\\n

Show a summary per file

\\n\\n| File | Description |\\\\n| ---- | ----------- |\\\\n| `runtime/tests/test_redis_event_bus.py` | Updated tests to `await bus.subscribe()` after async API change |\\\\n| `runtime/ailine_runtime/shared/trace_store.py` | Made `teacher_id` required in `get()`, added optional tenant checks to `append_node`/`update_run` |\\\\n| `runtime/ailine_runtime/shared/observability_store.py` | Added tenant-keyed evidence storage with `(teacher_id, run_id)` tuple keys |\\\\n| `runtime/ailine_runtime/shared/config.py` | Embedding dims default 1536, GEMINI_API_KEY alias, JWT private key validation |\\\\n| `runtime/ailine_runtime/api/routers/tutors.py` | Added auth dependency and anyio thread offload for sync I/O |\\\\n| `runtime/ailine_runtime/api/routers/setup_service.py` | Setup token log redaction, embedding `default_dims` corrected to 1536 |\\\\n| `runtime/ailine_runtime/api/routers/plans_stream.py` | Idempotency guard, `done` event for heartbeat, teacher_id passed to trace updates |\\\\n| `runtime/ailine_runtime/api/routers/observability.py` | `teacher_id` passed to `get_standards_evidence` for tenant scoping |\\\\n| `runtime/ailine_runtime/api/routers/auth.py` | PBKDF2 hashing/verification offloaded to thread pool |\\\\n| `runtime/ailine_runtime/api/middleware/tenant_context.py` | JTI blacklist fail-closed with LRU in-memory cache |\\\\n| `runtime/ailine_runtime/adapters/events/redis_bus.py` | Real PubSub subscription with background listener task |\\\\n| `runtime/ailine_runtime/adapters/db/alembic/versions/2026_02_12_0001_initial_schema.py` | Composite FK unique constraint for courses moved to initial migration |\\\\n| `runtime/ailine_runtime/adapters/db/alembic/versions/2026_02_27_0006_fix_composite_fk_unique_constraints.py` | Removed duplicate `courses` constraint now handled in 0001 |\\\\n| `runtime/ailine_runtime/adapters/db/alembic/versions/2026_03_04_0007_composite_indexes.py` | New composite indexes for common query patterns |\\\\n| `frontend/src/stores/accessibility-store.ts` | Moved `_mqCleanup` out of store to module-level, added exported `cleanupAccessibilityStore()` |\\\\n| `frontend/src/lib/sse-fetch.ts` | SSE reconnection with exponential backoff, `Last-Event-ID` tracking, retry field support |\\\\n| `frontend/src/lib/api.ts` | Replaced `as unknown as` cast with proper `as AuthUser` type import |\\\\n| `frontend/src/components/tutor/tutor-chat.tsx` | Removed `aria-live` from scroll container (moved elsewhere), smooth scroll only when not streaming |\\\\n| `frontend/src/components/tutor/chat-message-bubble.tsx` | Wrapped with `React.memo` to avoid unnecessary re-renders during streaming |\\\\n| `frontend/src/components/setup/setup-wizard.tsx` | Fixed API endpoint, added `toSetupPayload` snake_case mapper, safe defaults |\\\\n| `frontend/src/components/privacy/privacy-panel.tsx` | Added auth headers and AbortController cleanup to all fetch calls |\\\\n| `frontend/src/app/[locale]/login/page.tsx` | Removed stray `getAuthHeaders()` from login request (login doesn't need auth) |\\\\n| `docker-compose.yml` | Added migrations service, shared YAML anchors, safe defaults, resource limits |\\\\n| `agents/ailine_agents/resilience.py` | Full 3-state (closed/open/half-open) circuit breaker implementation |\\\\n| `.env.example` | Updated defaults: `AILINE_DEV_MODE=false`, `AILINE_DEMO_MODE=0`, dims=1536, GOOGLE_API_KEY |\\n

\\n\\n\\n\\n\\n\\n\\n---\\n\\n💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"@codex revise essa sugestão.\",\"path\":\"frontend/src/components/setup/setup-wizard.tsx\",\"side\":\"RIGHT\",\"line\":135}{\"type\":\"pull_request_comment\",\"body\":\"@codex revise essa sugestão.\",\"path\":\"frontend/src/components/setup/setup-wizard.tsx\",\"side\":\"RIGHT\",\"line\":31}{\"type\":\"pull_request_comment\",\"body\":\"@codex revise essa sugestão.\",\"path\":\"runtime/ailine_runtime/api/routers/tutors.py\",\"side\":\"RIGHT\",\"line\":207}{\"type\":\"pull_request_comment\",\"body\":\"@codex revise essa sugestão.\",\"path\":\"runtime/ailine_runtime/api/middleware/tenant_context.py\",\"side\":\"RIGHT\",\"line\":442}{\"type\":\"pull_request_comment\",\"body\":\"@codex revise essa sugestão.\",\"path\":\"runtime/ailine_runtime/shared/trace_store.py\",\"side\":\"RIGHT\",\"line\":107}{\"type\":\"pull_request_comment\",\"body\":\"@codex revise essa sugestão.\",\"path\":\"frontend/src/lib/sse-fetch.ts\",\"side\":\"RIGHT\",\"line\":179}","text_elements",[],{"_465":859,"_456":457,"_467":459},{"_468":860,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[861],{"_49":855,"_96":725},"turn/started",{"_456":457,"_91":864},{"_107":-5,"_45":459,"_460":865,"_462":866},[],"inProgress",{"_465":868,"_456":457,"_467":869},{"_468":870,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},"auto-compact-0",[871],{"_49":872,"_96":725},"\n /workspace/aiLine\n bash\n",{"_465":874,"_456":457,"_467":869},{"_468":875,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[876],{"_49":877,"_96":725},"# AGENTS.md instructions for /workspace/aiLine\n\n\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 3) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 4) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n",{"_465":879,"_456":457,"_467":869},{"_468":880,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":881,"_96":473},[882],"developer",{"_49":883,"_96":725},"Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled. Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `never`: This is a non-interactive mode where you may NEVER ask the user for approval to run commands. Instead, you must always persist and work around constraints to solve the task for the user. You MUST do your utmost best to finish the task and validate your work before yielding. If this mode is paired with `danger-full-access`, take advantage of it to deliver the best outcome for the user. Further, in this mode, your default testing philosophy is overridden: Even if you don't see local patterns for testing, you may add tests and scripts to validate your work. Just remove them before yielding.","thread/started",{"_886":887},"thread",{"_888":-5,"_889":-5,"_890":891,"_892":893,"_512":513,"_894":18,"_895":-5,"_896":-5,"_897":898,"_899":900,"_45":457,"_901":902,"_230":-5,"_903":-5,"_188":904,"_905":244,"_906":-5,"_519":907,"_462":-5,"_908":-5,"_81":909,"_910":893},"agentNickname","agentRole","cliVersion","0.88.0","createdAt",1772660569,"ephemeral","extra","forkedFromId","gitInfo",{"_130":911,"_912":-5,"_913":133},"historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/03/04/rollout-2026-03-04T21-42-49-019cbacd-b57b-7271-9683-027fb5e7e51b.jsonl","preview","recencyAt","vscode","threadSource",[],"updatedAt","work","originUrl","sha",[],"messages",[917],{"_45":918,"_919":920,"_921":922,"_923":922,"_468":924,"_462":925,"_470":-5,"_926":35,"_927":928,"_929":344,"_930":-5},"289a6b8b-d9b8-46f7-9635-f7232f923b2f","author",{"_100":369,"_230":-5,"_927":939},"create_time",1772660568.929764,"update_time",{"_935":49,"_936":937},"finished_successfully","weight","metadata",{"_931":932},"recipient","channel","l1239dk1",{"_933":934},"inline_comments",[],"content_type","parts",[938],"@codex revise essa sugestão. (path=runtime/ailine_runtime/api/middleware/tenant_context.py line=461 side=RIGHT)\nfeat: Sprint 29A-D — 27 multi-model audit fixes (security, reliabilit…\n\n…y, contracts, polish)\r\n\r\nP0 Critical (29A): migration composite FK ordering, embedding dim=1536, JWT revocation fail-closed with LRU cache, tenant-scoped trace/evidence stores, setup token log redaction, aria-live SSE chat fix.\r\n\r\nHigh Reliability (29B): PBKDF2 async offload, JWT startup validation, CircuitBreaker 3-state machine (half-open probe), Redis PubSub real subscribe, SSE client reconnection with exponential backoff, React.memo ChatMessageBubble.\r\n\r\nContract Alignment (29C): setup wizard endpoint/payload fix, idempotency guard, privacy panel auth+abort, safe defaults (demo=0, dev=false), GEMINI_API_KEY alias.\r\n\r\nMedium Polish (29D): SSE terminal ordering+backpressure, async tutor I/O, auth-first in tutor routes, login form cleanup, api.ts type safety, composite DB indexes, accessibility store cleanup.\r\n\r\nDeferred: D3 (auth.py DI refactor) — follow-up sprint.\r\n\r\n## Description\r\n\r\nBrief description of the changes and their motivation.\r\n\r\n## Type of Change\r\n\r\n- [ ] Bug fix (non-breaking change that fixes an issue)\r\n- [ ] New feature (non-breaking change that adds functionality)\r\n- [ ] Breaking change (fix or feature that would cause existing functionality to change)\r\n- [ ] Documentation update\r\n- [ ] Accessibility improvement\r\n- [ ] Performance improvement\r\n- [ ] Refactoring (no functional changes)\r\n\r\n## Accessibility Impact\r\n\r\n- [ ] No accessibility impact\r\n- [ ] Improves accessibility (describe how)\r\n- [ ] New UI elements have proper ARIA labels and keyboard navigation\r\n- [ ] Tested with screen reader\r\n- [ ] WCAG AAA contrast ratios verified\r\n\r\n## Testing\r\n\r\n- [ ] Backend tests pass (`uv run pytest`)\r\n- [ ] Agent tests pass (`cd agents && uv run pytest`)\r\n- [ ] Frontend tests pass (`pnpm test`)\r\n- [ ] New tests added for this change\r\n\r\n## Quality Gates\r\n\r\n- [ ] `uv run ruff check .` — clean\r\n- [ ] `uv run mypy .` — clean\r\n- [ ] `pnpm lint` — clean\r\n- [ ] `pnpm typecheck` — clean\r\n- [ ] Docker Compose builds and runs (`docker compose up -d --build`)\r\n\r\n## Screenshots\r\n\r\nIf UI changes, include before/after screenshots.\r\n\r\n## Related Issues\r\n\r\nCloses #(issue number)\r\n\nComments in the same thread:\n\nThe `_REVOCATION_CACHE` is a module-level plain dict that is accessed concurrently by async request handlers without any locking. Read-modify-write operations on it (checking `len`, evicting the oldest entry, and writing) are not atomic. Under high concurrency, two coroutines could both observe `len(_REVOCATION_CACHE) >= _REVOCATION_CACHE_MAX` and both try to evict and write, or the dict could be structurally modified during iteration of `_REVOCATION_CACHE.get`, leading to potential race conditions. An `asyncio.Lock` should protect these operations.\nThe `X-Setup-Token` header is hard-coded to an empty string (`''`). Since `require_setup_token` on the backend uses `hmac.compare_digest(x_setup_token, expected)`, an empty token will always be rejected with a 403, making the setup wizard non-functional. The actual setup token should be read from a state variable or user input in the wizard UI, not hard-coded to an empty string.\nThe module-level comment block for the `SetupWizard` component is malformed. The JSDoc comment for `SetupWizard` (`/** Map camelCase setup config to snake_case... */`) and the function comment above it (`/** Main setup wizard orchestrator... */`) overlap on adjacent lines (30-31) rather than each preceding its own declaration. The helper function `toSetupPayload` appears before `SetupWizard` but the comment block intended for `SetupWizard` ends up as a documentation block for `toSetupPayload` instead.\nThe `tutor_session_transcript` and `tutor_flag_turn` endpoints do not add `teacher_id: str = Depends(require_authenticated)` to their signatures despite the PR description stating \"auth-first in tutor routes.\" All other endpoints in this file were updated to include authentication, but these two are missing it. Without the `Depends(require_authenticated)` parameter, `require_tenant_access` inside them calls `get_current_teacher_id()` which relies on the middleware's context var — this may work via middleware, but the routes are inconsistent with the other updated endpoints and rely on implicit auth rather than explicit FastAPI dependencies.