fix(cache): retry transient identity barrier churn

[mldangelo-oai]

Summary

• retry transient change-clock barrier churn through the existing bounded capture loop instead of failing before the outer retries can run
• keep persistent churn fail-closed and isolate the source-independent cache regression from unrelated shared pytest-ancestor activity
• add deterministic transient and persistent barrier regressions plus a changelog entry

Evidence

Nightly 29892590286 failed only Correctness (ubuntu-latest, Python 3.13, Shard 1) at test_scan_cache_rejects_source_independent_marker_with_source_inputs[metadata_update5] with:

ValueError: File kept changing while capturing cache identity
1 failed, 11166 passed, 505 skipped

The deterministic transient-barrier regression fails on the exact current main and passes with this change. Persistent churn still raises after the bounded 15 attempts.

Validation

• PYTHONPATH=/private/tmp/modelaudit-cache-identity-barrier-20260722 PROMPTFOO_DISABLE_TELEMETRY=1 /Users/mdangelo/code/modelaudit/.venv/bin/python -m pytest -n 4 tests/cache/test_cache_correctness.py::test_capture_file_identity_retries_transient_change_clock_barrier tests/cache/test_cache_correctness.py::test_capture_file_identity_fails_closed_for_persistent_change_clock_barrier tests/cache/test_cache_correctness.py::test_capture_file_identity_retries_transient_monitor_start_change tests/cache/test_cache_correctness.py::test_capture_file_identity_advances_clock_before_hashing tests/cache/test_cache_correctness.py::test_scan_cache_rejects_source_independent_marker_with_source_inputs -q --tb=short --maxfail=1 — 10 passed
• PYTHONPATH=/private/tmp/modelaudit-cache-identity-barrier-20260722 PROMPTFOO_DISABLE_TELEMETRY=1 /Users/mdangelo/code/modelaudit/.venv/bin/python -m pytest -n 4 tests/cache --ignore=tests/cache/test_cache_correctness.py -q --tb=short --maxfail=1 — 22 passed
• Ruff, Ruff format check, changed-file mypy (Python 3.10), Prettier, and git diff --check clean

The full cache-correctness xdist run on this macOS environment still hits three pre-existing source-identity store assertions in unrelated tests; the exact Ubuntu CI lane is authoritative.

[Copilot]

Pull request overview

Improves the scan-results cache identity capture so transient “change-clock barrier” churn is retried via the existing bounded outer capture loop, avoiding premature failures while still failing closed for persistent churn.

Changes:

• Update _capture_file_identity to retry (with a short backoff) when the identity barrier cannot be satisfied on a given capture attempt, instead of failing before outer retries run.
• Add deterministic regressions for transient and persistent change-clock barrier behavior.
• Scope a cache-correctness test’s ancestor identity to the tmp tree to avoid unrelated ancestor churn, and add a changelog entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
modelaudit/cache/scan_results_cache.py	Changes barrier-exhaustion behavior to continue outer capture retries (with backoff) and preserve fail-closed semantics after bounded attempts.
tests/cache/test_cache_correctness.py	Adds targeted tests for transient/persistent barrier churn and scopes ancestor identity in a parametrized cache-correctness test to reduce nondeterministic churn.
CHANGELOG.md	Notes the cache identity-barrier churn retry fix under Unreleased bug fixes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 13 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 13 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 4.239s -> 4.294s (+1.3%).

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
rejected-basic-auth-candidates	tests/benchmarks/test_scan_benchmarks.py::test_rejected_basic_auth_candidates_scan_linearly	-	371.1 KiB	1	2.436s	2.487s	+2.1%	stable
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	334.0us	338.7us	+1.4%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	276.9us	280.6us	+1.3%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	304.7us	308.0us	+1.1%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	110.58ms	109.73ms	-0.8%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	294.4us	296.6us	+0.8%	stable
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	151.79ms	152.80ms	+0.7%	stable
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	101.91ms	102.57ms	+0.6%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	113.56ms	112.86ms	-0.6%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	145.29ms	146.08ms	+0.5%	stable
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	223.1us	222.1us	-0.4%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	620.05ms	621.12ms	+0.2%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	558.89ms	559.84ms	+0.2%	stable

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.