perf(opencode): bound fixed sentence delimiter scans

[seonghobae]

상태

Proposed / Draft. 이 PR은 canonical slug 소유자인 #2274 위에 쌓인 후속 delta입니다. #2274가 ordinary merge되기 전에는 독립 배포 권한이 없습니다.

문제와 경계

원래 branch는 #2274가 소유한 Unicode whitespace slug 최적화를 다시 포함했고, 고정 문장 경계(., ;, newline)용 native scan에는 의미 보존 회귀가 없었습니다. 또한 Python re가 매 호출마다 pattern을 컴파일한다는 설명과 end-to-end 성능처럼 읽히는 수치는 근거 범위를 넘었습니다.

수리

• base는 ⚡ Bolt: [정규표현식을 제거한 slug 생성 최적화] #2274 branch bolt-optimize-slug-generation-8217040582090548403@cc7fd559f7103ac568baac376975c4cc2c09f591입니다.
• current head 7ddb98582e9785e445120fc732004c83a3e890a1은 이전 head 696b91b2...를 first parent로, ⚡ Bolt: [정규표현식을 제거한 slug 생성 최적화] #2274 current head cc7fd559...를 second parent로 보존합니다.
• effective delta는 세 경로로 한정됩니다.
• negation boundary regex만 module-level compiled pattern으로 유지합니다.
• 고정된 세 문장 경계는 의미가 드러나는 boundary_index / boundary_indices scan으로 처리합니다.
• 각 경계의 양방향 execution/negation 격리를 parameterized regression으로 고정했습니다.
• benchmark는 CPython 3.12.14, 대표 96자 전후 문맥, 200,000회 × 5의 local microbenchmark로 한정했습니다: regex 최솟값 1.119s, native 최솟값 0.934s, 약 1.20×. end-to-end CI 향상 주장이 아닙니다.

RED → GREEN

• mutation RED: 세미콜론 scan을 제거하면 1 failed / 2 passed로 이웃 문장의 Chrome/Playwright evidence가 섞였습니다.
• 복구 GREEN: boundary regression 3 passed.
• fresh current-commit focused normalizer suite: 116 passed with -W error.
• compileall 및 git diff --check: PASS.
• exact head: 7ddb98582e9785e445120fc732004c83a3e890a1.
• exact tree: bf7b0cfc2853b9f68f9de3061c7446520a47a3cb.
• current-base effective diff: exactly .jules/bolt.md, normalizer source, boundary regression.
• exact tree is byte-identical to predecessor 696b91b2...; its fresh full-suite evidence is 3,399 passed / 5 skipped / 40 subtests. Commit identity는 새 hosted Checks로 다시 검증합니다.

동시 writer와 stack 보존

동시 Push 87fc95f911aa3cc8051372e191e78a79147b50d9과 그 뒤의 ordinary-forward 복구는 first-parent ancestry에 유지됩니다. #2274의 content-neutral advance cc7fd559...도 second parent로 통합해 현재 canonical base ancestry를 회복했습니다. Force Push나 destructive rebase는 사용하지 않았습니다.

Hosted exact-head Checks, qualifying independent approval, #2274 ordinary landing이 남아 있으므로 Draft를 유지합니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

P0 security/boundary regression on exact head e0feb52a42378a2f0c86b04a179ece5661fda683.

This parser-only optimization currently removes protected-main GitHub REST authority enforcement from both authenticated clients:

• scripts/ci/codeql_ghas_configuration_identity.py deletes canonical https://api.github.com validation and replaces the no-redirect opener with default urlopen;
• scripts/ci/strix_evidence_binding.py does the same;
• tests/test_github_api_url_boundary.py is deleted, so hostile authorities and bearer-forwarding redirects no longer fail;
• the corresponding doctoring, G-17 product-gap evidence, and CHANGELOG entry are also removed.

Python's default redirect handler may construct a second request from an authenticated request; this reopens the bearer-authority transition that protected main deliberately closed. These deletions are unrelated to opencode_review_normalize_output.py and violate the single-writer/delta-preservation boundary.

