Skip to content

fix(report): harden essay titles and semantic row headers - #997

Merged
seonghobae merged 21 commits into
mainfrom
fix/essay-report-row-header-accessibility-995
Aug 24, 2026
Merged

fix(report): harden essay titles and semantic row headers#997
seonghobae merged 21 commits into
mainfrom
fix/essay-report-row-header-accessibility-995

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Closes #980.
Supersedes closed/unmerged #995, #981, #1007, and adopts the compatible pointer-focus intent from closed/unmerged #1143 without its blanket :focus { outline: none; } selectors.

Current exact state

Evaluate only current head 47ec832f95e0ea0a31715212bd965325c28a4542 against protected main@04d0bc21a2a20693bcf16108cd76d394fe844d23. Predecessor-head checks/reviews are historical only; fresh exact-head required evidence and qualifying independent approval are mandatory.

Single landing unit

This branch combines compatible public essay-report trust, accessibility, and export-integrity boundaries after normal non-force reconciliation in #1010.

Callback-free title admission

All three public essay HTML renderers—score, validation evidence, and facets calibration—admit only an exact built-in str (or None) before .strip() and HTML escaping. Caller-defined str subclasses cannot execute overridden text callbacks. Existing blank-title validation and built-in escaping remain unchanged.

Semantic table row headers

Facets-calibration and validation-evidence tables explicitly supply row-header semantics only at domain-selected call sites. Task/rater/respondent/category-step/iteration and validation-metric axes use th scope="row"; the many-row score evidence relation intentionally does not infer a row header from position alone. Header/row width and row-header-index validation remain fail closed.

Complete print/PDF evidence

The shared standalone-report stylesheet keeps screen tables and canonical JSON scrollable, while print media removes screen-only overflow clipping and the 32rem JSON height cap so exact-value audit evidence remains visible when printed or exported to PDF.

Modality-safe scroll-region focus

Pointer-acquired focus on essay-report table scroll regions and canonical JSON <pre> blocks now suppresses the default outline only under :focus:not(:focus-visible). Keyboard focus retains the existing explicit high-contrast :focus-visible indicator. Regressions explicitly reject blanket .table-scroll:focus, pre:focus { outline: none; } suppression.

Latest pointer-focus lineage:

  • RED b01ba1ba90408242c365605f7b4b8cc6c61a1037;
  • GREEN 18b213520257a038accf4317a104c3cc0bfe06c5;
  • governed changelog/current head 47ec832f95e0ea0a31715212bd965325c28a4542.

Ownership boundary

This changes validation, HTML semantics, focus presentation, and print/export presentation only. It does not alter scoring, facets-calibration estimation, validation statistics, likelihoods, optimizers, or any psychometric arithmetic; production numerical ownership remains Rust-first.

The prior OpenCode CHANGES_REQUESTED review is anchored to predecessor head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 and is not reused as an exact-head code finding, but any still-effective formal approval requirement must be regenerated and satisfied on the current head. Current exact-head CI/security/static-analysis evidence is still regenerating.


Open in Devin Review

@coderabbitai

coderabbitai Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 81ce92ac-6f2b-429a-917f-6d39cf75d379

📥 Commits

Reviewing files that changed from the base of the PR and between 04d0bc2 and 017b22f.

📒 Files selected for processing (8)
  • docs/changelog.d/980-essay-report-title-trust-boundary.md
  • docs/changelog.d/995-essay-row-header-accessibility.md
  • docs/doctoring/accessible-html-table-row-headers.md
  • python/fast_mlsirm/scoring/essay/calibration_report_html.py
  • python/fast_mlsirm/scoring/essay/report_html.py
  • python/fast_mlsirm/scoring/essay/validation_report_html.py
  • tests/test_essay_report_title_trust_boundary.py
  • tests/test_scoring_essay_report_row_headers.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The change hardens title validation in three essay HTML renderers and adds semantic row headers to calibration and validation-evidence tables. Regression tests cover hostile string subclasses and generated HTML semantics. Documentation and changelog entries describe both updates.

Changes

Title trust boundary

Layer / File(s) Summary
Strict title validation and regressions
python/fast_mlsirm/scoring/essay/..., tests/test_essay_report_title_trust_boundary.py, docs/changelog.d/980-essay-report-title-trust-boundary.md
The three renderers reject str subclasses with the existing ValueError before callbacks or artifact creation. Tests cover all renderers and preserve normal title behavior.