\nThe `_is_jti_blacklisted` function now fails closed (returns `True`, treating the token as blacklisted) when Redis is unavailable — including at startup when the container hasn't loaded yet. This means that any request made before the application's container fully initializes (where `container` is `None`) will have all JWTs treated as revoked, potentially causing all authenticated requests to fail with 401 until the container is ready. This is a significant availability concern in production deployments, especially during rolling restarts or slow startup.\nThe `append_node` and `update_run` methods check `if teacher_id and trace.teacher_id and trace.teacher_id != teacher_id:` before blocking the operation. This means the tenant check is silently skipped when either the provided `teacher_id` is empty (`\"\"`) or the stored `trace.teacher_id` is empty. An attacker could call these methods with `teacher_id=\"\"` and bypass tenant isolation entirely. Since the caller in `plans_stream.py` always passes a non-empty `teacher_id`, this is likely a defense-in-depth gap, but it is inconsistent with the strengthened `get()` method which now always enforces the check.\nThe exponential backoff for retries computes the delay using `retryMs * Math.pow(2, attempt - 1)`. The first retry (attempt=1) results in `3000 * 1 = 3s`, but the comment says \"Exponential backoff: 3s, 6s, 12s, 24s, 48s\". The maximum is `3000 * Math.pow(2, 4) = 48000ms = 48s`. There is no cap or jitter applied — for 5 retries this totals ~93s of wait time. While this is unlikely to be a hard bug, there is no maximum delay cap, and without jitter, multiple clients reconnecting after a server restart will cause a thundering herd. Consider capping the delay (e.g., `Math.min(delay, 30000)`) and adding jitter.\n## Pull request overview\n\nThis is a large multi-category sprint PR (Sprint 29A-D) addressing security hardening, reliability improvements, contract alignment, and medium-priority polish across the AiLine platform's backend (Python/FastAPI) and frontend (React/TypeScript) codebases.\n\n**Changes:**\n- **Security & reliability**: JWT revocation fail-closed with in-memory LRU cache, tenant-scoped trace/evidence stores, PBKDF2 async offload, CircuitBreaker 3-state machine (half-open probe), Redis PubSub real subscribe, migration composite FK ordering fix\n- **Contract alignment**: Setup wizard endpoint/payload mapping, idempotency guard for plan streams, privacy panel auth+abort controller, safe env defaults (demo=0, dev=false), GEMINI_API_KEY alias, embedding dims=1536\n- **Polish**: SSE client reconnection with exponential backoff, React.memo for ChatMessageBubble, anyio async I/O in tutor routes, auth-first route pattern, login form cleanup, accessibility store cleanup, composite DB indexes\n\n### Reviewed changes\n\nCopilot reviewed 25 out of 25 changed files in this pull request and generated 7 comments.\n\n

Show a summary per file

\n\n| File | Description |\\n| ---- | ----------- |\\n| `runtime/tests/test_redis_event_bus.py` | Updated tests to `await bus.subscribe()` after async API change |\\n| `runtime/ailine_runtime/shared/trace_store.py` | Made `teacher_id` required in `get()`, added optional tenant checks to `append_node`/`update_run` |\\n| `runtime/ailine_runtime/shared/observability_store.py` | Added tenant-keyed evidence storage with `(teacher_id, run_id)` tuple keys |\\n| `runtime/ailine_runtime/shared/config.py` | Embedding dims default 1536, GEMINI_API_KEY alias, JWT private key validation |\\n| `runtime/ailine_runtime/api/routers/tutors.py` | Added auth dependency and anyio thread offload for sync I/O |\\n| `runtime/ailine_runtime/api/routers/setup_service.py` | Setup token log redaction, embedding `default_dims` corrected to 1536 |\\n| `runtime/ailine_runtime/api/routers/plans_stream.py` | Idempotency guard, `done` event for heartbeat, teacher_id passed to trace updates |\\n| `runtime/ailine_runtime/api/routers/observability.py` | `teacher_id` passed to `get_standards_evidence` for tenant scoping |\\n| `runtime/ailine_runtime/api/routers/auth.py` | PBKDF2 hashing/verification offloaded to thread pool |\\n| `runtime/ailine_runtime/api/middleware/tenant_context.py` | JTI blacklist fail-closed with LRU in-memory cache |\\n| `runtime/ailine_runtime/adapters/events/redis_bus.py` | Real PubSub subscription with background listener task |\\n| `runtime/ailine_runtime/adapters/db/alembic/versions/2026_02_12_0001_initial_schema.py` | Composite FK unique constraint for courses moved to initial migration |\\n| `runtime/ailine_runtime/adapters/db/alembic/versions/2026_02_27_0006_fix_composite_fk_unique_constraints.py` | Removed duplicate `courses` constraint now handled in 0001 |\\n| `runtime/ailine_runtime/adapters/db/alembic/versions/2026_03_04_0007_composite_indexes.py` | New composite indexes for common query patterns |\\n| `frontend/src/stores/accessibility-store.ts` | Moved `_mqCleanup` out of store to module-level, added exported `cleanupAccessibilityStore()` |\\n| `frontend/src/lib/sse-fetch.ts` | SSE reconnection with exponential backoff, `Last-Event-ID` tracking, retry field support |\\n| `frontend/src/lib/api.ts` | Replaced `as unknown as` cast with proper `as AuthUser` type import |\\n| `frontend/src/components/tutor/tutor-chat.tsx` | Removed `aria-live` from scroll container (moved elsewhere), smooth scroll only when not streaming |\\n| `frontend/src/components/tutor/chat-message-bubble.tsx` | Wrapped with `React.memo` to avoid unnecessary re-renders during streaming |\\n| `frontend/src/components/setup/setup-wizard.tsx` | Fixed API endpoint, added `toSetupPayload` snake_case mapper, safe defaults |\\n| `frontend/src/components/privacy/privacy-panel.tsx` | Added auth headers and AbortController cleanup to all fetch calls |\\n| `frontend/src/app/[locale]/login/page.tsx` | Removed stray `getAuthHeaders()` from login request (login doesn't need auth) |\\n| `docker-compose.yml` | Added migrations service, shared YAML anchors, safe defaults, resource limits |\\n| `agents/ailine_agents/resilience.py` | Full 3-state (closed/open/half-open) circuit breaker implementation |\\n| `.env.example` | Updated defaults: `AILINE_DEV_MODE=false`, `AILINE_DEMO_MODE=0`, dims=1536, GOOGLE_API_KEY |\n

\n\n\n\n\n\n\n---\n\n💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.\n@codex revise essa sugestão.\n@codex revise essa sugestão.\n@codex revise essa sugestão.\n@codex revise essa sugestão.\n@codex revise essa sugestão.\n@codex revise essa sugestão.",{},"created",1772660633.4216046,"Completing the task","event_type","info",{"_96":473,"_100":97,"_468":1466},{"_96":972,"_973":974},{"_96":948,"_949":950,"_951":952,"_953":954,"_955":-5},"pr","pr_title","fix: guard JTI revocation cache updates with asyncio.Lock in tenant_context","pr_message","### Motivation\n- Prevent race conditions on the module-level in-memory JTI revocation cache that can occur when concurrent async request handlers perform read-modify-write operations on the plain `dict` fallback.\n\n### Description\n- Added `import asyncio` and a module-level `_REVOCATION_CACHE_LOCK = asyncio.Lock()` and wrapped both the cache read/TTL-expiry path and the cache eviction/write path in `async with _REVOCATION_CACHE_LOCK:` blocks in `runtime/ailine_runtime/api/middleware/tenant_context.py` to make LRU-like updates atomic and replaced `del` with `pop(..., None)` for safer removal.\n\n### Testing\n- Compiled the modified file with `python -m py_compile runtime/ailine_runtime/api/middleware/tenant_context.py` which succeeded.","output_diff",{"_96":953,"_956":513,"_132":133,"_957":-5,"_368":958,"_959":960,"_961":372,"_962":963,"_964":965,"_966":967,"_968":-5},"pre_apply_patch","repo_id","preapply_patch_base_commit_sha","diff --git a/runtime/ailine_runtime/api/middleware/tenant_context.py b/runtime/ailine_runtime/api/middleware/tenant_context.py\nindex 35dabeaf1b4640edcdbe02beb2126ecfc4609246..6cab800d88360df5510863706c7dba30094bf6f8 100644\n--- a/runtime/ailine_runtime/api/middleware/tenant_context.py\n+++ b/runtime/ailine_runtime/api/middleware/tenant_context.py\n@@ -18,50 +18,51 @@ Authentication sources (in priority order):\n This avoids requiring JWT infrastructure during local dev.\n \n **SECURITY WARNING:** The X-Teacher-ID header bypass allows any\n caller to impersonate any teacher without authentication. This\n MUST NEVER be enabled in production. The ``validate_dev_mode()``\n function enforces this constraint at startup by raising\n ``ValueError`` if ``AILINE_DEV_MODE=true`` and\n ``AILINE_ENV=production``.\n \n 3. **Request body ``teacher_id`` field** -- legacy backward compatibility.\n If neither header is present, the middleware does NOT block the\n request. Router handlers can still read ``teacher_id`` from the\n body and set it manually. This preserves backward compat with\n existing clients that embed teacher_id in the payload.\n \n Routes that are excluded from tenant enforcement:\n - ``/health``\n - ``/docs``, ``/openapi.json``, ``/redoc``\n - ``/demo/*``\n - ``/setup/*``\n \"\"\"\n \n from __future__ import annotations\n \n import base64\n+import asyncio\n import functools\n import json\n import os\n from collections.abc import Awaitable, Callable\n from typing import Any\n \n import structlog\n from starlette.middleware.base import BaseHTTPMiddleware\n from starlette.requests import Request\n from starlette.responses import JSONResponse, Response\n \n from ...domain.exceptions import InvalidTenantIdError\n from ...shared.tenant import (\n clear_org_id,\n clear_tenant_id,\n clear_user_role,\n set_org_id,\n set_tenant_id,\n set_user_role,\n validate_teacher_id_format,\n )\n \n logger = structlog.get_logger(\"ailine.middleware.tenant_context\")\n \n # Path prefixes excluded from tenant context enforcement.\n@@ -395,92 +396,94 @@ def extract_teacher_id_from_jwt(token: str) -> tuple[str | None, str | None]:\n \n Returns a tuple of (teacher_id, error_reason). If teacher_id is not\n None, error_reason is None and vice versa.\n \n This is the public wrapper around the internal ``_extract_teacher_id_from_jwt``\n function, intended for use by WebSocket endpoints and other code that\n needs JWT verification outside the middleware pipeline.\n \"\"\"\n claims, error = _extract_teacher_id_from_jwt(token)\n return claims.teacher_id, error\n \n \n def extract_claims_from_jwt(token: str) -> tuple[_JwtClaims, str | None]:\n \"\"\"Public API: extract all RBAC claims from a JWT token.\n \n Returns a tuple of (_JwtClaims, error_reason). Extends\n ``extract_teacher_id_from_jwt`` with role and org_id.\n \"\"\"\n return _extract_teacher_id_from_jwt(token)\n \n \n # In-memory LRU fallback cache for JTI blacklist when Redis is down\n _REVOCATION_CACHE: dict[str, float] = {}\n _REVOCATION_CACHE_MAX = 1000\n _REVOCATION_CACHE_TTL = 300.0 # 5 minutes\n+_REVOCATION_CACHE_LOCK = asyncio.Lock()\n \n \n async def _is_jti_blacklisted(request: Request, jti: str) -> bool:\n \"\"\"Check if a JWT ID (jti) has been revoked via Redis blacklist.\n \n Fail-closed: returns True (treat as blacklisted) when Redis is\n unavailable, to prevent accepting potentially revoked tokens.\n Uses an in-memory LRU cache as fallback for known-good JTIs.