fix(mwpw-184989): send x-session-id to the LLM proxy and stop Feature QA failing silently

[sanrai]

What broke

On #591 the deterministic layer worked perfectly — build-output-diff published NO_CHANGE and review-score-gate auto-passed the PR with auto-pass: deps-dev + build-output-diff NO_CHANGE (bundle byte-identical).

No agent ever said so. Feature QA Review — the one wired to report exactly that — died at its first LLM call (run 32946357057, job 98107789143):

[llm] transport attempt 1 failed: HTTP 403: {"error":{"type":"missing_required_header","message":"Missing required header: x-session-id"}}
[llm] transport attempt 2 failed: HTTP 403: ... (same)
[llm] transport attempt 3 failed: HTTP 403: ... (same)
feature-review error: Error: llm failed after retries
    at llm (feature-review.mjs:156:9)
    at async feature-review.mjs:306:18

The proxy started requiring x-session-id. Only qa-runner-v2.mjs ever sent it — which is why Agent QA Review kept working (it shells out to that runner) while every direct caller began 403ing.

Then .catch(e => { console.error(...); process.exit(0) }) at the bottom of feature-review.mjs turned the crash into a green job with no comment and no notification. Nothing anywhere said the run had failed.

What this changes

1. Send the header. x-session-id (one randomUUID() per process, same shape as qa-runner-v2.mjs) added to all eight direct proxy callers:

feature-review.mjs · feature-backtest-worker.mjs · feature-backtest-batch.mjs · action-judge.mjs · ai-judge-test.mjs · mobile-probe.mjs · plan-probe.mjs · aggregate-report.mjs

2. Stop gating a deterministic fact behind a model. bundleDiffVerdict() is a commit-status read over the REST API — it needs no LLM at all. But it only runs after the triage LLM call, so a dead proxy took the bundle-diff report down with it. The triage call is now wrapped: on transport failure the agent falls through to postNonInjectable() and still reports SAFE (no bundle change) or NEEDS REVIEW (bundle changed).

That alone would have given #591 the comment it should have had.

3. Make silent outages visible. feature-review.mjs now writes a FEATURE_REVIEW_FAILED marker on an unhandled error, and qa-feature-review.yml logs it to the shared CI: AI / Agent review tool failures issue — the same monitor qa-agent-review.yml has had all along. The PR check still stays green; the failure just stops being invisible.

Notes

• No product code touched — .github/qa/ and one workflow only.
• .github/qa/ is outside the npm run lint path (react/src/js/components/Consonant), so no lint impact.
• No new module, so qa-feature-review.yml's explicit reviewer copy-list is unchanged.
• Verified with node --check across .github/qa/*.mjs and a YAML parse of the workflow.

Testing

The real check is the next run of this workflow on any PR: Feature QA Review should post a comment again instead of finishing green and silent. Worth a workflow_dispatch against #591 once this lands.

[github-actions]

Agent QA review — interactive + visual diff (advisory, non-blocking)

Last updated Aug 26, 2026, 1:54 AM PDT · PR opened · commit 69f4658 · 9 files changed.

0 open · 0 resolved · visual diff 0.00% · verdict PASS

Open findings

• Smoke test passed ✅

What the agent checked

Tested PR #600 against the live business.adobe.com/resources/main.html CaaS collection.

Context: PR #600 is a CI/QA-tooling-only change (adds x-session-id header to internal LLM-proxy callers in .github/qa/*.mjs scripts and the qa-feature-review workflow). It does not touch any frontend/CaaS rendering code. This matches what I observed: the supplied pixel diff (diff.png) showed no magenta/colored regions and 0.00% pixel difference between PR build and stable build — i.e., no visual/functional change is expected on the actual page.

