perf(review): scan backward for the last admissible label

[seonghobae]

Problem

The review normalizer scanned every occurrence of an admissible evidence label to select the final occurrence. Large repeated-output payloads paid for an unnecessary list and repeated forward scans, and an embedded docstring coverage: phrase could not be selected as the test-coverage label.

Change

• use native rfind() to locate the last admissible label;
• walk backward only when a coverage: hit is the embedded docstring coverage: phrase;
• preserve the next-label boundary and empty-label behavior;
• add regression coverage for repeated labels, embedded docstring labels, missing labels, and a 50,001-label payload.

Boundary repair and exact topology

Status: Ready for review / Proposed

Base: #2530 at 5a91ce9f9c3e773aa1172f1055fd791ccde8fdaa

Head: 5df9bbe20b5b2c979f1e4f416178e135f4759cd9

Tree: 7e82721b2de6b173d99988652cc0d81bdf9818c4

Parents:

1. 81de2b0c2868bb4970c9958ab0a0c2d4cfa11713 preserves the complete prior leaf and canonical-security restack history;
2. 5a91ce9f9c3e773aa1172f1055fd791ccde8fdaa integrates the current source-integrity-clean fix(ci): integrate parser, security, response, and coverage gates #2530 owner stack.

The tree resolves every duplicated Noema source/lock, CHANGELOG, doctoring, Gap, and hosted-reader assertion to canonical owner #2545 through #2530. Effective leaf scope is exactly two files:

• scripts/ci/opencode_review_normalize_output.py
• tests/test_opencode_review_normalize_output.py

No valid security delta was discarded: it is fully carried by #2545/#2530. The merge and ref update were ordinary and force=false.

Evidence

• prior repaired-lineage focused contracts: 122 passed, 2 skipped;
• exact current-head direct contracts: four cases GREEN, including 50,001 labels;
• exact current-head git diff --check: GREEN;
• earlier 1,800,039-byte measurement over 20 runs: previous scan 0.603195 s, rfind() 0.000084 s;
• both implementations remain worst-case O(N); this is an allocation/constant-factor repair, not an asymptotic-complexity claim.

Exact-head Security Scan 36783373034 and SAST Semgrep 36783372878 are terminal-success. CodeQL PR 36783373076 is fail-closed pending: actions job 110118893991 and python job 110118893992 each recorded DISPATCH_OUTCOME=success with VERDICT_STATE=pending, while coordinator job 110118952871 successfully dispatched the exact head/base and two-language matrix. There are zero review threads and no qualifying APPROVED review. Authenticated terminal CodeQL evidence, stable head/base validation, and independent approval remain required before ordinary merge; prior-head, skipped, queued, pending, in-progress, or owner-head evidence is not leaf approval.

2026-10-01 source-integrity owner refresh

Canonical owner #2530 repaired a source-integrity failure in the product/technical gap baseline at 5a91ce9f9c3e773aa1172f1055fd791ccde8fdaa. Ordinary two-parent merge 5df9bbe20b5b2c979f1e4f416178e135f4759cd9 carries that repair without rebasing or force-updating this leaf. Its parents are prior leaf 81de2b0c2868bb4970c9958ab0a0c2d4cfa11713 and owner 5a91ce9f9c3e773aa1172f1055fd791ccde8fdaa; tree 7e82721b2de6b173d99988652cc0d81bdf9818c4 leaves the effective PR delta exactly the same two normalizer files. Fresh exact-head warnings-fatal verification is 151 passed, and git diff --check is GREEN. Hosted Checks and an independent APPROVED review remain mandatory; prior-head results are stale evidence.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1cbe011f-4a4e-4cc8-b9e1-f2267cb2af73

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

증분 직접 검토 결과를 기록합니다.