\n \"\"\"\n import time as _time\n \n # Check in-memory cache first (known-good JTIs)\n- cached_ts = _REVOCATION_CACHE.get(jti)\n- if cached_ts is not None:\n- if _time.monotonic() - cached_ts < _REVOCATION_CACHE_TTL:\n- return False # Recently verified as not blacklisted\n- else:\n- del _REVOCATION_CACHE[jti]\n+ async with _REVOCATION_CACHE_LOCK:\n+ cached_ts = _REVOCATION_CACHE.get(jti)\n+ if cached_ts is not None:\n+ if _time.monotonic() - cached_ts < _REVOCATION_CACHE_TTL:\n+ return False # Recently verified as not blacklisted\n+ _REVOCATION_CACHE.pop(jti, None)\n \n container = getattr(getattr(request.app, \"state\", None), \"container\", None)\n if container is None:\n logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"no_container\")\n return True # Fail-closed\n event_bus = getattr(container, \"event_bus\", None)\n if event_bus is None:\n logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"no_event_bus\")\n return True # Fail-closed\n redis_client = await event_bus.get_redis_client()\n if redis_client is None:\n logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"no_redis_client\")\n return True # Fail-closed\n try:\n result = await redis_client.get(f\"jti_blacklist:{jti}\")\n if result is not None:\n return True # Token IS blacklisted\n \n # Cache as known-good\n- if len(_REVOCATION_CACHE) >= _REVOCATION_CACHE_MAX:\n- # Evict oldest entry\n- oldest_key = min(_REVOCATION_CACHE, key=_REVOCATION_CACHE.get) # type: ignore[arg-type]\n- del _REVOCATION_CACHE[oldest_key]\n- _REVOCATION_CACHE[jti] = _time.monotonic()\n+ async with _REVOCATION_CACHE_LOCK:\n+ if len(_REVOCATION_CACHE) >= _REVOCATION_CACHE_MAX:\n+ # Evict oldest entry\n+ oldest_key = min(_REVOCATION_CACHE, key=_REVOCATION_CACHE.get) # type: ignore[arg-type]\n+ del _REVOCATION_CACHE[oldest_key]\n+ _REVOCATION_CACHE[jti] = _time.monotonic()\n return False\n except Exception:\n logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"redis_error\")\n return True # Fail-closed on Redis error\n \n \n class TenantContextMiddleware(BaseHTTPMiddleware):\n \"\"\"Extract teacher_id from request and store in contextvars.\n \n The middleware is permissive: if no teacher_id can be extracted,\n the request proceeds without a tenant context. Endpoints that\n require tenant isolation call ``get_current_teacher_id()`` which\n will raise 401 if the context is missing.\n \"\"\"\n \n async def dispatch(\n self,\n request: Request,\n call_next: Callable[[Request], Awaitable[Response]],\n ) -> Response:\n # Skip excluded paths\n path = request.url.path\n if path in _EXCLUDED_EXACT or any(\n path.startswith(prefix) for prefix in _EXCLUDED_PREFIXES\n ):\n","external_storage_diff",{"_969":970,"_971":-5},"files_modified","lines_added",14,"lines_removed",11,"commit_message","fix: lock revocation cache updates in tenant middleware","additional_parent_commit_shas","file_id","file_00000000f28c71f782cad74ebfc8cca0","ttl","partial_repo_snapshot","files",[975],{"_188":525,"_976":-5,"_977":978,"_979":-5},"contents","line_range_contents",[980],"missing_reason",{"_981":372,"_982":983,"_468":984,"_985":62},"line_range_start","line_range_end",614,[986,244,987,988,989,990,244,991,244,992,993,994,995,996,244,997,998,999,244,1000,1001,1002,1003,1004,1005,244,1006,1007,1008,1009,1010,244,1011,1012,1013,1014,1015,1016,244,1017,244,1018,1019,1020,1021,1022,1023,1024,244,1025,1026,1027,1028,244,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,244,1039,244,1040,1041,1042,1043,1044,1045,1046,1047,1048,1038,244,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,244,1067,1068,244,244,1069,1070,244,1071,1072,1073,1074,244,1075,1076,1077,1078,244,1079,1080,1081,1082,1083,1084,1085,244,1086,1087,244,1088,1089,1090,1091,1092,1093,1094,244,1095,1096,1097,1098,1099,1100,1101,1102,1103,244,244,1104,1105,1106,244,1107,1108,1109,1082,1110,244,244,1104,1111,1112,244,1107,1113,1109,244,1114,1115,1116,1117,1118,1119,1082,1120,1121,1122,1123,244,1124,1125,1126,1127,1128,1129,244,1130,244,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,244,1145,1146,1147,1148,1149,1150,1151,244,244,1152,1153,244,1154,244,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,244,244,1166,1167,1168,1169,244,1170,1171,1082,1172,1173,244,1174,1175,1176,1177,1178,1179,244,1180,1181,1182,1183,1184,1185,1186,1187,1188,244,1189,1095,1190,1097,1191,1192,1101,1103,1193,244,244,1194,1195,1168,1196,244,1197,1198,1199,244,1200,1082,1201,1202,1203,1204,1205,1206,1207,1208,1094,1209,244,1210,1211,1212,1213,244,1214,1215,244,1216,1217,1218,1219,1220,1143,1221,244,1201,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233,1234,1235,244,1236,244,1237,1238,1239,1240,244,1241,1242,1243,1244,244,1245,1246,1247,1248,1249,1250,1094,1251,244,1252,1253,1254,1255,1256,1257,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,244,244,1273,1274,244,1275,1276,1082,1201,1277,1278,1279,1280,1281,1282,1283,1284,1285,1237,1286,1242,1243,1287,1288,1248,1289,1094,1290,1291,1292,244,244,1293,1294,244,1295,1296,244,1297,1298,1299,1082,1300,1301,244,244,1302,1303,244,1304,1305,1082,1306,244,244,1307,1308,1309,1310,1311,244,244,1312,1313,244,1314,1315,1316,1082,1317,244,1318,1319,1320,1321,1322,1323,1324,244,1325,1326,1327,1328,1329,1330,1331,1328,1332,1333,1334,1328,1201,1335,1336,1337,244,1338,1339,1340,1341,1342,1343,1344,1345,1346,1347,1348,244,244,1349,1350,244,1351,1352,1353,1354,1082,244,1355,1156,1356,1357,1358,1359,1360,1361,1362,1363,1364,244,1365,1366,1367,1368,244,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1386,1387,1395,1396,1397,1398,1399,1400,1401,244,1402,1403,1404,1405,1406,1407,1408,1409,1410,1401,1411,1412,1413,1414,1415,1416,1383,1417,1418,1393,1386,1419,1420,1421,1422,1387,1423,1424,1425,1426,1401,1427,1428,1429,1430,1400,1401,1431,1397,1432,1433,1400,1401,244,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1387,1445,1446,244,1447,1435,1448,1449,1450,1436,1451,1452,1453,1446,1454,1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1364],"contains_end_of_file","\"\"\"Tenant context middleware -- extracts and validates teacher_id per request.","Populates ``contextvars`` with the authenticated teacher_id so that","downstream code can call ``get_current_teacher_id()`` /","``get_tenant()`` without passing the ID explicitly through every","function signature.","Authentication sources (in priority order):","1. **Authorization header** (``Bearer ``) -- production path."," The JWT is decoded and the ``sub`` claim is used as teacher_id."," Supports RS256, ES256, and HS256 algorithms with full signature"," verification, claims validation (iss/aud/exp/nbf/sub), and"," algorithm pinning (rejects ``\"none\"`` and unsigned tokens).","2. **X-Teacher-ID header** -- development/testing convenience."," Only accepted when ``AILINE_DEV_MODE=true`` is explicitly set."," This avoids requiring JWT infrastructure during local dev."," **SECURITY WARNING:** The X-Teacher-ID header bypass allows any"," caller to impersonate any teacher without authentication. This"," MUST NEVER be enabled in production. The ``validate_dev_mode()``"," function enforces this constraint at startup by raising"," ``ValueError`` if ``AILINE_DEV_MODE=true`` and"," ``AILINE_ENV=production``.","3. **Request body ``teacher_id`` field** -- legacy backward compatibility."," If neither header is present, the middleware does NOT block the"," request. Router handlers can still read ``teacher_id`` from the"," body and set it manually. This preserves backward compat with"," existing clients that embed teacher_id in the payload.","Routes that are excluded from tenant enforcement:","- ``/health``","- ``/docs``, ``/openapi.json``, ``/redoc``","- ``/demo/*``","- ``/setup/*``","\"\"\"","from __future__ import annotations","import base64","import asyncio","import functools","import json","import os","from collections.abc import Awaitable, Callable","from typing import Any","import structlog","from starlette.middleware.base import BaseHTTPMiddleware","from starlette.requests import Request","from starlette.responses import JSONResponse, Response","from ...domain.exceptions import InvalidTenantIdError","from ...shared.tenant import ("," clear_org_id,"," clear_tenant_id,"," clear_user_role,"," set_org_id,"," set_tenant_id,"," set_user_role,"," validate_teacher_id_format,",")","logger = structlog.get_logger(\"ailine.middleware.tenant_context\")","# Path prefixes excluded from tenant context enforcement.","# Use trailing slash to ensure segment-boundary matching:","# e.g. \"/demo/\" matches \"/demo/login\" but NOT \"/demo_anything\".","# Exact paths (no trailing content) go in _EXCLUDED_EXACT instead.","_EXCLUDED_PREFIXES = ("," \"/docs/\","," \"/redoc/\","," \"/demo/\","," \"/setup/\",","# Exact-match excluded paths (not prefix-based).","# /auth/login, /auth/register, /auth/roles don't require tenant context.","# /auth/me DOES require tenant context (authenticated endpoint).","_EXCLUDED_EXACT = frozenset({"," \"/health\","," \"/health/ready\","," \"/health/diagnostics\","," \"/capabilities\","," \"/docs\","," \"/redoc\","," \"/demo\","," \"/setup\","," \"/openapi.json\","," \"/auth/login\","," \"/auth/register\","," \"/auth/demo-login\","," \"/auth/roles\",","})","# Algorithms considered safe. \"none\" is explicitly excluded.","_ALLOWED_ALGORITHMS = (\"HS256\", \"RS256\", \"ES256\")","def validate_dev_mode(*, env: str = \"\") -> None:"," \"\"\"Validate dev-mode safety at application startup."," Must be called during app creation. Raises ``ValueError`` if"," dev mode (X-Teacher-ID bypass) is enabled in a production"," environment, and logs a WARNING in any non-production"," environment where dev mode is active."," Args:"," env: The current deployment environment (from ``settings.env``)."," Expected values: ``\"development\"``, ``\"staging\"``,"," ``\"production\"``."," Raises:"," ValueError: If ``AILINE_DEV_MODE=true`` and *env* is"," ``\"production\"``."," \"\"\""," # Refresh caches so env changes (e.g. test fixtures) take effect."," _is_dev_mode.cache_clear()"," _get_jwt_config.cache_clear()"," if not _is_dev_mode():"," return"," if env == \"production\":"," raise ValueError("," \"FATAL: AILINE_DEV_MODE=true is FORBIDDEN in production. \""," \"The X-Teacher-ID header bypass allows unauthenticated \""," \"impersonation of any teacher. Remove AILINE_DEV_MODE from \""," \"the environment or set AILINE_ENV to a non-production value.\""," )"," logger.warning("," \"dev_mode_enabled\","," msg=("," \"X-Teacher-ID header bypass is ACTIVE. Any client can \""," \"impersonate any teacher without authentication. This \""," \"must NOT be used in production.\""," ),"," env=env or \"unknown\","," )","@functools.lru_cache(maxsize=1)","def _is_dev_mode() -> bool:"," \"\"\"Check if dev mode is enabled (cached after first call per app lifecycle)."," Uses lru_cache to avoid per-request os.getenv() overhead."," Call ``_is_dev_mode.cache_clear()`` when the environment changes"," (e.g. in create_app or test fixtures)."," return os.getenv(\"AILINE_DEV_MODE\", \"\").lower() in (\"true\", \"1\", \"yes\")","def _get_jwt_config() -> dict[str, Any]:"," \"\"\"Read JWT configuration from environment variables (cached)."," Call ``_get_jwt_config.cache_clear()`` when the environment changes"," Returns a dict with keys:"," - secret: HMAC secret (for HS256) or empty string"," - public_key: PEM-encoded public key (for RS256/ES256) or empty string"," - issuer: expected ``iss`` claim or None"," - audience: expected ``aud`` claim or None"," - algorithms: list of allowed algorithms"," secret = os.getenv(\"AILINE_JWT_SECRET\", \"\")"," public_key = os.getenv(\"AILINE_JWT_PUBLIC_KEY\", \"\")"," issuer = os.getenv(\"AILINE_JWT_ISSUER\", \"\") or None"," audience = os.getenv(\"AILINE_JWT_AUDIENCE\", \"\") or None"," # In dev mode without explicit key material, use the same fallback"," # secret as the auth router to ensure JWTs created at /auth/login"," # are verifiable by the middleware. F-254: uses a shared generated"," # secret instead of a hardcoded string."," if not secret and not public_key and _is_dev_mode():"," from ...shared.jwt_dev_secret import DEV_JWT_SECRET"," secret = DEV_JWT_SECRET"," # Determine algorithms based on what key material is available"," algorithms_env = os.getenv(\"AILINE_JWT_ALGORITHMS\", \"\")"," if algorithms_env:"," algorithms = ["," a.strip()"," for a in algorithms_env.split(\",\")"," if a.strip() in _ALLOWED_ALGORITHMS"," ]"," elif public_key:"," algorithms = [\"RS256\", \"ES256\"]"," elif secret:"," algorithms = [\"HS256\"]"," else:"," algorithms = []"," return {"," \"secret\": secret,"," \"public_key\": public_key,"," \"issuer\": issuer,"," \"audience\": audience,"," \"algorithms\": algorithms,"," }","class _JwtClaims:"," \"\"\"Lightweight container for claims extracted from a JWT.