[makr-code]

---

Author: "ThemisDB Team"
Created: "2026-10-09"
Last Updated: "2026-10-09"
Status: "active"

Pull Request

Target Version (Required)

Target Version: [Unreleased]

---

Description

Training selection and AdaLoRA-TT behavior needed to match their runtime contracts, particularly when selected data is partial or adapter metadata is invalid. This change makes those paths fail closed and documents measurable release gates and evidence gaps.

• Selected data: Filter requested IDs before the query limit; reject empty, duplicate, missing, or invalid selections rather than training on partial results.
• AdaLoRA-TT: Preserve effective scaling, verify orthogonality claims, and persist serialized exports through the configured storage engine. Missing storage or invalid exports fail safely.
• Release evidence: Document correctness and numerical gates; RocksDB restart durability, production serving handoff, and representative latency evidence remain unverified.

Selection ordering, conceptually:

FILTER sample._key IN <selected_ids>
LIMIT <unique_selected_id_count>

Linked Issues

Issue association is handled by repository metadata.

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other:

Breaking Change Checklist

• MAJOR version bump planned in VERSION and CMakeLists.txt
• Migration guide added in docs/migration/
• Announcement prepared for GitHub Discussions (≥ 2 weeks before release)
• CHANGELOG ### Removed / ### Changed section updated

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • T0 Trusted Core
  • T1 Security & Platform Services
  • T2 Data Plane Engines
  • T3 Interface & Protocol Edge
  • T4 Managed Extension Runtime
  • T5 Plugin Boundary
  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (no new cross-tier boundary introduced)

• Boundary-focused tests added/updated or explicit N/A rationale provided (selection validation failures are covered)

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?
  • Falls JA: Research-Dateien in /docs/research/ angelegt?
  • Falls JA: Im Modul-README unter "Wissenschaftliche Grundlagen" verlinkt?
  • Falls JA: In /docs/research/implementation_influence/ eingetragen?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md)
• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt
• RAII und Exception-Safety für neue/angepasste Pfade geprüft
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Performance-Metriken geprüft, falls Hotpath betroffen

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md
• Security hardening review performed for security-sensitive/runtime changes with .github/prompts/security-hardening-review.prompt.md (or N/A documented)
• API impact review performed for API/contract changes with .github/prompts/api-change-impact-review.prompt.md (or N/A documented)
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

High-Finding Exception Record (only if High is accepted)

• High-finding exception claimed in this PR

• Finding reference:

• Maintainer approver:

• Mitigation in current release:

• Target fix milestone:

• Tracking issue:

• Validation evidence:

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Code follows project style guidelines (clang-format / clang-tidy)
• Self-review completed
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased]
• No new warnings introduced
• Security-sensitive paths reviewed by security maintainer (if applicable)

Scanner and IntelliSense Gates

• IntelliSense/Compiler: no new errors in changed files
• clang-tidy/cppcheck: no new high-risk findings in changed files
• Gap Scanner: no new critical findings in categories security, input_validation, query_correctness, distributed_consistency, concurrency, memory
• Gap Scanner: no new high findings in the same categories (or explicitly approved)
• Gap Scanner delta report attached (baseline vs current), not only absolute totals
• New unknown scanner findings triaged (fixed, re-categorized, or justified)

• Fixes [module][evidence] training: align runtime quality, checkpointing, and failure handling with explicit resilience and correctness gates #7551

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

Recommend-Only CI Failure Diagnose

Workflow: Gate: PR Core
Run: https://github.com/makr-code/ThemisDB/actions/runs/43634952557
Branch: copilot/module-training-align-resilience-correctness
Commit: 4e97e7e

Beobachtung:

• Gate: PR Build Components Orchestrator / Validate: Final Runtime API Gate (TinyLlama + docs.db) / Validate: TinyLlama + docs.db Inference Gate (conclusion: failure, first failed step: Run TinyLlama inference tests, started: 2026-11-14T21:15:41.000Z)
• Gate: PR Build Components Orchestrator / Validate: Build Components Summary (conclusion: failure, first failed step: Validate reusable build components outcomes, started: 2026-11-14T21:58:13.000Z)
• Validate: PR Gates Summary (conclusion: failure, first failed step: Fail if mandatory release-critical gate failed, started: 2026-11-14T21:59:38.000Z)

Empfohlene naechste Schritte:

• 1. Oeffne den fehlgeschlagenen Job und pruefe den ersten fehlerhaften Step.
• 2. Reproduziere lokal nur den betroffenen Scope (zielgerichteter Build/Test statt Full Run).
• 3. Wenn der Fehler infra- oder flake-verdaechtig ist: Re-Run + Vergleich der Job-Logs.
• 4. Wenn reproduzierbar: kleine Fix-PR mit klarer Root-Cause-Notiz und Testnachweis erstellen.

