feat(coverage): add bounded PyO3 peer-evidence gate - #789
Conversation
|
Warning Review limit reached
Next review available in: 47 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
📝 WalkthroughWalkthroughPyO3/maturin 네이티브 확장 수집 실패 분류기와 안전한 증거 파일 처리를 추가했습니다. 정확한 PR HEAD의 Python·Rust·package CheckRun 성공을 검증하고, 결과를 OpenCode 승인 흐름과 품질 CI에 연결했습니다. ChangesPython 네이티브 확장 peer-gate
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant PythonTest as Python 테스트 실행
participant Classifier as classify-pytest
participant GitHub as GitHub CheckRuns
participant PeerGate as require-checks
participant Approval as OpenCode 승인 흐름
PythonTest->>Classifier: 로그·pyproject 스냅샷·변경 파일 전달
Classifier-->>PythonTest: PASS 또는 DEFERRED 모듈명
Approval->>GitHub: PR HEAD의 CheckRun 조회
GitHub-->>PeerGate: Python·Rust·package CheckRun JSON
PeerGate-->>Approval: exact-head 성공 여부
Approval-->>Approval: peer check 충족 시 승인 진행
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent address Integrate the published PyO3 native-extension helper into the protected central OpenCode coverage/review path on this same branch; keep the PR Draft until the integration is complete and exact-head evidence passes. Mirror the existing fail-closed R peer-evidence pattern rather than creating a second privileged reviewer. Required behavior:
Update the doctoring and CHANGELOG to distinguish source-only measurement, trusted native peer evidence, and remaining interpretation limits. Preserve immutable called-workflow source, reviewer credentials, NVIDIA/OpenCode model policy, independent approval, unresolved-thread, and branch-protection boundaries. |
|
@jules Implement the remaining central workflow integration on this existing Draft PR. Preserve the published helper and fail-closed trust boundary; do not create another PR or temporary workflow. Required scope:
Do not build PR-selected native code in the central sandbox, add a compatibility stub, skip product tests, use networked PR execution, change reviewer tokens or NVIDIA/OpenCode policy, weaken approval/protection gates, mark Ready, merge, or release. Commit as normal descendants without force-push, and report exact verification commands and the final head SHA. |
|
@jules Implement the remaining integration directly on this branch; do not create any temporary, self-modifying, encoded-patch, or branch-writing workflow. Required GREEN slice:
After integration, rerun OpenCode review for unchanged |
|
@jules Integrate the committed helper into the central Required fail-closed flow:
Do not build PR-selected native code inside the central sandbox, introduce a Python stub, auto-approve, weaken required checks, use COPILOT_GITHUB_TOKEN, or disturb the existing reviewer-agent secret contract. Update APA 7 doctoring and the authoritative changelog after GREEN. |
|
@coderabbitai Review the current Draft head |
Rate Limit Exceeded
|
|
Prepare the next bounded integration only after For the eventual current-main integration:
Keep Draft. Do not mutate the authoritative workflow from the pre-#759 base, approve, or merge. |
|
@jules Implement the existing TDD RED workflow contracts on exact live head Precondition: before every write, re-read the live head and stop without mutation unless it is the expected current head or your own direct descendant. Coverage integrationIn Initialize exactly: python_native_peer_check_required=0Only after a Python configured/default pytest/coverage command actually fails:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
--log "$log_file" \
--pyproject "$project_dir/pyproject.toml" \
--changed-files "$changed_files_file" \
--repo-root "$COVERAGE_SOURCE_WORKDIR"
and set In the compact PASS decision, when the variable is 1, emit exactly: Do not build/install PR-selected native code, add a Python stub, skip tests, or grant network access. Approval integrationMirror—but do not replace—the existing R peer-check pattern. Add independent functions that:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" require-checks \
--checks-json "$checks_file" \
--head-sha "$HEAD_SHA" \
--required-check "CI::python" \
--required-check "CI::rust" \
--required-check "CI::package"
Call this gate in both approval paths that already call Permanent tests and verificationMake the current tests GREEN without weakening them: python -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.pyThen run the permanent Python 3.10/3.14 quality workflow, focused and complete 100% production statement/branch coverage, interrogate 100%, compileall, actionlint, full central tests, security and supply-chain checks. Fix actual failures only. Preserve After GREEN, report the exact final SHA and verification commands in a PR comment. Do not request approval or change Draft state. |
|
