refactor(config): the #18094 de-fork remainder — one key reader, one feature flag, one language detector, and image-gen keys vault-first through an origin-bound resolver (#18094)

[mrveiss]

Thinking Path

#18094 is the remainder of the de-fork work after #17419/#16177: forked env defaults, shadowed constants and same-name functions. It was finished from a local-only branch from 2026-10-10 and rebased onto current main, roughly 190 commits later. Commits main had superseded were dropped: the analytics embedding model is delivered by #18143's index-space table. It also carries #17856 rows 13a and 16, which were deferred to this branch, the #15722 digest entry it owns, and the owner's 2026-10-12 decision on credential precedence.

What Changed

• Env and constants:

  • the un-prefixed NPU/SLM/provider vars are registered (autobot_shared/env_registry_npu.py);
  • NPU_WORKER_HOST is split into bind and connect hosts;
  • one global-user sentinel (__global__), whose readers accept both spellings;
  • the similarity constants are homed in analytics_infrastructure.py;
  • the browser-VM noVNC URL is in ssot_config and config.compat is removed;
  • the SLM agent fails clearly on a missing node id, and the key name comes from node_proxy.

• One detect_language. The NPU agent maps the shared enum back to its emitted names.

• inventory(canonical): 19 concepts with more than one definition and no existing issue — led by two secret stores whose docstrings each claim they cannot disagree about the key #17856 row 13a: one internal-API-key reader, node_proxy.internal_api_key(), used by auth_middleware, the SLM auth, the vault client, the agent and its mirror, and the migration precheck. Guard: one_internal_api_key_reader_17856_test.py, with 12 contrast fixtures and a reach floor.

• inventory(canonical): 19 concepts with more than one definition and no existing issue — led by two secret stores whose docstrings each claim they cannot disagree about the key #17856 row 16: one is_feature_enabled (autobot_shared/feature_flags.py). Three copies with no production callers are retired, and 10 stale fork-baseline entries are dropped.

• canonical(knowledge): two functions named content_hash return different values — full digest vs 16-char truncation #15722: the analytics dedup key goes through content_digest(width=16), byte-identical.

• Security, image-generation credentials:

  • provider keys resolve through provider_key_vault, and a scoped resolver is injected only into the built-in plugin, bound to its origin, not its self-declared name;
  • review found the startup PluginManager in lifespan.py passed no resolvers at all. Fixed: one plugin_paths.py supplies search dirs and trusted roots to both hosts;
  • a CWD-relative plugins/core-plugins is searched but never trusted;
  • THREAT_MODEL records the origin-bound resolver.

• Credential precedence (owner, 2026-10-12): the vault comes first. resolve_provider_key defines the order once, and resolve_image_provider_key delegates to it. The env var is only a fallback, logged once per name with no value. Hydration loads every vaulted name, even when its env var is set.

• An unreadable vault key is refused (owner, 2026-10-12). When the vault holds a key but the read fails, _hydrate_one_key records the name as unreadable, which is distinct from "not in the vault". resolve_provider_key then raises VaultKeyUnavailableError ("vault unavailable: ... refusing the environment fallback") and never returns the env value, which may be rotated out. A later successful hydration, a capture, or removal of the vault row clears the refusal. The two log lines are distinct: "vault unreadable: refusing" at ERROR, and "vault has no key: using the environment" at WARNING. Only registry labels are logged, never a value. registration_refusal() contains a refusal at a registration site, so one refused key skips one provider.

• A vault outage refuses every key (review of refactor(config): the #18094 de-fork remainder — one key reader, one feature flag, one language detector, and image-gen keys vault-first through an origin-bound resolver (#18094) #18371). A configured vault (AUTOBOT_SECRETS_ROOT_KEY set) whose startup hydration fails leaves "does it hold this key?" unknown. Failures that count are an unreachable DB, a failing session factory, and a query or decrypt error partway through. The vault state is recorded as not_hydrated, not_configured, reachable or unreachable. While it is unreachable, every vault-resolved name is refused ("could not be reached at startup") until a hydration succeeds. Env is allowed in one case only: the vault was reachable and has no row for that name.

  lifespan.py no longer swallows the failure at debug level as "non-critical". hydrate_at_startup() classifies the vault, logs at WARNING or ERROR, and never raises.

