[khanhkit]

Summary

• closes the non-Antigravity slice of AP-ISS-0202 with independent reproductions and minimal fixes across MITM byte/sudo handling, request lifecycle, UI/timeline state, key resolution, visibility, model-sync lifecycle, API-key quota reservation, abort classification, provider quota URLs, and combo PATCH validation
• records current-contract / not-reproducible dispositions instead of changing deliberate behavior
• intentionally withholds the src/mitm/handlers/antigravity.ts finding until AP-ISS-0199 / PR fix(security): close OAuth and proxy audit findings #138 is accepted, preserving the security-first overlap ordering

Routed finding dispositions

• 4233409466 Antigravity dynamic catalog: reproduced; cache fix remains fenced and is not present in this PR yet, pending fix(security): close OAuth and proxy audit findings #138
• 4233409492 + 4233409512 MITM split UTF-8 / byte-cap accounting: fixed
• 4233409525 sudo fallback password/data replay: fixed fail-closed
• 4233409583 provenance i18n namespace: fixed
• 4233409607 DashboardLayout legacy E2E env: fixed
• 4233409748 reasoning editor parent-key resync: fixed with keyed state boundary
• 4233409769 + 4233409788 + 4233409825 timeline timestamp/key-id/createdAt mapping: fixed
• 4233409838 endpoint alias canonicalization: terminal non-defect at current base; canonicalization/authz regression suite is green
• 4233409865 MCP scope default: terminal deliberate compatibility contract; operator opt-in remains explicit
• 4233409908 Dev Tools visibility: terminal deliberate #14021 discoverability behavior
• 4233409945 step-3.7-flash vision capability: terminal deliberate #13847 capability contract
• 4233409978 pending admission abort body: fixed/cancelled
• 4233409999 RFC1918 LAN classified as loopback: fixed
• 4233410019 malformed embedded IPv4: terminal non-reproducible; Node-parity ipVersion rejects malformed dotted tails before parsing
• 4233410077 Codex visibility case normalization: fixed
• 4233410108 model-sync startup timer cancellation: fixed; test async-tail interference also contained
• 4233410155 concurrent key quota overshoot: fixed with atomic SQLite reservation + completion reconciliation
• 4233410200 + 4233410244 over-broad abort/fetch-failed swallowing: fixed
• 4233410268 provider quota whitespace URL: fixed
• 4233410294 timeout margin: terminal non-defect; test-only invariant proves active-stream timeout covers every registered model timeout
• 4233410327 overrideAllowedProviders-only combo PATCH: fixed
• summary-apiKeyResolver explicit selected key fallback: fixed fail-closed
• summary-proxy-scopeId: terminal already-fixed; scopeId required across all five scoped schemas and DB guards

Verification on current immutable pushed SHA

• head: 323d805c2f477f76d7cc83ac3d1833ecaa9b8d69
• fresh selected Node regressions on rebased parent head: 173/173 pass
• CallContentProvenanceBadges Vitest: 3/3 pass
• node scripts/check/check-api-typecheck.mjs: pass after restoring the accidentally deleted local StepResult type alias (276 frozen-baseline diagnostics, 0 new)
• API typecheck gate unit tests: 16/16 pass
• sudo password/replay focused behavior: 5/5 pass
• npm run typecheck:core: pass on rebased parent head
• npm run check:open-sse-typecheck: 0 errors on rebased parent head
• npm run check:dashboard-typecheck: pass within frozen baseline (196 pre-existing errors; no new errors)
• ESLint: changed files pass, including the final systemCommands.ts repair
• npm run check:fetch-targets: pass
• npm run check:test-masking: pass / non-PR diff scan not applicable, absolute tautology scan OK
• npm run check:secrets: graceful skip because gitleaks is absent; hosted CI remains authoritative
• git diff --check: pass after the final repair

Ordering / next step

This PR remains intentionally draft while AP-ISS-0199 PR #138 is open. After #138 lands, rebase/compose the Antigravity cache fix on top of the accepted security change, rerun focused + quality gates on the new immutable SHA, then make this PR ready for review.