fix(crm): bound response structural traversal

[seonghobae]

Closes #1366.

Defect

crm._trusted_response_array() already rejected callback-bearing response carriers, active-path cycles, and evidence above the 20,000,000 logical-cell envelope before NumPy materialization. Exact built-in list/tuple traversal still had no independent structural-work ceiling, so malformed zero-cell/deep container fan-out could consume unbounded Python traversal while contributing no logical response cells.

RED → GREEN

• RED 5d8965445c69dbd465a8a65d6201eb12d9d116d4: a nine-node empty-container fan-out with a test-only structural ceiling of eight must fail with zero np.asarray(...) and compiled-core calls.
• GREEN 1e336ccfd273041e1a431e46053286099ebb5df2: add a structural-visit counter bounded at 2 × the existing logical-cell ceiling during callback-free exact built-in traversal.
• Compatibility proof 537af70905e71155c8cc41d7bea8100d2455c9ef: with a two-cell logical ceiling and four-node structural ceiling, a valid two-person × one-item built-in response matrix still reaches the Rust boundary unchanged.
• Governed evidence/current source head b4e00a17f7a9ad9efda16fd5aae791950c3fd579 records the resource contract.

For every valid non-empty 2-D built-in persons×items matrix with N scalar cells, traversal visits at most N row entries plus N scalar entries, so the 2N structural envelope preserves the complete valid matrix domain inside the existing logical-cell limit while bounding malformed container-only work.

Existing cycle rejection, shared acyclic subtree handling, exact NumPy row/scalar compatibility, complex/non-real/object/text diagnostics, NaN-only missingness, and logical-cell accounting remain unchanged.

Scientific ownership

Python validation/bounded materialization only. Samejima CRM likelihood, Gauss-Hermite integration, marginal-ML EM/WLS item updates, identification, convergence, uncertainty, EAP scoring, and all other production psychometric/statistical arithmetic remain unchanged and Rust-owned.

Fresh integration boundary

Protected base immediately before PR creation is main@9c12eab15fb8a187b135f9be1961f0693a431c23. Exact branch head is b4e00a17f7a9ad9efda16fd5aae791950c3fd579. Fresh same-scope PR/branch checks found no competing CRM response-admission writer. All predecessor checks/reviews are non-transferable; keep Draft until exact-current-head repository and applicable protected central acceptance evidence are complete. No gate weakening, self-approval, force update, destructive rebase, or Python numerical substitute is used.

Summary by CodeRabbit

• Bug Fixes

  • Improved validation of CRM response matrices by rejecting excessively deep or wide built-in list and tuple structures before processing.
  • Added clearer handling for malformed structures that exceed structural limits, while preserving support for valid matrices and existing missing-value behavior.

• Tests

  • Added coverage confirming oversized structures are rejected safely and valid responses continue to work correctly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2fa9f8ae-85d2-4ac9-b35d-79ca0d9c0672

📥 Commits

Reviewing files that changed from the base of the PR and between d77505e and 1eb21d3.

📒 Files selected for processing (3)

• docs/changelog.d/1366-crm-structural-budget.md
• python/fast_mlsirm/crm.py
• tests/test_crm_response_admission.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CRM response validator now limits structural traversal of built-in list and tuple containers to 40,000,000 visits. Tests cover rejection before NumPy or native-core processing and preserve valid matrix marshalling.

Changes

CRM structural admission

Layer / File(s)	Summary
Bound built-in response traversal python/fast_mlsirm/crm.py	Adds a structural budget equal to twice the 20,000,000-cell limit. The validator counts traversed children and raises a distinct ValueError when the budget is exceeded.
Validate rejection and compatibility tests/test_crm_response_admission.py, docs/changelog.d/1366-crm-structural-budget.md	Tests reject excessive empty-container fanout before NumPy conversion or compiled-core discovery. A valid two-row built-in matrix remains admissible and preserves native argument marshalling. The changelog documents the behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1eb21

This change bounds malformed response traversal before materialization without changing valid response handling; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: bounding CRM response structural traversal.
Linked Issues check	✅ Passed	The changes satisfy issue #1366 by adding an independent structural-visit budget, rejecting excessive empty-container fanout before NumPy materialization and compiled-core discovery, preserving existi…
Out of Scope Changes check	✅ Passed	The code, regression tests, and changelog entry are directly related to the structural traversal defect in issue #1366. No unrelated changes are identified.

Full details: Linked Issues check

Explanation

The changes satisfy issue #1366 by adding an independent structural-visit budget, rejecting excessive empty-container fanout before NumPy materialization and compiled-core discovery, preserving existing response validation behavior, and leaving CRM numerical computations unchanged.

Full details: Docstring Coverage

Explanation

Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/crm-structural-budget-1366

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devin-ai-integration]

Devin Review found 1 potential issue.