fix: review follow-ups — verdict value-type validation, hard parse budget, O(1) span eviction

- isEvalVerdict requires usable section shapes (audits/patterns arrays;
  necessity array or object) so a quoted example like {"audits": "..."}
  can't shadow a real verdict and silently default the category scores
- a span larger than the remaining parse budget is skipped instead of
  parsed (the budget is now a hard cap), and later smaller spans still
  get their turn
- matched-span retention uses a ring buffer: shift() re-indexed the
  whole array and made a {}{}{} pair flood quadratic

Author: domitriusclark

src/scoring/deep-eval.ts

@@ -348,7 +348,16 @@ function formatFullEntry(entry: NormalizedEntry): string {
 // A judge reply can quote example objects in prose; only the schema tells the
 // verdict apart. Any of the three known sections marks an eval verdict.
 function isEvalVerdict(c: Record<string, unknown>): boolean {
-  return "audits" in c || "necessity" in c || "patterns" in c;
+  // Key presence alone lets a quoted example like {"audits": "..."} shadow a
+  // real verdict — the section values must carry usable shapes: arrays for
+  // audits/patterns; necessity is an array (legacy all-category eval) or a
+  // single object (per-category eval).
+  return (
+    Array.isArray(c.audits) ||
+    Array.isArray(c.patterns) ||
+    Array.isArray(c.necessity) ||
+    (typeof c.necessity === "object" && c.necessity !== null)
+  );
 }
 
 export function parseCategoryEvalResponse(

src/scoring/parse-json.ts

@@ -38,6 +38,9 @@ export function parseJsonFromText(
   for (const span of spans) {
     if (parseBudget <= 0) break;
     if (accepted.some((a) => a.start <= span.start && a.end >= span.end)) continue;
+    // A span larger than the remaining budget is skipped, not parsed — the
+    // budget is a hard cap — and later (smaller) spans still get their turn.
+    if (span.end - span.start > parseBudget) continue;
     parseBudget -= span.end - span.start;
     const parsed = tryParseObject(text.slice(span.start, span.end + 1));
     if (parsed) {
@@ -90,7 +93,11 @@ function tryParseObject(candidate: string): Record<string, unknown> | null {
  * pass: push on `{`, pop on `}`. Braces inside JSON string values don't
  * count, and an unmatched open simply never pops. */
 function matchedSpans(text: string): { start: number; end: number }[] {
-  const spans: { start: number; end: number }[] = [];
+  // Ring buffer: keeps the last SPAN_LIMIT spans in O(1) per span (shift()
+  // re-indexes the whole array and turns a {}{}{} flood quadratic) and caps
+  // memory on span-heavy replies.
+  const ring: ({ start: number; end: number } | undefined)[] = new Array(SPAN_LIMIT);
+  let count = 0;
   const stack: number[] = [];
   let inString = false;
   for (let i = 0; i < text.length; i += 1) {
@@ -105,10 +112,13 @@ function matchedSpans(text: string): { start: number; end: number }[] {
     else if (ch === "}") {
       const start = stack.pop();
       if (start !== undefined) {
-        spans.push({ start, end: i });
-        if (spans.length > SPAN_LIMIT) spans.shift();
+        ring[count % SPAN_LIMIT] = { start, end: i };
+        count += 1;
       }
     }
   }
+  const spans: { start: number; end: number }[] = [];
+  const from = Math.max(0, count - SPAN_LIMIT);
+  for (let n = from; n < count; n += 1) spans.push(ring[n % SPAN_LIMIT]!);
   return spans;
 }

test/unit/scoring/parse-json.test.ts

@@ -170,3 +170,21 @@ End.`;
     expect(result).toEqual({ flaggedInteractions: [], patterns: [] });
   });
 });
+
+describe("parseJsonFromText hardening (review follow-ups)", () => {
+  it("a {}{}{} pair flood stays fast and keeps the trailing verdict", () => {
+    const input = `${"{}".repeat(500_000)}{"score": 7}`;
+    const started = Date.now();
+    expect(parseJsonFromText(input, (c) => typeof c.score === "number")).toEqual({ score: 7 });
+    expect(Date.now() - started).toBeLessThan(2_000);
+  });
+
+  it("a span larger than the parse budget is skipped, smaller later spans still parse", () => {
+    // 9MB of digits inside one balanced unparseable span exceeds the 8M
+    // budget — it must be skipped without being fed to JSON.parse, and the
+    // small verdict after it must still be found.
+    const big = `{${"9".repeat(9_000_000)} not json}`;
+    const input = `${big}\n{"score": 4}`;
+    expect(parseJsonFromText(input)).toEqual({ score: 4 });
+  });
+});