fix(tests): close #1831's stale served_model test, missing docstring, and coverage gap

[seonghobae]

Summary

#1831 ("ground verdicts and classify gateway errors") replaced _extract_served_model's scrub-and-keep sanitization with a delegate to the new, stricter _safe_model_identifier (reject outright on any character outside a conservative allowlist), but left three gaps that broke the required test/coverage/docstring suite for every .github PR:

1. test_served_model_is_annotation_safe still asserted the old scrub-based behavior (a sanitized non-None value) — now fails since the function returns None for the same malicious input.
2. The new nested render closure inside _bounded_allowed_locations_json had no docstring (interrogate 99.9%).
3. The new _extract_http_error_served_model function had zero test coverage (99% branch coverage — lines 1331-1332, 1340, 1343, 1346 uncovered).

Third and independent instance of the same "PR changes behavior, sibling test/coverage/docstring not updated" class found this tick, following #1829 (fixed #1826/#1823's gaps) and #1832 (fixed #1828's gap) — all from the same rapid merge burst as the org-wide Actions queue drained.

Is the behavior change itself a regression?

Verified it is not. Real provider model ids seen in this session's own gateway logs (deepseek-ai/deepseek-v4-pro-0813, meta/llama-3.2-11b-vision-instruct, google/gemma-3-12b-it, orchestrator/free) all still pass the new regex unaffected — only genuinely malformed/malicious input is now rejected outright instead of sanitized-and-kept. served_model is embedded directly into ::warning::/::notice:: GitHub Actions workflow commands (scripts/ci/noema_review_gate.py lines ~1600/1605/1621), so reject-and-report-unknown is strictly safer against annotation injection than the old scrub approach, never weaker.

Fix

1. Updated test_served_model_is_annotation_safe to assert the safe outcome (None) instead of a specific sanitized string, with a docstring explaining why None is the correct safe outcome. Added a companion test confirming a real provider id still passes through unchanged.
2. Added the missing docstring to render.
3. Added 7 tests in test_noema_model_output_edge_coverage.py covering _extract_http_error_served_model's success path and all six fail-closed branches (unreadable body, oversized body, invalid JSON, non-dict payload, non-dict error, non-dict detail).

Verification

• Full suite: 2780 passed, 1 skipped, 21 subtests passed (reproduced the original 1-failure state on fresh main before this fix).
• coverage report --fail-under=100: 100%.
• interrogate: 100%.
• Independently reproduced by a peer session on a separate branch before this fix landed, confirming it is not environment-specific.

Developer experience

Closes the last of three known gaps (alongside #1829 and #1832) blocking the required test/coverage/docstring suite for every .github PR.

User experience

None (test-infrastructure-only change; no product-facing behavior change).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: ed9f099e-f584-450d-b9e0-65b8a0ff30ba

📥 Commits

Reviewing files that changed from the base of the PR and between 816e3e4 and f3b1fbb.

📒 Files selected for processing (3)

• scripts/ci/noema_review_gate.py
• tests/test_noema_model_output_edge_coverage.py
• tests/test_noema_repair_attempt_telemetry.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}