Exact-head quality run @jules Implement the central workflow integration now rather than weakening these tests. Preserve the existing R peer gate and privileged reviewer chain. After GREEN, run full central coverage/docstrings/actionlint and replay OpenCode review against exact fast-mlsirm heads #546, #549, and #550. |
|
@opencode-agent address Fix the exact current-head quality failure on Run
Implement the documented fail-closed flow:
After GREEN, run all 90 focused tests at 100% statement/branch coverage, the complete central suite, interrogate 100%, compileall, actionlint, Python 3.10 compatibility, security workflows, and exact-head review. Keep Draft, |
|
@jules Implement the missing production integration on current branch |
|
@opencode-agent address Implement the committed workflow-integration RED contract on this Draft branch. Do not weaken the helper or tests. Preserve the existing R peer gate and reviewer credential chain. The central coverage job must capture bounded combined pytest output and status, classify only the exact unchanged maturin/PyO3 module-absence collection failure, then require trusted exact-head After GREEN, run the permanent workflow contracts, full central coverage/docstrings/actionlint/security, then replay exact current heads of fast-mlsirm #546, #549, and #550. |
|
@opencode-agent address Continue directly on exact head Required fail-closed behavior:
Keep Draft until canonical integration and exact-head checks are GREEN. After protected integration, rerun unchanged fast-mlsirm heads rather than reusing source-only failures. |
|
/oc Refetch the live PR head and stop without writing unless it is exactly In the isolated
Preserve Run the three RED workflow-contract tests first; then all 90+ focused peer-gate tests with 100% helper statement/branch coverage, the complete central suite, production docstrings 100%, Python 3.10 and 3.14 compatibility, actionlint, compileall, and |
|
@coderabbitai autofix Complete the existing production integration directly on exact head |
|
Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
|
/oc Refetch the exact live PR head and abort unless it is |
|
@opencode-agent Complete the permanent central integration directly on exact Draft head Exact-head run
Keep Draft and do not approve, merge, release, alter reviewer credentials, or weaken protection. |
|
/oc Refetch PR #789 and implement the PyO3 peer-evidence integration directly on the live Draft branch; abort on movement. Keep the staged patch artifact deleted. Wire |
|
Complete the planned production integration directly on Implement test-first and fail closed:
Run the three failing workflow contracts first, all focused peer-gate/file-safety/nested-project/requirements-directory tests, then the complete central suite, 100% production statement/branch coverage, interrogate, compileall, actionlint, and clean-tree checks. Keep Draft until the new exact head is green. |
|
/oc Complete the missing permanent workflow integration on exact head Run Implement directly in the permanent workflow:
Run all five peer-gate test files, then complete central 100% statement/branch coverage and production docstrings, Python 3.10/3.14 compilation, actionlint, security/supply-chain workflows, and |
|
/oc Refetch the live head and continue only if it is |
|
/oc Continue from the exact current head and finish the permanent PyO3 peer-evidence integration if it is still incomplete. Classify only a complete pytest collection failure caused exclusively by the declared maturin/PyO3 module being absent, serialize it as distinct |
|
@opencode-agent address Complete the bounded PyO3 peer-evidence integration on exact current Draft head Exact failing quality evidence is run
Preserve the existing source-only/networkless sandbox, no PR-selected extension build or import stub, exact-head/base materialization, credential isolation, NVIDIA NIM/reviewer credential chain, native-fuzz separation, 100% production statement/branch/public-docstring policy, and branch protection. Do not add a temporary, one-shot, self-modifying, encoded-patch, staged-patch, branch-local repair, or competing writer workflow. After the minimal integration, rerun the focused peer-gate suite, complete central suite, Python 3.10/3.14 compilation, actionlint/Bash checks, exact 100% production statement/branch/docstring gates, security/supply-chain workflows, clean-diff checks, and current-head automated review. Keep Draft until all exact-head gates and qualifying independent non-author approval are satisfied. |
|
@opencode-agent address Finish the bounded PyO3 native peer-evidence integration from a fresh protected-main base. Exact PR head is First normally merge exact protected main into this existing branch without rewriting history. Then satisfy only the three intentional integration RED contracts from exact-head Python Native Extension Peer Gate Quality CI run