• 의도한 유효 delta: label_section()의 마지막 label 탐색을 반복 find() 대신 rfind()로 단순화
• single-writer/범위 위반: 같은 branch에 생성기 메모, urllib3/PyJWT hash, coverage fixture의 PyO3 업그레이드가 함께 섞였습니다. 특히 fixture PyO3 0.23.4는 Trivy에서 HIGH/MEDIUM 2건을 새로 노출해 Security Scan을 실패시켰습니다.
• 검증 gap: 핵심 파서 변경에 직접 대응하는 fixture/unit test delta가 없습니다.
• 조치: .jules/bolt.md와 무관한 dependency/fixture 4개 파일을 base blob으로 되돌리고, 파서 코드만 보존한 Draft로 유지하겠습니다.

재작성이나 Force Push 없이 Contents API commit으로 scope를 정리하고 새 exact head를 재검증합니다.

[google-labs-jules]

증분 직접 검토 결과를 기록합니다.

• 의도한 유효 delta: label_section()의 마지막 label 탐색을 반복 find() 대신 rfind()로 단순화
• single-writer/범위 위반: 같은 branch에 생성기 메모, urllib3/PyJWT hash, coverage fixture의 PyO3 업그레이드가 함께 섞였습니다. 특히 fixture PyO3 0.23.4는 Trivy에서 HIGH/MEDIUM 2건을 새로 노출해 Security Scan을 실패시켰습니다.
• 검증 gap: 핵심 파서 변경에 직접 대응하는 fixture/unit test delta가 없습니다.
• 조치: .jules/bolt.md와 무관한 dependency/fixture 4개 파일을 base blob으로 되돌리고, 파서 코드만 보존한 Draft로 유지하겠습니다.

재작성이나 Force Push 없이 Contents API commit으로 scope를 정리하고 새 exact head를 재검증합니다.

확인했습니다. 스코프를 넘어서는 종속성과 픽스쳐 변경으로 인해 보안 이슈가 발생한 점, 그리고 파서 변경에 대한 직접적인 검증 테스트 추가가 누락된 부분을 인지하였습니다. 지시하신 대로 작업을 중지하겠습니다.

[seonghobae]

Pre-restack repair rationale

• live PR head: d094b157612204f51b01becdf90a5ee27bae7ef5
• live protected base: main@37b10243cec3d160ecc9c1be75c71428b160a703
• canonical current quality/security prerequisite: fix(ci): integrate parser, security, response, and coverage gates #2530 fix/full-suite-parser-locks-20260930@5b3a76ea71d7ae2fa9b1719f4f82df8d52e98082

The current Security and Python Security failures are inherited from the stale protected-base dependency set, not from the two-file label_section delta. I will preserve the valid parser/test delta, retarget onto #2530, and integrate that prerequisite through an ordinary two-parent commit. The implementation description will also be corrected: both versions are linear-time; the valid benefit is avoiding an occurrence list and stopping at the last admissible label, not changing asymptotic complexity.

No Force Push, destructive rebase, bypass, auto-merge, approval synthesis, or closure is authorized.

[seonghobae]

Concurrent head df2d184ae135bb39a050289b221aeca6047ad101가 이전 scope repair 뒤 .jules/bolt.md를 다시 도입하고 focused parser regression 두 건을 제거했습니다. 이는 generator metadata overlap과 missing-test 회귀입니다. current blobs를 다시 읽은 뒤 generator file은 base로 복원하고 동일한 last-label/docstring-coverage contract tests를 non-force descendant commit으로 복구하겠습니다. canonical security owner #2531/#2530 carryover는 유지합니다.

[seonghobae]

Exact-head review admission

Current head 2a76a117ad4d271955de28b6d69f61b0f4a9b006 and tree bca9b8228b8e904db9ab3c123644a92cfcc28eb8 were re-fetched after publication. The branch is mergeable, carries #2530 in ordinary ancestry, has exact-head Security run 36757453650 and SAST run 36757453836 SUCCESS, has zero unresolved review threads, and the published tree passes 109 focused warnings-fatal tests plus compile and diff checks. No remaining source finding justifies Draft.

