fix(noema): classify and bound malformed-verdict repair failures

.github/workflows/repair-noema-model-output-1617.yml

@@ -0,0 +1,149 @@
+name: TEMP repair Noema model-output boundary 1617
+
+on:
+  push:
+    branches:
+      - fix/noema-model-output-retry-20260901
+
+concurrency:
+  group: repair-noema-model-output-1617
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  repair:
+    if: >-
+      github.repository == 'ContextualWisdomLab/.github' &&
+      github.actor == 'seonghobae' &&
+      github.triggering_actor == 'seonghobae'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Checkout triggering repair head without credentials
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Bind the single-writer branch to the triggering head
+        run: |
+          set -euo pipefail
+          writer_ref='refs/heads/fix/noema-model-output-retry-20260901'
+          remote_head="$(git ls-remote origin "$writer_ref" | awk '{print $1}')"
+          test "$remote_head" = "$GITHUB_SHA"
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+
+      - name: Install repository-pinned quality tools
+        run: python -m pip install --require-hashes -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Apply typed-evidence, deadline, coverage, and reviewed follow-up repairs
+        run: |
+          set -euo pipefail
+          PYTHONPATH=. python scripts/ci/repair_noema_model_output_1617.py
+          PYTHONPATH=. python scripts/ci/repair_noema_wall_clock_1617.py
+          PYTHONPATH=. python scripts/ci/repair_noema_coverage_1617.py
+          PYTHONPATH=. python scripts/ci/repair_noema_model_output_followup_1617.py
+
+      - name: Remove temporary repair machinery before verification
+        run: |
+          rm -f scripts/ci/repair_noema_model_output_1617.py
+          rm -f scripts/ci/repair_noema_timeout_fixture_1617.py
+          rm -f scripts/ci/repair_noema_wall_clock_1617.py
+          rm -f scripts/ci/repair_noema_coverage_1617.py
+          rm -f scripts/ci/repair_noema_model_output_followup_1617.py
+          rm -f .github/workflows/repair-noema-model-output-1617.yml
+          test ! -e .github/workflows/repair-noema-model-output-1617.yml
+
+      - name: Verify repair scope and required semantic targets
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import subprocess
+          allowed = {
+              '.github/workflows/repair-noema-model-output-1617.yml',
+              'ARCHITECTURE.md',
+              'CHANGELOG.md',
+              'docs/doctoring/noema-model-output-repair-boundary.md',
+              'docs/product-technical-gap-baseline.md',
+              'scripts/ci/noema_review_gate.py',
+              'scripts/ci/repair_noema_coverage_1617.py',
+              'scripts/ci/repair_noema_model_output_1617.py',
+              'scripts/ci/repair_noema_model_output_followup_1617.py',
+              'scripts/ci/repair_noema_timeout_fixture_1617.py',
+              'scripts/ci/repair_noema_wall_clock_1617.py',
+              'tests/test_noema_model_output_failure_classification.py',
+          }
+          changed = set(subprocess.check_output(['git', 'diff', '--name-only'], text=True).splitlines())
+          unexpected = changed - allowed
+          if unexpected:
+              raise SystemExit(f'unexpected repair paths: {sorted(unexpected)}')
+          required = {
+              'scripts/ci/noema_review_gate.py',
+              'tests/test_noema_model_output_failure_classification.py',
+          }
+          missing = required - changed
+          if missing:
+              raise SystemExit(f'required repair targets unchanged: {sorted(missing)}')
+          print('verified repair scope:', *sorted(changed), sep='\n- ')
+          PY
+
+      - name: Verify focused Noema regressions
+        run: PYTHONPATH=. python -m pytest -q tests/test_noema_model_output_failure_classification.py tests/test_noema_review_gate.py
+
+      - name: Verify complete suite, source coverage, docs, and diff hygiene
+        run: |
+          set -euo pipefail
+          PYTHONPATH=. coverage run -m pytest tests -q
+          coverage report --show-missing
+          interrogate
+          git diff --check
+          test ! -e .github/workflows/repair-noema-model-output-1617.yml
+          test ! -e scripts/ci/repair_noema_model_output_1617.py
+          test ! -e scripts/ci/repair_noema_timeout_fixture_1617.py
+          test ! -e scripts/ci/repair_noema_wall_clock_1617.py
+          test ! -e scripts/ci/repair_noema_coverage_1617.py
+          test ! -e scripts/ci/repair_noema_model_output_followup_1617.py
+
+      - name: Commit verified production repair with an allowlisted scope
+        run: |
+          set -euo pipefail
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add -A -- \
+            .github/workflows/repair-noema-model-output-1617.yml \
+            ARCHITECTURE.md \
+            CHANGELOG.md \
+            docs/doctoring/noema-model-output-repair-boundary.md \
+            docs/product-technical-gap-baseline.md \
+            scripts/ci/noema_review_gate.py \
+            scripts/ci/repair_noema_coverage_1617.py \
+            scripts/ci/repair_noema_model_output_1617.py \
+            scripts/ci/repair_noema_model_output_followup_1617.py \
+            scripts/ci/repair_noema_timeout_fixture_1617.py \
+            scripts/ci/repair_noema_wall_clock_1617.py \
+            tests/test_noema_model_output_failure_classification.py
+          git diff --cached --check
+          test -z "$(git diff --name-only)"
+          git diff --cached --name-only | grep -Fx 'scripts/ci/noema_review_gate.py'
+          git diff --cached --name-only | grep -Fx 'tests/test_noema_model_output_failure_classification.py'
+          git commit -m 'fix(noema): bound and classify malformed-verdict repair'
+
+      - name: Guard and push only the verified exact-head commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test -n "${GH_TOKEN:-}"
+          writer_branch='fix/noema-model-output-retry-20260901'
+          writer_ref="refs/heads/${writer_branch}"
+          remote_head="$(git ls-remote origin "$writer_ref" | awk '{print $1}')"
+          test "$remote_head" = "$GITHUB_SHA"
+          gh auth setup-git
+          git push origin HEAD:"$writer_branch"

