perf: 마지막 유효 리뷰 라벨을 단일 역방향 스캔으로 찾기

.jules/bolt.md

@@ -1,4 +1,4 @@
-## 2024-05-19 - Pre-compile regex patterns to optimize deep label-scanning loops
+## 2026-06-27 - Pre-compile Regex Patterns for Deep Label Scanning
 **Learning:** Found a codebase-specific anti-pattern in `scripts/ci/opencode_review_normalize_output.py` where deep label-scanning loops over long review texts were redundantly recompiling regexes for verification labels inside the `label_matches` inner function. This caused measurable overhead in the CI review script.
 **Action:** When performing deep text inspection using repetitive substring or pattern matching across a known set of keys or labels, pre-compile the regex objects at the module level.
 ## 2024-06-21 - Python JSON Decoding Optimization
@@ -19,9 +19,6 @@
 ## 2026-06-25 - Avoid N+1 API blocking in PR checks
 **Learning:** In backend processing scripts, synchronous iterations calling an external service, such as fetching `restMergeableState` per PR, cause N+1 API bottlenecks and stall pipeline execution linearly. This matters for PR schedulers handling multiple PRs.
 **Action:** Use `concurrent.futures.ThreadPoolExecutor` for independent network calls in a loop when there are multiple items, keep empty and single-item inputs on the cheaper serial path, and bound `max_workers` to avoid API rate limits.
-## 2026-06-25 - Avoid N+1 API blocking in PR checks
-**Learning:** In backend processing scripts, synchronous iterations calling an external service, such as fetching `restMergeableState` per PR, cause N+1 API bottlenecks and stall pipeline execution linearly. This matters for PR schedulers handling multiple PRs.
-**Action:** Use `concurrent.futures.ThreadPoolExecutor` for independent network calls in a loop when there are multiple items, keep empty and single-item inputs on the cheaper serial path, and bound `max_workers` to avoid API rate limits.
 ## 2024-05-19 - Pre-compile Regex Patterns in Loop-called Functions
 **Learning:** In `scripts/ci/pr_review_merge_scheduler.py`, the `scrub_sensitive_data` function was repeatedly compiling multiple regex patterns via `re.sub` for every log line or text scrubbed. This incurs measurable overhead due to cache lookups and object recreation in tightly looped string processing.
 **Action:** When using multiple regex replacements inside functions that are called frequently or process large amounts of text, define and pre-compile the regex objects at the module level (e.g., `SENSITIVE_DATA_SCRUB_PATTERNS`) and iterate over them using `pattern.sub()`.
@@ -51,6 +48,11 @@
 ## 2026-08-29 - [대용량 텍스트 스캔 시 정규표현식 대신 네이티브 메서드 활용]
 **Learning:** `scripts/ci/opencode_review_normalize_output.py`의 라벨 스캐닝 루프에서 긴 LLM 리뷰 텍스트를 대상으로 `pattern.finditer()`를 호출하는 패턴이 있었습니다. 마이크로 벤치마크 결과, 단순 문자열 매칭에서는 네이티브 `str.find()`와 `while` 루프를 조합하는 것이 정규표현식 실행 오버헤드 없이 훨씬 빠르다는 것을 확인했습니다.
 **Action:** 내부 탐색 루프에서 정확히 일치하는 리터럴 문자열(라벨 접두사 등)을 검색할 때는 `re.compile(re.escape(string)).finditer()` 대신 고도로 최적화된 Python 네이티브 `text.find(candidate, index)` 메서드를 사용하십시오. 단, 무한 루프를 방지하기 위해 루프의 모든 분기에서 인덱스가 올바르게 진행되도록 보장해야 합니다.
+
 ## 2026-09-01 - 대용량 문자열 서브스트링 스캐닝 루프 최적화
 **Learning:** 긴 텍스트에서 여러 기준 문자열(`candidate`)을 탐색하여 다음 구역의 시작점을 찾을 때, 텍스트 전체에 대해 반복적으로 `text.find(candidate)`를 호출하면 O(N)의 비효율적인 중복 스캐닝 오버헤드가 발생합니다. 특히 가장 가까운 시작점을 찾기 위해 모든 후보를 스캔할 때 이 문제가 심화됩니다.
 **Action:** 기준점(`start`)을 잡은 후, `idx = text.find(candidate, start, end)`를 사용하여 검색 범위를 동적으로 축소(`end = min(end, idx)`)하십시오. 이렇게 하면 불필요한 스캐닝 오버헤드를 막고 검색 범위를 안전하게 줄여 매우 큰 성능 향상을 얻을 수 있습니다.
+
+## 2026-10-04 - 마지막 라벨을 단일 역방향 스캔으로 찾기
+**Learning:** `opencode_review_normalize_output.py`의 `label_section`은 `str.find()`를 반복해 모든 일치 위치를 Python 목록에 저장한 뒤 마지막 위치를 선택했습니다. 전체 시간 복잡도는 기존 구현과 `str.rfind()` 구현 모두 O(N)이지만, 단일 역방향 스캔은 Python 반복과 일치 위치 목록 할당을 줄입니다.
+**Action:** 마지막 리터럴 일치만 필요하면 `str.rfind()`를 사용하되, 이를 O(N) 제거로 표현하지 마십시오. 접두사 충돌(예: `coverage:`와 `docstring coverage:`)은 역방향으로 이전 일치를 계속 검사하고 계약 테스트로 보존하십시오.

