fix(detect): validate inputs before native discovery

[seonghobae]

Scope

Fix #903 by keeping invalid DETECT/DIMTEST requests inside the Python validation/marshalling boundary until their public inputs are fully validated.

Test-first lineage

• RED 02bb29458754288696f395ca10c1d5b2db575920 adds public regressions proving malformed DETECT response shapes and malformed DIMTEST partitions must fail without touching compiled-core discovery, plus valid-input/core-absent controls that require discovery exactly at the dispatch boundary.
• GREEN b5b7fe0fef2997ac098f3c3995a60217750ba5fd moves _core_module() discovery after the existing response/cluster and response/AT-set validation paths.
• 661afbbd68831d0cb22b391959ee445d2bf6fa97 records bounded release evidence.
• Follow-up RED f2534cf8ecc22e11bf22ad3ff9ed3d4834009805 proves an out-of-domain non-binary DETECT response must also be rejected before native discovery.
• Follow-up GREEN 5a88c704a8614e43119c09262ced34b1bef77a3b closes that public-domain gap by enforcing the documented exact 0/1 response contract before compiled-core discovery.

Preserved boundary

• DETECT conditional-covariance aggregation, DIMTEST grouping/statistic/bias correction/p-value arithmetic, and all result-affecting dimensionality computation remain Rust-owned and unchanged.
• Python continues to validate/marshal arrays and reconstruct results only.
• Valid requests still require the compiled Rust core and retain the established RuntimeError when it is unavailable.
• No dependency, provider, persistence, database, workflow, package-version, numerical-fallback, or gate change is introduced.

Lifecycle discipline

This PR remains Draft while current exact-head CI/security/package/provenance evidence is still running. Protected base, exact source identity, reviews, threads, and required checks must be refetched before any Ready or integration action; predecessor-head evidence does not transfer.

Fixes #903.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ae6e3642-f7c8-44ab-ac57-bbd801c51aa8

📥 Commits

Reviewing files that changed from the base of the PR and between fb67ced and 5a88c70.

📒 Files selected for processing (3)

• docs/changelog.d/903-detect-native-discovery-order.md
• python/fast_mlsirm/detect.py
• tests/test_detect_native_discovery_order.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}