3.2.0 maintenance — code quality sweep - #72
Open
Dan-StrategicAutomation wants to merge 5 commits into
Open
Conversation
added 3 commits
August 15, 2026 20:38
Collapse 72 development commits into a single coherent release commit. Benchmark & evaluation: - Automated benchmark runner (benchmark/run.py) with OpenRouter/Docker support - Evidence-gated scorer, proof verifier, AI judge, and bounded artifact indexer - Duck Store calibration suite (known-good / known-bad baselines) Guard & scope policy: - AST-based scope parsing (bashlex + yarl + netaddr) eliminating false positives - Receipt integrity verifier, fail-closed state parsers, record-as-you-go recency gates - Hypothesis disposition deadlock resolution; case-insensitive REPORTING phase gate - Block messages name remediation tools with concrete parameter templates Skills & methodology: - 31 playbooks / 17 references / 12 templates routed across pentest, web-attacks, access-control - De-benchmarked production code (no scorer/challenge references leak into the framework) - Evidence-path and open-redirect routing corrections; single-step win formalization Docs: - Corrected benchmark results to measured values (best 17/20, stable 14-17) - Sourced Duck Store ranking table with citations and model-agnostic cost/speed comparison Tests: 443 passed, 1 skipped; ruff clean.
Address correctness bugs identified in code review: - code_execution_audit.py: resolve receipt path before parents[2] so abandon_execution history lands in the engagement root, not ".". - exec_handlers.py: release sync-credit reservation in a try/finally so a mid-burst process kill (BaseException) cannot leak the reservation. - adapters.py: validate listener port presence before int() coercion, returning a clear "port is required" error instead of TypeError. - history.py: use splitlines() so legacy CR line breaks normalize correctly. - README: correct reference count (17 -> 18) in banner and tree. Version bump 3.1.0 -> 3.2.0 across pyproject.toml, distribution.yaml, plugin.yaml, CHANGELOG.md, and the release-surface test. Tests: 443 passed, 1 skipped; ruff check + format clean; check-release OK.
… C/D) Safe cosmetic improvements per code-review-fixes plan: - C1: hashlib.file_digest() in receipt_integrity.py - C2: datetime.fromisoformat() ×2 in command.py - C3: argparse.ArgumentParser in score.py (replaces manual argv loop) - C5: re.sub() for HTML comment removal in hypotheses.py (adds module-level import) - D1: removed unreachable RuntimeError in state.py - D2: renamed `findings` → `finding_files` in findings.py (avoids module shadowing) Deferred (carry regression risk or need benchmark verification): - C4: tempfile.TemporaryDirectory() (pytest basetemp spans subprocess + finally) - C6: FindingModel Pydantic v2 rewrite (validates findings — schema-sensitive) - C7: yarl.URL for scope classifier (validation boundary) - C8: comprehension modernizations (trivial but widespread) - B1–B3: parser consolidation (score.py↔ptt.py, chunked reader) — needs score delta proof - D2 (proof.py): param is clean, no module shadow All 443 tests pass; ruff + format + check-release clean.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| shutil.rmtree(item, ignore_errors=True) | ||
| else: | ||
| item.unlink(missing_ok=True) | ||
| except Exception: |
added 2 commits
August 15, 2026 21:39
Phase 1 per codebase standardisation plan: - adapter_handlers: remove os.environ["ENG_DIR"] mutation in handle_ffuf; pass eng_dir directly to resolve_ffuf_wordlist. Remove dynamic sys.modules lookup in _get_handle_exec; direct import of exec_handlers.handle_exec. Drop now-unused os/sys imports. - ptt_handlers: remove dynamic sys.modules lookup in _get_skill_view_adapter; return HermesSkillViewAdapter directly. Drop unused sys import. - base: acquire lock_file before appending to framework_feedback.md in _log_guard_friction (concurrent write safety). - AGENTS.md: add spelling/naming, timestamp, concurrency, sys.modules, and domain-driven test naming policies. - CHANGELOG: document 3.2.0 code-quality and concurrency sections. Tests updated to clean dependency injection (patch the module where the symbol resolves, not the handlers package): - exec_handlers.handle_exec for listener tests - ptt_handlers.HermesSkillViewAdapter for skill-view / PTT tests - resolve_ffuf_wordlist now receives eng_dir kwarg in ffuf handler tests All 443 tests pass; ruff check/format clean; check-release passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Maintenance release 3.2.0 with focused code-quality improvements derived from the
20260815_code-review-fixes.mdplan.This PR contains two committed sweeps:
48dfe02— Priority A correctness fixes + version bump to 3.2.09f6e86c— Priority C/D non-pythonic cleanup + dead code removalPriority A — Correctness (committed in 48dfe02)
code_execution_audit.py:314—receipt_file.parents[2]resolves to.on relative path.resolve().parents[2]exec_handlers.py:226–240— sync-credit reservation leak on mid-burst killtry/finallyguardadapters.py:298—int(None)on omitted--porthistory.py:24—replace("\r\n")misses bare\rsplitlines()Plus: version bump to 3.2.0 across all surfaces, README reference count 17→18.
Priority C/D — Cleanup (committed in 9f6e86c)
hashlib.file_digest()inreceipt_integrity.pydatetime.fromisoformat()×2 incommand.pyargparse.ArgumentParserinscore.pyre.sub()for HTML comment removal inhypotheses.pyRuntimeError("unreachable")instate.pyfindings→finding_filesinfindings.py(avoids module shadow)Deferred (not in this PR)
TemporaryDirectory()— pytest basetemp spanssubprocess+finallyFindingModelPydantic v2 rewrite — validates findings, schema-sensitiveyarl.URLfor scope classifier — validation boundaryproof.pyVerification
pytest: 443 passed, 1 skipped ✅ruff check: clean ✅ruff format --check: clean ✅scripts/violin_guard.py check-release: all gates pass ✅No behavioral changes in scoring, PTT, or guard logic — only the A1–A4 correctness fixes have semantic effect, and they are covered by the existing test suite.