CHANGELOG.md

@@ -1,3 +1,25 @@
+### Verification labels require standalone token boundaries
+
+- The central review normalizer now rejects required labels embedded in larger
+  identifiers such as `nocoverage:` and `notperformance:`. One shared predicate
+  protects reverse section selection, forward section termination, and the
+  verification-posture presence gate while retaining the intentional
+  `docstring coverage:` collision rule. RED commit `9a2ec91a` reproduces the
+  fail-open paths; the repaired module has 100% statement, branch, and
+  public-doc coverage. Hosted exact-head Checks and independent approval remain
+  required before protected integration.
+
+### Git lineage tests again use real repository evidence
+
+- Removed PR #2576's module-wide `subprocess.run` replacement after a RED
+  contract proved that it accepted a nonexistent nonzero commit as published
+  lineage. The boundary suite now executes real `git cat-file` and
+  `git merge-base --is-ancestor` results. The `rfind()` optimization is also
+  documented accurately as O(N), with reduced Python-loop and match-list
+  overhead rather than an elimination of linear scanning. Exact-tree evidence
+  is 144 focused tests with 100% statement/branch coverage for the changed
+  production module, plus 5,159 repository tests, 11 skips, and 40 subtests.
+  Hosted exact-head Checks and qualifying independent review remain required.
 ### Intel macOS native archives are bound to x86_64 bytes
 
 - The release prescreener now requires every native member in an Intel macOS

docs/product-technical-gap-baseline.md

@@ -7,6 +7,18 @@
 
 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다.
 