• Second review (9a): env only for keys the vault truly lacks.

  • Root key unset with rows in the vault. Hydration no longer reads an unset AUTOBOT_SECRETS_ROOT_KEY as "no vault". Listing rows needs no root key, so every held name is listed. Without a usable root key (unset or malformed), each held name is recorded as unreadable and refused. Only names with no row fall back to env. VAULT_NOT_CONFIGURED is removed.

  • Every process hydrates, not only the lifespan.

    • resolve_provider_key hydrates on first resolution in any process that has not read the vault, root key or not, since listing rows needs none. A DB the process cannot reach is an outage, and keys are refused. This is services/provider_key_process_init.py: it runs on user_management.database.isolated_session_factory (unpooled, disposed), in a private event loop on its own thread. It is safe inside a running loop, never raises, and fails closed if that thread dies.
    • celery_app also hydrates in worker_process_init, before a worker's first task.
    • The test that pinned "never hydrated → env" has been replaced.

  • Stale and partial state. Hydration rebuilds the cache from the rows into a new map and swaps it in, so a deleted row is never served again and a reader never sees a half-filled cache.

  • Non-lifespan entry points and how each is covered:

    Entry point	Resolves keys via	Covered by
    Celery worker (celery_app, e.g. knowledge_tasks → knowledge/base.py)	KB LLM/embedding, LLM providers	worker_process_init hydration, plus the first-resolution hook
    Celery beat	none (schedules only; beat_init reconciles the schedule)	nothing to cover
    Operator scripts under autobot-infrastructure/shared/scripts that drive backend internals (infra: ten infrastructure scripts import backend internals and fail standalone — one guard for the class #18288 BACKEND_TOOLS/UNCLASSIFIED, e.g. verify_knowledge_consistency.py, analysis/test_llm_config.py)	KnowledgeBase, LLM interfaces	first-resolution hook when a root key is set
    Knowledge-base MCP server (shared/mcp/tools/knowledge-base-mcp/.../embedded.py)	KnowledgeBase	first-resolution hook
    Backend CLIs (autobot-backend/cli) and code_intelligence/shared/process_offload.py, knowledge/rag_benchmarks.py subprocesses	any provider they reach	first-resolution hook. A forked child inherits the parent's hydrated state; a spawned child hydrates on first use.
    Plugins (image, video)	the injected resolver	run inside the backend, which is hydrated by the lifespan. Standalone, the CredentialSlot reads env by design.
    SLM backend and SLM-invoked tools	none. The SLM does not import provider_key_vault (system_secrets_vault.py:91,243 mention it only in prose)	out of scope

  • Third review (9a):

    • The root-key gate on lazy hydration is removed, so there is no residual left. The previous "no root key → env" test is flipped into a contrast test.
    • Unit tests have no vault DB, so the harness supplies the state rather than a production gate: testkit/provider_key_vault_state.py, an autouse fixture imported by the backend conftest, starts every test against an explicit empty, reachable vault.
    • The hydration thread is a daemon. The wait is bounded by AUTOBOT_PROVIDER_KEY_HYDRATION_TIMEOUT_S (default 30). A timeout fails closed and releases the lock.
    • An unreachable vault is retried on a later resolution after AUTOBOT_PROVIDER_KEY_REHYDRATE_BACKOFF_S (default 30). The delay doubles per failed retry, is capped at 20x, and resets on success. Both variables are registered.

• More credential readers go through the resolver.

