test(reliability): bound buyer-packet Git metadata lookup

[seonghobae]

Reliability gap

Advances #555 with a disjoint buyer-evidence-packet subprocess slice from exact protected main a7be9eb8ca0b807364173f8471fc300e3cf9350f.

scripts/build_buyer_packet.py::_source_commit() currently invokes local git rev-parse HEAD without a per-operation timeout and catches every exception into "unknown". A hung Git child can therefore consume the surrounding runner until an outer job timeout, and a real subprocess.TimeoutExpired is silently converted into apparently usable provenance.

Intentional fail-first contract

tests/test_buyer_packet_git_metadata_timeout.py requires:

• the local Git metadata subprocess receives a package-owned positive deadline no greater than 30 seconds;
• TimeoutExpired fails closed as exact stable RuntimeError("source commit lookup timed out") without reflecting child output/error/command text;
• successful lookup preserves stripped commit output; and
• ordinary non-timeout Git failures preserve the historical "unknown" fallback.

This first commit changes tests only. Keep Draft until GitHub CI proves the intended RED at the production boundary. Then implement the smallest root-cause correction in scripts/build_buyer_packet.py, add concise subprocess reliability doctoring plus an authoritative changelog fragment, render/check CHANGELOG.md, and require focused then full exact-head CI/Security/SAST/review evidence.

Scope boundary

Do not change packet contents, acquisition valuation semantics, numerical/psychometric code, workflows/dependencies, package version, canonical #604/#621 documentation, or the adjacent active subprocess slices in #666/#667/#578. Python/GitHub outer job ceilings are not substitutes for this bounded local operation.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7438af72-38fe-4fc9-8948-debfe6357461

📥 Commits

Reviewing files that changed from the base of the PR and between 384516b and 97d19f2.

📒 Files selected for processing (2)

• scripts/build_buyer_packet.py
• tests/test_buyer_packet_git_metadata_timeout.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Sole bounded GREEN writer for Draft #669. Final pre-write guard is mandatory: refetch exact PR head, independently resolve protected main, inspect comments/reviews, and refetch scripts/build_buyer_packet.py plus the focused tests. Proceed only if source head is still eb51d0b6080be498d583d66c2bb5b3f5714c66ab, protected main is still a7be9eb8ca0b807364173f8471fc300e3cf9350f, and no other source writer targets this branch/path; abort rather than race if anything moved.

Exact fail-first proof is complete. CI run 31422344514, Python job 93565855190, synthetic merge eaaf8ea1e27dd1811ea7c7feb4bd3dfe5ebeebea completed 2 failed, 2949 passed, 2 skipped. The ONLY failures are the new buyer-packet Git-metadata regressions: TimeoutExpired is swallowed into "unknown", and successful git rev-parse HEAD receives no bounded timeout. Existing buyer-packet behavior is otherwise GREEN. Rust/PyO3, package/reinstall/release acceptance, GPU-smoke, fuzz, Security Scan 31422344435, and SAST 31422344544 are GREEN. The unrelated _log_sigmoid RuntimeWarning is #583/#564 and must not be changed here.

Implement the minimum GREEN only:

1. In scripts/build_buyer_packet.py, define a clearly named package-owned local Git metadata deadline (positive and <=30 seconds; choose a defensible small local-command value and document it).
2. Pass that deadline to the existing subprocess.run(["git", "rev-parse", "HEAD"], ...) call.
3. Catch subprocess.TimeoutExpired explicitly before the existing non-timeout fallback and fail closed with exactly RuntimeError("source commit lookup timed out") from None; never echo child stdout/stderr, command text, repo paths, or exception payload.
4. Preserve successful stripped commit identity exactly. Preserve the historical "unknown" fallback for ordinary non-timeout Git/OS failure; do not broaden this slice into packet contents or acquisition-value semantics.
5. Run tests/test_buyer_packet_git_metadata_timeout.py plus existing tests/test_buyer_evidence_packet.py, meaningful changed-production branch/statement coverage, formatting and git diff --check.
6. Add concise reliability doctoring grounded in current Python subprocess documentation and GitHub Actions timeout documentation, with APA 7 references and no claim that the chosen local deadline is a scientific runtime limit. Add an authoritative docs/changelog.d/555-buyer-packet-git-metadata-timeout.md fragment only after product GREEN.
7. Render/check managed CHANGELOG.md, then run the full applicable Python/Rust/PyO3/package/GPU/fuzz/Security/SAST gates on one unchanged final head. Keep Draft and stop source writes after one coherent verified GREEN series so current-head review/merge governance returns to the maintainer loop.

Do not touch #604/#621 canonical docs, dependencies/workflows, package version/release, psychometric/numerical code, reviewer authority, or adjacent #555 slices (#578/#657/#666/#667/#670).

[github-actions]

자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요.

[seonghobae]

Superseded by unified Git metadata timeout fix PR (see fix/git-metadata-timeouts-unified).