fix(security-discovery): fan batches out through the shared LLM limiter by elliottwaves-20 · Pull Request #856 · NVIDIA/SkillSpector · GitHub
Skip to content

fix(security-discovery): fan batches out through the shared LLM limiter - #856

Open
elliottwaves-20 wants to merge 2 commits into
NVIDIA:mainfrom
elliottwaves-20:fix/security-discovery-concurrent-batches
Open

elliottwaves-20 wants to merge 2 commits into
NVIDIA:mainfrom
elliottwaves-20:fix/security-discovery-concurrent-batches

Conversation

@elliottwaves-20

Copy link
Copy Markdown
Contributor

Summary

Fixes #854. semantic_security_discovery now calls run_async(analyzer.arun_batches(batches)), like semantic_quality_policy, semantic_developer_intent and the meta analyzer. Its batches go through the shared limiter and respect SKILLSPECTOR_MAX_LLM_CONCURRENCY.

Behaviour

arun_batches_detailed maps errors the same way as run_batches_detailed (structured-response validation, runtime limit, provider failures; ValueError / NotImplementedError re-raised), sets _last_batch_outcome, and keeps the batch order. One difference, shared with the sibling analyzers: all batches run before a ValueError is raised, so a configuration error can surface after more calls, and if another batch already got a response the node reports failed instead of raising. Both still fail closed.

Testing

  • tests/nodes/analyzers/test_semantic_security_discovery.py: tests moved from patching run_batches to arun_batches. The two refusal tests now mock ainvoke and assert it was awaited (otherwise they would pass on a mock mismatch). New: four batches with a shared limit of 2 reach exactly 2 in flight (0 before the fix), a partial failure keeps the successful findings and marks the gap, and a runtime limit from the async fan-out is still recorded.
  • Unit suite: no new failures (Windows; failures present on unchanged main stay the same). ruff: clean.

🤖 Generated with Claude Code

elliottwaves-20 and others added 2 commits October 17, 2026 13:56
semantic_security_discovery called the synchronous run_batches, which
walks the batches one by one, while the sibling semantic analyzers use
run_async(arun_batches) behind the shared limiter. On a large package
this analyzer alone kept one request in flight for hours.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: elliottwaves-20 <pail1217@web.de>
…ial-failure tests

The refusal tests still mocked the synchronous invoke, so after the switch to
arun_batches they failed on a mock mismatch instead of the refusal. Mock
ainvoke, assert it was awaited, pin the shared limit in the concurrency test,
and cover a partial failure in the fan-out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: elliottwaves-20 <pail1217@web.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

semantic_security_discovery runs its batches one at a time

1 participant