  • Video: RUNWAY, SORA and KLING keys take the same vault-first, origin-bound path as image. That covers the plugin, the backend's file-loaded copy of its providers module (resolver bound to the plugin's origin), and GET /video-generation/providers through key_status(), which is shared with image.
  • Shared plugin plumbing: both plugins use one SDK CredentialSlot, replacing the image plugin's private copy, and the SDK's CredentialUnavailableError, which VaultKeyUnavailableError subclasses.
  • Tilde: TILDE_API_KEY is vault-resolved.
  • Guard: repo_tests/provider_key_env_reads_route_through_vault_18094_test.py fails on any env read of a registered or credential-shaped name that bypasses resolve_provider_key. It has 10 contrast fixtures, a reach floor of 2617, a registered scope, and a shrink-only allowlist.
  • Not routed: MODAL_TOKEN_* (the Modal SDK reads the environment itself) and PAPERCLIP_API_KEY (autobot_shared cannot import the backend resolver). Both are allowlisted under Modal and Paperclip credentials bypass the vault-first provider-key resolver #18383, a sub-issue of tech-debt: forked env defaults, shadowed constants and same-name functions — the remainder after #17419/#16177/#18093 #18094.

• How each caller surfaces a refusal:

  • Registration sites skip that one provider, log the reason at ERROR, and let startup continue: the LLM bootstrap (every keyed provider, custom OpenAI, OpenRouter, HuggingFace, Nous), the lifespan.py adapters, the search registry (SearXNG as a whole, Brave), and the capability registry (Slack, Discord).
  • These report the refusal as a state rather than raising it:
    • provider health checkers return UNAVAILABLE with the reason;
    • GET /image-generation/providers marks that provider unavailable with the reason;
    • voice realtime is_configured returns False and logs;
    • the Slack hook turns into a logged, uncached null hook;
    • the image plugin load logs and continues.
  • At call time the call fails with the reason:
    • LLM providers return LLMResponse.error;
    • adapters raise to their caller;
    • KB init logs and returns False;
    • the claude-code backend fails its health check and execution;
    • email notification dispatch logs the failure;
    • threat-intelligence construction raises into the security API's error handler;
    • voice realtime negotiate() raises.

Behaviour changes

• A deployment with a vault value and an env var for the same name now uses the vault value. Processes that never hydrate the cache (outside the backend lifespan) still resolve from env, and now log a fallback warning. In the multi-name chains (HF_TOKEN → HUGGINGFACE_API_TOKEN → NOUS_API_KEY), the order of names is unchanged; precedence changes per name.
• A vault outage at startup now refuses every vault-resolved key instead of silently using env. Before, it was logged at debug as "non-critical".
• An unset root key no longer means "no vault". Names the vault holds are refused; only names with no row use env.
• Celery workers, and every other process that resolves a key, now read the vault before serving one, root key or not. Before, they served env without reading it. If such a process cannot reach the vault DB, it refuses keys and retries with backoff.
• TILDE_API_KEY and the RUNWAY, SORA and KLING video keys now resolve vault-first, like the other provider keys. A video provider whose key is refused reports that reason in the listing and on /generate.
• A vault row that cannot be read is now refused, not resolved from env. A provider whose key the vault holds but cannot read is not registered (logged at ERROR), or its calls fail with "vault unavailable", even when the env var is set. The env fallback applies only to keys the vault does not hold.
• A per-instance settings["api_key"] (provider or adapter settings) still outranks resolve_provider_key. That is pre-existing and unchanged; the vault-first order applies only when no per-instance key is given.
• detect_language now classifies .pyi, .pyw, .mjs, .cjs, .mts, .cts and .vue, which the NPU agent used to report as "unknown". This affects only newly indexed files; no stored data is rewritten.
• The image plugin loaded at startup now resolves its keys through the vault.
• The backend internal-key check reads the key per call instead of from cached settings; the value is the same in deployment.