\"\"\""," __slots__ = (\"jti\", \"org_id\", \"role\", \"teacher_id\")"," def __init__("," self,"," teacher_id: str | None = None,"," role: str | None = None,"," org_id: str | None = None,"," jti: str | None = None,"," ) -> None:"," self.teacher_id = teacher_id"," self.role = role"," self.org_id = org_id"," self.jti = jti","def _extract_teacher_id_from_jwt("," token: str,",") -> tuple[_JwtClaims, str | None]:"," \"\"\"Extract claims (sub, role, org_id) from a JWT token."," Returns a tuple of (_JwtClaims, error_reason). If teacher_id inside"," the claims is not None, error_reason is None and vice versa."," cfg = _get_jwt_config()"," has_key_material = bool(cfg[\"secret\"]) or bool(cfg[\"public_key\"])"," if has_key_material:"," claims, error = _verified_jwt_decode(token, cfg)"," if claims.teacher_id is not None:"," return claims, None"," # Verified decode failed -- do NOT fall through to unverified"," return _JwtClaims(), error"," # Fallback: unverified base64 decode (only when no key material)"," if _is_dev_mode():"," claims = _unverified_jwt_decode(token)"," # SECURITY: Unverified tokens cannot escalate roles."," # Only extract sub; hardcode role to \"teacher\" to prevent"," # forged super_admin claims in dev mode."," claims.role = \"teacher\""," claims.org_id = None"," return claims, None"," # In non-dev mode without key material, reject JWT silently"," \"jwt_no_key_material\","," \"JWT received but no AILINE_JWT_SECRET or AILINE_JWT_PUBLIC_KEY \""," \"is configured. Set key material or enable dev mode.\""," return _JwtClaims(), \"no_key_material\"","def _verified_jwt_decode("," token: str, cfg: dict[str, Any]"," \"\"\"Decode and verify a JWT using PyJWT."," Supports HS256 (symmetric), RS256, and ES256 (asymmetric)."," Validates exp, nbf, iss, aud, and sub claims."," Rejects the ``none`` algorithm unconditionally."," Returns (_JwtClaims, None) on success, (_JwtClaims(), error_reason) on failure."," try:"," import jwt as pyjwt"," except ImportError:"," logger.warning("," \"jwt_library_missing\","," msg=("," \"JWT key material is configured but PyJWT is not installed. Install it with: pip install PyJWT[crypto]\""," ),"," return _JwtClaims(), \"jwt_library_missing\""," algorithms = cfg[\"algorithms\"]"," if not algorithms:"," logger.warning(\"jwt_no_algorithms\", msg=\"No allowed JWT algorithms configured\")"," return _JwtClaims(), \"no_algorithms\""," # Reject 'none' algorithm explicitly (defense in depth)"," algorithms = [a for a in algorithms if a.lower() != \"none\"]"," # Determine the verification key"," if cfg[\"public_key\"]:"," key: str | bytes = cfg[\"public_key\"]"," elif cfg[\"secret\"]:"," key = cfg[\"secret\"]"," return _JwtClaims(), \"no_key_material\""," decode_opts: dict[str, Any] = {"," \"algorithms\": algorithms,"," \"options\": {"," \"require\": [\"exp\", \"sub\"],"," \"verify_exp\": True,"," \"verify_nbf\": True,"," \"verify_iss\": cfg[\"issuer\"] is not None,"," \"verify_aud\": cfg[\"audience\"] is not None,"," },"," }"," if cfg[\"issuer\"]:"," decode_opts[\"issuer\"] = cfg[\"issuer\"]"," if cfg[\"audience\"]:"," decode_opts[\"audience\"] = cfg[\"audience\"]"," payload = pyjwt.decode(token, key, **decode_opts)"," sub = payload.get(\"sub\")"," if not sub or not isinstance(sub, str):"," logger.warning(\"jwt_missing_sub\", msg=\"JWT payload missing 'sub' claim\")"," return _JwtClaims(), \"missing_sub\""," # Extract RBAC claims with backward-compatible defaults"," role = payload.get(\"role\", \"teacher\")"," org_id = payload.get(\"org_id\")"," jti = payload.get(\"jti\")"," logger.debug("," \"auth_jwt_success\","," teacher_id=sub,"," role=role,"," org_id=org_id,"," issuer=payload.get(\"iss\"),"," return _JwtClaims(teacher_id=sub, role=role, org_id=org_id, jti=jti), None"," except pyjwt.ExpiredSignatureError:"," logger.warning(\"jwt_expired\", msg=\"JWT token has expired\")"," return _JwtClaims(), \"expired\""," except pyjwt.ImmatureSignatureError:"," logger.warning(\"jwt_not_yet_valid\", msg=\"JWT nbf claim is in the future\")"," return _JwtClaims(), \"not_yet_valid\""," except pyjwt.InvalidIssuerError:"," logger.warning(\"jwt_invalid_issuer\", msg=\"JWT issuer mismatch\")"," return _JwtClaims(), \"invalid_issuer\""," except pyjwt.InvalidAudienceError:"," logger.warning(\"jwt_invalid_audience\", msg=\"JWT audience mismatch\")"," return _JwtClaims(), \"invalid_audience\""," except pyjwt.InvalidAlgorithmError:"," logger.warning(\"jwt_invalid_algorithm\", msg=\"JWT uses disallowed algorithm\")"," return _JwtClaims(), \"invalid_algorithm\""," except pyjwt.DecodeError as exc:"," logger.warning(\"jwt_decode_error\", error=str(exc))"," return _JwtClaims(), \"decode_error\""," except pyjwt.InvalidTokenError as exc:"," logger.warning(\"jwt_invalid\", error=str(exc))"," return _JwtClaims(), \"invalid_token\"","def _unverified_jwt_decode(token: str) -> _JwtClaims:"," \"\"\"Decode JWT payload without signature verification (dev-mode fallback)."," Only used when no key material is configured AND dev mode is enabled."," Extracts sub, role, and org_id claims from the base64-encoded payload."," parts = token.split(\".\")"," if len(parts) < 2:"," return _JwtClaims()"," payload_b64 = parts[1]"," padding = 4 - len(payload_b64) % 4"," if padding != 4:"," payload_b64 += \"=\" * padding"," payload_bytes = base64.urlsafe_b64decode(payload_b64)"," payload: dict[str, Any] = json.loads(payload_bytes)"," teacher_id = str(sub) if sub is not None else None"," return _JwtClaims("," teacher_id=teacher_id,"," org_id=str(org_id) if org_id is not None else None,"," except (ValueError, KeyError, json.JSONDecodeError):"," logger.warning(\"unverified_jwt_decode_failed\")"," return _JwtClaims()","def extract_teacher_id_from_jwt(token: str) -> tuple[str | None, str | None]:"," \"\"\"Public API: extract teacher_id from a JWT token."," Returns a tuple of (teacher_id, error_reason). If teacher_id is not"," None, error_reason is None and vice versa."," This is the public wrapper around the internal ``_extract_teacher_id_from_jwt``"," function, intended for use by WebSocket endpoints and other code that"," needs JWT verification outside the middleware pipeline."," claims, error = _extract_teacher_id_from_jwt(token)"," return claims.teacher_id, error","def extract_claims_from_jwt(token: str) -> tuple[_JwtClaims, str | None]:"," \"\"\"Public API: extract all RBAC claims from a JWT token."," Returns a tuple of (_JwtClaims, error_reason). Extends"," ``extract_teacher_id_from_jwt`` with role and org_id."," return _extract_teacher_id_from_jwt(token)","# In-memory LRU fallback cache for JTI blacklist when Redis is down","_REVOCATION_CACHE: dict[str, float] = {}","_REVOCATION_CACHE_MAX = 1000","_REVOCATION_CACHE_TTL = 300.0 # 5 minutes","_REVOCATION_CACHE_LOCK = asyncio.Lock()","async def _is_jti_blacklisted(request: Request, jti: str) -> bool:"," \"\"\"Check if a JWT ID (jti) has been revoked via Redis blacklist."," Fail-closed: returns True (treat as blacklisted) when Redis is"," unavailable, to prevent accepting potentially revoked tokens."," Uses an in-memory LRU cache as fallback for known-good JTIs."," import time as _time"," # Check in-memory cache first (known-good JTIs)"," async with _REVOCATION_CACHE_LOCK:"," cached_ts = _REVOCATION_CACHE.get(jti)"," if cached_ts is not None:"," if _time.monotonic() - cached_ts < _REVOCATION_CACHE_TTL:"," return False # Recently verified as not blacklisted"," _REVOCATION_CACHE.pop(jti, None)"," container = getattr(getattr(request.app, \"state\", None), \"container\", None)"," if container is None:"," logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"no_container\")"," return True # Fail-closed"," event_bus = getattr(container, \"event_bus\", None)"," if event_bus is None:"," logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"no_event_bus\")"," redis_client = await event_bus.get_redis_client()"," if redis_client is None:"," logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"no_redis_client\")"," result = await redis_client.get(f\"jti_blacklist:{jti}\")"," if result is not None:"," return True # Token IS blacklisted"," # Cache as known-good"," async with _REVOCATION_CACHE_LOCK:"," if len(_REVOCATION_CACHE) >= _REVOCATION_CACHE_MAX:"," # Evict oldest entry"," oldest_key = min(_REVOCATION_CACHE, key=_REVOCATION_CACHE.get) # type: ignore[arg-type]"," del _REVOCATION_CACHE[oldest_key]"," _REVOCATION_CACHE[jti] = _time.monotonic()"," return False"," except Exception:"," logger.warning(\"jti_blacklist_check_failed_closed\", jti=jti, reason=\"redis_error\")"," return True # Fail-closed on Redis error","class TenantContextMiddleware(BaseHTTPMiddleware):"," \"\"\"Extract teacher_id from request and store in contextvars."," The middleware is permissive: if no teacher_id can be extracted,"," the request proceeds without a tenant context. Endpoints that"," require tenant isolation call ``get_current_teacher_id()`` which"," will raise 401 if the context is missing."," async def dispatch("," request: Request,"," call_next: Callable[[Request], Awaitable[Response]],"," ) -> Response:"," # Skip excluded paths"," path = request.url.path"," if path in _EXCLUDED_EXACT or any("," path.startswith(prefix) for prefix in _EXCLUDED_PREFIXES"," ):"," return await call_next(request)"," teacher_id: str | None = None"," role: str | None = None"," org_id: str | None = None"," jwt_error: str | None = None"," # 1. Try Authorization header (JWT)"," auth_header = request.headers.get(\"Authorization\", \"\")"," if auth_header.startswith(\"Bearer \"):"," jwt_token = auth_header[7:].strip()"," if jwt_token:"," claims, jwt_error = _extract_teacher_id_from_jwt(jwt_token)"," teacher_id = claims.teacher_id"," role = claims.role"," org_id = claims.org_id"," if teacher_id:"," # F-231: Check jti blacklist (Redis) for revoked tokens"," if claims.jti and await _is_jti_blacklisted("," request, claims.jti"," ):"," logger.warning("," \"jwt_revoked\","," jti=claims.jti,"," path=path,"," )"," teacher_id = None"," jwt_error = \"revoked\""," else:"," logger.debug("," \"tenant_from_jwt\","," teacher_id=teacher_id,"," role=role,"," if jwt_error:"," # JWT was present but invalid -- log auth failure"," logger.warning("," \"auth_jwt_failure\","," reason=jwt_error,"," path=path,"," )"," # 2. Try X-Teacher-ID header (dev mode only)"," if teacher_id is None:"," x_teacher_id = request.headers.get(\"X-Teacher-ID\", \"\").strip()"," if x_teacher_id:"," if _is_dev_mode():"," teacher_id = x_teacher_id"," # Also check for X-User-Role and X-Org-ID (dev mode only)"," raw_role = ("," request.headers.get(\"X-User-Role\", \"\").strip() or \"teacher\""," # SECURITY: Restrict dev mode role escalation — super_admin"," # cannot be assumed via dev headers (must use real JWT)."," dev_allowed_roles = frozenset({"," \"teacher\", \"student\", \"parent\", \"school_admin\","," })"," if raw_role not in dev_allowed_roles:"," \"dev_role_escalation_blocked\","," requested_role=raw_role,"," msg=("," f\"X-User-Role '{raw_role}' blocked in dev mode. \""," \"Only teacher/student/parent/school_admin allowed via headers.\""," ),"," raw_role = \"teacher\""," role = raw_role"," org_id = ("," request.headers.get(\"X-Org-ID\", \"\").strip() or None"," logger.debug("," \"tenant_from_header\","," teacher_id=teacher_id,"," role=role,"," else:"," \"x_teacher_id_ignored\","," reason=\"AILINE_DEV_MODE is not enabled\","," # Validate format if we have a teacher_id"," if teacher_id is not None:"," try:"," teacher_id = validate_teacher_id_format(teacher_id)"," except (ValueError, InvalidTenantIdError):"," logger.warning(\"teacher_id_format_invalid\", path=path)"," return JSONResponse("," status_code=422,"," content={"," \"detail\": ("," \"Invalid teacher_id format. Must be a UUID or alphanumeric identifier (max 128 chars).