fix(gtheory): harden NumPy scalar trust

[seonghobae]

Scope

Fix #851 at the public G-theory numeric-control marshalling boundary without changing generalizability-theory mathematics.

Protected main treated a NumPy numeric scalar as trusted when it satisfied isinstance(...) and its class __module__ string started with numpy. Caller-defined scalar subclasses can spoof that metadata and override __int__/__float__, so the existing predicate could authorize caller code before Rust numerical dispatch.

Test-first lineage

• RED 2e4ea04b31b9883be74f01de9c7ccbc382925d41 adds public-boundary regressions using caller-defined np.int64 and np.float64 subclasses whose module metadata is spoofed to numpy; rejected values must not execute conversion or representation callbacks and must not reach result-affecting Rust calls.
• GREEN d4b6a09bca142c9ccec20ef0f5c9bd096d49c8a5 replaces module-name trust with exact package-supported NumPy integer/floating scalar type identities while preserving built-in Python controls and genuine NumPy scalar normalization.
• 8c1484921ec47fc28e28b99d5ac7d7cfa31375e3 records canonical release evidence.
• ddd66bf7a7b78c9c3014ece0584b897bd27bec2b adds APA-traced doctoring and separates final NIST SSDF 1.1 from the SSDF 1.2 Initial Public Draft.
• Exact current head f079ccf847409618287735477c0ad4d24beab672 preserves the bounded G-theory validation, regression, changelog and doctoring slice.

Scientific and architecture boundary

• G-theory ANOVA, variance-component, D-study, Phi(lambda), clamping, denominator and coefficient arithmetic remain Rust-owned and unchanged.
• Huebner and Lucht (2019) reference-case ownership is unchanged.
• Python performs validation/marshalling only; no likelihood, estimator, formula, uncertainty, GPU, dependency, provider, database or workflow change is introduced.
• Existing rejection of Boolean, non-positive, non-real and non-finite controls is preserved.

Exact current state

• Protected base: fb67ced09d8ee00542c05d56374537a9a7239751.
• Exact source head: f079ccf847409618287735477c0ad4d24beab672.
• GitHub reports the PR mergeable and Ready for review.
• The exact-head check snapshot is terminal with no failing check; no formal submitted review or unresolved review thread is present.
• Protected integration still requires all then-live required contexts and a qualifying independent non-author approval. Automated evidence does not replace that decision.

No gate is weakened or bypassed. Any future source-head movement invalidates this evidence.

Fixes #851.

Summary by CodeRabbit

• Bug Fixes

  • Strengthened validation for numeric controls to accept only supported NumPy scalar types.
  • Rejected spoofed or caller-defined NumPy scalar subclasses before conversions or callbacks run.
  • Continued rejecting booleans, invalid values, nonpositive integers, and nonfinite numbers.

• Documentation

  • Added documentation and changelog coverage for the enhanced NumPy scalar validation behavior.

• Tests

  • Added regression coverage for spoofed scalar metadata, hostile conversions, representations, hashing, and equality.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: eb1a1b51-50b5-4810-89e7-11b4dbe16c60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 91416e64-6311-4954-b9e5-560bb4d3dca5

📥 Commits

Reviewing files that changed from the base of the PR and between 1f63c2b and 5b9f985.

📒 Files selected for processing (4)

• docs/changelog.d/851-gtheory-numpy-scalar-trust.md
• docs/doctoring/gtheory_numpy_scalar_trust.md
• python/fast_mlsirm/gtheory.py
• tests/test_gtheory_numpy_scalar_subclass_trust.py

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

G-theory numeric validation now uses exact trusted NumPy scalar types. Caller-defined subclasses are rejected before conversion or numerical callbacks. Regression tests cover spoofed metadata, hostile conversions, hashing, and equality behavior. Documentation and a changelog entry record the validation boundary.

Changes

G-theory scalar validation

Layer / File(s)	Summary
Trusted scalar validators python/fast_mlsirm/gtheory.py, docs/changelog.d/851-gtheory-numpy-scalar-trust.md, docs/doctoring/gtheory_numpy_scalar_trust.md	G-theory controls use exact trusted NumPy integer and floating-point types. Positive-integer and finite-real validation retain existing boolean, range, and finiteness checks. Documentation records the boundary.
Callback boundary regressions tests/test_gtheory_numpy_scalar_subclass_trust.py	Tests verify that spoofed subclasses and hostile conversion, representation, hashing, and equality callbacks are rejected before numerical dispatch.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 5b9f9

This localized change hardens NumPy scalar validation at the public G-theory boundary without changing numerical behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related issues

• ContextualWisdomLab/fast-mlsirm issue 879: Addresses the same class of hostile Python/NumPy integer subclass callbacks before native processing.
• ContextualWisdomLab/fast-mlsirm issue 914: Addresses the same validation boundary for hostile subclasses in different functions and controls.

Possibly related PRs

• ContextualWisdomLab/fast-mlsirm#878: Uses exact trusted scalar types to reject caller-defined subclasses before callbacks.
• ContextualWisdomLab/fast-mlsirm#853: Applies similar hostile NumPy scalar and metaclass validation to another API.
• ContextualWisdomLab/fast-mlsirm#922: Allowlists exact built-in and NumPy numeric types before callbacks or native computation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: hardening NumPy scalar trust in G-theory controls.
Linked Issues check	✅ Passed	The changes implement issue #851 by enforcing exact trusted NumPy scalar types, preserving validation behavior, adding boundary regressions, and documenting the security fix.
Out of Scope Changes check	✅ Passed	The code, tests, changelog, and doctoring documentation directly support the NumPy scalar trust hardening required by issue #851.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gtheory-numpy-scalar-trust-851

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head f079ccf847409618287735477c0ad4d24beab672.

• Head SHA: f079ccf847409618287735477c0ad4d24beab672

• Workflow run: 31913763410

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs (2 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs (2 files)"]
  R1 --> V1["docs review"]
  Evidence --> S2["Changed file: gtheory.py"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: gtheory.py"]
  R2 --> V2["required checks"]
  Evidence --> S3["Test: test_gtheory_numpy_scalar_subclass_trust.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_gtheory_numpy_scalar_subclass_trust.py"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: f079ccf847409618287735477c0ad4d24beab672
• Workflow run: 31913763410
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head f079ccf847409618287735477c0ad4d24beab672.

• Head SHA: f079ccf847409618287735477c0ad4d24beab672

• Workflow run: 31913763410

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs (2 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs (2 files)"]
  R1 --> V1["docs review"]
  Evidence --> S2["Changed file: gtheory.py"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: gtheory.py"]
  R2 --> V2["required checks"]
  Evidence --> S3["Test: test_gtheory_numpy_scalar_subclass_trust.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_gtheory_numpy_scalar_subclass_trust.py"]
  R3 --> V3["targeted test run"]

Loading

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Admin green-wave product SUCCESS