Hinweis: Dieser Workflow ist recommend-only. Keine Labels, keine Auto-Close-Aktionen, keine Code-Aenderungen.
Aktualisiert: 2026-11-14T21:59:48.699Z

[makr-code]

@copilot fix all

[github-actions]

Target: pr

Doc Metadata Gate

• Verdict: PASS
• Files seen: 22
• Files checked: 1
• Files skipped: 21
• Files with errors: 0
• Workflow: Gate: PR Doc Metadata
• Run: https://github.com/makr-code/ThemisDB/actions/runs/43634952493
• Commit: 08ac5ad1d2590b90170bc9583c5facd6a98bb47b

---

source_workflow: Gate: PR Doc Metadata
source_run: 43634952493
source_sha: 08ac5ad

[github-actions]

Target: pr

Caution

Gate: PR Primary Doc Structure ist fehlgeschlagen.
Run: https://github.com/makr-code/ThemisDB/actions/runs/43588087443
Commit: e1cbbfda44058fd4c5a186b70c31a641621a95e3

---

source_workflow: Gate: PR Primary Doc Structure
source_run: 43588087443
source_sha: e1cbbfd

[github-actions]

Target: pr

Doxygen Governance Gate

• Verdict: PASS
• Base branch: develop
• Changed C/C++ files: 10
• Changed public headers: 3
• Scoped modules: llm, training
• Release lane: no
• Phase 6 modules in scope: none
• Coverage enforced: no
• Coverage threshold: 95.0%
• Coverage result: skipped
• Coverage waiver active: no
• Approved waivers: none
• Structural findings: 0
• Advisory findings: 0
• Blocking Doxygen warnings: 0
• Suppressed out-of-scope Doxygen warnings: 0
• XML generated: yes

Changed source files

• include/llm/llama_wrapper.h
• include/training/adalora_tt_bridge.h
• include/training/incremental_lora_trainer.h
• src/llm/llama_wrapper.cpp
• src/training/adalora_tt_bridge.cpp
• src/training/incremental_lora_trainer.cpp
• tests/llm/test_llm_tinyllama_inference.cpp
• tests/test_adalora_tt_bridge.cpp
• tests/training/test_adalora_tt_bridge_hardening.cpp
• tests/training/test_incremental_lora_db_training.cpp

---

source_workflow: Gate: PR Doxygen Governance
source_run: 43634952358
source_sha: 08ac5ad

[github-actions]

✅ Wave C Policy Gate: Edition & License Validation

Result: ✅ Edition & License Validation PASSED
Workflow run: #43634952473
Triggered by: @makr-code

Checks

• ✅ Edition matrix consistency check
• ✅ License feature gate validation
• ✅ Enterprise/military marker detection
• ℹ️ Target branch: develop

See .github/workflows/gate-pr-edition-license.yml for details.

[github-actions]

✅ Wave C Policy Gate: Community Fail-Closed Validation

Result: ✅ Community Fail-Closed Validation PASSED
Workflow run: #43634952473
Triggered by: @makr-code

Checks

• ✅ No silent fallback patterns
• ✅ License disclaimers present
• ✅ No unguarded telemetry/tracking
• ✅ No private plugin references in community/minimal scope
• ✅ Community-only build config validation
• ✅ No enterprise secrets leakage

See .github/workflows/gate-pr-community-failclosed.yml for details.

[Copilot]

@copilot fix all

Raised the TinyLlama inference CTest timeout from 120 to 600 seconds while keeping the full suite, in 9046a072. Workflow lint, whitespace checks, and secret scanning passed; CodeQL reported zero Actions alerts. The workflow-boundary pytest could not run because pytest is unavailable. New PR workflows are action_required with no jobs, so the change has not yet been exercised in CI.

[github-actions]

RAG Embedding Version Governance Gate Report

Date: 2026-11-14T14:27:27Z
PR: 8116
Commit: 9046a07
Validation job result: success

Validation outcomes are recorded by the individual workflow steps and in the run summary.

References

• Spec: src/ingestion/EMBEDDING_VERSION_GOVERNANCE.md
• Schema: src/index/INDEX_MANIFEST_V1_SCHEMA.json

[github-actions]

Workflow Guidelines Compliance ✅ PASS

• Violations: 0
• Warnings: 0

See the job logs for details.

Reference: WORKFLOW_GUIDELINES.md

[makr-code]

@copilot fix all

[Copilot]

@copilot fix all

Fixed the two actionable CI issues in 99d2b792 and ec2c1486: the TinyLlama CTest registration now matches the 600-second gate timeout, and the release-critical build artifact uses the existing portable CPU flags because validation runs on a separate runner (the prior Illegal instruction failures). Actionlint and the CPU-policy tests passed (6 passed, 1 dependency-gated skip); secret scanning passed and CodeQL Actions analysis found no alerts. The new PR workflows are action_required, so these fixes still need approval and a fresh CI run.

[github-actions]

RAG Embedding Version Governance Gate Report

Date: 2026-11-14T17:01:13Z
PR: 8116
Commit: ec2c148
Validation job result: success

Validation outcomes are recorded by the individual workflow steps and in the run summary.

References

• Spec: src/ingestion/EMBEDDING_VERSION_GOVERNANCE.md
• Schema: src/index/INDEX_MANIFEST_V1_SCHEMA.json

[github-actions]

Workflow Guidelines Compliance ✅ PASS

• Violations: 0
• Warnings: 0

See the job logs for details.

Reference: WORKFLOW_GUIDELINES.md

[makr-code]

@copilot fix all

[github-actions]

RAG Embedding Version Governance Gate Report

Date: 2026-11-14T20:03:33Z
PR: 8116
Commit: 4e97e7e
Validation job result: success

Validation outcomes are recorded by the individual workflow steps and in the run summary.

References

• Spec: src/ingestion/EMBEDDING_VERSION_GOVERNANCE.md
• Schema: src/index/INDEX_MANIFEST_V1_SCHEMA.json

[github-actions]

Workflow Guidelines Compliance ✅ PASS

• Violations: 0
• Warnings: 0

See the job logs for details.

Reference: WORKFLOW_GUIDELINES.md