chore: internal audit remediation (25 tasks + security fix + ruff sweep) - #327

Merged

devopam merged 37 commits into

mainfrom

chore/audit-remediation-2026-08-25

Aug 31, 2026

Commits on Aug 25, 2026

docs: add audit-remediation implementation plan and project-incubation baseline

devopam
and
claude
committed
d94c77c
chore: audit remediation batch 1 (governance, packaging, configuration)

devopam
and
claude
committed
53028a1
fix: correct CODE_OF_CONDUCT.md verbatim text and add missing MCPG_NL2SQL_API_KEY

devopam
and
claude
committed
f0f017d
refactor: introduce MCPgError as the common base for domain exceptions

devopam
and
claude
committed
57c451f
fix: log 7 silent except-pass sites and preserve tracebacks in 23 error-logging call sites

devopam
and
claude
committed
fe95e70
fix: remove exc_info from 5 redaction-sensitive log sites; strengthen 7 traceback tests

devopam
and
claude
committed
be8b3aa
feat(http): mount /readyz readiness probe

devopam
and
claude
committed
6fd5a18

Commits on Aug 26, 2026

fix(query): bound result-set fetch instead of materialize-then-truncate

devopam
and
claude
committed
9ee5dda
security!: HTTP transport fails closed without auth configured

devopam
and
claude
committed
03d566c
security!: rate limiting enabled by default

devopam
and
claude
committed
8ef0352
security: bump HSTS default to 2 years, add optional TrustedHostMiddleware

devopam
and
claude
committed
eaf7abb
feat(nl2sql): record schema-context provenance on TranslationResult

devopam
and
claude
committed
6d55775
perf: reuse a shared httpx.AsyncClient in NL2SQL providers and OIDCVerifier

devopam
and
claude
committed
d35239e
feat: add circuit breaker around external LLM provider and OIDC JWKS calls

devopam
and
claude
committed
e916ff4
feat: add retry-with-backoff around external LLM provider and OIDC JWKS calls

devopam
and
claude
committed
5af2950
test: cover translate_nl_to_sql's CircuitBreakerError -> NL2SQLError path

devopam
and
claude
committed
368cb79
security: add centralized log-redaction filter as a backstop

devopam
and
claude
committed
41b5bf4
security: fix RedactionFilter scope claims and add end-to-end redaction test

devopam
and
claude
committed
05f09f1
ci: add license enumeration (pip-licenses) as a non-blocking report

devopam
and
claude
committed
16d6c30
docs(ci): document the verified [bot]-namespace assumption in auto-merge check

devopam
and
claude
committed
9a43acf
fix(ci): move [bot]-namespace comment out of the if: block scalar

devopam
and
claude
committed
2aecffc
fix(graph): validate catalog-derived label names before SQL interpolation

devopam
and
claude
committed
e2b8258
test: strengthen 5 bare-truthy assertions to check actual expected values

devopam
and
claude
committed
a746536
test: strengthen 5 bare-truthy assertions to check actual interpolated values

devopam
and
claude
committed
aad55e9
chore(deps): add pytest-mock, pytest-randomly, pytest-socket, time-machine, pytest-rerunfailures

devopam
and
claude
committed
537da62

Commits on Aug 27, 2026

style: fix PTH, C4, SIM, PYI ruff findings (74 violations)

devopam
and
claude
committed
dfcc0a6
fix(contract): regenerate tool-return-shapes snapshot for schema_context field

devopam
and
claude
committed
b5e02dc
style: assess ASYNC and C901 ruff findings (Task 23 Steps 6-7)

devopam
and
claude
committed
2b3de26
fix(docs): correct run_select_tuned's ASYNC109 noqa rationale + flag external's forward side-effect

devopam
and
claude
committed
853e55f

Commits on Aug 31, 2026

style(tools): make 53 boolean tool parameters keyword-only (FBT, tools.py subset)

devopam
and
claude
committed
eab2ef0
docs(changelog): correct stale ~93 FBT remainder figure to 157

devopam
and
claude
committed
525ccc1
style: make 18 boolean parameters keyword-only (FBT, src/ + tools/)

devopam
and
claude
committed
bd1c470
docs(changelog): correct FBT Part D call-site counts

devopam
and
claude
committed
393cb61
docs(changelog): state the 20-signature count for FBT Part D

devopam
and
claude
committed
2f16abe
style(tests): make 126 boolean parameters/call-sites keyword-only (FBT, Part E)

devopam
and
claude
committed
66d9d46
style: enable C90, ASYNC, C4, SIM, PTH, PYI, FBT in ruff select list (Task 23, Step 11)

devopam
and
claude
committed
bad1f96
docs: fix final-review Minor findings (M-1..M-4)

devopam
and
claude
committed
01bc5a5