\""," },"," )"," # Set in contextvars (None means \"no tenant context\")"," tid_token = set_tenant_id(teacher_id)"," role_token = set_user_role(role or \"teacher\")"," org_token = set_org_id(org_id) if org_id else None"," # Also bind to structlog for correlation"," structlog.contextvars.bind_contextvars("," teacher_id=teacher_id, role=role or \"teacher\","," response = await call_next(request)"," return response"," finally:"," clear_tenant_id(tid_token)"," clear_user_role(role_token)"," if org_token is not None:"," clear_org_id(org_token)"," structlog.contextvars.unbind_contextvars(\"teacher_id\", \"role\")"," else:"," # No tenant context -- proceed without it."," # Endpoints requiring auth will call get_current_teacher_id()"," # which raises 401.",[1467,1468,1469,1470,1471,1472,1473,1474],{"_935":49,"_49":1487},{"_935":1476,"_188":525,"_981":1485,"_982":1486},{"_935":1476,"_188":525,"_981":1483,"_982":1484},{"_935":49,"_49":1482},{"_935":1476,"_188":525,"_981":1480,"_982":1481},{"_935":49,"_49":1479},{"_935":1476,"_188":525,"_981":1477,"_982":1478},{"_935":49,"_49":1475},"\n* Committed the change and created a follow-up PR via `make_pr` with a summary of this reviewer-suggested fix.\n\n**Testing**\n* ✅ `python -m py_compile runtime/ailine_runtime/api/middleware/tenant_context.py`","repo_file_citation",458,465,"\n* Wrapped cache eviction/write (`len` check, oldest-key eviction, insert) in the same lock so the LRU-like update path is atomic across concurrent requests. ",433,440,"\n* Wrapped the cache read/TTL-expiry logic in `_is_jti_blacklisted` with the lock and switched expiry removal to `pop(jti, None)` to keep that mutation safe under concurrent handlers. ",417,422,42,44,"### Summary\n* Added `asyncio` import and introduced a module-level `_REVOCATION_CACHE_LOCK = asyncio.Lock()` so the in-memory JTI fallback cache has explicit async concurrency protection. ",{"_96":369,"_45":88,"_100":369,"_1490":1491,"_1492":1493,"_1494":1495,"_136":-5,"_123":1496},[87],"input_items",[1514,1515,1516,1517,1518,1519,1520,1521,1522,1523,1524,1525,1526,1527,1528,1529],"external_post_config",{"_1497":1498,"_307":241,"_1499":264,"_318":-5,"_956":301,"_1500":-5,"_1501":-5,"_1502":1503,"_1504":948,"_1505":-5,"_1506":-5,"_1507":1508,"_1509":18,"_1510":62,"_1511":57,"_1512":18,"_1513":-5},"user_model_slug","slug",1772660488.21276,"installation_id",67105755,"pr_number","gitlab_service_account_project_id","review_trigger","comment_id",2886276116,"comment_type","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",367319814,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review","review_summary_id",{"_96":473,"_100":369,"_468":1557},{"_356":357,"_358":359,"_1554":363,"_1555":133,"_365":-5,"_96":1556},{"_96":1530,"_358":1552,"_188":525,"_1533":1534,"_1535":1553},{"_96":1530,"_358":1551,"_188":1542,"_1533":1534,"_1535":1544},{"_96":1530,"_358":1550,"_188":1542,"_1533":1534,"_1535":1543},{"_96":1530,"_358":1549,"_188":1540,"_1533":1534,"_1535":1541},{"_96":1530,"_358":1548,"_188":525,"_1533":1534,"_1535":1539},{"_96":1530,"_358":1547,"_188":1537,"_1533":1534,"_1535":1538},{"_96":1530,"_358":1546,"_188":1532,"_1533":1534,"_1535":1536},{"_96":1530,"_358":1545,"_188":-5,"_1533":-5,"_1535":-5},{"_96":1530,"_358":1531,"_188":1542,"_1533":1534,"_1535":1544},{"_96":1530,"_358":1531,"_188":1542,"_1533":1534,"_1535":1543},{"_96":1530,"_358":1531,"_188":1540,"_1533":1534,"_1535":1541},{"_96":1530,"_358":1531,"_188":525,"_1533":1534,"_1535":1539},{"_96":1530,"_358":1531,"_188":1537,"_1533":1534,"_1535":1538},{"_96":1530,"_358":1531,"_188":1532,"_1533":1534,"_1535":1536},"pull_request_comment","@codex revise essa sugestão.","frontend/src/lib/sse-fetch.ts","side","RIGHT","line",179,"runtime/ailine_runtime/shared/trace_store.py",107,442,"runtime/ailine_runtime/api/routers/tutors.py",207,"frontend/src/components/setup/setup-wizard.tsx",31,135,"## Pull request overview\n\nThis is a large multi-category sprint PR (Sprint 29A-D) addressing security hardening, reliability improvements, contract alignment, and medium-priority polish across the AiLine platform's backend (Python/FastAPI) and frontend (React/TypeScript) codebases.\n\n**Changes:**\n- **Security & reliability**: JWT revocation fail-closed with in-memory LRU cache, tenant-scoped trace/evidence stores, PBKDF2 async offload, CircuitBreaker 3-state machine (half-open probe), Redis PubSub real subscribe, migration composite FK ordering fix\n- **Contract alignment**: Setup wizard endpoint/payload mapping, idempotency guard for plan streams, privacy panel auth+abort controller, safe env defaults (demo=0, dev=false), GEMINI_API_KEY alias, embedding dims=1536\n- **Polish**: SSE client reconnection with exponential backoff, React.memo for ChatMessageBubble, anyio async I/O in tutor routes, auth-first route pattern, login form cleanup, accessibility store cleanup, composite DB indexes\n\n### Reviewed changes\n\nCopilot reviewed 25 out of 25 changed files in this pull request and generated 7 comments.\n\n

Show a summary per file

\n\n\n\n\n\n\n---\n\n💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.","The exponential backoff for retries computes the delay using `retryMs * Math.pow(2, attempt - 1)`. The first retry (attempt=1) results in `3000 * 1 = 3s`, but the comment says \"Exponential backoff: 3s, 6s, 12s, 24s, 48s\". The maximum is `3000 * Math.pow(2, 4) = 48000ms = 48s`. There is no cap or jitter applied — for 5 retries this totals ~93s of wait time. While this is unlikely to be a hard bug, there is no maximum delay cap, and without jitter, multiple clients reconnecting after a server restart will cause a thundering herd. Consider capping the delay (e.g., `Math.min(delay, 30000)`) and adding jitter.","The `append_node` and `update_run` methods check `if teacher_id and trace.teacher_id and trace.teacher_id != teacher_id:` before blocking the operation. This means the tenant check is silently skipped when either the provided `teacher_id` is empty (`\"\"`) or the stored `trace.teacher_id` is empty. An attacker could call these methods with `teacher_id=\"\"` and bypass tenant isolation entirely. Since the caller in `plans_stream.py` always passes a non-empty `teacher_id`, this is likely a defense-in-depth gap, but it is inconsistent with the strengthened `get()` method which now always enforces the check.","The `_is_jti_blacklisted` function now fails closed (returns `True`, treating the token as blacklisted) when Redis is unavailable — including at startup when the container hasn't loaded yet. This means that any request made before the application's container fully initializes (where `container` is `None`) will have all JWTs treated as revoked, potentially causing all authenticated requests to fail with 401 until the container is ready. This is a significant availability concern in production deployments, especially during rolling restarts or slow startup.","The `tutor_session_transcript` and `tutor_flag_turn` endpoints do not add `teacher_id: str = Depends(require_authenticated)` to their signatures despite the PR description stating \"auth-first in tutor routes.\" All other endpoints in this file were updated to include authentication, but these two are missing it. Without the `Depends(require_authenticated)` parameter, `require_tenant_access` inside them calls `get_current_teacher_id()` which relies on the middleware's context var — this may work via middleware, but the routes are inconsistent with the other updated endpoints and rely on implicit auth rather than explicit FastAPI dependencies.","The module-level comment block for the `SetupWizard` component is malformed. The JSDoc comment for `SetupWizard` (`/** Map camelCase setup config to snake_case... */`) and the function comment above it (`/** Main setup wizard orchestrator... */`) overlap on adjacent lines (30-31) rather than each preceding its own declaration. The helper function `toSetupPayload` appears before `SetupWizard` but the comment block intended for `SetupWizard` ends up as a documentation block for `toSetupPayload` instead.","The `X-Setup-Token` header is hard-coded to an empty string (`''`). Since `require_setup_token` on the backend uses `hmac.compare_digest(x_setup_token, expected)`, an empty token will always be rejected with a 403, making the setup wizard non-functional. The actual setup token should be read from a state variable or user input in the wizard UI, not hard-coded to an empty string.","Comments in the same thread:\n\nThe `_REVOCATION_CACHE` is a module-level plain dict that is accessed concurrently by async request handlers without any locking. Read-modify-write operations on it (checking `len`, evicting the oldest entry, and writing) are not atomic. Under high concurrency, two coroutines could both observe `len(_REVOCATION_CACHE) >= _REVOCATION_CACHE_MAX` and both try to evict and write, or the dict could be structurally modified during iteration of `_REVOCATION_CACHE.get`, leading to potential race conditions. An `asyncio.Lock` should protect these operations.",461,"base_ref","head_ref","pull_request_info",[1558],{"_935":49,"_49":1559},"@codex revise essa sugestão. (path=runtime/ailine_runtime/api/middleware/tenant_context.py line=461 side=RIGHT)",[1934,1935,1936],[],{"_940":941,"_49":942,"_943":944},{"_915":1925},{"_380":1924},{"_380":1615},{"_349":264,"_339":350,"_351":352,"_353":62,"_354":18,"_355":18,"_356":357,"_358":359,"_360":311,"_361":131,"_362":363,"_364":133,"_365":366,"_367":-5,"_368":-5,"_369":1614,"_371":372,"_373":374,"_375":376,"_377":378},{"_45":127,"_238":239,"_240":241,"_242":18,"_243":244,"_245":246,"_247":1603,"_249":-5,"_250":-5,"_251":18,"_252":1604,"_254":244,"_255":244,"_256":1605,"_258":1606,"_260":1607,"_262":-5,"_263":264,"_265":266,"_267":268,"_269":1608,"_58":-5,"_123":271,"_272":1609,"_274":1610,"_276":277,"_278":18,"_279":18},{"_137":1598},[1570,1571,1572,1573,1574,1575,1576,1577,1578,1579,1580,1581,1582,1583,1584,1585,1586,1587,1588,1589,1590,1591,1592,1593,1594,1595,1596,1597],{"_174":222,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":221,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":220,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":219,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":218,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":217,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":216,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":215,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":213,"_176":177,"_178":179,"_180":190,"_182":214,"_184":185,"_186":35,"_188":-5},{"_174":210,"_176":177,"_178":179,"_180":211,"_182":212,"_184":185,"_186":35,"_188":-5},{"_174":209,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":208,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":207,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":205,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":206,"_188":-5},{"_174":204,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":203,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":201,"_188":-5},{"_174":202,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":200,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":201,"_188":-5},{"_174":199,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":198,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":197,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":196,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":195,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":193,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":192,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":191,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":189,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},[1599,1600],{"_226":1602,"_228":235},{"_226":1601,"_228":229},{"_230":231,"_96":232,"_123":233},{"_230":236,"_96":232,"_123":237},{"_341":342,"_343":344,"_345":244,"_346":-5,"_347":-5,"_348":-5},[301],{"_301":1611},{"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