test: cover generation contract float overflow

[seonghobae]

Adds a focused public-constructor regression for overflowed JSON floats in GenerationRequest.

Validation:

• Old 🛡️ Sentinel: [MEDIUM] Fix insecure deserialization in _contract_object #1821 predecessor 5d33851f8c3d2e985391424d135d26a2822fe5cd: test fails because 1e999 is accepted.
• Current 🛡️ Sentinel: [MEDIUM] Fix insecure deserialization in _contract_object #1821 head 1d1e16cd734549f77252002685de28e38738053b: test passes (1 passed in 0.82s); normal provider payload remains valid and the exact "extra":1e999 text is retained before construction.
• Existing native artifact reused (SHA256 5ba48fc2c93d823d92dad129d0d4540fdbdc89c3f83f63b96daf708a79a40451); no fresh native build or recovery claim.

Stacked on #1821 for integration. Tests-only; source owner changes are preserved.

[coderabbitai]

Warning

Review limit reached

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e1ab0e78-74b6-4639-9e1f-310cfa8358b5

📥 Commits

Reviewing files that changed from the base of the PR and between fb83dcb and 05d17c8.

📒 Files selected for processing (1)

• tests/test_generation_contract_overflow_acceptance.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head CodeQL dispatch evidence (2026-09-13)

The archived run validated PR 1834 head 05d17c8124b4be36c16efc23160e88a8dd18e485.
Both language denominators were preserved: Python scanned 788/788 Python and
7/7 Actions files; Actions scanned 7/7 Actions files.

The SARIF gates completed with Python files=1 results=2 medium_plus=0 and
Actions files=1 results=0 medium_plus=0. The archive contains logs only; no
SARIF payload or result-level locations. The Python log shows the
py/incomplete-url-substring-sanitization query was interpreted, but Issue
1838's prior two-result locations cannot be attributed to this different head
without the missing SARIF payload.

Both jobs failed after the completed scan/gate while publishing the commit
status: target app token and GitHub token returned HTTP 403 Resource not accessible by integration, followed by Actions-capable CodeQL wake credential is unavailable and exit code 1. This is a status-publish infrastructure failure,
not evidence of a Medium+ source finding.

Raw archive SHA-256:
b62ade05c2d475462aa05e7280550fdc7f0ad4e8aeda4ddaa78dee47f4962c79.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• tests/test_generation_contract_overflow_acceptance.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Test: test_generation_contract_overflow_acceptance.py"]
  S1 --> I1["regression suite"]
  I1 --> R1["Review risk: Test: test_generation_contract_overflow_acceptance.py"]
  R1 --> V1["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 05d17c8124b4be36c16efc23160e88a8dd18e485
• Workflow run: 34737164291
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Test: test_generation_contract_overflow_acceptance.py"]
  S1 --> I1["regression suite"]
  I1 --> R1["Review risk: Test: test_generation_contract_overflow_acceptance.py"]
  R1 --> V1["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 05d17c8124b4be36c16efc23160e88a8dd18e485
• Workflow run: 34737164291
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: test: cover generation contract float overflow #1834 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

[seonghobae]

Exact-head admission audit: 05d17c8124b4be36c16efc23160e88a8dd18e485 (base main@fb83dcb205236167d1b38812d265da52c2366716, 4 ahead / 0 behind).

현재 blocker: mechanically non-mergeable; terminal workflow: CodeQL PR:failure.

유효 commit·diff·review evidence를 보존한 채 Draft/Proposed로 교정합니다. Base 이동이나 queue 대기만을 이유로 Close하지 않으며, Force Push·synthetic status/approval·manual rerun·bypass는 사용하지 않습니다. Blocker 수리 후 새 exact head에서 Checks와 review admission을 다시 받아야 합니다.