perf(code-scanning): avoid second identity lookup without unverified speedup claim

[seonghobae]

Bounded change

compare_snapshots() now retrieves current_by_identity[identity] with one dict.get() call instead of membership testing followed by indexing when the key is present. current_by_identity is constructed locally from AnalysisEvidence values, so None is not a valid stored evidence value and the missing-key sentinel does not change the current domain contract.

Evidence boundary

The original PR claimed roughly 5–10% less overhead for large arrays but supplied no production-representative benchmark, profile, p95 measurement, CPU sample, or allocation evidence. That numerical performance claim is withdrawn. The source establishes only a narrower structural fact: a present identity no longer performs the explicit membership lookup plus a second indexed lookup in this Python source path. Missing identities still require one mapping lookup.

The generated .jules/bolt.md entry also generalized this into Always use dict.get(...) and called the prior form a measurable bottleneck without evidence. Normal descendant bab449970b3c2e12501ef0ca5290afcffa5d9e6a restores the protected journal blob while retaining the bounded production refactor. dict.get() is not a universal replacement when None is itself a valid value or when absence has distinct semantics.

Exact authority

• protected base at PR creation: develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8
• exact current head: bab449970b3c2e12501ef0ca5290afcffa5d9e6a
• effective product delta: appguardrail_core/code_scanning.py only
• no asymptotic-complexity, p95, CPU, GC, allocation, or percentage speedup claim is made

Promotion boundary

Keep Draft until the unchanged exact head has terminal repository/security/coverage evidence and current independent review. If this is to be sold as a material performance improvement rather than a bounded cleanup, add a production-representative compare_snapshots benchmark/profile first. Do not use predecessor checks, synthetic timing, source-neutral retriggers, self-approval, force updates, or gate weakening as merge evidence.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}