300},{},[],{"_282":62},{"_280":62,"_281":244},{"_45":303,"_230":304,"_305":1612,"_307":241,"_308":309,"_310":311,"_312":313,"_314":315,"_316":317,"_318":67,"_319":-5,"_320":18,"_321":62,"_322":62,"_323":62,"_324":18,"_325":-5,"_186":326,"_327":-5,"_58":1613},{"_333":334,"_45":335,"_96":336,"_337":338,"_339":340},{"_329":62,"_330":18,"_331":62,"_332":62},{"_333":334,"_230":334,"_379":-5,"_337":338,"_45":335},[1616,1617,1618,1619,1620,1621,1622,1623,1624,1625,1626,1627,1628,1629,1630,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1674,1675,1676,1677,1678,1679,1680,1681,1682,1683,1684,1685,1686],{"_180":884,"_454":1920},{"_180":463,"_454":1916},{"_180":463,"_454":1912},{"_180":463,"_454":1908},{"_180":862,"_454":1905},{"_180":463,"_454":1901},{"_180":477,"_454":1896},{"_180":477,"_454":1892},{"_180":463,"_454":1888},{"_180":463,"_454":1886},{"_180":477,"_454":1881},{"_180":463,"_454":1879},{"_180":477,"_454":1875},{"_180":463,"_454":1871},{"_180":463,"_454":1869},{"_180":477,"_454":1865},{"_180":463,"_454":1863},{"_180":477,"_454":1859},{"_180":463,"_454":1855},{"_180":463,"_454":1853},{"_180":477,"_454":1849},{"_180":463,"_454":1847},{"_180":477,"_454":1843},{"_180":463,"_454":1839},{"_180":463,"_454":1837},{"_180":477,"_454":1833},{"_180":463,"_454":1831},{"_180":477,"_454":1827},{"_180":463,"_454":1823},{"_180":463,"_454":1821},{"_180":463,"_454":1817},{"_180":477,"_454":1812},{"_180":463,"_454":1810},{"_180":477,"_454":1806},{"_180":463,"_454":1802},{"_180":463,"_454":1800},{"_180":477,"_454":1796},{"_180":463,"_454":1794},{"_180":477,"_454":1790},{"_180":463,"_454":1786},{"_180":463,"_454":1784},{"_180":477,"_454":1780},{"_180":463,"_454":1778},{"_180":477,"_454":1774},{"_180":463,"_454":1770},{"_180":463,"_454":1768},{"_180":477,"_454":1764},{"_180":463,"_454":1762},{"_180":477,"_454":1758},{"_180":463,"_454":1755},{"_180":463,"_454":1753},{"_180":477,"_454":1748},{"_180":463,"_454":1746},{"_180":477,"_454":1742},{"_180":463,"_454":1738},{"_180":463,"_454":1736},{"_180":477,"_454":1729},{"_180":463,"_454":1727},{"_180":477,"_454":1723},{"_180":463,"_454":1720},{"_180":463,"_454":1718},{"_180":477,"_454":1714},{"_180":463,"_454":1712},{"_180":463,"_454":1710},{"_180":477,"_454":1706},{"_180":463,"_454":1704},{"_180":477,"_454":1700},{"_180":463,"_454":1696},{"_180":477,"_454":1694},{"_180":463,"_454":1690},{"_180":453,"_454":1687},{"_456":457,"_91":1688},{"_107":-5,"_45":459,"_460":1689,"_462":117},[],{"_465":1691,"_456":457,"_467":459},{"_468":1692,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":97,"_96":473},[1693],{"_49":475,"_96":476},{"_465":1695,"_456":457,"_467":459},{"_45":480,"_472":-5,"_49":475,"_96":481},{"_465":1697,"_456":457,"_467":459},{"_468":-5,"_484":485,"_45":-5,"_471":-5,"_486":1698,"_96":488},[1699],{"_49":490,"_96":491},{"_465":1701,"_456":457,"_467":459},{"_468":1702,"_45":495,"_486":1703,"_96":488},[],[490],{"_465":1705,"_456":457,"_467":459},{"_499":500,"_45":-5,"_471":-5,"_501":502,"_96":503},{"_465":1707,"_456":457,"_467":459},{"_506":507,"_508":509,"_510":1708,"_512":513,"_514":515,"_516":35,"_45":500,"_517":518,"_519":520,"_462":117,"_96":521},[1709],{"_508":523,"_230":524,"_188":525,"_96":526},{"_465":1711,"_456":457,"_467":459},{"_529":530,"_499":500,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1713,"_456":457,"_467":459},{"_499":536,"_45":-5,"_471":-5,"_501":537,"_96":503},{"_465":1715,"_456":457,"_467":459},{"_506":540,"_508":541,"_510":1716,"_512":513,"_514":515,"_516":35,"_45":536,"_517":543,"_519":520,"_462":117,"_96":521},[1717],{"_508":545,"_230":524,"_188":525,"_96":526},{"_465":1719,"_456":457,"_467":459},{"_529":548,"_499":536,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1721,"_456":457,"_467":459},{"_468":-5,"_484":551,"_45":-5,"_471":-5,"_486":1722,"_96":488},[],{"_465":1724,"_456":457,"_467":459},{"_468":1725,"_45":556,"_486":1726,"_96":488},[],[],{"_465":1728,"_456":457,"_467":459},{"_499":560,"_45":-5,"_471":-5,"_501":561,"_96":503},{"_465":1730,"_456":457,"_467":459},{"_564":-5,"_529":1731,"_514":566,"_107":-5,"_45":560,"_567":-5,"_568":-5,"_569":-5,"_570":1732,"_572":573,"_462":117,"_574":573,"_96":575},{"_356":580,"_358":581},{"_576":-5,"_468":1733,"_578":1734},[1735],{"_356":580,"_358":581},{"_49":583,"_96":49},{"_465":1737,"_456":457,"_467":459},{"_529":561,"_499":560,"_45":-5,"_471":-5,"_230":586,"_532":-5,"_96":533},{"_465":1739,"_456":457,"_467":459},{"_468":-5,"_484":589,"_45":-5,"_471":-5,"_486":1740,"_96":488},[1741],{"_49":592,"_96":491},{"_465":1743,"_456":457,"_467":459},{"_468":1744,"_45":596,"_486":1745,"_96":488},[],[592],{"_465":1747,"_456":457,"_467":459},{"_499":600,"_45":-5,"_471":-5,"_501":601,"_96":503},{"_465":1749,"_456":457,"_467":459},{"_506":604,"_508":605,"_510":1750,"_512":513,"_514":607,"_516":35,"_45":600,"_517":608,"_519":520,"_462":117,"_96":521},[1751,1752],{"_508":613,"_96":612},{"_508":611,"_96":612},{"_465":1754,"_456":457,"_467":459},{"_529":616,"_499":600,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1756,"_456":457,"_467":459},{"_468":-5,"_484":619,"_45":-5,"_471":-5,"_486":1757,"_96":488},[],{"_465":1759,"_456":457,"_467":459},{"_468":1760,"_45":624,"_486":1761,"_96":488},[],[],{"_465":1763,"_456":457,"_467":459},{"_499":628,"_45":-5,"_471":-5,"_501":629,"_96":503},{"_465":1765,"_456":457,"_467":459},{"_506":632,"_508":633,"_510":1766,"_512":513,"_514":635,"_516":35,"_45":628,"_517":636,"_519":520,"_462":117,"_96":521},[1767],{"_508":638,"_96":612},{"_465":1769,"_456":457,"_467":459},{"_529":641,"_499":628,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1771,"_456":457,"_467":459},{"_468":-5,"_484":644,"_45":-5,"_471":-5,"_486":1772,"_96":488},[1773],{"_49":647,"_96":491},{"_465":1775,"_456":457,"_467":459},{"_468":1776,"_45":651,"_486":1777,"_96":488},[],[647],{"_465":1779,"_456":457,"_467":459},{"_499":655,"_45":-5,"_471":-5,"_501":656,"_96":503},{"_465":1781,"_456":457,"_467":459},{"_506":-5,"_508":659,"_510":1782,"_512":513,"_514":661,"_516":35,"_45":655,"_517":662,"_519":520,"_462":117,"_96":521},[1783],{"_508":664,"_96":612},{"_465":1785,"_456":457,"_467":459},{"_529":667,"_499":655,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1787,"_456":457,"_467":459},{"_468":-5,"_484":670,"_45":-5,"_471":-5,"_486":1788,"_96":488},[1789],{"_49":673,"_96":491},{"_465":1791,"_456":457,"_467":459},{"_468":1792,"_45":677,"_486":1793,"_96":488},[],[673],{"_465":1795,"_456":457,"_467":459},{"_499":681,"_45":-5,"_471":-5,"_501":682,"_96":503},{"_465":1797,"_456":457,"_467":459},{"_506":685,"_508":686,"_510":1798,"_512":513,"_514":515,"_516":35,"_45":681,"_517":688,"_519":520,"_462":117,"_96":521},[1799],{"_508":690,"_96":612},{"_465":1801,"_456":457,"_467":459},{"_529":693,"_499":681,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1803,"_456":457,"_467":459},{"_468":-5,"_484":696,"_45":-5,"_471":-5,"_486":1804,"_96":488},[1805],{"_49":699,"_96":491},{"_465":1807,"_456":457,"_467":459},{"_468":1808,"_45":703,"_486":1809,"_96":488},[],[699],{"_465":1811,"_456":457,"_467":459},{"_499":707,"_45":-5,"_471":-5,"_501":708,"_96":503},{"_465":1813,"_456":457,"_467":459},{"_711":1814,"_45":707,"_462":117,"_96":713},[1815],{"_368":715,"_9":1816,"_188":717},{"_718":-5,"_96":719},{"_465":1818,"_456":457,"_467":459},{"_468":1819,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[1820],{"_49":724,"_96":725},{"_465":1822,"_456":457,"_467":459},{"_529":728,"_499":707,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1824,"_456":457,"_467":459},{"_468":-5,"_484":731,"_45":-5,"_471":-5,"_486":1825,"_96":488},[1826],{"_49":734,"_96":491},{"_465":1828,"_456":457,"_467":459},{"_468":1829,"_45":738,"_486":1830,"_96":488},[],[734],{"_465":1832,"_456":457,"_467":459},{"_499":742,"_45":-5,"_471":-5,"_501":743,"_96":503},{"_465":1834,"_456":457,"_467":459},{"_506":746,"_508":747,"_510":1835,"_512":513,"_514":749,"_516":35,"_45":742,"_517":750,"_519":520,"_462":117,"_96":521},[1836],{"_508":752,"_96":612},{"_465":1838,"_456":457,"_467":459},{"_529":755,"_499":742,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1840,"_456":457,"_467":459},{"_468":-5,"_484":758,"_45":-5,"_471":-5,"_486":1841,"_96":488},[1842],{"_49":761,"_96":491},{"_465":1844,"_456":457,"_467":459},{"_468":1845,"_45":765,"_486":1846,"_96":488},[],[761],{"_465":1848,"_456":457,"_467":459},{"_499":769,"_45":-5,"_471":-5,"_501":770,"_96":503},{"_465":1850,"_456":457,"_467":459},{"_506":773,"_508":774,"_510":1851,"_512":513,"_514":515,"_516":35,"_45":769,"_517":776,"_519":520,"_462":117,"_96":521},[1852],{"_508":778,"_230":524,"_188":525,"_96":526},{"_465":1854,"_456":457,"_467":459},{"_529":781,"_499":769,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1856,"_456":457,"_467":459},{"_468":-5,"_484":784,"_45":-5,"_471":-5,"_486":1857,"_96":488},[1858],{"_49":787,"_96":491},{"_465":1860,"_456":457,"_467":459},{"_468":1861,"_45":791,"_486":1862,"_96":488},[],[787],{"_465":1864,"_456":457,"_467":459},{"_499":795,"_45":-5,"_471":-5,"_501":796,"_96":503},{"_465":1866,"_456":457,"_467":459},{"_506":799,"_508":800,"_510":1867,"_512":513,"_514":515,"_516":35,"_45":795,"_517":802,"_519":520,"_462":117,"_96":521},[1868],{"_508":804,"_230":524,"_188":525,"_96":526},{"_465":1870,"_456":457,"_467":459},{"_529":807,"_499":795,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1872,"_456":457,"_467":459},{"_468":-5,"_484":810,"_45":-5,"_471":-5,"_486":1873,"_96":488},[1874],{"_49":813,"_96":491},{"_465":1876,"_456":457,"_467":459},{"_468":1877,"_45":817,"_486":1878,"_96":488},[],[813],{"_465":1880,"_456":457,"_467":459},{"_499":821,"_45":-5,"_471":-5,"_501":822,"_96":503},{"_465":1882,"_456":457,"_467":459},{"_506":825,"_508":826,"_510":1883,"_512":513,"_514":515,"_516":35,"_45":821,"_517":828,"_519":520,"_462":117,"_96":521},[1884,1885],{"_508":833,"_96":612},{"_508":831,"_188":-5,"_96":832},{"_465":1887,"_456":457,"_467":459},{"_529":836,"_499":821,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":1889,"_456":457,"_467":459},{"_468":-5,"_484":839,"_45":-5,"_471":-5,"_486":1890,"_96":488},[1891],{"_49":842,"_96":491},{"_465":1893,"_456":457,"_467":459},{"_468":1894,"_45":846,"_486":1895,"_96":488},[],[842],{"_465":1897,"_456":457,"_467":459},{"_850":-5,"_468":1898,"_45":852,"_96":853},[1899],{"_49":855,"_856":1900,"_96":49},[],{"_465":1902,"_456":457,"_467":459},{"_468":1903,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[1904],{"_49":855,"_96":725},{"_456":457,"_91":1906},{"_107":-5,"_45":459,"_460":1907,"_462":866},[],{"_465":1909,"_456":457,"_467":869},{"_468":1910,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[1911],{"_49":872,"_96":725},{"_465":1913,"_456":457,"_467":869},{"_468":1914,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[1915],{"_49":877,"_96":725},{"_465":1917,"_456":457,"_467":869},{"_468":1918,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":881,"_96":473},[1919],{"_49":883,"_96":725},{"_886":1921},{"_888":-5,"_889":-5,"_890":891,"_892":893,"_512":513,"_894":18,"_895":-5,"_896":-5,"_897":1922,"_899":900,"_45":457,"_901":902,"_230":-5,"_903":-5,"_188":904,"_905":244,"_906":-5,"_519":907,"_462":-5,"_908":-5,"_81":1923,"_910":893},{"_130":911,"_912":-5,"_913":133},[],[],[1926],{"_45":918,"_919":1927,"_921":922,"_923":922,"_468":1928,"_462":925,"_470":-5,"_926":35,"_927":1929,"_929":344,"_930":-5},{"_100":369,"_230":-5,"_927":1933},{"_935":49,"_936":1932},{"_931":1930},{"_933":1931},[],[938],{},{"_96":473,"_100":97,"_468":1944},{"_96":972,"_973":1939},{"_96":948,"_949":950,"_951":952,"_953":1937,"_955":-5},{"_96":953,"_956":513,"_132":133,"_957":-5,"_368":958,"_959":1938,"_961":372,"_962":963,"_964":965,"_966":967,"_968":-5},{"_969":970,"_971":-5},[1940],{"_188":525,"_976":-5,"_977":1941,"_979":-5},[1942],{"_981":372,"_982":983,"_468":1943,"_985":62},[986,244,987,988,989,990,244,991,244,992,993,994,995,996,244,997,998,999,244,1000,1001,1002,1003,1004,1005,244,1006