fix(population): reject int64 narrowing overflow

[seonghobae]

Defect

_compact_population_labels() historically validated external population labels through binary64 before signed-int64 admission. That creates scientific/data-integrity risk before population compaction: values outside the signed-64 domain can saturate/wrap into a valid-looking group identity, while a valid wider floating-point value such as exact np.longdouble(INT64_MAX) can be rounded upward to 2**63 and rejected even though it fits the Rust-owned signed-64 contract.

Because multigroup calibration identifies compact group 0 as the reference population, label narrowing is part of the model-identification boundary rather than cosmetic input validation.

Test-first / review-driven lineage

• Initial overflow hardening 597e9ecc998ab855587cfcb35789f32aae763406: reject unsigned labels above INT64_MAX and floating values at/above the signed-64 boundary before narrowing; preserve exact signed-int64 upper-bound labels.
• Extended-precision RED 8f548c8ec7a7b832fb59953fe13d05a7d9619b62: prove exact np.longdouble(INT64_MAX) remains admissible when the platform provides precision beyond binary64; make the Python-sequence boundary regression independent of NumPy's version/platform-specific promotion choice.
• Extended-precision GREEN a7e560462263e8590d6ddab6dfe68c66173b1ed8: validate floating labels in their source dtype, compare 2**63 in that same dtype, and require the signed-int64 result to round-trip in the original floating dtype. Unsigned labels retain the explicit INT64_MAX guard.
• Narrow-float warning RED 6675615230389ffc7136be904dae8df50b87ec69: require ordinary finite float16 labels to remain valid under warnings-as-errors; constructing a 2**63 sentinel directly in float16 otherwise emits an overflow warning even though no finite float16 value can approach the signed-64 boundary.
• Narrow-float GREEN/current source head 84e169e034b720cfda853cb970e2ebd468697a9a: construct the dtype-specific 2**63 boundary only for floating dtypes whose exponent range can reach it (np.finfo(dtype).maxexp > 63). Smaller floating dtypes rely on the existing finite/integral checks and lossless signed-int64 round-trip.

Preserved contract

Valid sparse/non-contiguous labels and exact signed-64 identities remain compacted deterministically. Binary64 2**63, unsigned values above INT64_MAX, non-finite, negative, fractional, or lossy labels fail closed. Wider floating dtypes may represent valid signed-64 integers without needless binary64 narrowing; smaller floating dtypes do not emit irrelevant boundary-construction warnings.

Python changes validation/marshalling only. Multigroup/multilevel likelihood, population estimation, optimizer, uncertainty, recovery, and all result-affecting psychometric/statistical arithmetic remain unchanged and Rust-owned.

Exact integration boundary

Protected base immediately before this lifecycle write: main@0827dfa634b0a54c6a330f858801a80537ba6951.
Exact source/test head immediately before this write: 84e169e034b720cfda853cb970e2ebd468697a9a, open, non-Draft, mergeable.

Fresh repository-local runs for this exact head are regenerating: CI is pending; CodeQL, Security Scan, and SAST Semgrep are queued. Formal reviews remain COMMENTED-only with no independent APPROVED review. The extended-precision correctness finding is resolved; predecessor-head reviews/checks remain historical.

Require exact-current-head repository CI/security/static-analysis plus every applicable protected central coverage-evidence, opencode-review, Python/Rust/package/fuzz, dependency/SBOM/provenance context and effective independent approval before merge. No gate weakening, review dismissal, force update, or self-approval is used.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bf81e6b2-6fd4-440d-93b2-00f26cd3af37

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change validates population labels before signed int64 conversion. Values outside the supported range raise ValueError. A regression test and security changelog entry document this behavior.

Changes

Population label boundary validation

Layer / File(s)	Summary
Validate population label boundaries python/fast_mlsirm/fit.py, tests/test_population_label_int64_roundtrip.py, docs/changelog.d/population-label-int64-boundary.md	_compact_population_labels rejects unsigned and floating-point labels outside the signed 64-bit range before conversion. The regression test covers 2**63, and the changelog records the boundary behavior.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to 597e9

The change correctly rejects overflowing population labels, but it may also reject valid int64 labels supplied with extended floating-point precision; merge is reasonable with owner awareness and follow-up coverage for that input type.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main fix: rejecting overflow when population labels narrow to int64.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/population-label-int64-overflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head Checks RCA\n\nThe current Python 3.12 failure (job 97465663980) reproduces only the two protected-main predecessor failures already isolated in dependency PR #1324: test_rust_toolchain_contract.py asserts 5 == 4, and test_scoring_contract_metadata.py reports DID NOT RAISE ValueError. The population int64 narrowing change itself is not implicated by this log. Auto-merge remains armed; after #1324's normal protected merge, the base/update path must rerun this exact head. No check was weakened or bypassed.