Orion Studio — Review (P5, stage: REVIEW)

Owner: review agent. 5 lenses (staff-eng · UX · art-dir · a11y · perf) run in parallel against

the verified v1 slice (commits efdb1d6 · afe10e5 · d10949f). Plus a prior automated security

review of the auth commit. This file records findings, severity, and resolution. Fixes landed

in the REVIEW-fixes commit; deferred items are tied to D-1/D-2/D-3 infra and tracked in tasks.md.

Verdict

Ship the slice (fixtures). Two correctness blockers and a cluster of a11y/brand findings were

fixed; the rest are deferred with reason. 33 tests green, JS 6.9 KB / 60 KB.

Fixed (this review)

staff-eng (correctness)

[CRITICAL] SSE route shadowed — /api/runs/stream declared after /runs/{trace_id} → the

push path was dead (always polled). Fixed: reordered; regression test test_stream_route_not_shadowed.

[CRITICAL] Uncaught ValidationError/JSONDecodeError from the observe client → raw 500 +

killed the SSE generator. Fixed: _UPSTREAM_ERRORS now includes both in routes + SSE → calm 503.

[HIGH] py_webauthn .parse_raw removed in Pydantic v2 → first real passkey registration

would AttributeError. Fixed: model_validate_json (register + login).

[HIGH] HttpObserveClient leak — new httpx.AsyncClient per request/SSE tick in live mode.

Fixed: process-cached client (_cached_client).

[HIGH] session.verify() wrote to disk every request (prune-on-verify) — I/O on the event

loop per SSE tick. Fixed: verify is now read-only + inline expiry; prune only on create().

[HIGH] mutable default metadata: dict = {} → Field(default_factory=dict).
[MEDIUM] list_products walked .venv (1000s of files) on the event loop. Fixed:

os.walk pruning _SKIP_DIRS.

perf

[HIGH] SSE onerror could spawn duplicate poll loops. Fixed: poll starts once

(polling guard), handler nulled on close.

[LOW] trace.js bounds() spread into Math.min/max → stack overflow on 500+ steps.

Fixed: reduce.

a11y

[HIGH] silent SSE updates not announced. Fixed: polite #sr-status live region,

announces concise summary on change only.

[HIGH] color-only status (dot was aria-hidden, hue-only). Fixed: SR-only status word

per row + failed = ring shape (not just ember hue).

[HIGH] model_used at 3.1:1 body text. Fixed: --ink-dim (6.5:1).
[MEDIUM] no <h1> / page heading. Fixed: visually-hidden <h1>.
[MEDIUM] tri-state nav aria-pressed inconsistency + selected-run had no visible mark.

Fixed: view reset on nav switch; .run[aria-pressed="true"] style.

Reduced-motion: explicit .dot { animation: none } added.

UX

[HIGH] "connecting…" could stick forever if SSE connects but never emits. Fixed:

watchdog falls back to polling after pollMs*2.

[HIGH] PRISM nav bled the selected run's trace into the factory view; selectedId never

reset; SSE tick clobbered the PRISM sidebar. Fixed: nav handlers reset selection + clear

main; onRuns no-ops unless the Orion view is active.

art-dir (brand)

[HIGH] emoji rail icons violated brand §6 (hairline geometric glyphs). Fixed: inline

1.5px-stroke SVG glyphs (ring / prism / terminal).

[MEDIUM] multi-amber ration leak — N live runs/gates = N breathing dots, breaking the ≤1

thesis. Fixed: only the top live run breathes; others static amber; PRISM gates = steady

amber gate state (distinct from running).

[LOW] grain texture (§6) missing. Fixed: ~2.5% SVG-noise overlay.
P3 reconcile: brand §4 "sliding hairline focus" → amber :focus-visible outline (updated in

brand.md); §6 grain now implemented.

security (prior automated review of T05)

[CRITICAL] open registration → account takeover. Fixed: first-run-only registration.
[HIGH] challenge not session-bound + shared pool. Fixed: HttpOnly flight cookie, separate

[MEDIUM] TOCTOU world-readable window. Fixed: write_secret_0600 via os.open(…,0o600).

Deferred (with reason — not silently dropped)

[MEDIUM] SSE not re-mounted after login (staff-eng). Tied to remote-auth flow; revisit with

the login shell when remote mode is exercised (D-3).

[MEDIUM] iframe focus-trap / no escape affordance + **[LOW] no calm placeholder behind the

terminal (a11y/UX). Both are T10 (terminal) surface** — deferred until the ttyd+Tailscale VPS

exists (D-3); will be addressed when T10 is built and verifiable.

[LOW] .wf-bar graphic ~3:1 at the line (a11y). Minor; nudge bar color if it regresses.
AC-Calm (≤1 accent/viewport automated scan) and AC-Trust live-tier (zero-drift vs live

API) and AC-Sec-1 (port scan) require a browser / live Observe API / VPS respectively —

run at D-1/D-3 cutover (documented in spec §5, tasks.md).

Lens verdicts

staff-eng: fix-first → fixed. perf: ship after 2 fixes → fixed. a11y: not-conformant →

now AA on text, non-color cues added. art-dir: on-brand (minor) → leaks closed. UX:

calm discipline good, 2 bugs → fixed.