Preserve every classifier refusal boundary already covered by the 87 focused tests: any Rust/Cargo/native crate/stub/maturin metadata/package/lock/requirements/workflow change, mixed imports, actual test/setup/teardown/internal failures, truncation/crash, malformed or unsafe path must remain an ordinary blocking test failure. Do not build or import PR-selected native code in the source-only sandbox, add network access, create a compatibility stub, weaken coverage, or let peer evidence approve by itself. Do not force-push, use |
|
Exact-head RCA for First failing boundary: Source mutation is frozen in this invocation because this open PR’s existing writer owns the branch/path. The branch remains Draft; no approval, success, or merge authority is inferred. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
tests/test_python_native_extension_peer_gate_workflow_contract.py (1)
31-82: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win
require-checks경로에 대한 계약 단언을 강화하십시오. 워크플로의 관련 값은 존재하지만, 테스트의"check-runs","__typename","CheckRun"단언은 여러 무관한 위치를 통과할 수 있습니다.collect_successful_python_native_peer_check_evidence블록을 추출한 뒤 해당 블록에서 exact-headCheckRun필터를 검사하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_python_native_extension_peer_gate_workflow_contract.py` around lines 31 - 82, Strengthen test_approval_requires_live_exact_head_python_rust_and_package_checkruns by extracting the collect_successful_python_native_peer_check_evidence block from the workflow and asserting that check-runs, __typename, and CheckRun appear within that block. Keep the exact-head and required-check assertions scoped to the relevant require-checks path rather than matching unrelated workflow text.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/opencode-review-dispatch.yml:
- Around line 927-929: Update the temporary pytest log creation near
python_native_pytest_log to place the file under ${RUNNER_TEMP} (or otherwise
enforce an explicit size limit with truncation failure handling), instead of
relying on unbounded /tmp output. Keep the existing python_native_changed_files
and python_native_pyproject_snapshot temporary-file behavior unchanged.
- Line 930: changed_files_for_coverage가 rename된 파일의 이전 경로를 보존하도록 수정하십시오. rename을
add/delete로 기록하는 inventory를 사용하거나, helper가 old/new 경로를 모두 포함하는 name-status 입력을
검증·처리하게 하여 native crate 밖으로 이동한 경우에도 제거된 native 경로가 분류기에 전달되게 하십시오. 해당 rename 회귀
동작을 검증하는 테스트도 추가하십시오.
- Around line 7250-7251: statusCheckRollup 조회에서 contexts(first: 100)를
pageInfo.hasNextPage와 endCursor를 활용한 커서 페이지네이션으로 변경해 모든 CheckRun을 검사하도록 하십시오. 필수
CI::python、CI::rust、CI::package 검증이 후속 페이지에서도 수행되도록 기존 검증 흐름을 유지하고, 101번째 항목에 필수
CheckRun이 있는 회귀 테스트를 추가하십시오.
In `@scripts/ci/python_native_extension_peer_gate.py`:
- Around line 290-310: Update the changed-path checks in the peer-gate function
to always block repository-root pyproject.toml changes, including when
manifest_parent is nested, and to recognize pip dependency input files such as
requirements*.in alongside existing requirements*.txt files regardless of
directory. Extend the relevant tests with constraints.txt, requirements-ci.in,
and nested-project root pyproject.toml cases.
---
Nitpick comments:
In `@tests/test_python_native_extension_peer_gate_workflow_contract.py`:
- Around line 31-82: Strengthen
test_approval_requires_live_exact_head_python_rust_and_package_checkruns by
extracting the collect_successful_python_native_peer_check_evidence block from
the workflow and asserting that check-runs, __typename, and CheckRun appear
within that block. Keep the exact-head and required-check assertions scoped to
the relevant require-checks path rather than matching unrelated workflow text.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6bdeb467-44ec-4947-837a-724dc657f14b
📒 Files selected for processing (13)
.github/workflows/opencode-review-dispatch.yml.github/workflows/python-native-extension-peer-gate-quality-ci.ymlCHANGELOG.mddocs/doctoring/python-native-extension-peer-evidence.mddocs/doctoring/python-native-extension-peer-file-safety.mdscripts/ci/python_native_extension_peer_gate.pytests/test_opencode_agent_contract.pytests/test_python_native_extension_peer_gate.pytests/test_python_native_extension_peer_gate_file_safety.pytests/test_python_native_extension_peer_gate_nested_project.pytests/test_python_native_extension_peer_gate_requirements_directory.pytests/test_python_native_extension_peer_gate_workflow_contract.pytests/test_repository_branch_coverage_pr743_cleanup.py
|