Ready is restored solely to admit fresh CodeQL and independent review. CodeQL run 36757453709 was Draft-skipped and is not passing evidence. Ordinary merge remains HOLD until this exact head has terminal authenticated CodeQL evidence, a qualifying APPROVED review, stable head/base validation, and prerequisite protected integration. No empty commit, unchanged-head rerun, bypass, Force Push, rebase, auto-merge, or predecessor closure.

[seonghobae]

Exact-head gate update (2026-10-01)

• exact head: 2a76a117ad4d271955de28b6d69f61b0f4a9b006
• CodeQL PR 36759294333: dispatch job succeeded; both actions and python shards failed closed with VERDICT_STATE=pending.
• bound CodeQL dispatch 36759358851: queued and responsible for publishing the authenticated terminal verdict and rerunning the exact failed jobs.
• Strix 36759295585: SUCCESS.
• OpenCode dispatch 36760001509 and Noema 36759295723: queued.
• CodeRabbit skipped because this stacked PR targets a non-default base; that skip is not an independent approval.

This is asynchronous fail-closed evidence waiting, not a source failure or passing evidence. No unchanged-head rerun, empty commit, gate weakening, synthetic approval, auto-merge, or merge was performed.

[seonghobae]

Exact-head CodeQL handoff RCA

Current head 2a76a117ad4d271955de28b6d69f61b0f4a9b006 is unchanged. Latest CodeQL run 36759294333 completed language detection and dispatch coordination successfully; actions job 110037492838 and python job 110037492848 both failed closed only at VERDICT_STATE=pending.

The bound CodeQL Scan Dispatch run 36759358851 is queued for base 5b3a76ea71d7ae2fa9b1719f4f82df8d52e98082, required run 36759294333, and merge ref 05375310141030511dd0243bdb39c0bd47503de4. OpenCode dispatch 36760001509 is also queued. Exact-head Security and SAST are SUCCESS; unresolved threads remain zero and qualifying approvals remain zero.

This is asynchronous evidence admission, not a source finding or terminal CodeQL verdict. Merge remains HOLD. No manual rerun, empty commit, Draft toggle, bypass, Force Push, rebase, auto-merge, or synthetic status was used.

[seonghobae]

Exact-head Security Scan RCA and repair (2026-10-01)

• Repaired exact head: acd0fbbc54c37dc8558eaea026f38eabf7d1243d (tree 8f5095dce13bf60688402294ee1399c1f73fc70b), an ordinary one-parent successor of failed head f79a617aef6eca2e83f822a0014130372ffa54ef; the branch ref update used force=false.
• Exact failed evidence: Security Scan run 36770011020, job 110073743404, reported CVE-2026-86472 in fast-uri 3.1.7 and CVE-2026-101911/CVE-2026-101912 in ip-address 10.7.0 from scripts/ci/noema-document-reader/package-lock.json. The first Trivy mirror returned BLOB_UNKNOWN, but the GHCR fallback downloaded the database and emitted these SARIF findings, so the dependency findings—not the transient mirror response—caused the gate failure.
• Root repair: exact npm overrides pin the first fixed releases in the installed major lines (fast-uri 3.1.8, ip-address 10.7.1); deterministic regeneration changes only those two lock records. Direct hwp-mcp and @rhwp/core pins are unchanged.
• RED → GREEN: the hosted-reader contract failed first on fast-uri 3.1.7; repaired focused test 1 passed, full related file 12 passed, 2 optional skips, full repository 5,294 passed, 5 optional skips, 40 subtests; npm ci installed 108 packages; lock-only moderate npm audit reported 0 vulnerabilities; Ruff, JSON parsing, and git diff --check passed.
• Durable RCA and primary advisory citations are in docs/doctoring/noema-document-reader-npm-security-20261001.md and docs/product-technical-gap-baseline.md.
• The PR is Draft because the new head invalidates predecessor Checks and review evidence. Draft CodeQL is skipped and is not passing evidence. Fresh exact-head hosted Checks, Ready-triggered CodeQL/review evidence, and qualifying independent approval remain mandatory before ordinary merge.

