phrases15 hits · 26 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	src/codex/data/upstream-models.json	75	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	src/codex/data/upstream-models.json	75	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW	src/codex/data/upstream-models.json	242	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	src/codex/data/upstream-models.json	367	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	src/codex/data/upstream-models.json	488	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	src/codex/data/upstream-models.json	837	"instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an	CODE
LOW⚡	src/codex/data/roster-pinned-models.json	77	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	src/codex/data/roster-pinned-models.json	176	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	src/codex/data/roster-pinned-models.json	252	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	src/codex/data/roster-pinned-models.json	351	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	432	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	src/codex/data/roster-pinned-models.json	432	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	src/codex/data/roster-pinned-models.json	608	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	src/codex/data/roster-pinned-models.json	608	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM	src/lib/errors.ts	239	"i'm unable to help with that request",	CODE

Synthetic Comment Markers3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	…plan/260909_bulk_closeout_249/003_lane_small_nonbug.md	340	#4038 is OPEN, `enhancement` + `gui`, opened 2026-09-08 by the same author (cb8010d6) three hours before the PR. It	COMMENT
HIGH	devlog/_fin/260813_bun_canary_dogfood/020_bun_canary.md	9	## Step 1 — Install canary exactly as requested	COMMENT
HIGH	tests/responses/responses-memory-models.test.ts	474	// log records as requested; the phase itself is named in the route decision.	COMMENT

Verbosity Indicators7 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW⚡	tests/responses/responses-compaction-routing.test.ts	1744	// Step 1: an ordinary combo turn succeeds, populating the recall map.	COMMENT
LOW⚡	tests/responses/responses-compaction-routing.test.ts	1752	// Step 2: compaction arrives with the bare native model on the same lane.	COMMENT
LOW⚡	tests/adapters/google/google-antigravity-replay.test.ts	183	// Step 1: FC1 returns sig A.	COMMENT
LOW⚡	tests/adapters/google/google-antigravity-replay.test.ts	185	// Step 2: FC2 returns sig B (different identity, same partIndex 0).	COMMENT
LOW⚡	src/lib/windows-secret-acl.ts	1095	// Step 1: grant current user full control BEFORE any destructive ACL change.	COMMENT
LOW⚡	src/lib/windows-secret-acl.ts	1099	// Step 2: disable inheritance and remove inherited ACEs. The explicit owner ACE	COMMENT
LOW⚡	src/lib/windows-secret-acl.ts	1103	// Step 3: remove broad explicit grants using stable SIDs (not localized names).	COMMENT

Self-Referential Comments4 hits · 10 pts

Severity	File	Line	Snippet	Context
MEDIUM	.coderabbit.yaml	3	# This file is the single source of truth for CodeRabbit behavior; prefer editing	COMMENT
MEDIUM	…18_cursor_call_integration/cursor-call-integration.zsh	70	# Create the worktree only if it is missing, then prove it is at the expected SHA AND	COMMENT
MEDIUM	tests/ci-workflows/bump-dev-version.test.ts	133	"# This file is automatically @generated by Cargo.",	CODE
MEDIUM	tests/ci-workflows/bump-dev-version.test.ts	340	expect(lock.startsWith("# This file is automatically @generated by Cargo.\n# It is not intended for manual editing.\	CODE

Cross-Language Confusion1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH⚡	…te_thread_provider_policy/probes/test_native_policy.py	104	for wire in ('{}', '{"modelProviders": null}'):	CODE

Unused Imports7 hits · 6 pts

Severity	File	Line	Context
LOW	…928_remote_thread_provider_policy/probes/test_probe.py	1	CODE
LOW	…928_remote_thread_provider_policy/probes/test_probe.py	4	CODE
LOW	…_remote_thread_provider_policy/probes/native_policy.py	8	CODE
LOW	…te_thread_provider_policy/probes/test_native_policy.py	2	CODE
LOW	…_thread_provider_policy/probes/test_loopback_bridge.py	6	CODE
LOW	…_thread_provider_policy/probes/test_loopback_bridge.py	8	CODE
LOW	…ote_thread_provider_policy/probes/remote_list_probe.py	9	CODE

Cross-Language Confusion (JS/TS)1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	tests/clients/desktop-runtime-identity.test.ts	124	expect(body).toContain("_ => return None,");	CODE

Deep Nesting5 hits · 4 pts

Severity	File	Line	Context
LOW	…te_thread_provider_policy/probes/test_native_policy.py	30	CODE
LOW	…te_thread_provider_policy/probes/test_native_policy.py	54	CODE
LOW	…_thread_provider_policy/probes/test_loopback_bridge.py	60	CODE
LOW	…_thread_provider_policy/probes/test_loopback_bridge.py	70	CODE
LOW	…ote_thread_provider_policy/probes/remote_list_probe.py	88	CODE

lidge-jun/opencodex

Open-Source Code Quality, Security and Technical Debt Review