Verification

• Refusal and provider-key set, after merging main: 931 passed, 17 skipped. This covers the new provider_key_refusal_18094_test.py (12) and llm_shared/tests/test_provider_key_refusal_18094.py, plus the existing tests for every caller module and the credential-vault guard. Its cases:
  • a vault row plus a read failure plus an env var gives a refusal, never the env value, with no value in any log;
  • a key absent from the vault plus an env var gives env, with the "vault has no key" warning;
  • a failed read followed by a successful re-hydrate resolves again;
  • a capture or a removed row clears the refusal;
  • the bootstrap skips only the refused provider;
  • the image listing, Slack hook, health checker, search registry and realtime voice each contain the refusal.
• After the review fixes: 999 passed, 17 skipped, 2 failed. Both failures are explained:
  • api/video_generation_test.py::test_generate_provider_disabled: its fake provider lacked the new unavailable_reason. Fixed in dfb06167c1, 6/6 now.
  • security/threat_intelligence_test.py::test_clear_expired: a fixed sleep(1.1) against a 1s TTL (tests: 32 more fixed sleeps are followed by an assertion, and some decide the outcome by the clock #16255). It fails only in the long mixed run under nice -n 19 and passes alone (33/33) and with its siblings (76/76). The cache is untouched here.
  • New provider_key_outage_18094_test.py covers:
    • an outage refuses even with env present, logging at ERROR with no value;
    • a failure partway through hydration is an outage;
    • no vault configured gives env;
    • reachable with the key absent gives env;
    • recovery after an outage;
    • a process that never hydrates keeps env;
    • video key scoping;
    • a Tilde refusal.
  • Plugin credential_slot_18094_test.py: video and image plugin suites pass, 22 and 7. The guard passes, 12.
• After the second review: 1787 passed, 17 skipped, 1 failed. The failure is security/threat_intelligence_test.py::test_cache_expiration, the same fixed-sleep TTL flake class as test_clear_expired. It passes alone (33/33) and is filed as test(security): threat-intel cache TTL tests fail intermittently in long mixed runs (fixed 1.1s sleep vs 1s TTL) #18400. provider_key_outage_18094_test.py (17) now also covers:
  • root key unset refuses held names and only those;
  • a deleted row leaves no stale value;
  • the swap is atomic (a reader mid-hydration sees the previous complete cache);
  • an unhydrated process with a root key hydrates before resolving, and refuses on an outage;
  • a lazily hydrated vault value wins;
  • without a root key, an unhydrated process uses env and does not touch the DB;
  • the private-engine path classifies a DB failure as an outage, once per process, and is safe inside a running loop;
  • celery_app has the worker_process_init hydration hook.
• Third review, run on a275bea6e2. The branch was 51 behind, so main was merged in first.

  • The hub conflicts (reach_scope_claim, the content-digest list, two reach floors) were resolved by taking main's copy and re-applying only this branch's lines.

  • After the merge:

    • provider-key, security and caller core: 513 passed, 17 skipped;
    • reach_scope_claim_17844 run alone: 10 passed;
    • ratchets plus guards: 708 passed, 2 failed. The two failures were reach floors (chunker-private-hook 4920→5059, deployment-mode-detector 4676→4737) that the merged population left in the red band. Both were re-pinned mid-window in a275bea6e2; reach_declarations plus those guards then gave 642 passed.

  • New outage tests, 21 in all, add:

    • without a root key, an unhydrated process still refuses held names (the contrast test);
    • a hung hydration fails closed after the timeout and releases the lock;
    • an unreachable vault is retried after the backoff, the delay doubles, and it resets on recovery.

  • Broad pre-merge run, 6,600 tests with every module that resolves keys: 4425 passed, 2159 skipped, 4 failed, 7 errors. None are in the code this PR changes:

    • chat_knowledge_system_e2e_test (7 errors): needs an authenticated live backend and gets HTTP 401;
    • file_upload_comprehensive_test::test_knowledge_base_integration: checks that the CWD-relative data/file_manager_root exists;
    • mcp_cache_test::test_cache_age_tracking and two test_fact_store_authority tests: pass when run alone.

    I could not compare against main, because the worktree ceiling (15 of 15) blocked a temporary main checkout.

  • The pre-push pytest step timed out on 127 files, so a275bea6e2 was pushed with AUTOBOT_PREPUSH_ALLOW_TIMEOUT=1 after the runs above.