,1007,1008,1009,1010,244,1011,1012,1013,1014,1015,1016,244,1017,244,1018,1019,1020,1021,1022,1023,1024,244,1025,1026,1027,1028,244,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,244,1039,244,1040,1041,1042,1043,1044,1045,1046,1047,1048,1038,244,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,244,1067,1068,244,244,1069,1070,244,1071,1072,1073,1074,244,1075,1076,1077,1078,244,1079,1080,1081,1082,1083,1084,1085,244,1086,1087,244,1088,1089,1090,1091,1092,1093,1094,244,1095,1096,1097,1098,1099,1100,1101,1102,1103,244,244,1104,1105,1106,244,1107,1108,1109,1082,1110,244,244,1104,1111,1112,244,1107,1113,1109,244,1114,1115,1116,1117,1118,1119,1082,1120,1121,1122,1123,244,1124,1125,1126,1127,1128,1129,244,1130,244,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,244,1145,1146,1147,1148,1149,1150,1151,244,244,1152,1153,244,1154,244,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,244,244,1166,1167,1168,1169,244,1170,1171,1082,1172,1173,244,1174,1175,1176,1177,1178,1179,244,1180,1181,1182,1183,1184,1185,1186,1187,1188,244,1189,1095,1190,1097,1191,1192,1101,1103,1193,244,244,1194,1195,1168,1196,244,1197,1198,1199,244,1200,1082,1201,1202,1203,1204,1205,1206,1207,1208,1094,1209,244,1210,1211,1212,1213,244,1214,1215,244,1216,1217,1218,1219,1220,1143,1221,244,1201,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233,1234,1235,244,1236,244,1237,1238,1239,1240,244,1241,1242,1243,1244,244,1245,1246,1247,1248,1249,1250,1094,1251,244,1252,1253,1254,1255,1256,1257,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,244,244,1273,1274,244,1275,1276,1082,1201,1277,1278,1279,1280,1281,1282,1283,1284,1285,1237,1286,1242,1243,1287,1288,1248,1289,1094,1290,1291,1292,244,244,1293,1294,244,1295,1296,244,1297,1298,1299,1082,1300,1301,244,244,1302,1303,244,1304,1305,1082,1306,244,244,1307,1308,1309,1310,1311,244,244,1312,1313,244,1314,1315,1316,1082,1317,244,1318,1319,1320,1321,1322,1323,1324,244,1325,1326,1327,1328,1329,1330,1331,1328,1332,1333,1334,1328,1201,1335,1336,1337,244,1338,1339,1340,1341,1342,1343,1344,1345,1346,1347,1348,244,244,1349,1350,244,1351,1352,1353,1354,1082,244,1355,1156,1356,1357,1358,1359,1360,1361,1362,1363,1364,244,1365,1366,1367,1368,244,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1386,1387,1395,1396,1397,1398,1399,1400,1401,244,1402,1403,1404,1405,1406,1407,1408,1409,1410,1401,1411,1412,1413,1414,1415,1416,1383,1417,1418,1393,1386,1419,1420,1421,1422,1387,1423,1424,1425,1426,1401,1427,1428,1429,1430,1400,1401,1431,1397,1432,1433,1400,1401,244,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1387,1445,1446,244,1447,1435,1448,1449,1450,1436,1451,1452,1453,1446,1454,1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1364],[1945,1946,1947,1948,1949,1950,1951,1952],{"_935":49,"_49":1487},{"_935":1476,"_188":525,"_981":1485,"_982":1486},{"_935":1476,"_188":525,"_981":1483,"_982":1484},{"_935":49,"_49":1482},{"_935":1476,"_188":525,"_981":1480,"_982":1481},{"_935":49,"_49":1479},{"_935":1476,"_188":525,"_981":1477,"_982":1478},{"_935":49,"_49":1475},[2327,2328,2329],[],{"_940":941,"_49":942,"_943":944},{"_915":2318},{"_380":2317},{"_380":2008},{"_349":264,"_339":350,"_351":352,"_353":62,"_354":18,"_355":18,"_356":357,"_358":359,"_360":311,"_361":131,"_362":363,"_364":133,"_365":366,"_367":-5,"_368":-5,"_369":2007,"_371":372,"_373":374,"_375":376,"_377":378},{"_45":127,"_238":239,"_240":241,"_242":18,"_243":244,"_245":246,"_247":1996,"_249":-5,"_250":-5,"_251":18,"_252":1997,"_254":244,"_255":244,"_256":1998,"_258":1999,"_260":2000,"_262":-5,"_263":264,"_265":266,"_267":268,"_269":2001,"_58":-5,"_123":271,"_272":2002,"_274":2003,"_276":277,"_278":18,"_279":18},{"_137":1991},[1963,1964,1965,1966,1967,1968,1969,1970,1971,1972,1973,1974,1975,1976,1977,1978,1979,1980,1981,1982,1983,1984,1985,1986,1987,1988,1989,1990],{"_174":222,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":221,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":220,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":219,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":218,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":217,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":216,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":215,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":213,"_176":177,"_178":179,"_180":190,"_182":214,"_184":185,"_186":35,"_188":-5},{"_174":210,"_176":177,"_178":179,"_180":211,"_182":212,"_184":185,"_186":35,"_188":-5},{"_174":209,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":208,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":207,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":205,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":206,"_188":-5},{"_174":204,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":203,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":201,"_188":-5},{"_174":202,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":200,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":201,"_188":-5},{"_174":199,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":198,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":197,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":196,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":195,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":193,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":194,"_188":-5},{"_174":192,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":191,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},{"_174":189,"_176":177,"_178":179,"_180":190,"_182":183,"_184":185,"_186":35,"_188":-5},{"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":-5},[1992,1993],{"_226":1995,"_228":235},{"_226":1994,"_228":229},{"_230":231,"_96":232,"_123":233},{"_230":236,"_96":232,"_123":237},{"_341":342,"_343":344,"_345":244,"_346":-5,"_347":-5,"_348":-5},[301],{"_301":2004},{"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300},{},[],{"_282":62},{"_280":62,"_281":244},{"_45":303,"_230":304,"_305":2005,"_307":241,"_308":309,"_310":311,"_312":313,"_314":315,"_316":317,"_318":67,"_319":-5,"_320":18,"_321":62,"_322":62,"_323":62,"_324":18,"_325":-5,"_186":326,"_327":-5,"_58":2006},{"_333":334,"_45":335,"_96":336,"_337":338,"_339":340},{"_329":62,"_330":18,"_331":62,"_332":62},{"_333":334,"_230":334,"_379":-5,"_337":338,"_45":335},[2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021,2022,2023,2024,2025,2026,2027,2028,2029,2030,2031,2032,2033,2034,2035,2036,2037,2038,2039,2040,2041,2042,2043,2044,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,2055,2056,2057,2058,2059,2060,2061,2062,2063,2064,2065,2066,2067,2068,2069,2070,2071,2072,2073,2074,2075,2076,2077,2078,2079],{"_180":884,"_454":2313},{"_180":463,"_454":2309},{"_180":463,"_454":2305},{"_180":463,"_454":2301},{"_180":862,"_454":2298},{"_180":463,"_454":2294},{"_180":477,"_454":2289},{"_180":477,"_454":2285},{"_180":463,"_454":2281},{"_180":463,"_454":2279},{"_180":477,"_454":2274},{"_180":463,"_454":2272},{"_180":477,"_454":2268},{"_180":463,"_454":2264},{"_180":463,"_454":2262},{"_180":477,"_454":2258},{"_180":463,"_454":2256},{"_180":477,"_454":2252},{"_180":463,"_454":2248},{"_180":463,"_454":2246},{"_180":477,"_454":2242},{"_180":463,"_454":2240},{"_180":477,"_454":2236},{"_180":463,"_454":2232},{"_180":463,"_454":2230},{"_180":477,"_454":2226},{"_180":463,"_454":2224},{"_180":477,"_454":2220},{"_180":463,"_454":2216},{"_180":463,"_454":2214},{"_180":463,"_454":2210},{"_180":477,"_454":2205},{"_180":463,"_454":2203},{"_180":477,"_454":2199},{"_180":463,"_454":2195},{"_180":463,"_454":2193},{"_180":477,"_454":2189},{"_180":463,"_454":2187},{"_180":477,"_454":2183},{"_180":463,"_454":2179},{"_180":463,"_454":2177},{"_180":477,"_454":2173},{"_180":463,"_454":2171},{"_180":477,"_454":2167},{"_180":463,"_454":2163},{"_180":463,"_454":2161},{"_180":477,"_454":2157},{"_180":463,"_454":2155},{"_180":477,"_454":2151},{"_180":463,"_454":2148},{"_180":463,"_454":2146},{"_180":477,"_454":2141},{"_180":463,"_454":2139},{"_180":477,"_454":2135},{"_180":463,"_454":2131},{"_180":463,"_454":2129},{"_180":477,"_454":2122},{"_180":463,"_454":2120},{"_180":477,"_454":2116},{"_180":463,"_454":2113},{"_180":463,"_454":2111},{"_180":477,"_454":2107},{"_180":463,"_454":2105},{"_180":463,"_454":2103},{"_180":477,"_454":2099},{"_180":463,"_454":2097},{"_180":477,"_454":2093},{"_180":463,"_454":2089},{"_180":477,"_454":2087},{"_180":463,"_454":2083},{"_180":453,"_454":2080},{"_456":457,"_91":2081},{"_107":-5,"_45":459,"_460":2082,"_462":117},[],{"_465":2084,"_456":457,"_467":459},{"_468":2085,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":97,"_96":473},[2086],{"_49":475,"_96":476},{"_465":2088,"_456":457,"_467":459},{"_45":480,"_472":-5,"_49":475,"_96":481},{"_465":2090,"_456":457,"_467":459},{"_468":-5,"_484":485,"_45":-5,"_471":-5,"_486":2091,"_96":488},[2092],{"_49":490,"_96":491},{"_465":2094,"_456":457,"_467":459},{"_468":2095,"_45":495,"_486":2096,"_96":488},[],[490],{"_465":2098,"_456":457,"_467":459},{"_499":500,"_45":-5,"_471":-5,"_501":502,"_96":503},{"_465":2100,"_456":457,"_467":459},{"_506":507,"_508":509,"_510":2101,"_512":513,"_514":515,"_516":35,"_45":500,"_517":518,"_519":520,"_462":117,"_96":521},[2102],{"_508":523,"_230":524,"_188":525,"_96":526},{"_465":2104,"_456":457,"_467":459},{"_529":530,"_499":500,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2106,"_456":457,"_467":459},{"_499":536,"_45":-5,"_471":-5,"_501":537,"_96":503},{"_465":2108,"_456":457,"_467":459},{"_506":540,"_508":541,"_510":2109,"_512":513,"_514":515,"_516":35,"_45":536,"_517":543,"_519":520,"_462":117,"_96":521},[2110],{"_508":545,"_230":524,"_188":525,"_96":526},{"_465":2112,"_456":457,"_467":459},{"_529":548,"_499":536,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2114,"_456":457,"_467":459},{"_468":-5,"_484":551,"_45":-5,"_471":-5,"_486":2115,"_96":488},[],{"_465":2117,"_456":457,"_467":459},{"_468":2118,"_45":556,"_486":2119,"_96":488},[],[],{"_465":2121,"_456":457,"_467":459},{"_499":560,"_45":-5,"_471":-5,"_501":561,"_96":503},{"_465":2123,"_456":457,"_467":459},{"_564":-5,"_529":2124,"_514":566,"_107":-5,"_45":560,"_567":-5,"_568":-5,"_569":-5,"_570":2125,"_572":573,"_462":117,"_574":573,"_96":575},{"_356":580,"_358":581},{"_576":-5,"_468":2126,"_578":2127},[2128],{"_356":580,"_358":581},{"_49":583,"_96":49},{"_465":2130,"_456":457,"_467":459},{"_529":561,"_499":560,"_45":-5,"_471":-5,"_230":586,"_532":-5,"_96":533},{"_465":2132,"_456":457,"_467":459},{"_468":-5,"_484":589,"_45":-5,"_471":-5,"_486":2133,"_96":488},[2134],{"_49":592,"_96":491},{"_465":2136,"_456":457,"_467":459},{"_468":2137,"_45":596,"_486":2138,"_96":488},[],[592],{"_465":2140,"_456":457,"_467":459},{"_499":600,"_45":-5,"_471":-5,"_501":601,"_96":503},{"_465":2142,"_456":457,"_467":459},{"_506":604,"_508":605,"_510":2143,"_512":513,"_514":607,"_516":35,"_45":600,"_517":608,"_519":520,"_462":117,"_96":521},[2144,2145],{"_508":613,"_96":612},{"_508":611,"_96":612},{"_465":2147,"_456":457,"_467":459},{"_529":616,"_499":600,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2149,"_456":457,"_467":459},{"_468":-5,"_484":619,"_45":-5,"_471":-5,"_486":2150,"_96":488},[],{"_465":2152,"_456":457,"_467":459},{"_468":2153,"_45":624,"_486":2154,"_96":488},[],[],{"_465":2156,"_456":457,"_467":459},{"_499":628,"_45":-5,"_471":-5,"_501":629,"_96":503},{"_465":2158,"_456":457,"_467":459},{"_506":632,"_508":633,"_510":2159,"_512":513,"_514":635,"_516":35,"_45":628,"_517":636,"_519":520,"_462":117,"_96":521},[2160],{"_508":638,"_96":612},{"_465":2162,"_456":457,"_467":459},{"_529":641,"_499":628,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2164,"_456":457,"_467":459},{"_468":-5,"_484":644,"_45":-5,"_471":-5,"_486":2165,"_96":488},[2166],{"_49":647,"_96":491},{"_465":2168,"_456":457,"_467":459},{"_468":2169,"_45":651,"_486":2170,"_96":488},[],[647],{"_465":2172,"_456