feat(item-bank): add governed lifecycle buyer reports

[seonghobae]

Advances #609 with the bounded buyer-report stage over the already-shipped governed item-bank lifecycle.

Buyer gap

The repository already owns immutable, evidence-gated item-bank lifecycle records, semantic screening, pilot provenance, and suspension/reactivation governance. It still lacks the issue’s required machine-readable plus standalone human-readable lifecycle report. Buyers therefore cannot consume one package-owned summary of current state, lineage, governed evidence presence, comparability support, and explicit evidence limitations without rebuilding that interpretation downstream.

RED → GREEN

• bc5ce8f71baa6f5f88cce9393e2cd9cca7beb4bd — RED report contract: complete lineage, explicit comparability limitations, deterministic JSON, accessible standalone HTML, hostile container/title rejection.
• a81f14bd871bee8e1bd0e8ef91ad8c66f53c68ab — GREEN provenance-only report implementation.
• 269db6a16111b2c7c778b4002ec1a23dc170fb68 — changelog fragment.
• 44a506cc0aa56e87784c2ff0e3796666f39aa503 — doctoring and APA 7 research/standards basis.

Ownership boundary

Python only validates complete package-owned lifecycle lineages and renders governed metadata. It does not calculate calibration, fit, DIF, item information, linking/equating, exposure, drift, or uncertainty. Those production numerical quantities remain Rust-owned and are referenced by exact evidence identity/fingerprint only. Psychometrics Commons remains the downstream persistence/authorization owner.

Truthfulness and safety

• A report must start at the package-created piloting record and each successor must bind the previous record fingerprint.
• Cross-version comparability is supported_by_linking_evidence only when linking evidence is actually present; otherwise it is not_demonstrated.
• Missing linking, exposure, and drift evidence remain explicit limitations.
• No raw source/prompt/response/provider content is added to the report contract.
• HTML is standalone, escapes the caller title, includes semantic landmarks/table captions/skip link, and keeps a visible :focus-visible indicator.

Keep Draft until exact-current-head CI, security, package/coverage/review evidence is terminal. Predecessor-head evidence does not transfer.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ffa29b1b-d316-4456-ae65-fc0ea29363ee

📥 Commits

Reviewing files that changed from the base of the PR and between 04d0bc2 and 44a506c.

📒 Files selected for processing (4)

• docs/changelog.d/609-item-bank-buyer-report.md
• docs/doctoring/item_bank_lifecycle_reporting.md
• python/fast_mlsirm/rubric/item_bank_report.py
• tests/test_rubric_item_bank_report.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 44a506cc0aa56e87784c2ff0e3796666f39aa503.

• Head SHA: 44a506cc0aa56e87784c2ff0e3796666f39aa503

• Workflow run: 32174390273

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs (2 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs (2 files)"]
  R1 --> V1["docs review"]
  Evidence --> S2["Changed file: item_bank_report.py"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: item_bank_report.py"]
  R2 --> V2["required checks"]
  Evidence --> S3["Test: test_rubric_item_bank_report.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_rubric_item_bank_report.py"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 44a506cc0aa56e87784c2ff0e3796666f39aa503
• Workflow run: 32174390273
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 44a506cc0aa56e87784c2ff0e3796666f39aa503.

• Head SHA: 44a506cc0aa56e87784c2ff0e3796666f39aa503

• Workflow run: 32174390273

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs (2 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs (2 files)"]
  R1 --> V1["docs review"]
  Evidence --> S2["Changed file: item_bank_report.py"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: item_bank_report.py"]
  R2 --> V2["required checks"]
  Evidence --> S3["Test: test_rubric_item_bank_report.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_rubric_item_bank_report.py"]
  R3 --> V3["targeted test run"]

Loading

[seonghobae]

@opencode-agent Please re-review the unchanged current exact head 44a506cc0aa56e87784c2ff0e3796666f39aa503. The existing CHANGES_REQUESTED is based on central coverage/tooling run 32174390273; the owning .github main has since advanced with the flat-lock/relative-include coverage repair. Re-evaluate current-head item-bank report evidence only and do not transfer the previous central failure.

[seonghobae]

@opencode-agent Please re-review unchanged exact head 44a506cc0aa56e87784c2ff0e3796666f39aa503 against the current central coverage implementation. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on this SHA. The existing formal CHANGES_REQUESTED maps to central run 32174390273, which predates .github main b71a02a310e77f70c1e59f4719f6857cb33ca886 and its trusted-uv/flat-lock correction. Please generate fresh same-head formal evidence rather than carrying forward the superseded central tooling failure.

[seonghobae]

@opencode-agent Please re-review the unchanged exact head 44a506cc0aa56e87784c2ff0e3796666f39aa503 against the current central workflow. Its prior REQUEST_CHANGES was caused solely by coverage-evidence failure before PR-controlled tests. Repository-local CI, Security Scan, CodeQL, and Semgrep are terminal-success on this exact head. Reassess product/report correctness independently and replace the superseded infrastructure verdict only if current exact-head coverage evidence is now sufficient.

[seonghobae]

Superseded by #1003 at the identical exact source SHA 44a506cc0aa56e87784c2ff0e3796666f39aa503. #993's sole formal REQUEST_CHANGES is the historical central coverage-evidence failure from run 32174390273; repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on the source SHA. #1003 provides a fresh pull-request event for the current central workflow without source churn, force-push, review dismissal, or gate weakening. Closing this predecessor unmerged avoids duplicate landing vehicles.