I am preserving the intended bounded normalization changes and directly restoring the nine protected-main security/evidence paths test-first. This PR must remain Draft until fresh exact-head Checks and an independent review exist; predecessor evidence cannot transfer.

[seonghobae]

P0 single-writer / exact-head traceability finding on current b1f810e9509aafbeaa90f78ebd9cdc319e7d0d18.

Fresh PR metadata does not match the body: the body still names exact head e84cd5777b6535f1273fe059b6bba48668604e48 and says the effective stack delta is three paths, while GitHub currently reports head b1f810e... and four changed paths against #2274 (1ba01ec5...). The fourth path is tests/test_github_api_url_boundary.py, a 278-line GitHub REST authority/redirect/bearer/G-17 evidence security contract. That is not part of the fixed sentence-boundary performance slice and makes this generation a second writer for a foreign security/control-plane boundary.

RED acceptance: on the exact current base/head, assert the effective changed-file set is only the intended sentence-boundary optimization paths and assert the PR's published exact-head/path inventory matches GitHub. This generation currently fails both. GREEN: preserve the GitHub-API security delta in its canonical owner lineage, then ordinary-forward reconcile/restack #2287 so its effective diff is limited to the sentence-boundary source/test/benchmark-doctoring delta; update exact head/tree/path evidence and rerun focused/full/hosted checks on that resulting head. Do not force-push, destructively rebase, close a valid foreign delta, or use a source-neutral retrigger.

Gate: Single-writer FAIL / Traceability FAIL / performance semantics otherwise bounded pending exact-head evidence.

[seonghobae]

Exact-head review for 55f3ad0905ebb7094ea46a41bfc563de778f2f1a (tree f0ef816c5d3c710a6c0637879b2bb75292bef855).

The effective diff is now limited to the bounded fixed-delimiter scan, its parameterized semantic regression, and corrected benchmark documentation. The #2274 slug delta is inherited rather than duplicated; #2279-owned redirect work introduced by a concurrent push is no longer in this PR's effective tree while its commit remains in ancestry.

Mutation control removed the semicolon scan and produced 1 failed / 2 passed; restoring the scan produced 3 passed. Focused normalizer tests: 116 passed. Final exact-tree suite under Python 3.12.14 with warnings as errors: 3,367 passed / 3 skipped / 40 subtests. compileall and diff check pass.

No new source finding in this delta. This COMMENT is not an approval. Hosted exact-head checks, qualifying independent review, and successful #2274 landing remain required.

[seonghobae]

Exact-head repair receipt: 55f3ad0905ebb7094ea46a41bfc563de778f2f1a, tree f0ef816c5d3c710a6c0637879b2bb75292bef855, base #2274@1ba01ec5b474bdf2dcfba61421dce55621546c9a. Effective diff: 3 paths, +42/-3. RED 1 failed / 2 passed; GREEN boundary 3 passed; focused 116 passed; full 3,367 passed / 3 skipped / 40 subtests. Concurrent head adf1d1ec… remains an ancestor; update was force:false. Draft/Proposed retained pending replacement hosted checks and independent approval.

[seonghobae]

Follow-up acceptance on exact 55f3ad0905ebb7094ea46a41bfc563de778f2f1a.

The prior single-writer/traceability finding is repaired at source/scope level. Fresh GitHub compare now reports exactly three paths — .jules/bolt.md, scripts/ci/opencode_review_normalize_output.py, and tests/test_opencode_review_boundary_scan.py — so the foreign tests/test_github_api_url_boundary.py security-owner delta is no longer in this effective stack. The branch remains based on #2274 exact 1ba01ec5..., and the current body correctly describes the bounded sentence-boundary delta and local microbenchmark rather than an end-to-end CI claim.

Gate update: Single-writer PASS / Scope PASS / Traceability repair PASS. This is not merge authority: current exact-head CodeQL 35459961919, SAST 35459961945, and Security Scan 35459961902 are still queued, #2274 must land normally first, and a qualifying independent current-head approval remains required. Preserve Draft/Proposed; no blind rerun or source-neutral wake commit.