[seonghobae]

Exact-head review-gate handoff (2026-10-01)

Current head acd0fbbc54c37dc8558eaea026f38eabf7d1243d and base 5b3a76ea71d7ae2fa9b1719f4f82df8d52e98082 were re-fetched after Ready admission.

• Security Scan 36772148784: SUCCESS.
• SAST Semgrep 36772148748: SUCCESS.
• CodeQL PR 36772148780: language detection and dispatch coordination succeeded; the python and actions shards failed closed only with VERDICT_STATE=pending.
• Bound CodeQL Scan Dispatch 36772219799 is pending for this exact head, base, required run, and merge source db41101a1a9f84c7489d71836587f328cc32c9dc.
• Strix 36772149246 is in progress; Noema 36772149340 and OpenCode 36772149264 are queued.
• GitHub reports zero submitted reviews and zero inline review threads. Devin and CodeRabbit emitted skip descriptions; neither is qualifying independent approval.

The CodeQL failure is asynchronous fail-closed admission, not a source-analysis finding or passing evidence. Ordinary merge remains HOLD until the dispatch publishes authenticated terminal evidence, all applicable exact-head Checks are terminal GREEN, the live head/base remain stable, and a qualifying independent APPROVED review exists. No rerun, empty commit, bypass, Force Push, rebase, synthetic approval, auto-merge, or merge was used.

[seonghobae]

Boundary repair — canonical Noema security owner is #2545

Exact head fe5f5813f458085844b56db6b585dd3c3f134b57 preserves the valid normalizer delta and the concurrent security work, but the latter now duplicates canonical owner #2545. #2545 owns source overrides, generated lock, RED→GREEN contract, and the shared-security prerequisite stack; it pins ip-address 10.7.2, while this leaf still carries 10.7.1.

This PR is returned to Draft / Proposed. Keep the normalizer commits alive, then ordinary-restack on the accepted #2545 owner and remove the duplicated package source/lock/security-test documentation from the leaf. Fresh exact-head Checks and qualifying approval are required after that reconciliation. No close, bypass, force update, or stale approval reuse.

[seonghobae]

Restack rationale before ref update: current base #2530 has advanced to bd3cfe8645844ec7b140a1b73d2b339f8e4283dc and now integrates canonical Noema dependency owner #2545 at 9a4af5e438283a31dc05814d6bc2818caee782a3. The #2543 Noema source/lock, CHANGELOG, doctoring, Gap, and hosted-reader assertion delta is therefore fully carried by the canonical stack and must not remain leaf-owned.

I will preserve #2543 head fe5f5813f458085844b56db6b585dd3c3f134b57 as the first parent, merge current #2530 as the second parent, and resolve the tree to current #2530 plus only the two unique normalizer files. This is ordinary non-force ancestry integration, not predecessor disposal; valid security intent remains in #2545/#2530, and the leaf remains Draft until fresh exact-head evidence.

[seonghobae]

Non-force restack completed.

• exact head: e67418e3336ce1dd5165e64ae0b1cc286d2bddaa
• exact tree: 6ff7fe96cd0f726a67135c89a77702e4b1d9d33f
• base: current fix(ci): integrate parser, security, response, and coverage gates #2530 bd3cfe8645844ec7b140a1b73d2b339f8e4283dc
• effective scope: exactly the normalizer source and regression test
• duplicate Noema security delta: removed from the leaf tree and preserved through canonical fix(security): patch Noema document reader transitives #2545/fix(ci): integrate parser, security, response, and coverage gates #2530 ancestry
• mergeability: true; Draft retained

Exact-head direct contracts are GREEN for repeated labels, embedded docstring labels, missing labels, and 50,001 labels; git diff --check is clean. Fresh hosted leaf Checks and qualifying independent approval remain required.

