test(errors): rebuild ValidationError confidentiality on current main

[seonghobae]

CLOSED UNMERGED — current-main feasibility experiment for Issue #132

This branch started from protected main 9640ab9765db427412f3d108a4fc9eadf4fa1d8c to re-establish the rejected-value confidentiality RED without transferring evidence from closed experiment #133. The RED remained valid: a unique credential-shaped rejected value must not escape through the safe-default ValidationError message, args, repr, or structured evidence.

The branch then tested the narrow hypothesis that changing the generic constructor default could be made GREEN in isolation. Exact current head 8f27a2eaf684ec0e0208db1044530112613ff26e falsifies that hypothesis on the current repository surface.

Exact integration evidence

• Independently resolved protected main during final triage: a70866e47b74eb74654aa0f8dd12f72260a5bbe2.
• Exact branch head: 8f27a2eaf684ec0e0208db1044530112613ff26e.
• The branch changes only pg_llm_batch/exceptions.py and tests/test_validation_error_confidentiality_current_main.py; GitHub reports it mergeable as a Draft, but it is not gate-clean.
• Exact-head Security Scan, SAST Semgrep, and Release Acceptance are terminal-success.
• Exact-head CI run 31752607500 is terminal-failure. Its coverage/package job checked out the exact contributor head, then reported 45 failed / 827 passed. The failures are deterministic compatibility failures, not infrastructure failures: numerous existing package contracts intentionally retain bounded non-sensitive rejected values such as numeric limits, byte sizes, endpoint/configuration selectors, tenant/lifecycle validation markers, and other operator-useful evidence.
• The same run also fell below the required coverage gate because the new constructor policy branches were not fully exercised. This is additional failed evidence, not acceptance.
• Formal reviews: zero. Unresolved inline review threads: zero.

RCA and next safe implementation boundary

The privacy defect in Issue #132 remains valid, but a blanket constructor-default replacement is not an isolated two-file fix. This exact current-main experiment independently reproduces the integration boundary already exposed by #133: the eventual solution needs a call-site compatibility/classification pass that separates confidential/content-bearing rejected values from explicitly reviewed bounded non-sensitive diagnostics, then introduces the smallest explicit safe-value/disclosure policy without erasing useful operational evidence.

That audit should start only after currently active validation-producing owners settle. In particular, Draft #181 is adding durable checkpoint-store validation on a separate active branch, so broad exception/call-site churn here would race a moving validation surface. No code, checks, reviews, approvals, synthetic merge evidence, or conclusions from this closed branch transfer automatically to the future implementation.

Closing this PR unmerged preserves the RED/feasibility evidence while keeping Issue #132 open for the correctly scoped successor.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bb785c98-da28-4354-bc75-0e49a3c21376

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}