fix(accuracy): bound fixture decode resources

[seonghobae]

Summary

• Bound Tier 1 accuracy fixture bytes before checksum staging.
• Validate WAV channel count, sample rate, and duration from the header before PCM allocation.
• Add fail-closed coverage for header/read errors and file growth after stat.

Exact current identity

• Stacked base: cursor/bc-d6780991-1682-480d-b362-be2cddbcd28e-bb43@9f50f446bb42b7ad1becf5377cdffd9b10e37b40 (current fix(analysis): score C major acceptance from decoded WAV bytes #892 head)
• Exact head: c20e90783dcc3cc04824042cbac2734b1985772f
• The latest fix(analysis): score C major acceptance from decoded WAV bytes #892 dependency/runtime commits were merged into this branch with a normal local merge; no force-push was used.

Verification

• Targeted accuracy acceptance: 43 passed.
• Full Python suite at the exact head: 768 passed, 24 skipped, production statements/branches/functions/lines 100.00%.
• ruff, mypy, supply-chain, documentation, security-note, and git diff --check passed.
• The targeted command used for the 43 tests intentionally omitted full-suite coverage enforcement; the full-suite command is the 100% coverage evidence above.

Security Notes

The acceptance path treats fixture bytes and decoder metadata as untrusted. It adds no network, shell, IPC, or runtime analysis authority. A 100 MiB byte cap, eight-channel cap, 192 kHz sample-rate cap, and 15-minute duration cap run before hashing or decoded PCM scoring; reports still contain only SHA-256 and labels. File growth after stat, header inspection failure, and decoder limits fail closed.

Merge gate

This remains stacked on draft PR #892 and must not be treated as a protected develop merge. Keep it unmerged until the exact current head has terminal-success applicable checks, current-head review, zero valid unresolved findings, and normal stacked-branch governance.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d8efbd7-ab30-46d4-8f56-b282ea95596b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}