[seonghobae]

Exact-head canonical restack and review admission

Current head e67418e3336ce1dd5165e64ae0b1cc286d2bddaa (tree 6ff7fe96cd0f726a67135c89a77702e4b1d9d33f) is an ordinary two-parent merge of the complete prior leaf and current combined owner #2530 bd3cfe8645844ec7b140a1b73d2b339f8e4283dc. The PR base is that exact owner head.

• GitHub reports an effective two-file leaf diff: scripts/ci/opencode_review_normalize_output.py and tests/test_opencode_review_normalize_output.py.
• Canonical fix(security): patch Noema document reader transitives #2545/fix(ci): integrate parser, security, response, and coverage gates #2530 owns the Noema dependency source, lock, security tests, and documentation; no valid security delta was discarded.
• Independent exact-byte verification: PYTHONPATH=. pytest -W error tests/test_opencode_review_normalize_output.py — 110 passed; git diff --check — GREEN.
• Draft exact-head Security Scan 36776749580 and SAST 36776749418: SUCCESS. Draft CodeQL was skipped and is not passing evidence.
• Ready admission generated CodeQL PR 36776981732. Both language shards are fail-closed only with DISPATCH_OUTCOME=success and VERDICT_STATE=pending; bound dispatch 36777047415 is queued.
• Ready-event Security/SAST are in progress; Noema/OpenCode/Strix are queued. No qualifying independent APPROVED review exists.

Ready admits current-head review; it does not authorize merge. Ordinary merge remains HOLD until every applicable exact-head Check is terminal GREEN, the head/base remain stable, substantive threads are resolved, and an independent approval exists. No rerun, empty commit, bypass, force update, rebase, synthetic approval, auto-merge, or close was used.

[seonghobae]

Draft admission correction (2026-10-01)

The concurrent writer correctly restacked this leaf onto canonical owner #2530 at 5a91ce9f9c3e773aa1172f1055fd791ccde8fdaa using ordinary merge commit 5df9bbe20b5b2c979f1e4f416178e135f4759cd9. The effective leaf remains the two normalizer files, so the source-integrity owner delta is preserved.

The restacked exact head is not merge-ready: CodeQL PR 36779891833 is terminal failure, while Security Scan 36779891695 and SAST Semgrep 36779892082 are GREEN; independent approvals remain 0. The shared CodeQL handler sample still has no in-progress runner assignment. I therefore returned the unchanged exact head to Draft. No commit, rebase, force update, rerun, status synthesis, bypass, close, or merge was performed.

[seonghobae]

Ready admission restored (2026-10-01)

Exact head 5df9bbe20b5b2c979f1e4f416178e135f4759cd9 and base 5a91ce9f9c3e773aa1172f1055fd791ccde8fdaa are unchanged. The Draft conversion was based only on CodeQL PR run 36779891833 being terminal failure. Exact shard logs show DISPATCH_OUTCOME=success and VERDICT_STATE=pending for both actions and python: this is the intended fail-closed handoff, not an actionable source finding.

Draft caused current-head OpenCode, Noema, and Strix admission jobs to skip, creating a circular review wait. Ready is therefore restored solely as review admission. Security Scan 36779891695 and SAST Semgrep 36779892082 are GREEN; exact-byte local evidence remains 151 warnings-fatal tests and clean git diff --check. CodeQL authenticated terminal evidence, agent verdicts, stable head/base, and a qualifying independent APPROVED review remain merge gates. No rerun, auto-merge, bypass, or approval was fabricated.

[seonghobae]

Exact-head readiness correction for 5df9bbe20b5b2c979f1e4f416178e135f4759cd9: CodeQL PR run 36783373076 is terminal failure, there is no qualifying APPROVED review, and skipped/pending/predecessor evidence is not acceptance. This PR had already been identified as not-ready; the current Ready transition did not add approval or a passing gate.

Moving this PR to Draft / Proposed preserves every commit and valid delta while the central review/queue prerequisite is repaired. No close, force update, bypass, merge, or stale approval is performed.