fix(review): operator-stack audit — cross-version placeholders, contract leaks, live-path self-guard

[ginccc]

A four-reviewer audit of everything merged into this branch (#679–#689) plus an end-to-end trace of the operator paths — then a second adversarial round over the fix itself, which caught a HIGH defect in my own first version. The changelog entry carries the full account; the highlights:

Confirmed findings, fixed

Cross-version placeholder stranding. dropPendingApprovalPlaceholder removes the pending bubble by recomputing the exact string — silently assuming pause and resume run the same build. Two releases changed the default wording, so every in-flight pause across the upgrade would have rendered [stale placeholder, answer] on its first resume: the precise artifact those releases were written to kill. Resume now recognises its predecessors' wording; two upgrade-boundary tests simulate a pre-upgrade pause.

Self-conversation guard now holds without a pause — including the branch round two caught. #689's rule was enforced only on the approval path, so an ungated call executed with no check anywhere. My first fix guarded the main live loop; the second review round found the mixed-batch pause branch (ungated calls execute before the pause is thrown, frozen into the batch, never rechecked — one gated delete plus one ungated self-say in a single model turn slipped through). Both loops now refuse with the same NOT_EXECUTED envelope. Accepted cost documented in code: resolver-less tools fall back to raw-argument containment, kept because it is the only check covering converse_with_agent handed the agent's own conversationId.

#684 contract leaks narrowed. Failed results no longer enter ApiCallsTask's cross-call template merge (a failed call's error text could overwrite a previous success's {body} for a later call's payload) nor the RAG system prompt (up to 2KB of proxy/WAF error page masquerading as "## Search Results"). Error bodies — and the status-message fallback — are redacted before reaching the model; a 401 routinely echoes the credential that failed. Memory-side *Error keys unchanged.

Test-drive actually works end-to-end now. Two silent breaks: returningFields="" (the natural fill for a required parameter) nulled steps/outputs/properties from the read-back, so a working agent looked broken; and the say tool's $ref body description carried zero field names, so a guessed {"message": …} bound to InputData defaults and a human-approved test message was never delivered, with a 200. Body $refs resolve one level (schemas namespace only — round two caught the wrong-namespace resolution risk); enum values and defaults reach parameter descriptions (the environment typo→production trap).

Smaller: bare-\r SSE padding, RFC 7615 headers in the credential deny-list, #688's shared-path stripping disclosed.

Verified sound by the audit, no change needed

maxPausesPerTurn exhaustion is fail-closed; the pause ordinal is deterministic across all six resume entry points; #687's guard cannot diverge from the pinned fingerprint; conversation ids are globally unique across environments, so test-env conversations read back fine.

Tests

264 across the affected suites — including upgrade-boundary resumes, live-path refusals, refused-mid-batch behaviour, blank-filter recovery, and redaction survival of the failure reason. Local full unit baseline unchanged (GroupHitlIT needs Docker, as always).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f83c4b8-89b7-4b14-a75a-40d722225c9e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}