Review-only request for exact current head Please inspect the five-file repair for all four addressed CodeRabbit findings: runner-owned pytest-log placement, rename-as-delete/add boundary inventory, fail-closed cursor pagination across every exact-head CheckRun page, and repository-wide The exact-head focused quality workflow 31570671841 and Strix workflow 31570671729 are terminal-success. Other security/supply-chain checks remain queued; they are separate gate evidence and must not be interpreted as semantic source findings or approval. Do not modify the branch, approve on behalf of the author, merge, release, weaken protection, or reuse predecessor-head review evidence. |
|
Exact-current-head review request for Review the complete 13-file bounded PyO3 peer-evidence gate: defer only complete pytest collection failures caused exclusively by the unchanged declared native module; sealed regular Keep the exact head unchanged. Do not transfer predecessor evidence, synthesize author approval, build PR-selected native code in the source sandbox, treat deferral as success, relax peer-check/path/file boundaries, merge, release, or bypass protection. @coderabbitai review |
|
@opencode-agent address Finish this existing Draft PR in place. Do not create a stacked PR, compatibility stub, temporary branch writer, or networked execution of PR-selected native code. Integrate
Keep Draft until the direct canonical integration and all same-head gates are green. Do not approve, merge, release, alter reviewer credentials/protections, or use |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='9299a4515b3436607bbad895bf1c73205dce3582'
repo='ContextualWisdomLab/.github'
pr='789'
echo '== checked-out HEAD =='
git rev-parse HEAD
echo '== expected head =='
printf '%s\n' "$expected_head"
echo '== PR metadata =='
gh pr view "$pr" --repo "$repo" --json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision
echo '== changed files against base =='
git diff --name-status '6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba...HEAD'
echo '== relevant file outlines =='
ast-grep outline scripts/ci/python_native_extension_peer_gate.py --items all --view expanded
ast-grep outline tests/test_python_native_extension_peer_gate_workflow_contract.py --items all --view expanded
echo '== workflow symbols and integration references =='
rg -n -C 4 \
-e 'r_peer_check_required' \
-e 'python_native_peer_check_required' \
-e 'python_native_extension_peer_gate\.py' \
-e 'classify-pytest' \
-e 'require-checks' \
-e 'Python native-extension source-only deferral' \
-e 'Python native-extension peer evidence' \
.github/workflows/opencode-review-dispatch.yml
echo '== helper exact-head and changed-file logic references =='
rg -n -C 3 \
-e 'def (classify_pytest_inputs|has_required_exact_head_checks|_read_bounded_regular)' \
-e 'requirements|constraints|pyproject|rename|previous|old' \
-e 'endCursor|hasNextPage|CheckRun|workflow' \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
echo '== current-head check runs =='
gh api --paginate \
"/repos/ContextualWisdomLab/.github/commits/$expected_head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha,.details_url] | `@tsv`' || true
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved comments(first: 1) { nodes { author { login } body } } }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | [.comments.nodes[0].author.login, .comments.nodes[0].body] | `@json`' || trueLength of output: 78558 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== coverage execution and PyO3 classification =='
sed -n '780,1020p' .github/workflows/opencode-review-dispatch.yml
echo '== changed-file inventory function =='
rg -n -A100 -B10 'changed_files_for_coverage\(\)' .github/workflows/opencode-review-dispatch.yml
echo '== coverage summary, outputs, and transfer boundary =='
sed -n '2030,2140p' .github/workflows/opencode-review-dispatch.yml
rg -n -C5 -e 'COVERAGE_EVIDENCE_SUMMARY' -e 'r_peer_check_required' -e 'python_native_peer_check_required' .github/workflows/opencode-review-dispatch.yml
echo '== Python native peer collector and gate call sites =='
sed -n '7180,7425p' .github/workflows/opencode-review-dispatch.yml
rg -n -C5 -e 'coverage_defers_to_python_native_peer_checks' -e 'require_successful_python_native_peer_checks' -e 'collect_successful_python_native_peer_check_evidence' .github/workflows/opencode-review-dispatch.yml
echo '== helper implementations =='
sed -n '64,165p' scripts/ci/python_native_extension_peer_gate.py
sed -n '168,398p' scripts/ci/python_native_extension_peer_gate.py
sed -n '399,536p' scripts/ci/python_native_extension_peer_gate.py
echo '== complete workflow-contract tests =='
cat -n tests/test_python_native_extension_peer_gate_workflow_contract.py
echo '== focused base-to-head diff =='
git diff --no-ext-diff --unified=40 '6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba...HEAD' -- \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py \
tests/test_python_native_extension_peer_gate_file_safety.py \
tests/test_python_native_extension_peer_gate_requirements_directory.pyLength of output: 161049 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== all Python native peer-gate call sites and enclosing control flow =='
