Skip to content

PR1: Core plumbing (CLI modularization, fail-closed CI, bandit)#21

Merged
fraware merged 10 commits into
mainfrom
pr/1-core-plumbing
Jul 21, 2026
Merged

PR1: Core plumbing (CLI modularization, fail-closed CI, bandit)#21
fraware merged 10 commits into
mainfrom
pr/1-core-plumbing

Conversation

@fraware

@fraware fraware commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Modular CLI, fail-closed CI, Bandit baseline, schemas, and core Python analyzer plumbing (Waves 0-9 base).
  • Split into granular commits by subsystem for easier review.

Stack merge order into main

  1. This PR (PR1: Core plumbing (CLI modularization, fail-closed CI, bandit) #21) into main
  2. PR2: Python analyzer fidelity (waves 3-14) #22 Python fidelity tests
  3. PR3: Multilang analyzers + csharp_ast package-data (waves 15-24) #23 Multilang analyzers
  4. PR4: Surface honesty (web_demo, commenter, dashboard, VS Code) #24 Surface honesty
  5. PR5: Optional cleanup (templates theater labels, instrumentation quarantine) #25 Optional cleanup
  6. Parallel fidelity PRs onto pr/5 (then into main after PR5: Optional cleanup (templates theater labels, instrumentation quarantine) #25): feat(rust): invent-free cross-module mod/use edges (Wave 26) #27 (Rust), feat(csharp): invent-free using/ProjectReference edges (Wave 27) #30 (C#), Wave 28: Go invent-free cross-package import edges #26 (Go), Wave 29: invent-free JS/TS path-mapping (tsconfig paths + package.json imports) #28 (JS path-mapping), Wave 30: Python residual high-confidence imported typing #29 (Python residual)

Test plan

  • CI green on this branch
  • pytest smoke / remediation wave tests
  • Confirm tour-must-pass and analyzer workflows fail closed on breakage

@cursor

cursor Bot commented Jul 21, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown

Understand-First PR map delta

Metric Value
Functions added 438
Functions removed 201
Functions modified 157
Complexity net change +2365
Complexity total (base → head) 0 → 2365
Side-effect tag adds (heuristic) 186
Policy breaches 108

Complexity increases

  • cli/ucli/analyzers/python_analyzer:_file_signature: 0 → 1
  • cli/ucli/analyzers/python_analyzer:_is_code_file: 0 → 2
  • cli/ucli/analyzers/python_analyzer:_open_cache: 0 → 1
  • cli/ucli/analyzers/python_analyzer:_parse_file: 0 → 8
  • cli/ucli/analyzers/python_analyzer:build_python_map: 0 → 21
  • cli/ucli/boundaries/scan:scan_boundaries: 0 → 11
  • cli/ucli/config:load_config: 0 → 8
  • cli/ucli/config:load_preset: 0 → 2

Policy breaches

  • cli/ucli/analyzers/python_analyzer:_parse_file: 0 → 8 (threshold 5)
  • cli/ucli/analyzers/python_analyzer:build_python_map: 0 → 21 (threshold 5)
  • cli/ucli/boundaries/scan:scan_boundaries: 0 → 11 (threshold 5)
  • cli/ucli/config:load_config: 0 → 8 (threshold 5)
  • cli/ucli/contracts/contracts:_choose_2xx_response: 0 → 9 (threshold 5)
  • cli/ucli/contracts/contracts:_exists_module_func: 0 → 10 (threshold 5)
  • cli/ucli/contracts/contracts:_strategy_expr: 0 → 24 (threshold 5)
  • cli/ucli/contracts/contracts:check_contracts: 0 → 6 (threshold 5)
    Generated by u scan + u diff --old/--new (Python AST + JS/TS best-effort when present).
    Complexity: McCabe for Python; keyword-heuristic for JS/TS — mixed totals are not uniform McCabe.
    Side effects are Python AST heuristics when present; JS maps typically omit them.
    PR comment step is fail-soft; scan/diff above are fail-closed.

