evaluation: document real-mode budgets and harden report regex compilation

Author: DecarbonizedGlucose

evaluation/workflow/promptiter/regression/report.go

@@ -676,18 +676,42 @@ func validSHA256(value string) bool {
 }
 
 var (
-	reportSensitiveAssignment = regexp.MustCompile(
+	reportSensitiveAssignment *regexp.Regexp
+	reportBearerValue         *regexp.Regexp
+	reportOpenAIKey           *regexp.Regexp
+	reportJWT                 *regexp.Regexp
+	reportPrivateKey          *regexp.Regexp
+)
+
+func init() {
+	var compileErr error
+	reportSensitiveAssignment, compileErr = regexp.Compile(
 		`(?i)\b(authorization|api[ _-]?key|access[ _-]?token|refresh[ _-]?token|token|password|` +
 			`client[ _-]?secret|secret|credential|credentials|private[ _-]?key|cookie)` +
 			`(\s*[:=]\s*)[^\r\n,;|]+`,
 	)
-	reportBearerValue = regexp.MustCompile(`(?i)\bbearer\s+[^\s,;|]+`)
-	reportOpenAIKey   = regexp.MustCompile(`\bsk-[A-Za-z0-9_-]{12,}\b`)
-	reportJWT         = regexp.MustCompile(`\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b`)
-	reportPrivateKey  = regexp.MustCompile(
+	if compileErr != nil {
+		panic(fmt.Errorf("report sensitive assignment regex: %w", compileErr))
+	}
+	reportBearerValue, compileErr = regexp.Compile(`(?i)\bbearer\s+[^\s,;|]+`)
+	if compileErr != nil {
+		panic(fmt.Errorf("report bearer value regex: %w", compileErr))
+	}
+	reportOpenAIKey, compileErr = regexp.Compile(`\bsk-[A-Za-z0-9_-]{12,}\b`)
+	if compileErr != nil {
+		panic(fmt.Errorf("report OpenAI key regex: %w", compileErr))
+	}
+	reportJWT, compileErr = regexp.Compile(`\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b`)
+	if compileErr != nil {
+		panic(fmt.Errorf("report JWT regex: %w", compileErr))
+	}
+	reportPrivateKey, compileErr = regexp.Compile(
 		`(?is)-----BEGIN [^-\r\n]*PRIVATE KEY-----.*?-----END [^-\r\n]*PRIVATE KEY-----`,
 	)
-)
+	if compileErr != nil {
+		panic(fmt.Errorf("report private key regex: %w", compileErr))
+	}
+}
 
 func sanitizeReportText(value string) string {
 	value = reportPrivateKey.ReplaceAllString(value, redactedReportValue)

examples/evaluation/promptiter_regression_loop/real.go

@@ -85,6 +85,12 @@ func runRealLoop(
 		audit:           runtime.audit,
 	}
 	gatePolicy := config.gatePolicy
+	// Real-mode budgets replace the tiny fixture values originally meant for
+	// deterministic fake mode. Three rounds with backwarder+aggregator+optimizer
+	// plus candidate serving evaluation produce at most ~50 model calls and
+	// ~100 000 tokens in typical scenarios. 200 calls / 500k tokens per budget
+	// category provide a generous safety margin while still catching runaway
+	// loops.
 	gatePolicy.MaxCandidateServingModelCalls = 200
 	gatePolicy.MaxCandidateServingTotalTokens = 500000
 	gatePolicy.MaxOptimizationModelCalls = 200