DO NOT MERGE: mutation-check for #15931's AC4

[mrveiss]

Throwaway PR, not for merge. Deliberately removes #15931's blocked-by refusal to get a real CI run showing test_the_route_refuses_a_blocked_item red, per the coordinator's request for actual mutation proof rather than a reading-based argument. Will be closed (not merged) once the run is recorded, and a restoring commit follows this one on the same branch before that.

Refs #15931

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 48cd0097-fce7-4ff9-bf74-c477c982624d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(perf): re-derive Multimodal processor startup's budget post-#15297 (#16535) #16537 fix(perf): re-derive Multimodal processor startup's budget post-fix(ml): drop resume_download, removed from from_pretrained in transformers v5 (#15054) #15297 (perf(test): Multimodal processor startup budget still calibrated against #15054's broken (work-skipping) baseline #16535)
• fix(llm-shared): remove dead SemanticLLMCache, keep live semantic cache (#16528) #16536 fix(llm-shared): remove dead SemanticLLMCache, keep live semantic cache (Consolidate duplicate semantic LLM-response cache implementations #16528)
• feat(tooling): check_run_status gains a pending-with-age helper (#16126) #16534 feat(tooling): check_run_status gains a pending-with-age helper (docs(process): two review findings on MEASUREMENT_DISCIPLINE.md — family order and D's missing mechanism #16126)
• fix(files): conversation uploads accept PDF and GIF, not the truncated '.pd' and '.gi' (#16521) #16523 fix(files): conversation uploads accept PDF and GIF, not the truncated '.pd' and '.gi' (bug(files): conversation uploads reject every PDF and GIF because the allowlist says '.pd' and '.gi' #16521)
• fix(infra): consolidate the last 3 private TLS-cert-generation copies (#16020) #16522 fix(infra): consolidate the last 3 private TLS-cert-generation copies (nginx cannot start on a node with no TLS cert: five roles consume the shared keypair, four provision it #16020)
• security(lint): classify test_first_remediation.py as production, fix the 2 real gaps it surfaced (#16514) #16518 security(lint): classify test_first_remediation.py as production, fix the 2 real gaps it surfaced (chore(lint): classify scripts/test_first_remediation.py as production and document the sync_orchestrator ssh gap #16514)
• docs(infra): record redis role tools as binary names, not units (#16060, #16071) #16511 docs(infra): record redis role tools as binary names, not units (Redis is managed by two unit names that do not exist, and a failed restore-stop is silent #16060, redis naming: five more sites name a unit the fleet does not have (#16060 follow-up) #16071)
• refactor(lifespan): split cleanup_services and _init_graph_rag_service into steps under the length limit (#16250) #16509 refactor(lifespan): split cleanup_services and _init_graph_rag_service into steps under the length limit (function-length-check pre-commit hook blocks any commit to lifespan.py: cleanup_services (267 lines) and _init_graph_rag_service (68 lines) exceed the 65-line ceiling #16250)
• security(routers): gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream (#16507) #16508 security(routers): gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream (security(routers): gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream #16507)
• test(user-management): a user in org A gets no results from org B (#16279) #16506 test(user-management): a user in org A gets no results from org B (security(users): /user-management/users/search answers anonymous callers with names from every organisation #16279)
• security(settings): record the real caller, not the literal "admin" (#16501) #16504 security(settings): record the real caller, not the literal "admin" (security(settings): sync_config and update_hardware_priority record the literal "admin" instead of the real caller #16501)
• fix(chat-knowledge): contexts can be deleted, cascade with their chat, and orphans get cleaned (#16490) #16503 fix(chat-knowledge): contexts can be deleted, cascade with their chat, and orphans get cleaned (bug(chat-knowledge): contexts can be created but never deleted, so orphans accumulate #16490)
• fix(slm-frontend): give the service-log fetch one path and its real timeout (#16256) #16500 fix(slm-frontend): give the service-log fetch one path and its real timeout (tech-debt(slm-frontend): the two log viewers fetch the same journal through two paths with different timeouts #16256)
• fix(a2a): cooperative cancellation checkpoints in execute_a2a_task (#16174) #16498 fix(a2a): cooperative cancellation checkpoints in execute_a2a_task (Cancelling an A2A task does not stop its executor, so claims can only lapse rather than release #16174)
