Set release boundaries for the score labeler

Operational risks for the threshold score labeler (scores.py) center on eval() on pasted score text or logging raw learner identifiers beside scores, plus the earlier failure mode (string scores that compare lexicographically, or IndentationError that hides a wrong cutoff). Safety lives in executable gates, allowlists, redaction, and a named owner—not in a warning paragraph under an unsafe function.

def load_scores(raw):
    values = []
    for index, part in enumerate(raw.split(",")):
        try:
            value = float(part.strip())
        except ValueError:
            raise ValueError(f"score[{index}] is not numeric") from None
        if not 0.0 <= value <= 1.0:
            raise ValueError(f"score[{index}] must be between 0 and 1")
        values.append(value)
    return values

print(load_scores("0.2,0.9,0.4"))
try:
    load_scores("__import__('os').system('echo unsafe')")
except ValueError as error:
    print("rejected:", error)

Expected output:

[0.2, 0.9, 0.4]
rejected: score[0] is not numeric

The previous kind of assertion—assert ... if False else True—proves nothing because it always evaluates to True. The negative test above exercises the actual parser and confirms that pasted Python is treated as invalid data, not executed. A source scanner can supplement this test, but it cannot replace runtime behavior.

Name who can disable the feature, what data is retained, and how to roll back to the last known good artifact. Pin the reviewed configuration (versions, thresholds, allowlists) so “what shipped” is reconstructable for python-only-what-you-need.

Write the release blocker as a predicate, not a feeling: “Do not ship the score labeler if eval() on pasted score text or logging raw learner identifiers beside scores.” Pair it with a passing control that shows the reviewed configuration still works for scores=[0.2,0.9,0.4], threshold=0.5. Name an owner and a rollback handle (git tag, docs_version, previous image).

Security pages must not paste the happy-path demo. If your gate code looks like the implementation page, replace it with a deny/allow check aimed at eval() on pasted score text or logging raw learner identifiers beside scores.

State the data retention rule in one line (what is stored, for how long, who can read it). Then state the kill switch (env flag, config pin, or feature owner). The score labeler is not shippable without both, even when boundary labels at 0.49/0.50/0.51 and empty-list positive count 0 looks healthy.

Build a comma-separated temperature parser that rejects Python expressions, nan, and values outside the supported physical range. Add a log-safety test proving raw input is absent from failure events.

ML Python starter

Previous · Next