You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(lint): clear retained Ruff debt and gate the full repository - #348
Follow-up to the baseline debt intentionally retained by #105 / #323 (both historical; this does not reopen or close#105). One debt-focused PR, separate from the baseline-test and diagnostic behavior repairs.
Ruff 0.17.3: 197 findings across 69 files → 0; 145 files needing formatting → 0 (783 checked files now formatted).
Preserve Ruff rules, exclusions, dependency pin, workflow check identity, action pins and permissions. Upgrade the existing lint job from changed-file checks to python scripts/lint_changed.py --all; retain --base for local convenience.
Formatter tranche: 142 Python files AST-equivalent; 16 changed Python fences in 3 Markdown files AST-equivalent with surrounding prose unchanged.
Audit lint changes individually: unused imports, explicit Optional/zip semantics, mapping iteration, ordered incremental list extension, error chaining and test cleanups. Final full delta has 135 AST-unchanged Python files, 51 explicitly audited AST-changed Python files, and 5 non-Python files.
62 new/changed line-local suppression sites have contract reasons: deliberate error/quarantine boundaries, existing ValueError APIs, review-pass-name false positives, noncrypto sampling, executable hooks, intentional Semgrep source fixtures, and validated HTTP(S) requests. No blanket rule disabling or broader excludes.
Deliberate behavior details (not a pure-format claim)
Provider probes now refuse non-HTTP(S) URLs before request construction; five no-I/O regression cases cover this. Existing successful HTTP probe tests remain. Exception causes become explicit; test failure assertions remain active under -O; async test filesystem checks use a worker thread. Git SHA1 object hashes are unchanged and explicitly marked non-security. Intentional taint-fixture AST and ruleid/ok adjacency are unchanged; vulnerable example functions were never executed.
Validation and review
python scripts/lint_changed.py --all: all checks passed; 783 files already formatted.
git diff --check: clean.
Integrated owner supported/affected selection: 948 passed (capacity reporting, uncertainty basis, factories, and the original four targeted modules). Original owner targeted run: 148 passed (lint helper/workflow, provider, projection compatibility, baseline advisory tests).
Independent selected runs: 211 passed / 1 skipped; 515 passed / 3 skipped / 3 baseline failures; 359 passed / 3 same baseline failures. These overlap and are not summed as unique coverage.
The 3 fixed projection-oracle failures reproduce identically on base 2995c41 and remain in their separate repair scope.
Three sequential five-lens reviews completed (independent security/correctness + quality, owner deslop + blast-radius + manual CE-style contract/evidence review), followed by fresh independent requirements acceptance. No formal CE engine is claimed.
Explicit local aggregate limit
The full run collected 31,625 tests but was stopped at about 19% after concurrent shared-worktree Git-config changes made it unsuitable as a pristine aggregate gate. The partial log is diagnostic evidence, not a full-suite pass. Four fixval failures reproduced on both head and exact base; one depends on the sandbox's read-only /tmp/.git marker. Invocation-audit profile tests also fail on both head/base because this local filesystem is overlayfs while the unchanged recorder explicitly requires ext4/btrfs. The invocation source and test files have no diff. Paired module runs have identical 1,139 failing/error test IDs: each has 189 failures, 950 setup errors and 31 passes; no head-only failure/error. At PR creation, hosted CI qualification was pending. It has now completed successfully on the exact reviewed commit; see the hosted results below. The interrupted local run is still not claimed as a full local pass.
Integration with current main
Main advanced through #346 while publication awaited the narrowly requested workflow authorization. This branch preserves every intervening Phase 7 file byte-for-byte. The sole overlap, tests/test_provider_capacity_reporting.py, was already formatted on main, so its formatting-only change drops out. All remaining 191 per-file patches are byte-identical to the originally reviewed debt delta; there are no new scoped paths. Independent integration review and fresh acceptance recheck passed; full-tree Ruff remains clean.
Local Phase 7 offline-fixture tests encounter a sandbox-specific read-only /tmp/.git ancestor, causing unchanged gate discovery to attempt subprocess execution forbidden by those tests. The first failure/error pair reproduced identically on exact new base ef5ef54; repeated unsupported groups were stopped rather than misrepresented as a pass. No fixture, protected marker, production code or CI selector was weakened to bypass this limitation. Hosted CI has now qualified these groups on its supported runner.
Review anchor: de674a93555462d20ce8c79e79257913689963f2 against ef5ef54f0f280535554716b5e9aaabeef6e652b0; integrated binary patch SHA256 189e61e1ad619c2d250ab1630356d53aef0407bc4f5257eca3204e4586fe3433. Original reviewed anchor: d1991e623ae7a1f9f850ebff0ffcc58d1cfb67e5 against 2995c41e23a700aa6ed72306217ce3385b6550c1.
Hosted CI — verified 2026-11-01 13:06 UTC
Exact head de674a93555462d20ce8c79e79257913689963f2: all checks completed successfully (Linux tests, full-tree lint, CodeQL/Analyze Python).
Ownership/cancellation: 568 passed, zero skips in this required phase.
Cgroup-backed sandbox: 32 passed.
Full service-free selection: 31,520 passed, 81 skipped, 68 deselected, 2 subtests passed in 38m09s. Existing CI selections/exclusions were not broadened by this PR.
Local process integration: 11 passed, 7 deselected.
