fix(scoring): reject executable integer controls

[seonghobae]

Intent

Fixes #887 by making governed scoring integer controls inert before normalization. Public request/observation/result factories must reject caller-controlled integer protocols and subclasses before conversion or comparison callbacks can execute.

Test-first lineage

• RED 3146e963e40aabddae5f57d14e3d0c1fcd43c0e6 adds public-constructor regressions for arbitrary __index__ providers, caller-defined Python integer subclasses, caller-defined NumPy integer subclasses, and genuine NumPy scalar compatibility.
• GREEN implementation a37685a5d1d098ea4be9f4538920ceda77545c11 adds exact-type built-in/NumPy integer normalization with identity-only trusted-type admission.
• 49fa0da07f37f1b46bfccb7cfd9e3bcd6fa95c9b installs that boundary through the scoring contract composition surface before public execution factories are exposed.
• 7fab468558008e00dde0c5631bb3c204afb5a049 adds canonical changelog evidence.
• Exact current head 4c24c054af90b7b056e9c1f5306543d1dfcdb74f strengthens public regressions so rejected arbitrary providers and caller-defined Python/NumPy integer subclasses also prove zero __int__, __repr__, equality, hashing, and rich-comparison callback execution.

Preserved boundary

• Exact built-in integers and genuine package-supported NumPy integer scalar identities remain accepted and normalize to built-in integers.
• Booleans, arbitrary __index__ providers, and caller-defined Python/NumPy integer subclasses fail before caller conversion/comparison/equality/hashing code can participate.
• Existing response-size, execution-attempt, score-category and package-owned AssessmentSpecError bounds remain authoritative.
• Validation/marshalling only: no scoring, calibration, aggregation, uncertainty, DIF, linking, utility, likelihood, estimator, model formula, Rust numerical kernel, persistence, provider, dependency, or gate-policy change.
• The slice is path-local and does not overlap the active shared scoring-policy validator implementation in fix(scoring): harden policy integer callback boundary #869.

Exact current state

• Protected base remains fb67ced09d8ee00542c05d56374537a9a7239751 at the latest refetch.
• Exact source head is 4c24c054af90b7b056e9c1f5306543d1dfcdb74f; GitHub reports the PR mergeable.
• The PR is intentionally Draft again because predecessor-head gate evidence became historical when the security regression proof advanced.
• Exact-head CI/security/package/coverage/review evidence is being recomputed for 4c24c054af90b7b056e9c1f5306543d1dfcdb74f; queued or running checks are not treated as predecessor evidence.

Protected integration still requires every live exact-head gate plus a qualifying independent non-author approval and last-push approval under the live rulesets; no automated review or author action substitutes for those gates. Any future source-head or protected-base movement invalidates predecessor evidence and requires a fresh sweep.

Summary by CodeRabbit

• Bug Fixes
  • Hardened scoring validation for integer inputs and execution controls.
  • Invalid or hostile integer-like values are rejected safely before custom conversion callbacks run.
  • Genuine built-in and NumPy integer values remain supported.
  • Invalid values continue to produce consistent assessment errors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a4617e86-c5c2-42cd-b48b-11bc06bc8875

📥 Commits

Reviewing files that changed from the base of the PR and between fb67ced and 4c24c05.

📒 Files selected for processing (4)

• docs/changelog.d/887-scoring-execution-integer-callback-safety.md
• python/fast_mlsirm/scoring/_execution_integer_safety.py
• python/fast_mlsirm/scoring/contracts.py
• tests/test_scoring_execution_integer_callback_safety.py

---

📝 Walkthrough

Walkthrough

The change hardens governed scoring integer validation. It rejects caller-defined coercion before callbacks execute, preserves bounded AssessmentSpecError behavior, supports genuine NumPy integer scalars, and adds regression tests.

Changes

Scoring integer callback safety

Layer / File(s)	Summary
Trusted integer normalization python/fast_mlsirm/scoring/_execution_integer_safety.py	Exact built-in and supported NumPy integer types are normalized. Bounded controls and score categories raise assessment errors for invalid values.
Execution normalizer installation python/fast_mlsirm/scoring/_execution_integer_safety.py, python/fast_mlsirm/scoring/contracts.py	Contract initialization installs the integer normalizers on the package-owned execution module.
Callback-safety regression coverage tests/test_scoring_execution_integer_callback_safety.py, docs/changelog.d/887-scoring-execution-integer-callback-safety.md	Tests verify callback-free rejection of hostile values and continued support for genuine NumPy integer scalars. The changelog records the behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 4c24c

This localized validation change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant ScoringContracts
  participant ScoringExecution
  participant AssessmentSpecError
  Caller->>ScoringContracts: build scoring request, observation, or result
  ScoringContracts->>ScoringExecution: validate integer control or score category
  ScoringExecution-->>ScoringContracts: normalized trusted integer
  ScoringExecution-->>AssessmentSpecError: report invalid integer metadata
  ScoringContracts-->>Caller: scored contract or AssessmentSpecError

Loading

Possibly related issues

• ContextualWisdomLab/fast-mlsirm issue 868: Covers the same integer callback-safety hardening for scoring controls.
• ContextualWisdomLab/fast-mlsirm issue 858: Covers the same integer-subclass rejection and safe normalization behavior.

Possibly related PRs

• ContextualWisdomLab/fast-mlsirm#847: Applies analogous callback-safe integer validation in linking.irt_link.
• ContextualWisdomLab/fast-mlsirm#869: Hardens related scoring-policy integer validation with trusted built-in and NumPy scalar normalization.
• ContextualWisdomLab/fast-mlsirm#878: Applies related callback-safe integer validation to scoring and model-comparison controls.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes implement inert integer validation, preserve supported values and errors, add public-constructor regressions, and include changelog evidence for issue [#887].
Out of Scope Changes check	✅ Passed	The changes remain limited to governed scoring integer validation, marshalling, tests, and changelog documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: rejecting executable integer controls in scoring validation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/scoring-execution-integer-callback-887

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}