• fix(sdk): TypeScript SDK request/response parity + missing /api prefix (#15528, #16495) #16497 fix(sdk): TypeScript SDK request/response parity + missing /api prefix (bug(sdk): the TypeScript SDK still sends the parameters and parses the envelopes the Python SDK stopped sending #15528, bug(sdk): every TypeScript SDK request omits the /api prefix — 404 against a real backend #16495)
• refactor(agents): extract NPUCodeSearchAgent's pattern helpers, add declared_scopes (#16173) #16496 refactor(agents): extract NPUCodeSearchAgent's pattern helpers, add declared_scopes (NPUCodeSearchAgent cannot declare its write scopes: its file is at the size ceiling #16173)
• fix(frontend): converge the permission vocabulary onto the backend's real Permission enum, wire in v-permission (#16243) #16493 fix(frontend): converge the permission vocabulary onto the backend's real Permission enum, wire in v-permission (tech-debt(frontend): usePermissions' permission strings share nothing with the backend's Permission vocabulary #16243)
• security(research): treat fetched repos and pages as untrusted data (#16488) #16492 security(research): treat fetched repos and pages as untrusted data (security(research): treat fetched repos and pages as untrusted data: prompt-injection hardening for research, adopt and web-fetch #16488)
• feat(frontend): wire router meta.minRole into a real guard, ranked against the backend's role order (#16244) #16489 feat(frontend): wire router meta.minRole into a real guard, ranked against the backend's role order (tech-debt(frontend): router meta.minRole is declared and read by no guard #16244)
• chore(git): rename Dev_new_gui to main and main to release across the repo (#16479) #16487 chore(git): rename Dev_new_gui to main and main to release across the repo (infra(git): swap branch names across the repo for the rename (in-repo half of #16461) #16479)
• feat(secrets): wire in SecretAuditLog, consolidate SecretVault into SecretsManager (#16485) #16486 feat(secrets): wire in SecretAuditLog, consolidate SecretVault into SecretsManager (wire in SecretAuditLog, consolidate SecretVault into SecretsManager #16485)
• fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (#16481) #16484 fix(frontend): retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (retire useSettingsApi/SystemRepository/services-api.ts/CacheService.ts dead settings paths #16481)
• feat(llm): cross-worker quota headroom store, persist real 429 headroom #16483 feat(llm): cross-worker quota headroom store, persist real 429 headroom
• chore(activity-tracking): retire the terminal/file/browser tracking hooks as dead code (#16466) #16475 chore(activity-tracking): retire the terminal/file/browser tracking hooks as dead code (chore(activity-tracking): wire in or retire terminal/file/browser activity tracking + secret_usage audit (backend) #16466)
• chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates #16474 chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates
• feat(collaboration): surface pending invitations in the collaboration panel (#16470) #16472 feat(collaboration): surface pending invitations in the collaboration panel (impl gap: surface pending collaboration invitations in a UI #16470)
• feat(collaboration): persist activity/notification history, add invitation list+respond endpoints (#16460) #16471 feat(collaboration): persist activity/notification history, add invitation list+respond endpoints (feat(collaboration): persist activity/notification history and add invitation list+respond endpoints #16460)
• security(settings): record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (#16278) #16469 security(settings): record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (security(settings): the core /api/settings routes read and write system config with no authentication #16278)
• fix(migrations): port 6 orphaned tables into the canonical Alembic chain (#16464) #16467 fix(migrations): port 6 orphaned tables into the canonical Alembic chain (fix(migrations): 6 tables in the orphaned database/migrations/ chain were never applied to the live Alembic chain #16464)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

AutoBot Phase Validation Results

System Maturity: 96.5%

Phase Status:

PASS Phase 1: Core Infrastructure: 100.0%
PASS Phase 2: Knowledge Base and Memory: 100.0%
IN PROGRESS Phase 3: LLM Integration: 66.7%
PASS Phase 4: Security and Authentication: 100.0%
PASS Phase 5: Agent Orchestration: 100.0%
PASS Phase 6: Enhanced UI/UX: 100.0%
PASS Phase 7: Testing and Validation: 100.0%
PASS Phase 8: Advanced Features: 100.0%
PASS Phase 9: Multi-Modal AI: 100.0%
PASS Phase 10: Production Readiness: 100.0%

Recommendations:

• 🟡 MEDIUM: Phase 3: LLM Integration requires attention (66.7% complete): Review and implement
• ✅ System is production-ready - consider advanced features and scaling: Review and implement

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[mrveiss]

Mutation-check complete — evidence posted on #15931 (AC4 ticked). Closing without merging; branch and worktree next.