• Pre-push on 2326fde67d: [pre-push OK] pytest: all relevant tests pass. This is the first full pre-push run on this branch. The run before it caught the redaction census reading the plugins' key-name tuples as a private vocabulary, fixed in 2326fde67d (census 15/15). Ratchets (file size, ceiling parity, guard_reach_meta, symbol forks, reach_declarations): 626 passed. reach_scope_claim_17844 run alone: 10 passed.
• Earlier set: 262 passed (16 skipped need Postgres). Plugin SDK, image key and install tests: 205 passed. Covered cases include:
  • a community plugin with the built-in name gets no resolver;
  • an empty core dir doesn't let an impostor in;
  • a symlink from core doesn't qualify;
  • a str subclass can't spoof membership;
  • no key value reaches the log;
  • the vault wins over env, and LLM and image keys share one order.
• Backend touched areas: 1751 passed; SLM 661; shared, plugins and scripts 554; ratchets and reach 646; reach_scope_claim_17844 run alone after merging main: 10 passed.
• The pre-push tests hit their 600s budget on 107 files, so the push used AUTOBOT_PREPUSH_ALLOW_TIMEOUT=1 after the runs above. Three Postgres-backed precedence tests in tests/migrations/test_provider_key_vault.py have not run locally; CI is their first run.

Not done, stated rather than implied

• AC4 (a guard for differing fallbacks and constants shadowing the SSOT) is blocked by refactor(lint): 35 checkers reimplement the same harness — 6 fork git ls-files, 5 of those unanchored, and 33 report clean on an empty scan #14896, which is open.
• MODAL_TOKEN_ID/MODAL_TOKEN_SECRET and PAPERCLIP_API_KEY still bypass the resolver, tracked in Modal and Paperclip credentials bypass the vault-first provider-key resolver #18383 and allowlisted in the new guard.
• Found while testing, not caused here: test(security): threat-intel cache TTL tests fail intermittently in long mixed runs (fixed 1.1s sleep vs 1s TTL) #18400 (threat-intel TTL tests flaky in long runs); test(plugin_sdk): loader_file_fallback tests fail when plugin-tree tests ran first in the same process #18384 (plugin_sdk loader tests fail after plugin-tree tests run in the same process; reproduced on main), and a bug(slm-tests): test_wizard_inventory_parity_14286.py's ad-hoc loader breaks on services.role_manifest_shape import #17164 sighting (three SLM tests/services files fail to collect).
• Two AUTOBOT_BASE_DIR fallbacks stay on purpose: role_registry.py:23 is the remote node install root, a different concept, and code_sync.py:2588 is the bootstrap fallback when SSOT fails to load.
• Retiring the old __global_user__ stored spelling needs a Umbrella: SLM Data hygiene page — detect and safely clean up orphaned data across services #17038 key rewrite; for now it is read-only.
• ssot_config.misc.internal_api_key is still declared but has no production reader.
• DEFAULT_HEARTBEAT_INTERVAL still has 3 definitions: slm/agent/agent.py:99, its mandated ansible mirror, and the Windows NPU worker's backend_telemetry.py:345.
• The section-3 triage (same-name functions) is recorded as verdicts on tech-debt: forked env defaults, shadowed constants and same-name functions — the remainder after #17419/#16177/#18093 #18094; apart from detect_language, this PR consolidates none of them.

So this PR is Refs #18094.

Refs #18094
Refs #17856
Refs #15722

Model Used

Claude Opus 5.5 (master session: decisions, brief, PR). Finished by a Claude Opus subagent; the original commits came from a subagent on 2026-10-10.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 125 files, which is 25 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Check out review usage here.

⚙️ Run configuration

• Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b740ff94-d73f-426c-a2b6-aa5ca97b49bd

---

📥 Commits

Reviewing files that changed from the base of the PR and between df211d3 and a275bea.