scripts/ci/repair_noema_coverage_1617.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""Add fail-closed coverage for PR #1617's temporary production transform.
+
+This one-shot helper is removed by the repair workflow before the verified
+production commit is created.
+"""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+TEST = ROOT / "tests/test_noema_model_output_failure_classification.py"
+
+
+def main() -> None:
+    text = TEST.read_text(encoding="utf-8")
+    marker = "def test_repair_wall_clock_deadline_defensive_fail_closed_paths"
+    if marker in text:
+        raise RuntimeError("#1617 deadline coverage regressions already present")
+    text += r'''
+
+
+def test_repair_wall_clock_deadline_defensive_fail_closed_paths(monkeypatch) -> None:
+    """Invalid budgets/platform state fail closed instead of weakening the bound."""
+    import signal
+
+    with pytest.raises(ValueError, match="must be positive"):
+        with gate._repair_wall_clock_deadline(0):
+            pass
+
+    if not hasattr(signal, "setitimer"):
+        pytest.skip("remaining cases require POSIX setitimer")
+
+    monkeypatch.delattr(gate.signal, "setitimer")
+    with pytest.raises(RuntimeError, match="requires POSIX setitimer support"):
+        with gate._repair_wall_clock_deadline(1):
+            pass
+
+
+def test_repair_wall_clock_deadline_refuses_existing_process_alarm() -> None:
+    """Noema never overwrites another caller's active process alarm."""
+    import signal
+
+    if not hasattr(signal, "setitimer"):
+        pytest.skip("POSIX process timer is required by the Linux review runner")
+    signal.setitimer(signal.ITIMER_REAL, 30)
+    try:
+        with pytest.raises(RuntimeError, match="refused to overwrite"):
+            with gate._repair_wall_clock_deadline(1):
+                pass
+    finally:
+        signal.setitimer(signal.ITIMER_REAL, 0)
+
+
+def test_repair_wall_clock_deadline_rejects_non_main_thread_signal_context(monkeypatch) -> None:
+    """A signal handler that cannot be installed fails closed before any timer starts."""
+    import signal
+
+    if not hasattr(signal, "setitimer"):
+        pytest.skip("POSIX process timer is required by the Linux review runner")
+
+    def reject_signal(*_args, **_kwargs):
+        raise ValueError("signal only works in main thread")
+
+    monkeypatch.setattr(gate.signal, "signal", reject_signal)
+    with pytest.raises(RuntimeError, match="process main thread"):
+        with gate._repair_wall_clock_deadline(1):
+            pass
+    assert signal.getitimer(signal.ITIMER_REAL)[0] == 0
+
+
+def test_repair_unexpected_runtime_failure_preserves_initial_model_evidence(monkeypatch) -> None:
+    """Unexpected corrective parser/runtime failures keep the first trusted diagnostic."""
+    import json
+
+    monkeypatch.setenv("NOEMA_LLM_API_URL", "https://llm.example/v1/chat/completions")
+    monkeypatch.setenv("NOEMA_LLM_API_KEY", "test-key")
+    head_sha = "e" * 40
+
+    class Response:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return None
+
+        def read(self):
+            return json.dumps(
+                {"choices": [{"message": {"content": json.dumps(_verdict())}}]}
+            ).encode()
+
+    monkeypatch.setattr(
+        gate.urllib.request.OpenerDirector,
+        "open",
+        lambda *_args, **_kwargs: Response(),
+    )
+    monkeypatch.setattr(gate, "fetch_pr", lambda _repo, _number: {"headRefOid": head_sha})
+    original_decode = gate.decode_llm_response_body
+    decode_calls = 0
+
+    def decode_once_then_fail(raw_bytes):
+        nonlocal decode_calls
+        decode_calls += 1
+        if decode_calls == 2:
+            raise RuntimeError("repair parser invariant failed")
+        return original_decode(raw_bytes)
+
+    monkeypatch.setattr(gate, "decode_llm_response_body", decode_once_then_fail)
+
+    with pytest.raises(RuntimeError) as exc_info:
+        gate.call_llm(
+            "owner/repo",
+            7,
+            {"title": "test", "headRefOid": head_sha},
+            DIFF,
+            False,
+            head_sha,
+            changed_paths=("README.md",),
+        )
+
+    message = str(exc_info.value)
+    assert "Noema repair failed closed" in message
+    assert "outcome must be falsified or confirmed" in message
+    assert "repair parser invariant failed" in message
+    assert decode_calls == 2
+'''
+    TEST.write_text(text, encoding="utf-8")
+
+
+if __name__ == "__main__":
+    main()