Essay table row headers

Layer / File(s) Summary
Row-header rendering
python/fast_mlsirm/scoring/essay/calibration_report_html.py, python/fast_mlsirm/scoring/essay/validation_report_html.py
Calibration and validation-evidence tables mark their first columns as row headers.
Accessibility contract and verification
tests/test_scoring_essay_report_row_headers.py, docs/doctoring/accessible-html-table-row-headers.md, docs/changelog.d/995-essay-row-header-accessibility.md
Tests verify <th scope="row"> output for identity values. Documentation defines the assignments and verification requirements.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 017b2

This is a localized change to essay-report title handling and table accessibility semantics; no actionable merge-blocking risk remains after normal checks and review.

Possibly related issues

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The changes satisfy the title trust-boundary requirements in [#980] and the row-header accessibility requirements in [#995].
Out of Scope Changes check ✅ Passed All changes are limited to the linked issue objectives, related tests, changelog fragments, and accessibility documentation.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely summarizes the two primary changes: hardened essay title validation and semantic row headers.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/essay-report-row-header-accessibility-995

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Normal non-force branch reconciliation. Preserve exact-built-in title admission and semantic row-header markup plus both focused regression/evidence sets.
@seonghobae seonghobae changed the title fix(report): restore semantic essay table row headers fix(report): harden essay titles and semantic row headers Aug 19, 2026
@seonghobae
seonghobae marked this pull request as ready for review August 19, 2026 03:34
@seonghobae
seonghobae enabled auto-merge (squash) August 19, 2026 03:34

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please independently review exact current head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 against live main. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on this head. Verify exact-built-in title admission and semantic scope="row" identity headers across the essay report surfaces; do not transfer predecessor review evidence.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8.

  • Head SHA: 017b22f1a5a5603e2207e7a2861fdae1f1476ae8

  • Workflow run: 32213307681

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs (3 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs (3 files)"]
  R1 --> V1["docs review"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]
Loading

@opencode-agent

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 017b22f1a5a5603e2207e7a2861fdae1f1476ae8
  • Workflow run: 32213307681
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8.

  • Head SHA: 017b22f1a5a5603e2207e7a2861fdae1f1476ae8

  • Workflow run: 32213307681

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs (3 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs (3 files)"]
  R1 --> V1["docs review"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]
Loading

@opencode-agent
opencode-agent Bot disabled auto-merge August 19, 2026 04:58

Copy link
Copy Markdown
Contributor Author

@opencode-agent review
@cwl-noema-review review

Fresh re-review request: ContextualWisdomLab/.github#1136 has merged, fixing the central coverage-evidence bug (_install_trusted_uv() target-triple validation) that caused the prior REQUEST_CHANGES verdict on this PR. Please re-review exact current head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 — the underlying infrastructure blocker is now resolved on .github main. Do not transfer evidence from any prior head.


Generated by Claude Code

Copy link
Copy Markdown
Contributor Author

@opencode-agent Please re-review unchanged current exact head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 with the current central workflow. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on this exact head and there are no unresolved review threads. The current formal REQUEST_CHANGES is coverage-only from run 32213307681, which predates the central trusted-uv version-output correction. Current ContextualWisdomLab/.github protected main is 9e9f59f3ac1e96a960c021b131d768c238f4c21a (#1136). Reacquire same-head coverage/review evidence from a fresh current-central run; do not transfer predecessor evidence.

Copy link
Copy Markdown
Contributor Author

@opencode-agent Please re-review unchanged exact head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 against live main@04d0bc21a2a20693bcf16108cd76d394fe844d23. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on this exact head. The only formal CHANGES_REQUESTED maps to central coverage run 32213307681, from before .github main advanced to 9e9f59f3ac1e96a960c021b131d768c238f4c21a (fix(ci): verify trusted uv target-triple output (#1136), 2026-08-19T09:24:32Z), which repairs the trusted-uv materialization boundary that failed before target-repository execution. Please regenerate same-head coverage/formal review evidence under the current central contract; do not transfer the prior infrastructure verdict.

Copy link
Copy Markdown
Contributor Author

@opencode-agent review
@cwl-noema-review review

Re-dispatch unchanged exact head 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 under central .github@bbedc1a51ec1a2421f129955c629b3cd0507a4ec. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success and inline threads are empty. The sole formal CHANGES_REQUESTED came from central coverage run 32213307681 before #1136 corrected trusted-uv verification; central main now also includes #1140's OIDC permission repair for scheduler callers. Generate fresh same-head coverage/formal review evidence without transferring the old infrastructure verdict.

