[github-actions]

What this PR does

Every guarded kubectl-ome action on my service refuses with 'action refused: safety inputs exceed inspection bounds' although each InferenceReplica is far below the documented 2048-row bound — what else does the CLI cap when it inspects the replica evidence, and why does only the runtime sync page mention 32 InferenceReplicas and 256 migrations?

Why we need it

Source change: ome-projects/ome@8645e0c

From commit 30 (Add guarded rollout pause and resume), whose patch introduced the shared replica-evidence collector with these caps end to end (verified in the patch: the command help text '32 related IRs / two pages, 2048 instances and 256 migrations per IR' at patch line 71, the ListBounded limits PageSize 16 / MaxItems 32 / MaxPages 2 at patch line 2037, and the per-IR bounds 'len(ir.Status.Migrations) > 256' at patch line 2104). Current code verified today: pkg/cli/mutate/replicas.go:49 lists the service's InferenceReplicas with paging.Limits{PageSize: 16, MaxItems: 32, MaxPages: 2} and a truncated list returns ErrBounds (:73-74); replicas.go:131 refuses a replica with more than 16 ownerReferences, 256 annotations, 256 status.migrations records or 64 conditions, and :139 one with more than 2048 decoded rows — all mapping to 'action refused: safety inputs exceed inspection bounds' (target.go:18). The same collector backs rollout pause, promote and rollback (cmd/rollout/actions.go:189-194, whose Long help pins 'Safety inspection caps 32 related IRs / two pages, 2048 instances and 256 migrations per IR'), runtime sync (mutate/runtime_sync_replicas.go:56) and migration start (mutate/migration_evidence.go:89); instance release-held runs its own list with the identical limits and per-IR caps (mutate/held_release_source.go:56 and :162), and scale inspects the selected replica through the same inspectReplica per-IR caps (mutate/scale_evidence.go:43). Docs gap verified today: reference/kubectl-ome/guarded-actions.md's 'Instance status decoding' bounds table (:85-88) lists only 'The status holds more than 2048 rows' under the bounds message, :92 says 'The 2048-row bound is the CLI's own, the same for every action', and the Target checks row (:63) says only 'The InferenceService is too large for the command to check safely' — nothing names the 32-replica list cap or the 256-migration-records cap, so an operator whose busy component accumulates over 256 migration records inside the one-hour audit window, or whose namespace lists more than 32 InferenceReplicas under the service's ome.io/inferenceservice label, finds no explanation for the refusal. A repo-wide grep shows only reference/kubectl-ome/runtime.md:649 naming these numbers, scoped to runtime sync ('more than 32 InferenceReplicas, more than 2048 instances or 256 migrations in one of them'), which both proves the numbers are doc-worthy and leaves the shared contract page inconsistent with it. One independent concern: the remaining inspection caps of the one evidence collector that one commit introduced, as rows in the guarded-actions bounds table that already owns the 2048-row cap. Distinct from merged #41, which documented the ColumnarV2 decode-and-refuse behavior and the 2048-row bound on this same section and did not cover the list or migration caps.

Scope: cli-actions / guarded-actions-evidence-inspection-caps. Other concerns are deferred.

How to test

• Passed the documentation path and size guard (under 1000 added plus deleted lines; no file-count limit).
• Passed an independent accuracy and single-concern review.
• Passed git diff --check and website content/link tests, type checks, lint and production build.

Checklist

• Every commit is signed off (git commit -s)
• pnpm lint && pnpm check && pnpm test && pnpm build passes (run by the publisher on an isolated copy)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d19e2b42-8487-4381-8ca6-4cac9b347000

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[github-actions]

Documentation maintenance: ready. Unsuccessful content rounds: 0/3. Operational attempts: 0/3.

Head: ade8d3b979a3569f397106a49cdfdf38f2e25bfc; reviewed main: 1bfbb4c381bedd7db00749de0b733cb954f91914.

Every claim in the final diff is verified against the pinned code (d141021). The 32-replica list cap row matches the shared collector: label selector ome.io/inferenceservice (constants.go:444), paging.Limits{PageSize:16, MaxItems:32, MaxPages:2} with a truncated list returning ErrBounds (replicas.go:46-74), i.e. "at most two pages of 16, refuses a cut-off list"; instance release-held runs an identical list (held_release_source.go:56,75-79). The per-replica caps row matches inspectReplica (replicas.go:131: >16 ownerReferences, >256 annotations, >256 status.migrations including finished records, >64 conditions → ErrBounds) and validateHeldReplicaIdentity (held_release_source.go:162); the exact refusal message is target.go:18. The "second case"→"last case" renumbering is required and correct: migration start remaps only ErrStale to "migration precondition conflicts or is stale..." (migration_evidence.go:91-92, migration.go:69) exiting 3 via PreconditionError→MutationConflict (exitcode.go:10,62-64), while ErrBounds passes through. Command coverage is right: among rollout commands only pause/promote/rollback collect evidence (cmd/rollout/actions.go:189-190); migration start (migration_evidence.go:89) and runtime sync (runtime_sync_replicas.go:56) use the collector; scale never lists — exact GET of the scaled replica (cmd/scale/collect.go:118) and of pinned-run siblings (scale_pinned.go:48-57), all through inspectReplica so the per-replica caps apply, and "pinned sibling proof" plus the #preview anchor exist in scale.md (:125,:143). The byte-bounds sentence matches replicaPayloadBounded (annotation/label bytes 65536, 4096 per status string, 1MB total → ErrBounds). All edits serve the one concern (the remaining inspection caps of the one evidence collector on the guarded-actions bounds section) with only consequential renumbering and a cross-reference; no since badges or release claims added, no code, nav, redirect or protected reference/api changes. checks.json is empty and the context has no review threads, so no threads are addressed.

Workflow evidence

Human review threads and CODEOWNER approval remain under repository policy.