[google-labs-jules]

Exact-head repair receipt: 55f3ad0905ebb7094ea46a41bfc563de778f2f1a, tree f0ef816c5d3c710a6c0637879b2bb75292bef855, base #2274@1ba01ec5b474bdf2dcfba61421dce55621546c9a. Effective diff: 3 paths, +42/-3. RED 1 failed / 2 passed; GREEN boundary 3 passed; focused 116 passed; full 3,367 passed / 3 skipped / 40 subtests. Concurrent head adf1d1ec… remains an ancestor; update was force:false. Draft/Proposed retained pending replacement hosted checks and independent approval.

Acknowledged.

[seonghobae]

Cross-owner security delta repair receipt — current exact head 55f3ad0905ebb7094ea46a41bfc563de778f2f1a

Initial reviewed head e0feb52a42378a2f0c86b04a179ece5661fda683 mixed the bounded OpenCode sentence-boundary optimization with nine protected-main GitHub REST authority/evidence regressions: both authenticated clients lost canonical-authority validation and no-redirect openers, the hostile redirect contract was deleted, and CHANGELOG/doctoring/G-17 evidence was removed.

• COMMENT review: P0 boundary finding
• RED b1f810e9: restored the protected hostile-authority test first; the two clients' validator/opener contracts failed 4/4.
• GREEN adf1d1ec: restored all nine protected-main blobs exactly, leaving only the intended parser paths against then-current main.
• Concurrent ordinary-forward reconciliation preserved both commits in ancestry, retargeted this PR onto canonical slug owner #2274, and removed the foreign security paths from the effective diff.

Fresh current-head evidence:

• effective changed paths are exactly .jules/bolt.md, scripts/ci/opencode_review_normalize_output.py, and tests/test_opencode_review_boundary_scan.py;
• fixed-delimiter and inherited slug semantic probes: 10/10;
• changed boundary test compile: 1/1;
• unresolved inline threads: 0;
• current hosted CodeQL 35459961919, Semgrep 35459961945, and Security 35459961902 are queued.

The PR remains Draft/Proposed. Its stacked base #2274 is also Draft; its four exact-head hosted runs are terminal cancelled, and no qualifying independent current-head approval exists. Therefore neither PR is eligible for merge or auto-merge. No force push, destructive rebase, self-approval, synthetic status, or security-gate weakening was used.

[seonghobae]

Exact-head COMMENT review for d35de7fd6d86cd46325aff471a010772f4cc1b39 (not an approval).

The earlier P0 single-writer/traceability finding is resolved at this generation:

• first parent 55f3ad0905ebb7094ea46a41bfc563de778f2f1a preserves every concurrent branch commit;
• second parent 3f4095d75b174cabbdff04d4ab3f70ece344ff67 preserves the canonical #2274 slug owner and current protected-main security ancestry;
• GitHub reports only the intended three effective paths;
• remote/local exact tree 748c43e7c79f36f076fa64b27bda990d244cdfec is identical.

Test-first evidence: semicolon-removal mutation RED 1 failed / 2 passed; restored boundary suite 3 passed; combined focused warnings-as-errors 116 passed; whole exact-current-tree warnings-as-errors 3,401 passed / 3 skipped / 40 subtests; compileall and diff check pass. The local benchmark remains explicitly bounded and does not claim end-to-end gain.

No new substantive source finding was identified. Hosted exact-head runs are not GREEN and no independent approval exists, so Draft remains correct.

[seonghobae]

Current-head evidence receipt — d35de7fd6d86cd46325aff471a010772f4cc1b39

• exact remote/local tree: 748c43e7c79f36f076fa64b27bda990d244cdfec
• canonical base head: 3f4095d75b174cabbdff04d4ab3f70ece344ff67
• effective path contract: exactly 3 paths
• mutation RED: 1 failed / 2 passed
• focused GREEN: 116 passed with -W error
• exact-current-tree full GREEN: 3,401 passed / 3 skipped / 40 subtests
• compileall, git diff --check: PASS
• mergeable / Draft / unresolved threads 0

The exact-head CodeQL, SAST, and Security workflow generations are cancelled rather than GREEN; no source-neutral rerun was requested. Independent approval is also absent.

