fix(validators): vision input hardening — 0-record, label-column, bbox/size geometry

[shujaatTracebloc]

Summary

Adversarial image-classification ingestion — re-verified against the merged develop validator chain (not the stale deployed image) — showed the #303 zero-record guard and #313 label-column guard were wired NLP-only, so vision still had the same two gaps. This extends both to the vision factories.

Gaps (confirmed on develop HEAD via the real map_validators chain)

Case	Before	Cause
header-only / empty CSV	✅ passes preflight → ingests 0 rows → orphan empty table + late "rows already in the database"	no IngestableRecordsValidator
missing configured label column	✅ passes preflight → records clean to label=None → backend rejects each row HTTP 400 "label: may not be null"	no LabelColumnValidator

(corrupt image, wrong resolution, single label, all-images-missing were already caught.)

Fix

• New _zero_record_validator helper wires IngestableRecordsValidator(file_subdir="images") into all file-bearing vision categories — image_classification, object_detection, semantic_segmentation, keypoint_detection — so a zero-record vision manifest fails fast at preflight (no orphan table).
• LabelColumnValidator added to image_classification only — it is the only vision category whose label is a CSV column. Object detection / segmentation / keypoint source labels from XML / masks / annotation files, so adding it there would wrongly reject every such dataset.
• TextContentValidator stays NLP-only (it decodes UTF-8 text — meaningless for images).

Resulting image_classification chain: FileType → IngestableRecords → ImageResolution → LabelColumn → LabelDiversity → TableName → Duplicate.

Tests

• Mapping: image gets both guards (exact-list updated); OD/seg/keypoint get the zero-record guard only and never LabelColumnValidator; updated the prior NLP-only content-hygiene assertion (TextContent stays NLP-only).
• Behavioral (test_vision_input_validators.py): real chain on staged images — empty CSV → IngestableRecordsValidator reject; missing label column → LabelColumnValidator reject; valid → passes.
• Full suite: 1209 passed, 1 xfailed, total coverage 96.7% (gate 95%). black-clean.

Follow-up to #303 / #313, extending the same hardening from NLP to vision.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes expand which datasets fail at preflight across all vision modalities and add coordinate/size logic in VOC and keypoint validators; behavior is well-tested but mis-tuned target_size or edge cases in best-effort image lookup could reject previously accepted datasets.

Overview
Extends NLP-style preflight guards to vision ingest: IngestableRecordsValidator (via _zero_record_validator) is wired into all file-bearing vision categories so header-only/empty manifests fail before creating orphan tables; LabelColumnValidator is added only to image_classification (other vision tasks don’t use a CSV label column).

Semantic segmentation adds a second ImageResolutionValidator with subdir="masks" so masks are readable and match target_size, not just images under images/.

Keypoint detection passes target_size into KeypointAnnotationValidator as expected_resolution to reject coords outside [0, W) × [0, H), with negative and out-of-bounds errors reported independently.

Object detection PascalVOCXMLValidator now rejects bboxes past declared <size>, cross-checks declared dimensions against the stem-paired file under SRC_PATH/images, and resolves images from SRC_PATH (not XML parent paths).

Tests cover mapping chains, end-to-end image-classification preflight, masks/keypoints/XML geometry, plus minor formatting in existing tests.

^{Reviewed by Cursor Bugbot for commit 2fa816c. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Added: semantic segmentation + keypoint detection (vision sweep complete)

Semantic segmentation — masks were unvalidated (ImageResolutionValidator only scans <SRC>/images):

• mask resolution ≠ image → passed (breaks pixel-wise labels); corrupt/unreadable mask → passed (only .png extension checked).
• Fix: ImageResolutionValidator gains a subdir param; seg factory adds a subdir="masks" instance → masks must be readable + share the images' target resolution.

Keypoint detection — keypoint coords past the image edge passed (validator never saw image size; only non-negative was checked).

• Fix: thread target_size into KeypointAnnotationValidator as expected_resolution; coords > width/height now rejected.

Not changed (pending product call): keypoint Visibility stays restricted to 0/1. Accepting COCO's 0/1/2 is a format decision (could admit data the runtime doesn't support), so it's flagged rather than silently relaxed.

Vision sweep now complete across all four categories (image, object detection, semantic segmentation, keypoint).

[LukasWodka]

👋 Heads-up — Code review queue is at 35 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• .github#60 — feat(security): public-repo PII gate (block customer names + secrets in PRs) · author: @LukasWodka · no reviewer assigned
• .github#61 — fix(wip-limit): avoid sort|head SIGPIPE failing the WIP check when queue >10 · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#119 — fix(averaging): exact federated GaussianNB merge — usable + correct (WS-B B2, docs: fix staging-recipe link branch ref (main → develop) #112) · author: @divyasinghds · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#833 — fix(deploy): graceful shutdown + Dockerfile hygiene; drop dead EC2 script · author: @LukasWodka · no reviewer assigned
• backend#840 — feat(rfc-0001): namespace-slug rule + validation command (#837) · author: @LukasWodka · no reviewer assigned
• backend#843 — fix(test): connect local MySQL test DB over TCP + document mac test-tier setup · author: @LukasWodka · reviewer: @saadqbal
• backend#844 — fix(test): activate ServiceBusMock under pytest so experiment-utils tests don't hang · author: @LukasWodka · reviewer: @saadqbal
• backend#845 — feat(auth): add ClientAccessToken — bounded, revocable bearer token for the CLI (#835) · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ba5cb07. Configure here.}