rg -n -C 18 \
-e 'require_python_native_peer_checks_for_deferred_coverage\(\)' \
-e 'require_python_native_peer_checks_for_deferred_coverage' \
-e 'COVERAGE_EVIDENCE_RESULT' \
-e 'create_pull_review.*APPROVE' \
-e 'create_pull_review_with_payload.*APPROVE' \
.github/workflows/opencode-review-dispatch.yml
echo '== verifier and test coverage for duplicate CheckRun records =='
rg -n -C 8 \
-e 'len\(matches\)' \
-e 'duplicate' \
-e 'successful_checks' \
-e 'has_required_exact_head_checks' \
-e 'require-checks' \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py \
scripts/ci/python_native_extension_peer_gate.py
echo '== final coverage decision and all result markers =='
rg -n -C 4 \
-e 'Coverage Decision' \
-e 'Result: PASS' \
-e 'Result: DEFERRED' \
-e 'Test evidence: supported repository test suites passed' \
.github/workflows/opencode-review-dispatch.yml
echo '== permanent quality workflow =='
cat -n .github/workflows/python-native-extension-peer-gate-quality-ci.yml
echo '== doctoring and changelog references =='
rg -n -C 3 \
-e 'DEFERRED|CheckRun|PyO3|maturin|source-only|exact-head|duplicate|rerun' \
CHANGELOG.md \
docs/doctoring/python-native-extension-peer-evidence.md \
docs/doctoring/python-native-extension-peer-file-safety.md
echo '== PR review and latest current-head check suites =='
gh pr view 789 --repo ContextualWisdomLab/.github --json isDraft,reviewDecision,reviews,headRefOid
gh api "/repos/ContextualWisdomLab/.github/commits/9299a4515b3436607bbad895bf1c73205dce3582/check-suites?per_page=100" \
--jq '.check_suites[] | [.app.slug,.status,.conclusion,.head_sha,.workflow_run.url] | `@tsv`' || trueLength of output: 90605
[P1] Reject duplicate matching CheckRun recordsIn The function checks only that This conflicts with the stated fail-closed contract. Duplicate same-head Update the verifier to require exactly one matching record for each required I also verified these non-source conditions:
I applied the repository rule that only successful checks on the exact current head count as merge evidence. I do not approve this PR. 🧠 Learnings usedYou are interacting with an AI system. |
Record the inclusion-of-untrusted-control-sphere prohibition so a source-only sandbox cannot treat a missing compiled extension as license to run pull-request maturin or cargo hooks. Force the trusted-uv installer tests onto the linux x86_64 runner path and add the control-plane architecture diagram.
|
Hourly loop 2026-08-13: re-read exact head Current head already implements each one:
Removed stale |
A markdown file in docs/requirements/ is not a lock or packaging change. Only .in/.txt/.lock names in a requirements path invalidate source-only sandbox deferral.
1 participant
Buyer-visible blocker
Central OpenCode coverage could fail before pytest collection in maturin/PyO3 packages when the isolated source-only sandbox could not import an unchanged compiled extension. That environment limitation is now distinguished from source failures without converting it into passing evidence.
Integrated bounded repair
pyproject.tomlbefore untrusted tests and use its logical path only for repository-relative boundary checks;requirements/path, workflow/action, or any repositorypyproject.tomlchange;DEFERREDcoverage decision, neverPASS;CheckRunevidence forCI::python,CI::rust, andCI::package, paginating every GraphQL context page;Exact identity and evidence
source_head_sha:9299a4515b3436607bbad895bf1c73205dce3582pr_base_snapshot_sha:6eb06cdd08c79a06f7b390069d4ffa49e2eb7dbalive_base_tip_sha:6eb06cdd08c79a06f7b390069d4ffa49e2eb7dbaThe four current-head review findings were repaired test-first in commit
9299a45. The focused regression suite passes 97 tests. The complete repository suite passes 1,087 tests plus 16 subtests with exact 100% owned production statement/branch coverage, 100% production docstrings, compilation, clean-patch validation, and checksum-verified actionlint.Exact-head hosted run 31570671841 and the current security/supply-chain cycle were started by this commit. Pending, queued, cancelled, skipped-required, neutral, or absent evidence is not passing. Merge remains prohibited until every applicable exact-head gate is terminal-success and qualifying independent approval satisfies protection.
Security and acceptance boundary
This PR does not skip tests, build PR-selected extensions, enable network access in the source sandbox, add a Python substitute, approve itself, or weaken protection. Deferral is authorized only for an unchanged native trust boundary and only when all exact-head peer checks pass.
A source merge would remain intermediate. Protected-main scheduled/manual consumer evidence for the original
fast-mlsirm#546failure class is required before operational closure.Advances #784.