+### 2026-10-09 review-label token-boundary delta
+
+| Gap ID | 상태 | exact-tree evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-REVIEW-LABEL-TOKEN-BOUNDARY-01 | **Source repaired on Draft `.github#2576`; protected integration pending** | RED `9a2ec91ad9f1f6c91000e02174ddad00d1c9b575` proves that `nocoverage:`, `undercoverage:`, `rediscoverage:`, and `notperformance:` were accepted as standalone verification labels. The forward scan also truncated a valid coverage section at an embedded suffix, while a summary with every label prefixed by `not` satisfied the posture gate. GREEN uses one native boundary predicate for reverse selection, forward termination, and required-label presence. Focused normal and `GITHUB_ACTIONS=true` runs pass 114 tests; the changed module covers 750 statements and 362 branches at 100%, with 100% public-doc coverage. The warnings-as-errors repository suite passes 5,162 tests, 11 skips, and 40 subtests after deselecting two fixed-date CodeQL fixture failures that reproduce unchanged on parent `8b94e1ba`; the PR body remains the authority for the published exact head. | Canonical owner is central `.github/scripts/ci/opencode_review_normalize_output.py`; #2576 preserves executable mode `100755` and carries #2593's valid direct `docstring coverage:` regression intent. Keep #2576 Draft until exact-current-head hosted checks and a qualifying independent approval exist. Repair the two parent-reproduced CodeQL fixture time bombs in their own bounded owner lane; do not treat them as source evidence against this parser fix or bypass them at merge time. |
+
+### 2026-10-07 Git lineage test-integrity delta
+
+| Gap ID | 상태 | exact-tree evidence | causal owner / next gate |
+|---|---|---|---|
+| CONTROL-G17-REAL-GIT-LINEAGE-01 | **Source repaired on Draft `.github#2576`; protected integration pending** | RED `651968a1eb13eb64e854975f1b86c38c57bcc390` replaced a documented G-17 SHA with the nonexistent nonzero value `1111…1111` and reproduced `DID NOT RAISE`: the PR's module-wide autouse fixture returned success for every nonzero SHA. GREEN `1e07bc9939a1ecf3c614ef2b5b001b165558c8a0` removed that fixture so the guard again executes real `git cat-file` and `git merge-base --is-ancestor`. The ordinary two-parent restack at `54c9d092a10a39339db430f34329ac7ee1015a78` has tree `c5da05a91693d8a17a856b37a126835880c89ea8`, is zero commits behind protected `main` `7554587c2e3106a388998bcad048a3d7121de25e`, and passed 144 focused tests with 100% statement/branch coverage for `opencode_review_normalize_output.py`; the warnings-as-errors repository suite passed 5,159 tests, 11 skips, and 40 subtests. | The central `.github` test-control boundary owns published-lineage verification. Keep the PR Draft until its post-documentation exact head has terminal hosted security/runtime Checks, no unresolved actionable review, and qualifying independent current-head approval. Predecessor-head Python Security/SAST failures had zero recorded steps and no log blob, so they are runner-admission evidence, not source failures and not a basis for blind rerun or bypass. The PR body is the authority for the live exact head after this row changes the tree. |
+
 ### 2026-09-19 exact-head incident delta
 
 | Gap ID | 상태 | exact-head evidence | causal owner / next gate |

scripts/ci/opencode_review_normalize_output.py

@@ -935,6 +935,26 @@ def mentions_actual_changed_file(reason: str, summary: str) -> bool:
     return any(changed_file in combined for changed_file in changed_files)
 
 
+def _label_match_is_embedded(text: str, index: int, label: str) -> bool:
+    """Return whether one label match is embedded in a larger token."""
+    return (
+        index > 0 and (text[index - 1].isalnum() or text[index - 1] == "_")
+    ) or (
+        label == "coverage:"
+        and text[max(0, index - len("docstring ")) : index] == "docstring "
+    )
+
+
+def _contains_standalone_label(text: str, label: str) -> bool:
+    """Return whether text contains a label outside larger tokens."""
+    index = text.find(label)
+    while index != -1:
+        if not _label_match_is_embedded(text, index, label):
+            return True
+        index = text.find(label, index + len(label))
+    return False
+
+
 def mentions_verification_posture(reason: str, summary: str) -> bool:
     """Return whether an approval records the concrete review surfaces checked."""
     combined = f"{reason}\n{summary}".casefold()
@@ -947,26 +967,27 @@ def mentions_verification_posture(reason: str, summary: str) -> bool:
         # Handle no-op PRs with empty/no changed files where deep verification labels may be omitted by model.
         return True
     return (
-        all(label in combined for label in APPROVAL_VERIFICATION_LABELS)
+        all(
+            _contains_standalone_label(combined, label)
+            for label in APPROVAL_VERIFICATION_LABELS
+        )
         and "codegraph" in combined
     )
 
 
 def label_section(text: str, label: str) -> str:
     """Return text after a verification label until the next known label."""
-    # ⚡ Bolt: Fast path starts using native find, avoiding nested O(N) regex evaluation
-    starts: list[int] = []
-    index = text.find(label)
+    # One reverse scan avoids the prior Python loop and list of every match.
+    index = text.rfind(label)
     while index != -1:
-        if label == "coverage:" and text[max(0, index - 10) : index] == "docstring ":
-            index = text.find(label, index + len(label))
+        if _label_match_is_embedded(text, index, label):
+            index = text.rfind(label, 0, index)
             continue
-        starts.append(index)
-        index = text.find(label, index + len(label))
+        break
 
