fix(diagnostics): strict advisory_only validation + to_dict serialization

- AdvisoryCheck.from_dict: reject malformed strings ('false', '0') —
  only accept bool or int 0/1, not truthy strings (CodeRabbit MAJOR)
- to_dict: serialize AdvisoryCheck instances to dicts — prevents
  TypeError on JSON serialization (Sentry MEDIUM)
- advisory_checks property: explicit comment on except block (CodeQL)
- tests: add string rejection test, AdvisoryCheck serialization test,
  JSON serializability test

80 tests pass.

Author: rahuldass19

src/qwed_new/core/diagnostics.py

@@ -121,9 +121,19 @@ def to_dict(self) -> Dict[str, Any]:
 
     @classmethod
     def from_dict(cls, data: Dict[str, Any]) -> "AdvisoryCheck":
+        raw_advisory_only = data.get("advisory_only", True)
+        if isinstance(raw_advisory_only, bool):
+            advisory_only = raw_advisory_only
+        elif isinstance(raw_advisory_only, int) and raw_advisory_only in (0, 1):
+            advisory_only = bool(raw_advisory_only)
+        else:
+            raise ValueError(
+                "AdvisoryCheck.advisory_only must be a bool or integer 0/1"
+            )
+
         return cls(
             name=data.get("name", ""),
-            advisory_only=bool(data.get("advisory_only", True)),
+            advisory_only=advisory_only,
             constraint_id=data.get("constraint_id"),
             details=data.get("details", {}),
         )
@@ -263,21 +273,30 @@ def advisory_checks(self) -> List[AdvisoryCheck]:
                 try:
                     result.append(AdvisoryCheck.from_dict(item))
                 except ValueError:
-                    pass
+                    # Invalid advisory metadata is non-authoritative; skip it.
+                    continue
             elif isinstance(item, AdvisoryCheck):
                 result.append(item)
         return result
 
     def to_dict(self) -> Dict[str, Any]:
         """Serialize to dict for API/SDK responses and attestation claims.
 
-        Returns a flat dict with all three layers. advisory_checks are
-        serialized as dicts inside developer_fields.
+        Returns a flat dict with all three layers. AdvisoryCheck instances
+        in developer_fields['advisory_checks'] are serialized to dicts.
         """
+        # Deep-copy developer_fields and serialize any AdvisoryCheck instances
+        fields = dict(self.developer_fields)
+        checks = fields.get("advisory_checks")
+        if isinstance(checks, list):
+            fields["advisory_checks"] = [
+                item.to_dict() if isinstance(item, AdvisoryCheck) else item
+                for item in checks
+            ]
         return {
             "status": self.status.value,
             "agent_message": self.agent_message,
-            "developer_fields": self.developer_fields,
+            "developer_fields": fields,
             "proof_ref": self.proof_ref,
             "is_authoritative": self.is_authoritative,
         }

tests/test_diagnostics.py

@@ -265,6 +265,11 @@ def test_from_dict_rejects_zero_advisory_only(self):
         with self.assertRaises(ValueError):
             AdvisoryCheck.from_dict({"name": "test", "advisory_only": 0})
 
+    def test_from_dict_rejects_string_advisory_only(self):
+        """from_dict must reject string 'false' — bool('false') is True in Python."""
+        with self.assertRaises(ValueError):
+            AdvisoryCheck.from_dict({"name": "test", "advisory_only": "false"})
+
     def test_advisory_check_to_dict(self):
         ac = AdvisoryCheck(
             name="vlm_analysis",
@@ -373,6 +378,25 @@ def test_verified_round_trip(self):
         self.assertEqual(r2.proof_ref, r.proof_ref)
         self.assertEqual(r2.developer_fields, r.developer_fields)
 
+    def test_to_dict_serializes_advisory_check_instances(self):
+        """to_dict must serialize AdvisoryCheck instances to dicts (Sentry MEDIUM)."""
+        ac = AdvisoryCheck(name="llm", constraint_id="test", details={"verdict": "yes"})
+        r = DiagnosticResult.unverifiable("no", {"advisory_checks": [ac]})
+        d = r.to_dict()
+        checks = d["developer_fields"]["advisory_checks"]
+        self.assertEqual(len(checks), 1)
+        self.assertIsInstance(checks[0], dict)
+        self.assertEqual(checks[0]["name"], "llm")
+
+    def test_to_dict_json_serializable_with_advisory_checks(self):
+        """to_dict output must be JSON-serializable even with AdvisoryCheck instances."""
+        import json
+        ac = AdvisoryCheck(name="nli", constraint_id="graph.nli", details={"label": "entailment"})
+        r = DiagnosticResult.unverifiable("no", {"advisory_checks": [ac]})
+        d = r.to_dict()
+        payload = json.dumps(d)  # must not raise TypeError
+        self.assertIn("nli", payload)
+
     def test_unverifiable_round_trip(self):
         r = DiagnosticResult.unverifiable(
             "Cannot verify",