fix: consolidated quality cleanup #533

Merged

didericis merged 31 commits from fix/quality-cleanup-consolidated into main 2026-07-27 09:26:30 -04:00

Conversation 0 Commits 31 Files Changed 73

+3072 -906

didericis-codex commented 2026-07-27 01:34:13 -04:00

Collaborator

Copy Link

Copy Source

Consolidates the complete 11-part quality-cleanup stack (previously #514, #518, #523-#528, and #530-#532) into one reviewable PR against main.

Includes the final review fixes:

• normalize FastAPI request-validation failures to the established HTTP 400 control-plane contract and remove the test-only 422 rewrite;
• import urllib.error so full-project Pyright passes;
• reject database-directory symlinks and open database files with O_NOFOLLOW, validating and chmodding the pinned regular-file descriptor;
• update permission-failure and symlink regression coverage.

Validation:

• 2,521 unit tests executed; the two stale chmod-mock failures found by the full run were corrected, then all affected store/orchestrator suites passed (77 tests).
• Full-project Pyright: 0 errors.
• Affected-file Pylint: 9.75/10 (repository gate is 8.0).
• git diff --check passes.

Supersedes #514, #518, #523, #524, #525, #526, #527, #528, #530, #531, and #532.

Refs #444.

Consolidates the complete 11-part quality-cleanup stack (previously #514, #518, #523-#528, and #530-#532) into one reviewable PR against main. Includes the final review fixes: - normalize FastAPI request-validation failures to the established HTTP 400 control-plane contract and remove the test-only 422 rewrite; - import urllib.error so full-project Pyright passes; - reject database-directory symlinks and open database files with O_NOFOLLOW, validating and chmodding the pinned regular-file descriptor; - update permission-failure and symlink regression coverage. Validation: - 2,521 unit tests executed; the two stale chmod-mock failures found by the full run were corrected, then all affected store/orchestrator suites passed (77 tests). - Full-project Pyright: 0 errors. - Affected-file Pylint: 9.75/10 (repository gate is 8.0). - git diff --check passes. Supersedes #514, #518, #523, #524, #525, #526, #527, #528, #530, #531, and #532. Refs #444.

didericis-codex added 30 commits 2026-07-27 01:34:18 -04:00

fix(security): prohibit unauthenticated orchestrator e2222bd96b

fix(docker): surface enumeration failures 15ecada022

refactor(backend): type enumeration failures 47b6bead69

fix(firecracker): abort cleanup on scan errors 2bc9ef8ec0

fix(docker): fail closed on network address scan errors 7d9933edc0

fix(security): authenticate persisted egress secrets de192359ee

fix(orchestrator): bound unauthenticated HTTP requests b09952045a

feat(firecracker): enumerate running bottles b8818948a0

refactor(egress): split request policy pipeline stages a59e495faa

fix(orchestrator): satisfy adapter type contracts 6e46a9b191

docs(prd): define authoritative failure boundaries ecaf23cdb5

docs(prd): extend authoritative cleanup boundaries 0146450951

docs(prd): require cleanup execution integrity 3bb90da11c

docs(prd): bound heavy gateway operations ff4da6f41e

docs(prd): require shared storage permissions 3dbf1780b4

build(orchestrator): pin FastAPI runtime dependencies a25ea7c188

refactor(orchestrator): replace manual HTTP dispatch with FastAPI 31a7efc0ed

fix(orchestrator): keep host client dependency-free 7dcce2ff12

fix(orchestrator): bound streamed request bodies ffda40abae

refactor(egress): extract request policy stages 105538d3a6

refactor(egress): extract outbound DLP request stage a24fe0264d

refactor(supervisor): separate MCP dispatch from transport bb1776a858

fix(cleanup): revalidate destructive backend plans c7c3a79028

fix(gateway): bound stdlib HTTP request work f33566941b

fix(gateway): contain output pump shutdown races fd295d4c14

fix(cleanup): use authoritative resource identities f242733d15

fix: enforce cleanup and secret integrity 95cbd0e1c8

fix: bound heavy gateway operations dbbb185d0a

fix: enforce shared storage permissions 38a67d2767

fix: close consolidated quality review findings aaf1e60abe

didericis added 1 commit 2026-07-27 01:35:02 -04:00

Merge remote-tracking branch 'origin/main' into fix/quality-cleanup-consolidated 031bc6301e

didericis merged commit 420184b874 into main 2026-07-27 09:26:30 -04:00

didericis deleted branch fix/quality-cleanup-consolidated 2026-07-27 09:26:35 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

Compat/Breaking

Breaking change that won't be backward compatible

Kind/Bug

Something is not working

Kind/Documentation

Documentation changes

Kind/Enhancement

Improve existing functionality

Kind/Feature

New functionality

Kind/Security

This is security issue

Kind/Testing

Issue or pull request related to testing

Priority

Critical

1

The priority is critical

Priority

High

2

The priority is high

Priority

Low

4

The priority is low

Priority

Medium

3

The priority is medium

Status

Abandoned

3

Somebody has started to work on this but abandoned work

Status

Blocked

1

Something is blocking this issue or pull request

Status

Need More Info

2

Feedback is required to reproduce issue or to continue work

Status/Needs Triage

Awaiting initial classification

No Label

Milestone

No items

No Milestone

Assignees

Clear assignees

didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#533