test(scanner): pin required-substring prefilter semantics

[seonghobae]

Current repair state — 2026-09-05

• protected base: develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8
• exact head: 2a3a8f47b09df32ed69610e0c16c4c142988e2f7
• lifecycle: Draft / test-only security contract
• exact protected-base compare: ahead 2 / behind 0
• effective diff: only tests/test_required_substring_prefilter_contract.py

Review finding and repair

The original Bolt commit changed the production _scan_file prefilter from all(...) to an explicit loop, added a source comment claiming a measured ~2x speedup, and promoted the local microbenchmark into repository-wide .jules/bolt.md doctrine. The branch had no production-path equivalence regression and no representative end-to-end benchmark/profile proving a buyer-visible scan improvement. In a security scanner hot path, that is insufficient evidence to retain a speculative implementation change.

Normal descendant 2a3a8f47... therefore restores both scanner/cli/appguardrail.py and .jules/bolt.md byte-for-byte to protected develop. No performance claim, Python micro-optimization, or global doctrine remains in the effective diff.

The retained valid delta is an executable security contract around the existing required-substring prefilter. It drives the real _scan_file boundary and proves:

• a missing first, middle, or last required literal skips regex execution;
• an empty required-substring tuple remains admissible;
• when every required literal is present, the prefiltered rule emits exactly the same finding as the no-prefilter rule.

This protects the false-negative boundary independently of any future optimization technique. A future hot-path optimization must start from representative/right-cleared production profiling and preserve this contract; if the prefilter is materially hot, the Rust-first extraction/migration boundary must be evaluated rather than normalizing repeated unsupported Python micro-tuning.

Promotion gate

Fresh exact-head unit/coverage/security/SAST/review evidence is required. Keep Draft until one unchanged head has terminal required checks, 100% owned coverage/docstrings where applicable, zero valid unresolved findings, and qualifying independent review under live protection.

No self-approval, bypass, force update, destructive rebase, dummy/no-op retrigger, performance overclaim, or predecessor evidence transfer.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: Prefilter semantics remain equivalent

skip_rule preserves all() short-circuiting and empty-sequence behavior. Cached prefilters are tuples, so iterator exhaustion cannot alter later scans.

---

Was this helpful? React with 👍 or 👎 to provide feedback.