fix(report): replay essay title trust boundary on current review workflow

[seonghobae]

Supersedes #981 without changing its corrected product tree.

Exact source head: e2d5e0ebfe11d9b842a88f4773dbad3d4c577ccb. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on this SHA, with no unresolved review threads.

The three public essay HTML renderers admit only exact built-in strings (or None) before .strip()/escaping, so caller str subclasses cannot execute text callbacks. Existing blank-title validation and HTML escaping remain intact; scoring/calibration likelihoods, optimizers, and other psychometric arithmetic are unchanged and remain Rust-owned.

#981's formal OpenCode CHANGES_REQUESTED is solely central coverage-evidence run 32124690362. This successor creates a fresh pull-request event for the current central workflow without source churn, force-push, review dismissal, or gate weakening.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 15 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 34557ef2-9a90-4b56-907d-a8dfa5f59132

📥 Commits

Reviewing files that changed from the base of the PR and between 04d0bc2 and e2d5e0e.

📒 Files selected for processing (5)

• docs/changelog.d/980-essay-report-title-trust-boundary.md
• python/fast_mlsirm/scoring/essay/calibration_report_html.py
• python/fast_mlsirm/scoring/essay/report_html.py
• python/fast_mlsirm/scoring/essay/validation_report_html.py
• tests/test_essay_report_title_trust_boundary.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by combined #997 after normal non-force reconciliation in #1010.

Fresh identities at closure:

• this PR exact head: e2d5e0ebfe11d9b842a88f4773dbad3d4c577ccb;
• combined fix(report): harden essay titles and semantic row headers #997 exact head: 017b22f1a5a5603e2207e7a2861fdae1f1476ae8.

#997 preserves this complete three-renderer exact-built-in title admission, hostile-title regression, and title changelog fragment, and adds the compatible semantic row-header call sites, regression, and WCAG doctoring. Keeping both open would create two landing vehicles for the same title-boundary source changes. Do not merge both.