fix(kpi): reject malformed JSON-looking threshold evidence

[seonghobae]

Purpose

Test-first repair of the threshold KPI evidence parser. scripts/check-kpi.mjs already fails closed on UTF-8, duplicate-key, status, latency and timestamp corruption, but its JSON parse catch previously silently treated malformed structured NDJSON as Wrangler diagnostic noise. A truncated /exchange record could therefore disappear before threshold/window evaluation.

RED → GREEN

• original protected base: f726c9157120866c1979272a4dd3eec5e2a329b2
• RED head: c634eb25fc1138ebee98e41aa2ee9ab22364e9bf
• RED application CI 32609511110, job 97120093652: exact checkout/base/toolchain passed; the single new regression failed because malformed structured JSON was dropped and the script reported only No exchange events found.
• production repair head before restack: 5f88bda2280fb61c549ad7850785b68c1c9ddfbe
• current exact candidate after non-destructive convergence with fix(kpi): validate direct metric evidence #482 protected truth: bac746ffdcda2ad4db2c4a9d042ab8563059660b
• production repair: JSON-looking lines that fail parsing now exit 1 with line-specific diagnostics; ordinary plain Wrangler diagnostic noise remains tolerated

Exact-head verification

On unchanged bac746ffdcda2ad4db2c4a9d042ab8563059660b and live base 59739e2b37e80d52e37093d9f3252332a2da1eb7:

• application CI 32609737644: terminal success
• reviewer-ci 32609737596: terminal success
• central Security Scan 32609737583: terminal success
• review threads: none

Authority boundary

This protects threshold/window computation from silently discarded malformed evidence. It does not create production KPI provenance, a 30-day window, release/deployment evidence, revenue or acquisition authority.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 94f149a4-f58b-42f8-a668-d46e8ab5d27c

📥 Commits

Reviewing files that changed from the base of the PR and between 59739e2 and bac746f.

📒 Files selected for processing (3)

• scripts/check-kpi.mjs
• scripts/compute-kpi.mjs
• test/check-kpi-input-integrity.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Malformed-JSON diagnostic reports wrong line number

lines drops blank lines via filter(Boolean), so the index from lines.entries() is a position in the filtered array, not the file line. Any blank line before a malformed JSON-looking line makes the reported line N point at the wrong line.

---

Was this helpful? React with 👍 or 👎 to provide feedback.