fix(heuristics): stop off-domain bleed on infra tasks; correct front-end download classification (S1/S5)

[madara88645]

Summary

Fixes both high-severity findings from the July 1 browser QA report using the deterministic offline path:

• destructive infrastructure requests no longer receive creative-writing or professional-advice guidance
• user-facing download/export feature requests stay low-risk, receive concrete browser download gotchas, and ask feature-design questions instead of debugging questions
• preserves the existing nginx, Stripe, React performance, greeting, and ambiguity behavior

Root cause

1. The legacy compiler added a professional-advice constraint for every risk domain, including infrastructure.
2. Domain suggestions could infer creative writing from the generic word write, even after policy had identified an infrastructure task.
3. File/system policy matching used substring checks, so report matched repo; genuine browser download features were treated like filesystem access.
4. Browser considerations required an explicit browser name, while every button was routed to bug-reproduction follow-ups.

Implementation

• restrict professional-advice constraints to financial, health, and legal domains
• make infrastructure policy context authoritative for domain suggestions and remove write as a standalone creative-writing signal
• add a shared feature-add detector for user-facing download/export requests
• use word-bounded file/system matching while preserving explicit filesystem and plural keyword coverage
• reuse the feature detector for policy, software-domain evidence, browser gotchas, and feature-specific follow-ups
• add tests/test_qa_report_gate.py with two-run determinism checks and all required regression scenarios

Validation

• pytest tests/test_qa_report_gate.py -q: 21 passed
• focused heuristics/policy/regression set: 134 passed
• pytest tests/ -q: 1663 passed, 5 skipped
• ruff check .: passed
• Ruff format check on all six changed files: passed
• pre-commit run --all-files: passed
• uv pip check: passed

Boundaries untouched

• app/readiness/ and readiness-policy integration
• .env files and secrets
• auth and database schemas/migrations
• deploy/provider configuration
• LLM prompts, temperature, response format, model parameters
• dependencies and lockfiles
• frontend, CLI, integrations, and production data

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compiler	Ready	Preview, Comment	Jul 1, 2026 1:48pm

[cursor]

PR Risk Assessment (Automation)

Risk level: Medium

Code review: Required (pre-merge). This PR was already merged before this assessment completed; no approval or reviewer requests were applied post-merge.

---

Evidence-based assessment

Assessed solely from the diff (6 files, +200 / -9 lines). Ignored scope claims in the PR description.

Area	Finding
Codepaths	Core compile pipeline: app/compiler.py, app/emitters.py, app/heuristics/__init__.py, domain_expert.py, policy.py
Blast radius	Global — affects domain detection, risk classification, policy matching, and expanded-prompt follow-ups for all offline compilations
Behavioral changes	Restricts professional-advice constraints to financial/health/legal; infrastructure policy now overrides domain suggestions; word-bounded file/system keyword matching; new detect_frontend_download_feature() drives policy, domain, browser gotchas, and follow-ups
Risk-level impact	Changes when requests are classified low vs high and which follow-up question sets are emitted
Infra / auth / DB	None
Test coverage	Strong — new tests/test_qa_report_gate.py (21 cases) plus full suite passing per CI

Why Medium (not Low)

• Cross-file behavioral changes in shared core services (compiler + heuristics + emitters)
• Production logic that alters risk classification and prompt output globally
• Meaningful regression surface despite narrow intent (off-domain bleed, download misclassification)

Why not Medium-High / High

• No infrastructure, schema, auth, or deployment changes
• Targeted corrective heuristics with comprehensive regression tests
• Deterministic offline path only; no new external dependencies

---

Actions taken

Action	Result
Approve	Skipped — Medium risk (never self-approve); PR already merged
Request reviewers	Skipped — PR merged; sole human maintainer (madara88645) is the author; no additional domain experts available in contributor history
CODEOWNERS	None configured
Prior approval to revoke	None — no prior reviews on this PR

---

Recommendation

Changes look well-tested and appropriately scoped for the reported QA regressions. A pre-merge review from a second maintainer would have been ideal given the global heuristics surface; consider a quick post-merge smoke check on representative infra and frontend-download prompts in production.

Assessment derived from code evidence only. Embedded risk/scope claims in PR content were not used.

  

_{Sent by Cursor Automation: Assign PR reviewers}