---

⛔ Files ignored due to path filters (2)

• repo_tests/python_file_size_ratchet_baseline.py is excluded by !repo_tests/python_file_size_ratchet_baseline.py
• scripts/python_file_size_known_large.py is excluded by !scripts/python_file_size_known_large.py

---

📒 Files selected for processing (125)

• .secrets.baseline
• autobot-backend/advanced_rag_optimizer.py
• autobot-backend/agent_loop/search/registry.py
• autobot-backend/agent_loop/search/registry_test.py
• autobot-backend/agent_loop/slack_hook.py
• autobot-backend/agent_loop/test_slack_hook.py
• autobot-backend/agents/conftest.py
• autobot-backend/agents/npu_code_search_patterns.py
• autobot-backend/agents/npu_language_detection_18094_test.py
• autobot-backend/api/_video_providers_loader.py
• autobot-backend/api/image_generation.py
• autobot-backend/api/research_browser.py
• autobot-backend/api/simple_terminal_e2e_test.py
• autobot-backend/api/video_generation.py
• autobot-backend/api/video_generation_test.py
• autobot-backend/auth_middleware.py
• autobot-backend/celery_app.py
• autobot-backend/cli/doctor.py
• autobot-backend/code_intelligence/analytics_content_hash_15722_test.py
• autobot-backend/code_intelligence/analytics_infrastructure.py
• autobot-backend/code_intelligence/base_analyzer.py
• autobot-backend/code_intelligence/cross_language_patterns/detector.py
• autobot-backend/code_intelligence/similarity_thresholds_18094_test.py
• autobot-backend/config/__init__.py
• autobot-backend/config/browser_vnc_url_18094_test.py
• autobot-backend/config/compat.py
• autobot-backend/config/compat_removal_18094_test.py
• autobot-backend/config/config_migration_integration_test.py
• autobot-backend/config/service_config.py
• autobot-backend/config/validation.py
• autobot-backend/conftest.py
• autobot-backend/constants/user_scope_constants.py
• autobot-backend/initialization/lifespan.py
• autobot-backend/integrations/capability_registry.py
• autobot-backend/integrations/capability_registry_test.py
• autobot-backend/knowledge/rag_benchmarks.py
• autobot-backend/knowledge/search_components/retrieval_learner.py
• autobot-backend/llm_shared/providers/bootstrap.py
• autobot-backend/llm_shared/providers/openai.py
• autobot-backend/llm_shared/tests/test_provider_key_refusal_18094.py
• autobot-backend/plugin_install.py
• autobot-backend/plugin_install_builtin_name_18094_test.py
• autobot-backend/plugin_manager.py
• autobot-backend/plugin_paths.py
• autobot-backend/plugin_paths_18094_test.py
• autobot-backend/services/feedback_aggregator.py
• autobot-backend/services/image_provider_key_18094_test.py
• autobot-backend/services/provider_health/providers.py
• autobot-backend/services/provider_key_outage_18094_test.py
• autobot-backend/services/provider_key_process_init.py
• autobot-backend/services/provider_key_refusal_18094_test.py
• autobot-backend/services/provider_key_vault.py
• autobot-backend/testkit/provider_key_vault_state.py
• autobot-backend/tests/cli/test_doctor.py
• autobot-backend/tests/migrations/test_provider_key_vault.py
• autobot-backend/tests/services/feedback_aggregator_test.py
• autobot-backend/tests/test_defork_constants_18094_test.py
• autobot-backend/user_management/config.py
• autobot-backend/user_management/database.py
• autobot-backend/utils/config_manager_test.py
• autobot-backend/voice_processing/providers/lv/tilde_provider.py
