fix(stella-pipeline): bound the oracle trace at the verifier-prompt ingress (#1787)

[macanderson]

Supersedes #1982, which was auto-closed when the branch it was stacked on
went away. Same single commit, now rebased directly on main.

Note: main currently fails cargo clippy -p stella-pipeline with five
pre-existing warnings unrelated to this change (fixed in #2009), so this
PR's clippy step inherits them until that lands.

What & why

The last unbounded ingress into the verdict prompt, and the item #1787 folds in
at the end of its body:

Also worth folding in: the trusted evidence summary has no length bound
(oracle_trace grows per observation; the diff has a token budget, the
trusted zone does not) — pipeline/evidence.rs since the extraction.

verifier_evidence_summary renders oracle_trace in full. That trace gains an
observation per verification round, and the repair gate (#1479) keeps granting
rounds for as long as a measured budget affords them — so the one channel that
grows without limit was also the one channel with no ceiling. Every other input
to that prompt is bounded: the diff has a token budget, recall frames have
bound_recalled_frames, and Verdict::reasoning got its cap in #1932.

Bounded to the newest 24 observations, with the drop stated in-band:

oracle_trace=[…76 earlier observation(s) omitted → candidate:pass → candidate:fail → …]

Three choices worth naming, because each has a wrong-looking alternative:

• Newest kept, oldest dropped. The recent runs are what the verdict weighs;
  a trace clipped from the front would hand the verifier a history that stops
  before the evidence.
• Stated, not silent. A trace that silently began mid-run reads as the whole
  run — the verifier would draw conclusions about a first observation that was
  not the first.
• Clipped where the value is constructed, not at a downstream consumer.
  That is the same "structural, not by convention" rule fix(stella-pipeline): bound the verdict reasoning at the point it is constructed (#1787) #1932 applied to
  reasoning, and it is why the stored LadderSnapshot and
  verdict_provenance are deliberately untouched: the bound is on the prompt
  ingress, not on the record.

24 is sized far above a normal run (a baseline plus a handful of rounds), so
the bound only ever bites a pathological loop. It is a named constant next to
its rationale rather than a literal.

The witness

• This PR includes a witness test

a_pathological_oracle_trace_is_clipped_with_the_drop_stated — a 100-observation
trace renders exactly 24 entries behind the …76 earlier observation(s) omitted → marker, and still ends on the newest observation.

an_ordinary_oracle_trace_renders_unchanged is the other half, and the one
that matters for regression: a 5-observation trace is asserted byte-identical
to render_oracle_trace, main's own unbounded function, which is still
present and still used for provenance. So every prompt the bound does not bite
is unchanged to the byte — which also means no verdict-reuse digest (#1431)
moves for an ordinary run.

Honest note on "fails on main": these pin a bound that does not exist on main,
so the failure there is that bounded_oracle_trace is not defined — the same
shape as #1932's witnesses for the reasoning cap, and the shape any
"add a missing ceiling" change has. The behavioural claim is carried by the
second test, which compares against main's function directly rather than
against a copied expectation.

The gate

• cargo test -p stella-pipeline — 585 + 5 + 2 + 5 + 6 + 4 = 607 passed, 0 failed
• cargo clippy -p stella-pipeline --all-targets — clean
• cargo fmt --check -p stella-pipeline — clean
• scripts/check-file-size.sh — OK, none grew (evidence.rs was extracted from
  pipeline.rs precisely so this kind of channel can be added without touching
  a god file, and that still holds)

Full workspace left to CI.

Nothing left behind

Refs #1787, deliberately not Closes — this is the folded-in bound only.
Item 1 (a provider-parity-aware structured verdict output path, invariant 8)
remains open and is being approached from a different angle in #1964; item 2
shipped as #1932 and item 3 as #1951.

Refs #1787

Summary by Sourcery

Bound the oracle trace rendered in verifier evidence summaries and added tests to cover the new trusted-zone length cap.

New Features:

• Introduce a bounded oracle trace renderer for verifier prompts that limits the trusted evidence summary to the newest observations while indicating omissions in-band.

Tests:

• Add witness tests ensuring long oracle traces are clipped with an explicit omission marker and that ordinary short traces remain byte-identical to the unbounded renderer.

[sourcery-ai]

Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
stella-cli-docs	Ignored		Aug 7, 2026 3:05am

[sourcery-ai]

Reviewer's Guide

Bounds the oracle trace rendered in the verifier evidence summary to the newest 24 observations, with an in-band indication of omitted earlier observations, and adds tests to verify both pathological and ordinary trace behaviors remain correct.

File-Level Changes

Change	Details	Files
Introduce a bounded oracle trace renderer for verifier prompts and wire it into the evidence summary, with tests covering clipping behavior and unchanged ordinary runs.	Add MAX_ORACLE_TRACE_OBSERVATIONS constant to define the maximum number of oracle observations rendered for the verifier prompt. Implement bounded_oracle_trace helper that slices to the newest observations and prefixes a textual marker when earlier entries are omitted. Update the evidence summary construction to use bounded_oracle_trace instead of the unbounded render_oracle_trace for the verifier prompt. Extend the tests module with utilities to construct synthetic OracleObservation traces and two tests: one asserting clipping with an in-band omission marker for a long trace, and one asserting byte-identical output to the existing renderer for a short trace.	crates/stella-pipeline/src/pipeline/evidence.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.