@fraware fraware mentioned this pull request Jul 21, 2026
Merged
fraware added 10 commits July 20, 2026 23:32
@fraware
feat(analyzers): add base map meta, registry, and Python analyzer core
ae966e0 
Establish the analyzer package used by later fidelity and multilang waves so maps share one contract.
@fraware
feat(cli): add graph, boundaries, contracts, and shared config modules
f75a0de 
Centralize scan-time graph construction and contract helpers outside the Typer entrypoint.
@fraware
feat(cli): extract lens, metrics, pack, report, trace, and visual sub…
a93ba3a 
…systems

Move product surfaces into dedicated packages so the CLI entrypoint stays thin.
@fraware
feat(cli): modularize Typer command groups and ops modules
a744aab 
Split scan, CI, doctor, tour, and related commands for maintainable fail-closed wiring.
@fraware
feat(cli): wire modular entrypoint and packaging metadata
d282339 
Point the installable console script at the new command layout and pytest config.
@fraware
ci: fail-closed GitHub workflows for tour, analysis, and publish gates
580862b 
Tighten PR and release pipelines so broken analyzer or tour paths cannot silently pass.
@fraware
ci: align GitLab/Bitbucket pipelines and Bandit baseline with fail-cl…
6fe707e 
…osed policy

Keep non-GitHub CI honest about security scanning and local config defaults.
@fraware
docs(schemas): refresh map, lens, and config schema references
3d98bc3 
Document the contracts the modular CLI and analyzers emit for downstream tools.
@fraware
docs: update usage and security guidance for the modular CLI
c201776 
Describe the remodeled command surface and security expectations for contributors.
@fraware
test: add CLI smoke, contracts, and remediation wave coverage
92398da 
Lock core plumbing behavior before Python fidelity and multilang PRs land.
@fraware
fraware force-pushed the pr/1-core-plumbing branch from 3eb5187 to 92398da Compare July 21, 2026 06:34
@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown

Understand-First PR map delta

Metric Value
Functions added 438
Functions removed 201
Functions modified 157
Complexity net change +2365
Complexity total (base → head) 0 → 2365
Side-effect tag adds (heuristic) 186
Policy breaches 108

Complexity increases

  • cli/ucli/analyzers/python_analyzer:_file_signature: 0 → 1
  • cli/ucli/analyzers/python_analyzer:_is_code_file: 0 → 2
  • cli/ucli/analyzers/python_analyzer:_open_cache: 0 → 1
  • cli/ucli/analyzers/python_analyzer:_parse_file: 0 → 8
  • cli/ucli/analyzers/python_analyzer:build_python_map: 0 → 21
  • cli/ucli/boundaries/scan:scan_boundaries: 0 → 11
  • cli/ucli/config:load_config: 0 → 8
  • cli/ucli/config:load_preset: 0 → 2

Policy breaches

  • cli/ucli/analyzers/python_analyzer:_parse_file: 0 → 8 (threshold 5)
  • cli/ucli/analyzers/python_analyzer:build_python_map: 0 → 21 (threshold 5)
  • cli/ucli/boundaries/scan:scan_boundaries: 0 → 11 (threshold 5)
  • cli/ucli/config:load_config: 0 → 8 (threshold 5)
  • cli/ucli/contracts/contracts:_choose_2xx_response: 0 → 9 (threshold 5)
  • cli/ucli/contracts/contracts:_exists_module_func: 0 → 10 (threshold 5)
  • cli/ucli/contracts/contracts:_strategy_expr: 0 → 24 (threshold 5)
  • cli/ucli/contracts/contracts:check_contracts: 0 → 6 (threshold 5)
    Generated by u scan + u diff --old/--new (Python AST + JS/TS best-effort when present).
    Complexity: McCabe for Python; keyword-heuristic for JS/TS — mixed totals are not uniform McCabe.
    Side effects are Python AST heuristics when present; JS maps typically omit them.
    PR comment step is fail-soft; scan/diff above are fail-closed.

@fraware
fraware changed the base branch from master to main July 21, 2026 06:35
@fraware
fraware merged commit 7ae1462 into main Jul 21, 2026
13 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fraware