fix(conformance): reject excessive JSON nesting before decoder

[seonghobae]

Closes #1329.

Defect

ConformanceInventory.from_json() enforces UTF-8 and byte-size admission and validates parsed-container nesting after json.loads(...), but a deeply nested syntactically valid manifest could enter Python's recursive decoder before the package-owned MAX_MANIFEST_NESTING contract was applied.

The prior attempt in #1319 was not reused as a branch: its live head had been incompatibly reconstructed to revert protected-main functionality and had lost its focused regression/changelog. #1319 was closed unmerged. This PR replays only the validated JSON-depth intent from a clean protected-main lineage.

RED → GREEN lineage

• RED c773c2f6f96e630f3dd49a5ac66d466fef3f4b76: monkeypatch json.loads and prove over-budget structural nesting fails before the decoder; pin the exact depth boundary and quoted-string/escape behavior.
• GREEN 3c383b889bf58a10efa3435e1264bc2a0fa60f6b: add raw structural-depth scanning after exact text/UTF-8/byte admission and before json.loads.
• Governed evidence 4fa1288d48dbec52ab361744585366e8f5085345.

The existing duplicate-member rejection, non-finite constant rejection, iterative post-parse depth validation, strict manifest replay, canonicality, and inventory-fingerprint checks remain unchanged.

Concurrent lineage reconciliation

The branch later advanced compatibly to exact head 961e416fc0f0550665c017a30edf0e3b866c7c1c by incorporating unrelated statistical-study/recovery/CI-contract changes. Comparing that live head against current protected main@66bec7e551eb82dd41338deb5c8374ff4557ceef leaves the effective conformance delta exactly three files: python/fast_mlsirm/cross_engine_conformance.py, tests/test_cross_engine_conformance_json_depth.py, and docs/changelog.d/1329-conformance-json-depth.md (8 commits ahead / 2 behind, merge base c26dac4bcdb7d600a2688c3e74eb4a68c0b45620). The later main release-cut/accessibility commits do not overlap this conformance surface.

Scope / scientific ownership

Python security/replay validation only. No likelihood, estimator, scoring, uncertainty, recovery, cross-engine discrepancy arithmetic, or other production psychometric/statistical calculation changes. Rust-first numerical ownership is unaffected.

Current integration boundary

This PR is now Ready for review, open and mergeable at exact head 961e416fc0f0550665c017a30edf0e3b866c7c1c. Exact-head repository-local CI, Security Scan, CodeQL, and SAST Semgrep are all terminal success; formal reviews and review threads were empty immediately before the Ready transition.

Ready is not merge authority. The branch is two unrelated protected-main commits behind, so base-sensitive/merge-result evidence must be refreshed before landing. Require every applicable protected central coverage/review/package/SBOM/provenance/dependency context and effective independent approval before merge. No force update, gate weakening, review dismissal, or self-approval is used.

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 931eca6e-d160-409f-9e49-df221b779574

📥 Commits

Reviewing files that changed from the base of the PR and between 7006815 and 55815f9.

📒 Files selected for processing (3)

• docs/changelog.d/1329-conformance-json-depth.md
• python/fast_mlsirm/cross_engine_conformance.py
• tests/test_cross_engine_conformance_json_depth.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.