[google-labs-jules]

Cross-owner security delta repair receipt — current exact head 55f3ad0905ebb7094ea46a41bfc563de778f2f1a

Initial reviewed head e0feb52a42378a2f0c86b04a179ece5661fda683 mixed the bounded OpenCode sentence-boundary optimization with nine protected-main GitHub REST authority/evidence regressions: both authenticated clients lost canonical-authority validation and no-redirect openers, the hostile redirect contract was deleted, and CHANGELOG/doctoring/G-17 evidence was removed.

• COMMENT review: P0 boundary finding
• RED b1f810e9: restored the protected hostile-authority test first; the two clients' validator/opener contracts failed 4/4.
• GREEN adf1d1ec: restored all nine protected-main blobs exactly, leaving only the intended parser paths against then-current main.
• Concurrent ordinary-forward reconciliation preserved both commits in ancestry, retargeted this PR onto canonical slug owner #2274, and removed the foreign security paths from the effective diff.

Fresh current-head evidence:

• effective changed paths are exactly .jules/bolt.md, scripts/ci/opencode_review_normalize_output.py, and tests/test_opencode_review_boundary_scan.py;
• fixed-delimiter and inherited slug semantic probes: 10/10;
• changed boundary test compile: 1/1;
• unresolved inline threads: 0;
• current hosted CodeQL 35459961919, Semgrep 35459961945, and Security 35459961902 are queued.

The PR remains Draft/Proposed. Its stacked base #2274 is also Draft; its four exact-head hosted runs are terminal cancelled, and no qualifying independent current-head approval exists. Therefore neither PR is eligible for merge or auto-merge. No force push, destructive rebase, self-approval, synthetic status, or security-gate weakening was used.

Acknowledged. This is an informational system notification indicating that cross-owner security delta repair was applied correctly and the effective diff contains only the intended optimization paths.

[google-labs-jules]

Current-head evidence receipt — d35de7fd6d86cd46325aff471a010772f4cc1b39

• exact remote/local tree: 748c43e7c79f36f076fa64b27bda990d244cdfec
• canonical base head: 3f4095d75b174cabbdff04d4ab3f70ece344ff67
• effective path contract: exactly 3 paths
• mutation RED: 1 failed / 2 passed
• focused GREEN: 116 passed with -W error
• exact-current-tree full GREEN: 3,401 passed / 3 skipped / 40 subtests
• compileall, git diff --check: PASS
• mergeable / Draft / unresolved threads 0

The exact-head CodeQL, SAST, and Security workflow generations are cancelled rather than GREEN; no source-neutral rerun was requested. Independent approval is also absent.

Acknowledged. This is an informational system notification confirming current-head evidence and test results.

[seonghobae]

Exact-head COMMENT review for a794d6224e8cda9bea53173ba94946c692b7bc6e (not an approval).

Fresh concurrency revalidation found predecessor 36024e12... had deleted the executable boundary regression, restored an inaccurate repeated-regex-compilation claim, and replaced semantic names with idx/indices. Current head preserves that commit as its first parent and restores the previously proven tree ordinary-forward.

GREEN at the byte-identical tree 748c43e7c79f36f076fa64b27bda990d244cdfec: exact three-path effective diff, mutation RED 1 failed / 2 passed, boundary GREEN 3 passed, combined focused 116 passed, whole suite 3,401 passed / 3 skipped / 40 subtests, compileall and diff check PASS. The #2274 base includes current protected-main ancestry, so foreign security contracts remain preserved outside this delta.

No remaining substantive source finding was identified. Draft remains required pending new exact-head hosted evidence and independent approval.

