[chrishonson]

Root Cause Analysis

In functions/src/app.ts, recordRequestEvent(...) was invoked with void (fire-and-forget) before issuing res.status(403).json(...) (and res.status(401).json(...)).
Because recordRequestEvent was not awaited, the response was sent concurrently with the observer recording logic. In environments with asynchronous observers or event-loop / microtask preemption, await request(app) in functions/test/app.test.ts can resolve and check runtime.observer.listEvents() before the observer event is appended. In serverless Cloud Functions, unawaited background promises fired after sending the HTTP response are also subject to runtime CPU throttling or instance teardown.

Evidence

• Reproduction stress tests on untouched origin/release:
  • 30 isolated runs of test/app.test.ts: 30 passed, 0 failed.
  • 40 sequential runs of the full test suite (npm --prefix functions test): 40 passed, 0 failed.
  • 40 runs of test/app.test.ts under 4-core heavy background CPU load: 40 passed, 0 failed.
  • Concurrent vitest run --coverage runs collided on coverage/.tmp rather than failing inside app.test.ts.
• Code reading confirmed the unawaited fire-and-forget call in app.ts.
• Hardened router.use middleware in functions/src/app.ts to async and awaited recordRequestEvent(...) on both 403 (origin not allowed) and 401 (unauthorized) rejection paths, guaranteeing deterministic event recording before the HTTP response completes.

Verification

• 20 consecutive runs of npm --prefix functions test: 20/20 passed (0 failures).
• Gates:
  • python3 scripts/run-gate.py metacortex_typecheck: Exit code 0
  • python3 scripts/run-gate.py metacortex_test: Exit code 0 (181 passed, 1 skipped, 80.06% coverage)
  • python3 scripts/run-gate.py metacortex_package: Exit code 0

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T04:26:10.954103Z	f91ad91	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.