[irvingpop]

Fixes the third pilot false result on front-end#2027: "dependency data incomplete: registry lookup failed" for vite@8.3.5 (a real version). The full npm document for vite is about 39 MB; the 32 MiB cap rejected it, and the job log did not say why.

• NPM_MAX_RESPONSE_BYTES 32 -> 128 MiB (decoded). Largest legitimate document measured: renovate, about 74 MB, growing about 22 MB/yr; 128 MiB keeps 8 parallel full parses within runner memory.
• Requests gzip; bounded zlib inflate aborts as soon as the decoded size passes the cap (a 1 GiB gzip bomb stops at cap+1 with about 32 MiB peak). Identity accepted; any other or corrupt encoding fails closed with its own reason.
• New per-run download byte budget (1 GiB decoded) with its own reason; failed fetches release their reservation.
• Distinct failure reasons in the finding ("over the size cap", encoding, budget) and per-key failure logging (class + short reason, no bodies).
• Design doc K-18/K-19, including the deferred design: bounded streaming extraction of time[v] and lifecycle scripts, with its trigger (a legitimate document near 100 MiB, or runner memory pressure). The owner chose this route after two independent analyses; evaluate in the pilot before a larger change.

Unit tests 2701 passed; release tests 2 passed. Live check: real vite document fetched with gzip parses and yields time["8.3.5"]. Eval not run.

Review: one fix round (budget reservation on failed fetches), scoped re-review clean. Open minor: a fetch that streams most of a body then fails counts 0 bytes against the run budget (bounded by the per-fetch timeout and the 240 s run budget).

Goes live only with a release.

🤖 Generated with Claude Code

[github-actions]

🔴 FAIL: OC Claude review did not complete

Caution

Incomplete file coverage blocks this PR. No waiver can clear it.
Next step for the author: fix the cause named in the row, then push. The review runs again on the new commit.

Severity	Effect	Where	Finding	Found by
🚫 Hard block	Blocks, no waiver	review/tests/unit/test_collect.py	Incomplete file coverage: file content not scanned: unterminated-private-key, in review/tests/unit/test_collect.py	File checks (code, no model)
⚠️ Not run	Blocks, no waiver	Review pass	authentication failed. The pass returned no result.	Workflow (code, no model)
⚠️ Not run	Blocks, no waiver	Security pass	authentication failed. The pass returned no result.	Workflow (code, no model)
⚠️ Not run	Blocks, no waiver	Supply chain pass	authentication failed. The pass returned no result.	Workflow (code, no model)
⚠️ Not run	Blocks, no waiver	Gate	A required job did not succeed: dependency-review: failure	Workflow (code, no model)
⚠️ Not run	Blocks, no waiver	Gate	Dependency review did not succeed: job result failure	Workflow (code, no model)
⚠️ Not run	Blocks, no waiver	Gate	Dependency review did not succeed: step outcome failure	Workflow (code, no model)

File checks	Review	Security	Supply chain	Dependency review	Coverage
🚫 1 hard block, 2 signals	❌ failed	❌ failed	❌ failed	❌ failed	🚫 incomplete

_{Run 40943446648, attempt 1 for head 4df72dc into main. The required workflow in the merge box is the result that counts. This bot never approves a PR.}

📋 Full review record: reasons, checks, signals, finding details, model summaries, token usage

Reviewed snapshot

Head SHA	Merge base SHA	Base branch	Run
4df72dcad804b3a33cd58f097e1abb118a2acd5b	cc710fb58541d33015c4a7d14b23718a55a6a526	main	40943446648, attempt 1

Reasons the gate failed

Reason	Waivable?	Detail
A required job did not succeed	🚫 no	dependency-review: failure
Dependency review did not succeed	🚫 no	job result failure
Dependency review did not succeed	🚫 no	step outcome failure
A review pass failed	🚫 no	pass review failed: authentication failed
A review pass failed	🚫 no	pass security failed: authentication failed
A review pass failed	🚫 no	pass supply-chain failed: authentication failed
Hard block from the file checks	🚫 no	incomplete-coverage in review/tests/unit/test_collect.py
Hard block from the file checks	🚫 no	incomplete-coverage (coverage record is not complete)

No waiver line is shown. At least one reason cannot be waived, so a waiver would not change the result.

Checks (code, no model)

Check	Result	Detail
Hard block	🚫 blocks	Incomplete file coverage: file content not scanned: unterminated-private-key, in review/tests/unit/test_collect.py
Coverage	🚫 NOT complete	files in comparison 5, files collected 5, trees complete
Unavailable file	⚠️ unavailable	review/tests/unit/test_collect.py: unterminated-private-key
Dependency changes	✅ none
Dependency review job	❌ failed

Signals (context only, never block)

• ℹ️ Very long line: lines longer than 500 characters, in docs/claude-review-design.md, lines 289 294 295 994 995
• ℹ️ Credential-like string: credential-assignment (value redacted), in review/tests/unit/test_collect.py, lines 1312

Dependency changes

None.

Finding details

Model output from untrusted input. Check it before you act on it. Verified means only that the quoted text is at that place. It does not mean the claim is true.

Blocking is decided by code from category and severity, never by the model. A finding in a blocking category blocks only at high or critical severity.

No findings from the passes that ran. The Review, Security, Supply chain pass did not run, so this is not a clean result.

Model summaries

Model output from untrusted input. Check it before you act on it. Verified means only that the quoted text is at that place. It does not mean the claim is true.

Pass	Status	Model	Summary
Review	❌ failed		No summary. Reason: authentication failed
Security	❌ failed		No summary. Reason: authentication failed
Supply chain	❌ failed		No summary. Reason: authentication failed

Token usage

Pass	Input	Output	Cache write	Cache read	Attempts
Review	not recorded	not recorded	not recorded	not recorded	not recorded
Security	not recorded	not recorded	not recorded	not recorded	not recorded
Supply chain	not recorded	not recorded	not recorded	not recorded	not recorded
Recorded total	not recorded	not recorded	not recorded	not recorded	not recorded