[efraespada]

Bugbot could mistake Python host lines for generated Kotlin lines and flag a correct missed-coverage assertion as failing. Review now receives bounded, inert numbered literal evidence and independently verifies candidate hypotheses against the same source before publication.

What changed

• Share conservative literal/escape/dedent projection and trusted verification activation across ordinary review, diff partitions and the real-agent benchmark. Preserve canonical diff text and resolution ownership.
• Require correlated, exhaustive verification decisions with immutable candidate identity/file/anchor and concrete evidence. Invalid output, locale, limits or provider errors fail analysis; rejected hypotheses cannot resolve historical findings.
• Add synthetic source oracles, independent security/contract controls, coverage budgets, documentation and dated evidence retaining every measured regression.

Validation

• Focused evidence/integration tests pass; pure policies, verifier, locale registry and prompt reach 100% all coverage metrics, with changed delivery modules meeting 95% lines/statements and 90% branches/functions.
• Typecheck, lint, documentation/workflow/specification/package validation and isolated package smoke pass. Mandatory full commit hook: 810 suites, 15,329 passing tests, 35 existing skips; build and lint pass. Fresh GitHub/native acceptance remains required before merge.
• Recorded six-case actual-agent inputs: baseline 3 false positives/1 false negative; corrected single-batch pipeline 0/0. The batching follow-up preserves that single-batch wire contract and adds 21/200-candidate, recovery and telemetry controls. Two independent defect controls pass all default model gates.

Review notes

The six-case model sample still fails the unchanged exact-location gate (0/2); complete scores and failed intermediate campaigns remain in quality/bugbot/evidence/issue-796.json. This is not an all-model-gates pass. The sample does not test publication remapping or establish statistical accuracy or consumer adoption. Consumer evidence was read-only; committed fixtures are synthetic.

Read-only verification runs only for retained Python literal witnesses with nonempty candidates, using the same provider/model/effort. Support all 1–200 schema-valid candidates in at most ten sequential batches of 20, preflighting global identity and the 32,000-byte candidate limit per batch. Keep the 128,000-byte complete-prompt bound per query and existing three partition attempts (at most 33 total queries). Serialized initial/secondary JSON replies have a separate 4,000,000-byte UTF-8 wire bound, preserving object/string equivalence for valid batched responses above the prompt ceiling. A later failure cannot publish partial results or resolve historical findings. Count every initial/retried and secondary query in telemetry. No new public configuration or historical finding mutation authority.

Closes #796.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~805

Documentation is deployed and generated using docs.page

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on f7b4f19. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit fddfeef was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• low: Mixed tab and space indentation produces incorrect dedent witnesses — src/application/policies/bugbot_python_literal_witness_policy.ts:176

[vypbot]

Bugbot: review complete

Current status: No active findings on f7b4f19.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: f7b4f19272a7; base: ab5f7d78e201; reason: protected-path.

[efraespada]

/copilot recheck effort=high

Please independently re-evaluate finding bugbot_python_literal_witness_policy.ts:176:dedent-mixed-tabs-spaces at unchanged head fddfeefab6eceabcc1341587c181954a58cd764e. Python's dedent documentation treats tabs and spaces as unequal indentation: https://docs.python.org/3/library/textwrap.html#textwrap.dedent. The exact reported input "\t a\n b" remains unchanged under Python 3.9.6 stdlib and exactly matches the current pure projection. TextWrapper.expand_tabs is a different API. The inline thread records the independent data-only check and existing test coverage. Preserve all normal review, resolution and approval checks.

[vypbot]

Request could not be completed

Impact: The operation did not accept the supplied input.

Action: Correct the input and retry.

Retained state: No new state or external effect was created.

Error code: validation.invalid-input

Retryable: No

Reference: cfd2254e-1254-4508-bdf7-5694cab4f816

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.16%. Comparing base (5b3664f) to head (f7b4f19).
⚠️ Report is 97 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #805      +/-   ##
===========================================
+ Coverage    94.50%   95.16%   +0.66%     
===========================================
  Files         1035     1103      +68     
  Lines        33299    36292    +2993     
  Branches      9824    10834    +1010     
===========================================
+ Hits         31468    34536    +3068     
+ Misses         699      673      -26     
+ Partials      1132     1083      -49     

Files with missing lines	Coverage Δ
...application/policies/agent_output_locale_policy.ts	100.00% <ø> (ø)
...plication/policies/bugbot_diff_partition_policy.ts	100.00% <100.00%> (ø)
...ion/policies/bugbot_literal_verification_policy.ts	100.00% <100.00%> (ø)
...n/policies/bugbot_python_literal_witness_policy.ts	100.00% <100.00%> (ø)
.../commit/bugbot/analyze_bugbot_revision_use_case.ts	96.96% <100.00%> (ø)
...secases/steps/commit/bugbot/build_bugbot_prompt.ts	98.76% <100.00%> (+5.32%)	⬆️
...cases/steps/commit/bugbot/query_bugbot_findings.ts	96.96% <100.00%> (+0.54%)	⬆️
...commit/bugbot/verify_generated_literal_findings.ts	100.00% <100.00%> (ø)
src/prompts/bugbot.ts	100.00% <100.00%> (ø)
src/tooling/bugbot_benchmark_runner.ts	100.00% <100.00%> (+22.22%)	⬆️

... and 150 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on f7b4f19. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 059d679 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: More than 20 findings make literal verification fail the review — src/application/usecases/steps/commit/bugbot/verify_generated_literal_findings.ts:63