At the completion of PR CI, this PR was still Draft, open and unmerged. It was subsequently marked ready and merged after explicit PR-specific user authorization; see the lifecycle record below.
Authorized merge and cleanup — 2026-11-01 13:25 UTC
Merged as 7851ee8be2d6488a00d34d75ad1663e86fa32e63 after fresh exact-head checks. The actual merge tree 7b0d21c7921879c2ed98f94be04bba1ff61f17cb is identical to the fully validated PR head; parents are ef5ef54 and de674a9. The exact remote branch fix/105-ruff-debt-20261101 was deleted by ordinary Git transport and verified absent. Post-merge Linux/CodeQL push checks are being monitored separately.
• Clear retained Ruff lint and formatting debt across source, tests, and Python documentation
examples.
• Make CI check the entire repository while retaining diff-scoped checks for local use.
• Document intentional suppressions and test provider probes against non-HTTP(S) URLs.
Keep the existing lint helper and workflow identity. Adding full-tree selection to that helper reuses its pinned-version lookup, exclusions, and check commands without duplicating them in CI; retaining --base preserves the faster local workflow.
Files changed (191) +11065 / -5839
Enhancement (1) +8 / -8
lint_changed.pyAdd a full-tree lint mode+8/-8
Add a full-tree lint mode
• Adds mutually exclusive --all selection while preserving --base and the existing Ruff check commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Follow-up to the baseline debt intentionally retained by #105 / #323 (both historical; this does not reopen or close #105). One debt-focused PR, separate from the baseline-test and diagnostic behavior repairs.
python scripts/lint_changed.py --all; retain--basefor local convenience.Deliberate behavior details (not a pure-format claim)
Provider probes now refuse non-HTTP(S) URLs before request construction; five no-I/O regression cases cover this. Existing successful HTTP probe tests remain. Exception causes become explicit; test failure assertions remain active under
-O; async test filesystem checks use a worker thread. Git SHA1 object hashes are unchanged and explicitly marked non-security. Intentional taint-fixture AST and ruleid/ok adjacency are unchanged; vulnerable example functions were never executed.Validation and review
python scripts/lint_changed.py --all: all checks passed; 783 files already formatted.git diff --check: clean.2995c41and remain in their separate repair scope.Explicit local aggregate limit
The full run collected 31,625 tests but was stopped at about 19% after concurrent shared-worktree Git-config changes made it unsuitable as a pristine aggregate gate. The partial log is diagnostic evidence, not a full-suite pass. Four fixval failures reproduced on both head and exact base; one depends on the sandbox's read-only
/tmp/.gitmarker. Invocation-audit profile tests also fail on both head/base because this local filesystem is overlayfs while the unchanged recorder explicitly requires ext4/btrfs. The invocation source and test files have no diff. Paired module runs have identical 1,139 failing/error test IDs: each has 189 failures, 950 setup errors and 31 passes; no head-only failure/error. At PR creation, hosted CI qualification was pending. It has now completed successfully on the exact reviewed commit; see the hosted results below. The interrupted local run is still not claimed as a full local pass.Integration with current main
Main advanced through #346 while publication awaited the narrowly requested workflow authorization. This branch preserves every intervening Phase 7 file byte-for-byte. The sole overlap,
tests/test_provider_capacity_reporting.py, was already formatted on main, so its formatting-only change drops out. All remaining 191 per-file patches are byte-identical to the originally reviewed debt delta; there are no new scoped paths. Independent integration review and fresh acceptance recheck passed; full-tree Ruff remains clean.Local Phase 7 offline-fixture tests encounter a sandbox-specific read-only
/tmp/.gitancestor, causing unchanged gate discovery to attempt subprocess execution forbidden by those tests. The first failure/error pair reproduced identically on exact new baseef5ef54; repeated unsupported groups were stopped rather than misrepresented as a pass. No fixture, protected marker, production code or CI selector was weakened to bypass this limitation. Hosted CI has now qualified these groups on its supported runner.Review anchor:
de674a93555462d20ce8c79e79257913689963f2againstef5ef54f0f280535554716b5e9aaabeef6e652b0; integrated binary patch SHA256189e61e1ad619c2d250ab1630356d53aef0407bc4f5257eca3204e4586fe3433. Original reviewed anchor:d1991e623ae7a1f9f850ebff0ffcc58d1cfb67e5against2995c41e23a700aa6ed72306217ce3385b6550c1.Hosted CI — verified 2026-11-01 13:06 UTC
Exact head
de674a93555462d20ce8c79e79257913689963f2: all checks completed successfully (Linux tests, full-tree lint, CodeQL/Analyze Python).Linux run 41306058847:
At the completion of PR CI, this PR was still Draft, open and unmerged. It was subsequently marked ready and merged after explicit PR-specific user authorization; see the lifecycle record below.
Authorized merge and cleanup — 2026-11-01 13:25 UTC
Merged as
7851ee8be2d6488a00d34d75ad1663e86fa32e63after fresh exact-head checks. The actual merge tree7b0d21c7921879c2ed98f94be04bba1ff61f17cbis identical to the fully validated PR head; parents areef5ef54andde674a9. The exact remote branchfix/105-ruff-debt-20261101was deleted by ordinary Git transport and verified absent. Post-merge Linux/CodeQL push checks are being monitored separately.