perf(rules): preserve reference deduplication semantics while evaluating loop form

[seonghobae]

extract_public_references()와 _merge_references()의 순서 보존 중복 제거를 dict.fromkeys(generator)에서 명시적 insertion-ordered dict 누적으로 바꾸는 candidate입니다. 전후 모두 O(N)이며 buyer-visible 성능 개선은 아직 입증하지 않습니다.

Canonical succession / intervening-delta repair

이 PR은 같은 production rewrite를 반복한 #1075, #1084, #1132의 유효 semantic delta를 승계하는 canonical survivor입니다. current source는 first-seen ordering, whitespace normalization, falsy filtering과 empty/non-matching input behavior를 유지하고 tests/test_reference_deduplication_contract.py가 그 경계를 regression으로 고정합니다. predecessor PR들의 고정적인 10–50% speedup 문구와 generated Bolt doctrine은 merge evidence가 아니며 승계 대상에서 제외했습니다.

이후 normal descendant 6dd6b6c976c38b58cd892fd05ad373c4eb5b55e6가 regression test를 삭제하고 generated Bolt doctrine을 재도입한 것을 stale/race로 취급하지 않고 읽어 수리했습니다. e4bd598efda627afa999c843f152bb360f513681에서 regression을 복구했고, aa6bfe2641d88de29ac9fa62adbcbdbc0117e797에서 protected develop의 .jules/bolt.md blob(8ce7ce8f7bbf514a6042b338317e2c5ddd004bf0)을 정확히 재채택했습니다. force update는 사용하지 않았습니다.

Current protected-base effective delta는 appguardrail_core/rules.py와 tests/test_reference_deduplication_contract.py 두 파일뿐입니다.

Acceptance

• exact-head semantic regression과 기존 suite가 terminal GREEN일 것;
• 정량 성능을 주장하려면 동일 Python/runtime/CPU, representative 또는 right-cleared AppGuardrail rule corpus, warm-up/반복, median/p95와 CPU/allocation evidence를 재현 가능하게 남길 것;
• 그 evidence가 없으면 constant-factor implementation candidate로만 평가하고 buyer-visible speedup을 주장하지 않을 것;
• required exact-head Security/SAST/CodeQL 및 current-head review를 새로 획득할 것.

Current exact head: aa6bfe2641d88de29ac9fa62adbcbdbc0117e797. Draft 유지. Predecessor result, self-approval, gate weakening, scanner suppression, source-neutral retrigger, force push, destructive rebase는 acceptance가 아닙니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.