":457,"_467":459},{"_499":655,"_45":-5,"_471":-5,"_501":656,"_96":503},{"_465":2174,"_456":457,"_467":459},{"_506":-5,"_508":659,"_510":2175,"_512":513,"_514":661,"_516":35,"_45":655,"_517":662,"_519":520,"_462":117,"_96":521},[2176],{"_508":664,"_96":612},{"_465":2178,"_456":457,"_467":459},{"_529":667,"_499":655,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2180,"_456":457,"_467":459},{"_468":-5,"_484":670,"_45":-5,"_471":-5,"_486":2181,"_96":488},[2182],{"_49":673,"_96":491},{"_465":2184,"_456":457,"_467":459},{"_468":2185,"_45":677,"_486":2186,"_96":488},[],[673],{"_465":2188,"_456":457,"_467":459},{"_499":681,"_45":-5,"_471":-5,"_501":682,"_96":503},{"_465":2190,"_456":457,"_467":459},{"_506":685,"_508":686,"_510":2191,"_512":513,"_514":515,"_516":35,"_45":681,"_517":688,"_519":520,"_462":117,"_96":521},[2192],{"_508":690,"_96":612},{"_465":2194,"_456":457,"_467":459},{"_529":693,"_499":681,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2196,"_456":457,"_467":459},{"_468":-5,"_484":696,"_45":-5,"_471":-5,"_486":2197,"_96":488},[2198],{"_49":699,"_96":491},{"_465":2200,"_456":457,"_467":459},{"_468":2201,"_45":703,"_486":2202,"_96":488},[],[699],{"_465":2204,"_456":457,"_467":459},{"_499":707,"_45":-5,"_471":-5,"_501":708,"_96":503},{"_465":2206,"_456":457,"_467":459},{"_711":2207,"_45":707,"_462":117,"_96":713},[2208],{"_368":715,"_9":2209,"_188":717},{"_718":-5,"_96":719},{"_465":2211,"_456":457,"_467":459},{"_468":2212,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[2213],{"_49":724,"_96":725},{"_465":2215,"_456":457,"_467":459},{"_529":728,"_499":707,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2217,"_456":457,"_467":459},{"_468":-5,"_484":731,"_45":-5,"_471":-5,"_486":2218,"_96":488},[2219],{"_49":734,"_96":491},{"_465":2221,"_456":457,"_467":459},{"_468":2222,"_45":738,"_486":2223,"_96":488},[],[734],{"_465":2225,"_456":457,"_467":459},{"_499":742,"_45":-5,"_471":-5,"_501":743,"_96":503},{"_465":2227,"_456":457,"_467":459},{"_506":746,"_508":747,"_510":2228,"_512":513,"_514":749,"_516":35,"_45":742,"_517":750,"_519":520,"_462":117,"_96":521},[2229],{"_508":752,"_96":612},{"_465":2231,"_456":457,"_467":459},{"_529":755,"_499":742,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2233,"_456":457,"_467":459},{"_468":-5,"_484":758,"_45":-5,"_471":-5,"_486":2234,"_96":488},[2235],{"_49":761,"_96":491},{"_465":2237,"_456":457,"_467":459},{"_468":2238,"_45":765,"_486":2239,"_96":488},[],[761],{"_465":2241,"_456":457,"_467":459},{"_499":769,"_45":-5,"_471":-5,"_501":770,"_96":503},{"_465":2243,"_456":457,"_467":459},{"_506":773,"_508":774,"_510":2244,"_512":513,"_514":515,"_516":35,"_45":769,"_517":776,"_519":520,"_462":117,"_96":521},[2245],{"_508":778,"_230":524,"_188":525,"_96":526},{"_465":2247,"_456":457,"_467":459},{"_529":781,"_499":769,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2249,"_456":457,"_467":459},{"_468":-5,"_484":784,"_45":-5,"_471":-5,"_486":2250,"_96":488},[2251],{"_49":787,"_96":491},{"_465":2253,"_456":457,"_467":459},{"_468":2254,"_45":791,"_486":2255,"_96":488},[],[787],{"_465":2257,"_456":457,"_467":459},{"_499":795,"_45":-5,"_471":-5,"_501":796,"_96":503},{"_465":2259,"_456":457,"_467":459},{"_506":799,"_508":800,"_510":2260,"_512":513,"_514":515,"_516":35,"_45":795,"_517":802,"_519":520,"_462":117,"_96":521},[2261],{"_508":804,"_230":524,"_188":525,"_96":526},{"_465":2263,"_456":457,"_467":459},{"_529":807,"_499":795,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2265,"_456":457,"_467":459},{"_468":-5,"_484":810,"_45":-5,"_471":-5,"_486":2266,"_96":488},[2267],{"_49":813,"_96":491},{"_465":2269,"_456":457,"_467":459},{"_468":2270,"_45":817,"_486":2271,"_96":488},[],[813],{"_465":2273,"_456":457,"_467":459},{"_499":821,"_45":-5,"_471":-5,"_501":822,"_96":503},{"_465":2275,"_456":457,"_467":459},{"_506":825,"_508":826,"_510":2276,"_512":513,"_514":515,"_516":35,"_45":821,"_517":828,"_519":520,"_462":117,"_96":521},[2277,2278],{"_508":833,"_96":612},{"_508":831,"_188":-5,"_96":832},{"_465":2280,"_456":457,"_467":459},{"_529":836,"_499":821,"_45":-5,"_471":-5,"_230":531,"_532":-5,"_96":533},{"_465":2282,"_456":457,"_467":459},{"_468":-5,"_484":839,"_45":-5,"_471":-5,"_486":2283,"_96":488},[2284],{"_49":842,"_96":491},{"_465":2286,"_456":457,"_467":459},{"_468":2287,"_45":846,"_486":2288,"_96":488},[],[842],{"_465":2290,"_456":457,"_467":459},{"_850":-5,"_468":2291,"_45":852,"_96":853},[2292],{"_49":855,"_856":2293,"_96":49},[],{"_465":2295,"_456":457,"_467":459},{"_468":2296,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[2297],{"_49":855,"_96":725},{"_456":457,"_91":2299},{"_107":-5,"_45":459,"_460":2300,"_462":866},[],{"_465":2302,"_456":457,"_467":869},{"_468":2303,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[2304],{"_49":872,"_96":725},{"_465":2306,"_456":457,"_467":869},{"_468":2307,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":369,"_96":473},[2308],{"_49":877,"_96":725},{"_465":2310,"_456":457,"_467":869},{"_468":2311,"_470":-5,"_45":-5,"_471":-5,"_472":-5,"_100":881,"_96":473},[2312],{"_49":883,"_96":725},{"_886":2314},{"_888":-5,"_889":-5,"_890":891,"_892":893,"_512":513,"_894":18,"_895":-5,"_896":-5,"_897":2315,"_899":900,"_45":457,"_901":902,"_230":-5,"_903":-5,"_188":904,"_905":244,"_906":-5,"_519":907,"_462":-5,"_908":-5,"_81":2316,"_910":893},{"_130":911,"_912":-5,"_913":133},[],[],[2319],{"_45":918,"_919":2320,"_921":922,"_923":922,"_468":2321,"_462":925,"_470":-5,"_926":35,"_927":2322,"_929":344,"_930":-5},{"_100":369,"_230":-5,"_927":2326},{"_935":49,"_936":2325},{"_931":2323},{"_933":2324},[],[938],{},{"_96":473,"_100":97,"_468":2337},{"_96":972,"_973":2332},{"_96":948,"_949":950,"_951":952,"_953":2330,"_955":-5},{"_96":953,"_956":513,"_132":133,"_957":-5,"_368":958,"_959":2331,"_961":372,"_962":963,"_964":965,"_966":967,"_968":-5},{"_969":970,"_971":-5},[2333],{"_188":525,"_976":-5,"_977":2334,"_979":-5},[2335],{"_981":372,"_982":983,"_468":2336,"_985":62},[986,244,987,988,989,990,244,991,244,992,993,994,995,996,244,997,998,999,244,1000,1001,1002,1003,1004,1005,244,1006,1007,1008,1009,1010,244,1011,1012,1013,1014,1015,1016,244,1017,244,1018,1019,1020,1021,1022,1023,1024,244,1025,1026,1027,1028,244,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,244,1039,244,1040,1041,1042,1043,1044,1045,1046,1047,1048,1038,244,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,244,1067,1068,244,244,1069,1070,244,1071,1072,1073,1074,244,1075,1076,1077,1078,244,1079,1080,1081,1082,1083,1084,1085,244,1086,1087,244,1088,1089,1090,1091,1092,1093,1094,244,1095,1096,1097,1098,1099,1100,1101,1102,1103,244,244,1104,1105,1106,244,1107,1108,1109,1082,1110,244,244,1104,1111,1112,244,1107,1113,1109,244,1114,1115,1116,1117,1118,1119,1082,1120,1121,1122,1123,244,1124,1125,1126,1127,1128,1129,244,1130,244,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,244,1145,1146,1147,1148,1149,1150,1151,244,244,1152,1153,244,1154,244,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,244,244,1166,1167,1168,1169,244,1170,1171,1082,1172,1173,244,1174,1175,1176,1177,1178,1179,244,1180,1181,1182,1183,1184,1185,1186,1187,1188,244,1189,1095,1190,1097,1191,1192,1101,1103,1193,244,244,1194,1195,1168,1196,244,1197,1198,1199,244,1200,1082,1201,1202,1203,1204,1205,1206,1207,1208,1094,1209,244,1210,1211,1212,1213,244,1214,1215,244,1216,1217,1218,1219,1220,1143,1221,244,1201,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233,1234,1235,244,1236,244,1237,1238,1239,1240,244,1241,1242,1243,1244,244,1245,1246,1247,1248,1249,1250,1094,1251,244,1252,1253,1254,1255,1256,1257,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,244,244,1273,1274,244,1275,1276,1082,1201,1277,1278,1279,1280,1281,1282,1283,1284,1285,1237,1286,1242,1243,1287,1288,1248,1289,1094,1290,1291,1292,244,244,1293,1294,244,1295,1296,244,1297,1298,1299,1082,1300,1301,244,244,1302,1303,244,1304,1305,1082,1306,244,244,1307,1308,1309,1310,1311,244,244,1312,1313,244,1314,1315,1316,1082,1317,244,1318,1319,1320,1321,1322,1323,1324,244,1325,1326,1327,1328,1329,1330,1331,1328,1332,1333,1334,1328,1201,1335,1336,1337,244,1338,1339,1340,1341,1342,1343,1344,1345,1346,1347,1348,244,244,1349,1350,244,1351,1352,1353,1354,1082,244,1355,1156,1356,1357,1358,1359,1360,1361,1362,1363,1364,244,1365,1366,1367,1368,244,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1386,1387,1395,1396,1397,1398,1399,1400,1401,244,1402,1403,1404,1405,1406,1407,1408,1409,1410,1401,1411,1412,1413,1414,1415,1416,1383,1417,1418,1393,1386,1419,1420,1421,1422,1387,1423,1424,1425,1426,1401,1427,1428,1429,1430,1400,1401,1431,1397,1432,1433,1400,1401,244,1434,1435,1436,1437,1438,1439,1440,1441,1442,1443,1444,1387,1445,1446,244,1447,1435,1448,1449,1450,1436,1451,1452,1453,1446,1454,1455,1456,1457,1458,1459,1460,1461,1462,1463,1464,1465,1364],[2338,2339,2340,2341,2342,2343,2344,2345],{"_935":49,"_49":1487},{"_935":1476,"_188":525,"_981":1485,"_982":1486},{"_935":1476,"_188":525,"_981":1483,"_982":1484},{"_935":49,"_49":1482},{"_935":1476,"_188":525,"_981":1480,"_982":1481},{"_935":49,"_49":1479},{"_935":1476,"_188":525,"_981":1477,"_982":1478},{"_935":49,"_49":1475},[2348,2349,2350,2351,2352,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363],{"_1497":1498,"_307":241,"_1499":264,"_318":-5,"_956":301,"_1500":-5,"_1501":-5,"_1502":1503,"_1504":948,"_1505":-5,"_1506":-5,"_1507":1508,"_1509":18,"_1510":62,"_1511":57,"_1512":18,"_1513":-5},{"_96":473,"_100":369,"_468":2364},{"_356":357,"_358":359,"_1554":363,"_1555":133,"_365":-5,"_96":1556},{"_96":1530,"_358":1552,"_188":525,"_1533":1534,"_1535":1553},{"_96":1530,"_358":1551,"_188":1542,"_1533":1534,"_1535":1544},{"_96":1530,"_358":1550,"_188":1542,"_1533":1534,"_1535":1543},{"_96":1530,"_358":1549,"_188":1540,"_1533":1534,"_1535":1541},{"_96":1530,"_358":1548,"_188":525,"_1533":1534,"_1535":1539},{"_96":1530,"_358":1547,"_188":1537,"_1533":1534,"_1535":1538},{"_96":1530,"_358":1546,"_188":1532,"_1533":1534,"_1535":1536},{"_96":1530,"_358":1545,"_188":-5,"_1533":-5,"_1535":-5},{"_96":1530,"_358":1531,"_188":1542,"_1533":1534,"_1535":1544},{"_96":1530,"_358":1531,"_188":1542,"_1533":1534,"_1535":1543},{"_96":1530,"_358":1531,"_188":1540,"_1533":1534,"_1535":1541},{"_96":1530,"_358":1531,"_188":525,"_1533":1534,"_1535":1539},{"_96":1530,"_358":1531,"_188":1537,"_1533":1534,"_1535":1538},{"_96":1530,"_358":1531,"_188":1532,"_1533":1534,"_1535":1536},[2365],{"_935":49,"_49":1559},"task_e_69a8a706b7b0832f9238f2f7bfbc5ebd",1772660486.717694,"Github Mention: feat: Sprint 29A-D — 27 multi-model audit fixes (security, reliabilit…","has_generated_title","has_unread_turn","denormalized_metadata",{"_2397":35,"_2398":2399,"_2400":-5,"_2401":-5,"_2391":2402,"_2403":-5,"_2404":-5,"_2405":-5,"_2406":-5},"task_status_display",{"_2385":2386,"_2387":241,"_134":131,"_2388":-5,"_2389":948},"creator_workspace","external_pull_requests",[2378],{"_45":2379,"_2380":87,"_2381":2382,"_2383":133},"github-1155572075-5","assistant_turn_id","pull_request",{"_349":264,"_339":350,"_351":352,"_353":62,"_354":18,"_355":18,"_356":357,"_358":359,"_360":311,"_361":131,"_362":363,"_364":133,"_365":366,"_367":-5,"_368":-5,"_369":2384,"_371":372,"_373":374,"_375":376,"_377":378},"codex_updated_sha",{"_333":334,"_230":334,"_379":-5,"_337":338,"_45":335},"latest_turn_status_display",{"_2390":87,"_116":117,"_2391":2392,"_98":2393,"_2394":-5,"_2395":-5,"_2396":948,"_118":-5},"environment_label","fix_task_id","initial_intent","turn_id","diff_stats",{"_961":372,"_962":963,"_964":965},[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_961":-5,"_962":-5,"_964":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","dd",{"_2421":2422,"_2423":2424},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","manageRootRouteStylesheet","mobileWebHandoffEnabled","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",2420],"traceId","11694981904097301159","traceTime",1787638183430]