@seonghobae seonghobae closed this Aug 19, 2026
@seonghobae seonghobae reopened this Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@opencode-agent review

Fresh exact-head re-review requested for 017b22f1a5a5603e2207e7a2861fdae1f1476ae8 against protected main@04d0bc21a2a20693bcf16108cd76d394fe844d23. Repository CI, Security Scan, CodeQL, and Semgrep are terminal-success on this unchanged head. The only formal CHANGES_REQUESTED is the pre-repair central coverage-evidence failure from run 32213307681; ContextualWisdomLab/.github#1136 has since merged the trusted-uv target-triple verification repair. Please regenerate same-head coverage/review evidence before this Draft is promoted.

@seonghobae
seonghobae marked this pull request as ready for review August 21, 2026 02:56
@seonghobae

Copy link
Copy Markdown
Contributor Author

Reviewed exact HEAD 017b22f1a5a5603e2207e7a2861fdae1f1476ae8. CodeGraph/source review confirms essay HTML title boundaries reject caller-defined string subclasses before strip/escape or artifact creation, and semantic row headers use <th scope="row"> for task, rater, respondent, threshold, iteration, and validation-metric identity axes. Native-free score/facets regression tests passed 2/2; Ruff, compileall, interrogate across all three renderers (100%), and diff checks passed. Validation fixture tests were blocked only by the local checkout lacking compiled fast_mlsirm._core; hosted exact-head CI/Rust/GPU/security/OpenCode coverage/review checks are green. The old REQUEST_CHANGES review cites an earlier coverage failure; no bypass or self-approval used.

@seonghobae
seonghobae enabled auto-merge (squash) August 21, 2026 02:56

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

Open in Devin Review

@opencode-agent
opencode-agent Bot disabled auto-merge August 21, 2026 03:49
@seonghobae
seonghobae enabled auto-merge (squash) August 21, 2026 04:46
@seonghobae

seonghobae commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Current-head formal review refresh request for 017b22f1a5a5603e2207e7a2861fdae1f1476ae8: the existing OpenCode CHANGES_REQUESTED cites an earlier coverage failure, while current exact-head CI/Rust/GPU/security/OpenCode/Noema Checks are successful. Please re-run review against this exact SHA and bind the decision to a retrievable same-head run. Preserve normal protection; no self-approval or bypass. @opencode-agent review @cwl-noema-review review

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current HEAD 111805c was validated in an exact detached worktree after building the native extension: 25 focused essay-report tests passed. Ruff, interrogate (production sources 100%), compile/diff checks were already clean. Hosted required checks remain pending; normal protected auto-merge remains armed.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Fresh exact-head review request for current 111805c. The prior CHANGES_REQUESTED is bound to predecessor 017b22f and pre-repair coverage infrastructure. Current exact-head local native validation passes 25 focused essay-report tests; re-acquire same-head coverage, Noema, and OpenCode evidence under protected main. No bypass or self-approval. @opencode-agent review @cwl-noema-review review

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 3 new potential issues.

Open in Devin Review

Comment thread python/fast_mlsirm/scoring/essay/report_html.py
Comment thread python/fast_mlsirm/scoring/essay/calibration_report_html.py
Comment thread python/fast_mlsirm/scoring/essay/calibration_report_html.py
@opencode-agent
opencode-agent Bot disabled auto-merge August 21, 2026 10:33
@opencode-agent opencode-agent Bot added area: security Security boundary, hardening, or vulnerability prevention priority: medium Normal-priority or P2 work status: needs-review Open pull request requiring current-head review or checks type: bug Defect or incorrect behavior labels Aug 22, 2026
@seonghobae
seonghobae enabled auto-merge (squash) August 24, 2026 01:08
@opencode-agent
opencode-agent Bot disabled auto-merge August 24, 2026 02:19
@seonghobae
seonghobae merged commit 9ef9e1a into main Aug 24, 2026
38 checks passed
@seonghobae
seonghobae deleted the fix/essay-report-row-header-accessibility-995 branch August 24, 2026 04:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: security Security boundary, hardening, or vulnerability prevention priority: medium Normal-priority or P2 work status: needs-review Open pull request requiring current-head review or checks type: bug Defect or incorrect behavior

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Harden essay HTML title trust boundaries against str subclasses

1 participant