-    if not starts:
+    if index == -1:
         return ""
-    start = starts[-1] + len(label)
+    start = index + len(label)
 
     end = len(text)
     # ⚡ Bolt: Dynamically shrink the search window to prevent O(N) redundant scanning overhead
@@ -976,10 +997,7 @@ def label_section(text: str, label: str) -> str:
 
         idx = text.find(candidate, start, end)
         while idx != -1:
-            if (
-                candidate == "coverage:"
-                and text[max(0, idx - 10) : idx] == "docstring "
-            ):
+            if _label_match_is_embedded(text, idx, candidate):
                 idx = text.find(candidate, idx + len(candidate), end)
                 continue
             end = min(end, idx)

tests/test_github_api_url_boundary.py

@@ -76,6 +76,7 @@ def _unexpected_open(*_args: Any, **_kwargs: Any) -> Any:
     pytest.fail("rejected GitHub API authority reached opener")
 
 
+
 def _assert_g17_evidence_is_published(baseline: str) -> None:
     """Require every full G-17 evidence SHA to resolve in current published ancestry."""
     rows = [line for line in baseline.splitlines() if line.startswith(G17_ROW_PREFIX)]
@@ -276,3 +277,18 @@ def test_doctoring_qualifies_foreign_semgrep_revision_owner() -> None:
     )
 
     assert expected_link in doctoring
+
+
+def test_published_lineage_guard_rejects_nonzero_unpublished_g17_evidence() -> None:
+    """A nonzero commit-shaped but unpublished G-17 identifier must fail closed."""
+    baseline = Path("docs/product-technical-gap-baseline.md").read_text(
+        encoding="utf-8"
+    )
+    mutated = baseline.replace(
+        "57477289ebec5631b0c48f0bc419f336dbe19deb",
+        "1111111111111111111111111111111111111111",
+        1,
+    )
+
+    with pytest.raises(AssertionError, match="not published"):
+        _assert_g17_evidence_is_published(mutated)

tests/test_opencode_review_normalize_output.py

@@ -1375,6 +1375,10 @@ def test_label_and_full_coverage_detection(tmp_path, monkeypatch):
         "performance: FAST docstring coverage: 100% something else coverage: 100%"
     )
     assert norm.label_section(text_coverage, "performance:") == " FAST "
+    assert (
+        norm.label_section("coverage: first docstring coverage: second", "coverage:")
+        == " first "
+    )
     assert norm.mentions_full_coverage("", FULL_SUMMARY)
     no_source_summary = FULL_SUMMARY.replace(
         "coverage execution evidence proves 100% test coverage",
@@ -1434,6 +1438,31 @@ def test_label_and_full_coverage_detection(tmp_path, monkeypatch):
     )
 
 
+@pytest.mark.parametrize("identifier_prefix", ["no", "under", "redis"])
+def test_coverage_label_rejects_identifier_suffixes(identifier_prefix):
+    """Identifier suffixes must not satisfy the standalone coverage label."""
+    summary = FULL_SUMMARY.replace(
+        "Coverage:", f"{identifier_prefix}coverage:", 1
+    )
+
+    assert norm.label_section(summary.casefold(), "coverage:") == ""
+    assert not norm.mentions_full_coverage("", summary)
+
+
+def test_embedded_label_does_not_end_the_current_section():
+    """An identifier suffix must not truncate a preceding valid section."""
+    text = "coverage: verified notperformance: forged docstring coverage: verified"
+
+    assert norm.label_section(text, "coverage:") == " verified notperformance: forged "
+
+
+def test_verification_posture_rejects_identifier_suffix_labels():
+    """Every required verification label must have a standalone token boundary."""
+    summary = "\n".join(f"not{line.casefold()}" for line in FULL_SUMMARY.splitlines())
+
+    assert not norm.mentions_verification_posture("", summary)
+
+
 def test_check_structural_approval_rejects_invalid_or_unsafe_approvals(
     tmp_path, monkeypatch
 ):