CRITICAL: PR #21750 mypy protocol subtype fix is unsound - silently treats incompatible types as compatible

[knoal]

Problem - CRITICAL

PR #21750 (Fix infinite recursion in protocol subtype check) is unsound. The fix silently treats incompatible types as compatible.

Impact

• The recursion "fix" uses an arbitrary magic number threshold (no justification) and skips the type check entirely
• Could allow incompatible types to be used in mypy code
• A user code that previously failed type-checking would now pass with no error
• This is a correctness regression in a type-checker

What was audited

MCE audit Tmypy21750 (2026-07-19) caught 4 HIGH attacks via F-C:

1. The fix is unsound - it silently treats incompatible types as compatible
2. The threshold is an arbitrary magic number with no justification
3. No failing-first demonstration is provided
4. The test does NOT exercise the actual recursion bug

Recommended fix

1. The author should:
   a. Either find a sound fix that actually resolves the recursion (e.g., memoization, iterative resolution)
   b. Or document why the magic number threshold is correct
2. Add a failing-first test that demonstrates the bug pre-fix
3. Add test coverage for types that should NOT be treated as compatible

Cross-references

• MCE audit: Tmypy21750 (2026-07-19), 0/4 HIT, Brier 0.6
• F-C analysis: /home/alex/.hermes/mce/fc-critiques/Tmypy21750-with-diff.json
• PR: Fix infinite recursion in protocol subtype check (GH#21739) #21750
• Issue: GH#21739