Client or integration
Other
Area
Proxy and routing
Summary
AGENTS.md pins two invariants on src/server/index.ts: Lab activation stays behind labActivationRequired, and startServer stays synchronous so a policy route can never be evaluated before its evidence provider is registered. tests/lab/core-lab-boundary.test.ts is what holds the second one.
The scan stops after the direct callees of startServer. It catches activateLab becoming async, but activateLab calls installLabAutomationRuntime and startAutomationIfEnabled without awaiting them (src/lib/lab-activation.ts:176, :200). If either of those became async and awaited before registration, startServer would return before activation completed and the guard would stay green.
No runtime regression today — the production chain is synchronous. This is a guard that would not fail on the defect it exists to catch, which is worth fixing before it is relied on.
Reproduction
- Read
tests/lab/core-lab-boundary.test.ts:361 and follow which callees the synchrony scan walks.
- Compare with the activation chain in
src/lib/lab-activation.ts:167-200.
- Mentally make
installLabAutomationRuntime async with an await before its registration call: activateLab still parses as synchronous, so the guard passes while the window is broken.
Suggested fix: walk the bounded activation chain recursively, or pin every synchronous helper activateLab calls, and add a mutation case for a nested callee rather than only for the entry point.
Version
2.56.0 (e4a8539)
Operating system
macOS 15.5
Logs or error output
(static analysis; no runtime output)
Checks
Client or integration
Other
Area
Proxy and routing
Summary
AGENTS.md pins two invariants on
src/server/index.ts: Lab activation stays behindlabActivationRequired, andstartServerstays synchronous so a policy route can never be evaluated before its evidence provider is registered.tests/lab/core-lab-boundary.test.tsis what holds the second one.The scan stops after the direct callees of
startServer. It catchesactivateLabbecoming async, butactivateLabcallsinstallLabAutomationRuntimeandstartAutomationIfEnabledwithout awaiting them (src/lib/lab-activation.ts:176,:200). If either of those became async and awaited before registration,startServerwould return before activation completed and the guard would stay green.No runtime regression today — the production chain is synchronous. This is a guard that would not fail on the defect it exists to catch, which is worth fixing before it is relied on.
Reproduction
tests/lab/core-lab-boundary.test.ts:361and follow which callees the synchrony scan walks.src/lib/lab-activation.ts:167-200.installLabAutomationRuntimeasync with anawaitbefore its registration call:activateLabstill parses as synchronous, so the guard passes while the window is broken.Suggested fix: walk the bounded activation chain recursively, or pin every synchronous helper
activateLabcalls, and add a mutation case for a nested callee rather than only for the entry point.Version
2.56.0 (e4a8539)
Operating system
macOS 15.5
Logs or error output
(static analysis; no runtime output)Checks