Fix 17 findings from deep code review (10 high + 7 medium)

[Therealdk8890]

Deep review of the Python port across six subsystems (core storage, query/graph, alignment, integrations, CLI/UI/CI, tests/packaging). Every fix here was reproduced before fixing and is covered by a regression test proven to fail against the pre-fix code. Full suite: 473 passed, 4 skipped; ruff + mypy clean.

High severity (10)

Security

• Stored XSS in render_trace_html — trace data (LLM/tool output) flowed unescaped into a <script> JSON block and into DOM innerHTML. Now HTML-escaped server-side, JSON escaped so </script> can't break out, and client-side escaped before innerHTML. This is the exact class 0.6.1 fixed in index.html/report.py but missed here.
• CI gate bypass (action/run_gate.py) — the multi-line summary (embedding attacker-influenceable step ids) was written to $GITHUB_OUTPUT with a fixed heredoc delimiter, so a crafted step name could close the heredoc early and inject passed=true, silently passing a real regression. Now a random per-write delimiter + a step-summary fence sized past any backtick run.

Correctness

• SQL query precedence (query.py) — nested AND/OR/missing_step compiled to flat INTERSECT/UNION/EXCEPT; SQLite's equal left-to-right precedence silently re-grouped them, diverging from the in-memory backend. Members are now isolated in sub-selects.
• Write-buffer depth drift (write_buffer.py) — per-run counter written back stale after eviction, permanently over-shedding a run's events.
• @traced generator false error (instrument.py) — early termination (GeneratorExit) recorded a spurious CRITICAL .error; now a clean .end (sync + async).
• google_genai span mislink — nested calls attached to the grandparent; now sets parent_span_id.
• Alignment reorder detection (alignment_engine.py, alignment_interpreter.py) — the strictest audit profile was blind to reordering, and detection keyed on list position instead of the authoritative sequence. Now sorts by sequence and is mode-independent.
• Replay cycle drop (replay.py) — span cycles/self-parents left events in neither the tree nor the orphan list; now surfaced as orphans.
• Graph cycle validator (verification.py) — missed cycles on partial graphs and overflowed on deep valid chains; now seeds from all edge endpoints and is iterative.

Medium severity (7)

• LlamaIndex secret redaction — captured the full serialized LLM config, including api_key in versions that ship it; secret-keyed values (nested included) are now redacted.
• UI viewer Host-header allowlist — no Host/Origin check left trace data reachable via DNS rebinding; loopback binds now enforce a loopback allowlist.
• UnregisteredToolRule fail-open — a string registry degraded not in to substring matching; now compared as a single exact entry.
• Live consumer thread death — a raising subscriber killed the shared consumer, stopping all delivery; now logs and continues.
• CrewAI + SQLite silent failures — now logged (were swallowed with no trace).
• UI _json_serializable dead branch — serialized internal field names instead of to_dict().

Tests

19 regression tests added/updated across 13 files. Two test_*_gate tests that pinned the buggy alignment behavior (reorder only caught by span-aware profiles) were rewritten to pin the corrected contract. Each new test was verified to fail against the unfixed code.

See CHANGELOG.md ([Unreleased]) for the full annotated list.

🤖 Generated with Claude Code