[HouMinXi]

Summary

Closes #30.

• Give runtime its own explicit response keys so a valid advisory finding does not trigger L1 excerpt repair.
• Opt runtime into complete-root JSON decoding across API and CLI responses, JSON correction, continuation and wider retries. Reject duplicate/nonfinite/scalar roots and malformed root text instead of extracting or repairing a different payload.
• Only accept continuations that extend the original response. Preserve default L1/falsifier recovery and the existing runtime singleton-wrapper/metadata compatibility.

The consumer validation already delivered by #59 remains unchanged. This does not manufacture smoke receipts or convergence evidence.

Validation

• 2,262 related runtime, invocation, JSON recovery, excerpt and falsifier tests passed.
• 88 new transport-contract cases include OpenAI/Anthropic/Vertex dispatch, four CLI representations, actual OpenAI/Anthropic HTTP-byte fixtures, nested truncation, correction, append-only continuation and wider retry.
• Ruff 0.17.3 check and format check passed for all touched files; whitespace check passed.
• Manual five-lens review completed over three cycles, plus independent security/correctness and code-quality review and separate acceptance audit on the final patch. Independent default-continuation parity and strict-boundary probes passed; acceptance reviewer reran the initial 2,133 tests. The CI follow-up was independently reviewed and validated again.

Tests replace provider/HTTP or subprocess boundaries; no live provider calls or native CLI service were required. This is not a claim that the entire repository test suite passed. Formal CE automation was not run.

CI follow-up

The first Linux run reported three legacy CLI test doubles that did not accept the new opt-in keyword (31,522 tests passed). The follow-up only updates those test doubles, asserts the default remains false, and adds an explicit runtime strict-true forwarding assertion. Production code is unchanged by the follow-up. New-head CI is green at f9f8643f48ba41c2d555fc2adedee4fb05b2097e: Linux tests, changed-file lint and CodeQL all succeeded. The service-free selection passed 31,526 tests (81 skipped, 68 deselected), ownership/cancellation passed 568, cgroup sandbox passed 32, and local process integration passed 11. These counts retain the workflow's existing selection/exclusions, not an assertion that every repository test ran.

Attribution-clean CI and final composition

Current head d711f15deef9772452da14791855c3fb09def97c has terminal-green Linux, lint, and CodeQL. Linux checked this head against main 8493df4: 31,944 service-free tests passed (81 skipped, 64 deselected), plus 568 ownership/cancellation, 32 sandbox and 11 integration cases passed. The older SHA above is historical before the authorized attribution rewrite.

Prospective composition with #353 is clean: 28 disjoint changed paths retain their reviewed source blobs; 2,094 focused combined tests passed with no failures or skips. Full Ruff check/format (789 files), whitespace and independent composition/requirements acceptance pass. No denied real-CLI/Semgrep qualification route was run. Expected merge tree for this PR: e9745b18b7d7e77fd9855ebc54d6afd81dcafd1c; expected tree after #353: a649d8acf41985fbab743db4ae376005d91c0b73.

Final merged-main CI

Both approved PRs are merged. Final main 2141c997494d08a6756d7073c5dcb1397fc48dee has the reviewed composition tree a649d8acf41985fbab743db4ae376005d91c0b73; Linux tests and CodeQL are terminal green. Linux logs confirm this exact checkout: 32,010 service-free cases passed (81 skipped, 64 deselected; 2 subtests), 568 ownership/cancellation, 32 sandbox, and 11 integration cases passed (7 deselected). These selections may overlap and are not summed. Both merged feature branches were deleted and their absence verified. No CI source fix or history rewrite was needed for this merge sequence.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →