fix(multilevel): reject hostile numeric callbacks

[seonghobae]

Reliability/security defect

Protected main accepted subclasses of built-in int/float for multilevel membership_weight and stationary AR coefficients, then coerced them with float(value). A hostile numeric subclass could therefore execute caller-controlled __float__ code inside a package-owned validation boundary and leak its arbitrary exception instead of the stable MultilevelContractError contract.

Test-first RED

Fail-first exact head 0580fee690fa03e750e7284fa1700e5df2aba197 was evaluated on synthetic merge 0e52c0002ff3a7c837be1214715faac3fe53ad17 over protected main c91ae210bc8e0340a5b0587cf5289b82a2e8ab92.

CI run 31564180125, Python 3.14.6 job 94012520401, reached the complete public test boundary and finished 7 failed, 3458 passed, 2 skipped. Five failures were inherited protected-main documentation/fit-statistics inconsistencies. The remaining exact two failures were the intended REDs in tests/test_multilevel_hostile_numeric_callbacks.py: build_context_membership(...) and build_longitudinal_state_spec(...) dispatched hostile __float__ callbacks and leaked their caller exception.

Narrow GREEN

Current exact source head: 35bb61f7d70d1ba4993d3bb2f9397ce5b7e7b5a0 on protected base c91ae210bc8e0340a5b0587cf5289b82a2e8ab92.

The production correction remains limited to python/fast_mlsirm/multilevel/_validation.py:

• accept only exact built-in int or float at these scalar contract boundaries;
• reject Boolean values and numeric subclasses before conversion callbacks can run;
• preserve finite/range checks and ordinary built-in numeric semantics;
• preserve stable non-reflective MultilevelContractError codes/paths;
• add no Python estimator and change no multilevel formula or Rust numerical ownership.

Exact-current verification

CI run 31564554574 is terminal on the unchanged exact head. Python 3.14.6 job 94013619930 collected the complete suite; both permanent hostile-callback regressions are GREEN and the final result is 5 failed, 3460 passed, 2 skipped. Python 3.12 failed on the same inherited five-test family.

The remaining five failures are outside this two-file slice and reproduce the protected-main baseline line: two canonical documentation-maturity contract literals plus three historical NumPy-fallback expectations that contradict protected-main Rust fail-closed S-X²/person-fit ownership. Rust workspace/PyO3, package/reinstall, fuzz, explicit GPU smoke/parity, Security Scan, and SAST Semgrep succeeded on this exact head.

Merge boundary

Keep Draft. The slice-owned REDs are GREEN, but required repository-wide Python evidence remains non-passing until the protected-main baseline correction integrates. Do not mutate unrelated canonical documentation/fit-statistics paths or restore Python numerical fallbacks here. After the live base moves, regenerate every base-sensitive check/review on the unchanged final head before Ready/merge.

Refs #565.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 093edc8d-f10c-4685-aecd-0af904c9d9f7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by GREEN on current main.