What I did on the live page:

1. Loaded https://business.adobe.com/resources/main.html — page rendered fully, hero, breadcrumb, "Explore all Adobe resources" heading, filter rail, and card grid all displayed correctly, no console errors on initial load.
2. Opened the "Refine Your Results" filter panel (Search, Products, Content Type, Industry accordions) — all controls present and clickable via get_interactives.
3. Typed "AI" into the Search filter box — input accepted text and rendered a clear ("x") button correctly, filter panel styling remained intact. Result count did not visibly update within the observed window (still showed 3843 results) — this appears to be pre-existing site search/debounce behavior unrelated to this PR's tooling-only change scope, not something introduced by PR fix(mwpw-184989): send x-session-id to the LLM proxy and stop Feature QA failing silently #600.
4. Cleared the search filter via the "Clear Search filter" button — input reset cleanly, panel re-rendered correctly.
5. Expanded the "Industry" accordion — chevron rotated, checkbox list (Automotive and Mobility, Consumer Goods, Financial Services, Government, Healthcare, High-Tech, Manufacturing, Media and Entertainment, Retail, ...) rendered with proper spacing/alignment, no overlap or truncation.
6. Cards grid (thumbnails, titles, descriptions, CTAs like "Watch now"/"Read now", "UPCOMING" badge) all rendered correctly and aligned in a 2-column grid with no layout breakage.
7. Ran axe-core accessibility audit scoped to the LeftFilters panel: 0 violations, 22 passes.
8. Checked console errors: only a benign "Permissions policy violation: unload is not allowed in this document" message appeared, which is a known browser/embed-policy notice unrelated to this PR and not a functional error.

Conclusion: No visual or functional regressions were found on the live page attributable to PR #600. This is expected since the PR only modifies GitHub Actions QA/CI scripts (adding an x-session-id header to LLM proxy calls and fixing silent failure in feature-review.mjs) — it does not touch any block/component code that renders on business.adobe.com. The filter panel, search box, industry accordion, and card grid all function and render as expected, matching stable behavior. No layout breakage, no accessibility violations, no console errors introduced.

Verdict: PASS — the PR's actual code changes are CI-tooling only and correctly produce zero rendering impact on the live page, consistent with the 0.00% pixel diff. All interactive elements tested (search, filter accordions, clear buttons, card grid) work as expected with no regressions.

PR / stable / diff screenshots + console + axe artifacts in the workflow run.

Review history (1 run)

• 69f4658 · Aug 26, 2026, 1:54 AM PDT · PR opened · passing, no regressions — fix(mwpw-184989): send x-session-id to the LLM proxy and sto

[github-actions]

🧪 Feature QA review — injected feature test (advisory, non-blocking)

Last updated Aug 26, 2026, 1:56 AM PT · commit 694b863 · pull_request.

Overall: SKIPPED

Not an injectable feature -- skipped.

Triage model unavailable (llm failed after retries) -- reporting the deterministic bundle diff only.

This PR's change isn't driven by config/collection data the harness can force, and the build-output-diff verdict wasn't available to consult. (The visual/smoke review still applies.)

Screenshot in the workflow run.

Review history (1 run)

• Aug 26, 2026, 1:56 AM PT · SKIPPED · 694b863 · pull_request

[github-actions]

AI Code Review

Last updated Aug 26, 2026 1:56 AM PDT · PR opened · commit 69f4658 · 9 files changed in PR.

1 open · 0 resolved · this run: +1 new

Open findings

• 🟠 Triage failure fallback doesn't actually report bundle-diff verdict 🆕
  In feature-review.mjs, the catch block around the triage llm() call posts a generic 'reporting the deterministic bundle diff only' message via postNonInjectable and immediately calls process.exit(0), but never computes or includes the actual build-output-diff verdict described in the adjacent comment, so the promised deterministic fallback is never delivered.

Review history (1 run)

• 69f4658 · Aug 26, 2026 1:56 AM PDT · PR opened · +1 new (1 open) — fix(mwpw-184989): send x-session-id to the LLM proxy and stop Feature…

[sonarqube-acom-pr-deco-public]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (91.00% Estimated after merge)
• No data about duplications (5.40% Estimated after merge)

Project ID: adobecom_caas_9e89bc21-de4f-46e2-9443-2052ced9386d

View in SonarQube