docs: add 30-second hook to README top#56
Merged
Merged
Conversation
Added project description and live demo link to README.
MarwaBS
added a commit
that referenced
this pull request
Jul 5, 2026
…it B3) (#57) The 30-second-hook commit (#56) shipped marketing claims the system cannot keep. This PR makes every claim true instead of deleting it, and closes the transitive-dependency gap it was audited alongside. HIGH - determinism overclaim cluster: - UI banner said 'Scoring is identical across all modes' and the module docstring said apply_score/verdict are 'IDENTICAL across all four modes' - false when OPENAI_API_KEY is set: the orchestrator feeds live llm_confidence into score() at weight 0.25 (our own test_orchestrator.py allows a 25-point delta). Banner + docstring now scope the invariant to the four deterministic signals and disclose the up-to-25-point LLM-mode delta. - README claimed 'Reproducibility verified to 1e-9 across local, CI, and HuggingFace Spaces' - no HF-side verification exists (tests/ are excluded from the Space image). Now scoped to what is verified: 1e-9 on the deterministic scoring path, in local and CI test runs. - 'Same input -> same output, every time' now explicitly scoped to the LLM-absent path; 'job-offer scoring engine' corrected to job-description scoring. - New grep-tests (TestClaimHonesty) pin the corrected wording so the overclaims cannot silently return. MEDIUM - transitive deps unpinned + vulnerable despite 'exact == pins': - The deployed set carried starlette 1.2.1 (PYSEC-2026-248/249) and torch 2.12.0 (CVE-2025-3000) because only DIRECT deps were pinned. - Added requirements-lock.txt: full transitive lock (105 pins, universal markers, compiled for py3.12), consumed as a pip constraints file by the Dockerfile and both CI install steps - shipped image == tested universe. Lock resolves starlette 1.3.1 (fixed) and torch 2.12.1 (outside the CVE-2025-3000 affected range; 2.12.0 was inside - the same advisory DB flags 2.12.0 and passes 2.12.1). - New CI pip-audit step over the lock (no ignores needed today); new tests/test_requirements_lock.py enforces the lock/installer contract. - requirements.txt + Dockerfile headers now state exactly what is pinned where. Full suite re-run green in a fresh py3.12 venv installed from the lock; streamlit boots and scripts.demo_example reproduces the README numbers under the locked set. MEDIUM/LOW - flaky AppTest: explicit default_timeout=30 (cold runs exceeded the 3s default). LOW - precision_apply semantics: now genuinely precision-of-APPLY - positives over outcomes whose decision verdict is APPLY, mirroring the precision_priority join (was computed over ALL outcomes). Omitted (not fabricated as 0.000) when no APPLY outcomes exist. Regression tests proven red against the old computation. LOW doc drifts: four grep-tests (not three); model download ~90 MB weights / ~175 MB on disk (not ~400 MB); hermetic suite ~5-10 s measured (not ~1-2 s). All pinned by grep-tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added project description and live demo link to README.