[seonghobae]

Superseding current-head receipt — a794d6224e8cda9bea53173ba94946c692b7bc6e

Concurrent head 36024e12... is preserved as the first parent. Current tree 748c43e7c79f36f076fa64b27bda990d244cdfec is byte-identical to the independently verified tree, so the exact-tree results remain: focused 116 passed; full 3,401 passed / 3 skipped / 40 subtests; compileall/diff check PASS. GitHub again reports exactly the intended three paths and mergeable Draft state.

All predecessor-head hosted evidence is retired. Only runs attached to a794d622... may satisfy the hosted gate.

[seonghobae]

Current-base exact-head receipt: d0433ce4d9049fccb5b70d2cc8d78862e4b254a0, tree bf7b0cfc2853b9f68f9de3061c7446520a47a3cb, base #2274@3f4095d75b174cabbdff04d4ab3f70ece344ff67. Effective diff: 3 paths, +39/-3. Focused 116 passed; full 3,401 passed / 3 skipped / 40 subtests. Concurrent bc5e0fa8… is preserved as parent; branch update was force:false. Draft/Proposed retained.

[seonghobae]

Exact-head revalidation for d0433ce4d9049fccb5b70d2cc8d78862e4b254a0 (tree bf7b0cfc2853b9f68f9de3061c7446520a47a3cb) after concurrent #2274 restack.

The previous live head had regressed the current #2274 slug documentation and Unicode regression. This ordinary-forward descendant preserves #2274@3f4095d75b174cabbdff04d4ab3f70ece344ff67 intact and limits the effective diff to three paths: bounded delimiter scan, its parameterized regression, and qualified benchmark documentation.

Mutation RED remains 1 failed / 2 passed when semicolon scanning is removed. Current-base focused suite: 116 passed. Exact final tree full suite under Python 3.12.14 with warnings as errors: 3,401 passed / 3 skipped / 40 subtests. compileall and diff check pass.

No new source finding in the repaired delta. This COMMENT is not an approval. Hosted replacement checks, qualifying independent current-head review, and #2274 ordinary landing remain required.

[seonghobae]

Exact-head COMMENT review for 696b91b2fb3183e3f25be0b4e1e1d27b575ffc6a (tree bf7b0cfc2853b9f68f9de3061c7446520a47a3cb; not an approval).

Concurrent parent 87fc95f911aa3cc8051372e191e78a79147b50d9 deleted the executable six-case delimiter contract and four Unicode slug cases, replaced the bounded benchmark evidence with the inaccurate claim that Python regex compiles on every call, and weakened boundary_index / boundary_indices to ambiguous one-word names. Commit 696b91b… preserves that parent in ancestry and ordinary-forward restores all four paths to the previously verified tree. No force update or destructive rebase was used.

Fresh current-tree verification: 116 focused tests passed with warnings as errors; compileall and diff check passed. The tree is byte-identical to predecessor d0433ce4…, whose whole-suite evidence is 3,401 passed / 3 skipped / 40 subtests. GitHub now reports exactly three effective paths against canonical #2274 and the PR body is bound to the current head/tree.

Single-writer, regression-contract, naming, and evidence-scope findings are repaired. Draft remains required because the three new hosted workflows are queued, #2274 must land first, and there is no qualifying independent current-head approval.

[seonghobae]

Exact-head COMMENT review for 7ddb98582e9785e445120fc732004c83a3e890a1 (tree bf7b0cfc2853b9f68f9de3061c7446520a47a3cb; not an approval).

The current head is a two-parent ordinary-forward stack repair: first parent 696b91b2... preserves all valid sentence-boundary lineage, and second parent cc7fd559... is the live #2274 canonical slug-owner head. Git confirms the live base is now an ancestor and the effective diff remains exactly three bounded paths.

The merge commit is tree-identical to the previously verified 696b91b2... generation. Fresh current-commit focused warnings-as-errors: 116 passed; compileall and git diff --check pass. Tree-equivalent full-suite evidence remains 3,399 passed / 5 skipped / 40 subtests, while hosted Checks are regenerated for this exact commit identity.

No new source finding remains. Draft/Proposed stays correct pending #2274 ordinary landing, terminal exact-head Checks, and a qualifying independent approval.