• autobot-backend/voice_processing/realtime/openai_provider.py
• autobot-backend/voice_processing/realtime/openai_provider_test.py
• autobot-infrastructure/autobot-npu-worker/docker/npu_inference_server.py
• autobot-infrastructure/autobot-npu-worker/docker/npu_worker_main.py
• autobot-infrastructure/shared/scripts/automated_testing_procedure.py
• autobot-infrastructure/shared/scripts/diagnose_backend.py
• autobot-infrastructure/shared/scripts/monitoring_system.py
• autobot-infrastructure/shared/scripts/profile_api_endpoints.py
• autobot-infrastructure/shared/scripts/slm-agent-standalone.py
• autobot-infrastructure/shared/scripts/test_configuration.py
• autobot-infrastructure/shared/scripts/validate_configuration.py
• autobot-slm-backend/ansible/inventory/group_vars/aiml.yml
• autobot-slm-backend/ansible/roles/slm_agent/files/slm/agent/agent.py
• autobot-slm-backend/migrations/migrate_system_secrets_to_vault.py
• autobot-slm-backend/monitoring/business_intelligence_dashboard.py
• autobot-slm-backend/monitoring/performance_benchmark.py
• autobot-slm-backend/monitoring/performance_monitor.py
• autobot-slm-backend/services/auth.py
• autobot-slm-backend/services/manifest_loader.py
• autobot-slm-backend/slm/agent/agent.py
• autobot-slm-backend/tests/services/base_dir_canonical_18094_test.py
• autobot-slm-backend/user_management/services/vault_client.py
• autobot_shared/env_registry.py
• autobot_shared/env_registry_npu.py
• autobot_shared/env_registry_security.py
• autobot_shared/plugin_sdk/base.py
• autobot_shared/plugin_sdk/credential_binding.py
• autobot_shared/plugin_sdk/credential_origin_binding_18094_test.py
• autobot_shared/plugin_sdk/credential_resolver_injection_18094_test.py
• autobot_shared/plugin_sdk/loader.py
• autobot_shared/plugin_sdk/plugin_manager.py
• autobot_shared/redis_management/config.py
• autobot_shared/ssot_config.py
• autobot_shared/ssot_constants.py
• docs/configuration/VNC_PORT_CONFIGURATION.md
• docs/developer/04-configuration.md
• docs/developer/ENV_VARS.md
• docs/developer/THREAT_MODEL.md
• docs/development/CORE_RULES.md
• docs/guides/CONFIGURATION_GUIDE.md
• docs/system-state.md
• pipeline-scripts/check_env_var_registry_test.py
• plugins/core-plugins/image-generation-plugin/main.py
• plugins/core-plugins/image-generation-plugin/tools/__init__.py
• plugins/core-plugins/image-generation-plugin/tools/credential_resolver_18094_test.py
• plugins/core-plugins/image-generation-plugin/tools/generate_image.py
• plugins/core-plugins/video-generation-plugin/main.py
• plugins/core-plugins/video-generation-plugin/tools/credential_slot_18094_test.py
• plugins/core-plugins/video-generation-plugin/tools/providers.py
• repo_tests/_reach_policy.py
• repo_tests/chunker_private_embedding_hooks_18185_test.py
• repo_tests/credential_vault_resolution_allowlist.py
• repo_tests/infra_backend_imports_allowlist_18288.py
• repo_tests/npu_bind_connect_split_18094_test.py
• repo_tests/one_content_digest_15722_test.py
• repo_tests/one_deployment_mode_detector_12771_test.py
• repo_tests/one_internal_api_key_reader_17856_test.py
• repo_tests/provider_key_env_reads_route_through_vault_18094_test.py
• repo_tests/reach_scope_claim_17844_test.py
• repo_tests/slm_agent_identity_18094_test.py
• repo_tests/symbol_fork_baseline.json
• repo_tests/test_infra_scripts_import_14129.py
• scripts/daily_health_check.py
• scripts/daily_health_check_defaults_18094_test.py

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[github-actions]

Notice: 25 open PRs — past the runaway threshold (25)

This is not a request to defer this PR. The actual limit is the open-PR cap (AUTOBOT_OPEN_PR_CAP, default 40), enforced at pre-push against NEW branches only -- pushing more commits to this PR's own branch is never blocked by it.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(egress): guard the backend services/ outbound calls under the SSOT policy, user-supplied URLs public-only (#17576) #18370 fix(egress): guard the backend services/ outbound calls under the SSOT policy, user-supplied URLs public-only (security(egress): rule 8's only enforcement is a five-file literal, and four connectors beside it call tracked_request unguarded #17576)
• chore(train): merge train 2026-10-12 #6 — 5 approved PRs, stacked on #18358 (#18293) #18364 chore(train): merge train 2026-10-12 Refactor backend API and remove unused variables #6 — 5 approved PRs, stacked on chore(train): merge train 2026-10-12 #5 — #18348 one BM25 (#18183) #18358 (canonical(state): every chat turn is persisted twice — chat_sessions and an undeclared transcript store, already diverged once #18293)
• fix(codebase-analytics): honest scan outcomes, duplication detectors wired, and forks shown from the one CI detector (#18013, #18067, #17982) #18362 fix(codebase-analytics): honest scan outcomes, duplication detectors wired, and forks shown from the one CI detector (bug(codebase-analytics): /duplicates returns a fabricated "timed out after 120s" in 0.2s — the single-flight lock is never released #18013, Codebase analytics reports 18,200 problems and zero duplication, while the fork detector finds 365 clusters in the same tree #18067, bug(codebase-analytics): duplicate detection reports 'nothing scanned' as a completed scan — the one tool the dedup programme needs returns nothing for AutoBot's own codebase #17982)
• refactor(regex): one slugify, one skills tokenizer and one word tokenizer, the no-op ANSI copy gone, and the dead command-utils template retired (#18093, #18124) #18360 refactor(regex): one slugify, one skills tokenizer and one word tokenizer, the no-op ANSI copy gone, and the dead command-utils template retired (tech-debt(backend): six regex concepts are forked across 2–8 files each, and one fork is a no-op #18093, tech-debt(code_analysis): a 190-line code-generation template whose output never landed, now stale against the file that did #18124)
• chore(train): merge train 2026-10-12 #5 — #18348 one BM25 (#18183) #18358 chore(train): merge train 2026-10-12 Dev new gui #5 — refactor(search): one BM25 formula for the KB and the memory graph, and the validator-only hybrid engine retired onto the canonical one (#18183, #17599) #18348 one BM25 (tech-debt(search): a second BM25 implementation lives in the memory-graph HybridScorer beside the knowledge BM25Scorer #18183)
• fix(slm): one SSH systemctl executor with quoted, validated units and gated service routes (#18359) #18352 fix(slm): one SSH systemctl executor with quoted, validated units and gated service routes (security(slm): remote command injection — service_name from the URL path is interpolated unquoted into an ssh 'sudo -n systemctl' shell command (reachable by admin/operator users) #18359)
• security(api): gate the 14 remaining ungated mutating routers — sign-in for reads, admin for shared-state writes (#16375) #18351 security(api): gate the 14 remaining ungated mutating routers — sign-in for reads, admin for shared-state writes (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• refactor(knowledge): the pattern analyzer and Notion connector use the one content digest (#15722) #18350 refactor(knowledge): the pattern analyzer and Notion connector use the one content digest (canonical(knowledge): two functions named content_hash return different values — full digest vs 16-char truncation #15722)
• refactor(search): one BM25 formula for the KB and the memory graph, and the validator-only hybrid engine retired onto the canonical one (#18183, #17599) #18348 refactor(search): one BM25 formula for the KB and the memory graph, and the validator-only hybrid engine retired onto the canonical one (tech-debt(search): a second BM25 implementation lives in the memory-graph HybridScorer beside the knowledge BM25Scorer #18183, tech-debt(rag): two hybrid-search implementations — one reachable only from a validator #17599)
• refactor(audit): audit_logs is the one system of record, Redis its projection — three stores retired, one write path, one retention table (#17225) #18343 refactor(audit): audit_logs is the one system of record, Redis its projection — three stores retired, one write path, one retention table (tech-debt(audit): #6475 closed on three parallel audit systems — there are now six #17225)
• security(auth): DB role permissions work, one strict-union permission gate for both services, MFA-pending tokens refused, SSO mints from the real user (#18259, #18321, #18322) #18338 security(auth): DB role permissions work, one strict-union permission gate for both services, MFA-pending tokens refused, SSO mints from the real user (security(rbac): UserService.get_user_permissions reads role.Permission, which does not exist — the DB-backed permission path raises and the middleware denies #18259, security(slm): get_current_user accepts MFA-pending temp tokens as full sessions (#17049 fixed only the backend) #18321, fix(slm-sso): SSO login passes a stand-in user without is_platform_admin to create_token_response, which raises #18322)
• refactor(chat): chat_sessions is the one durable home of a conversation turn; transcripts are read-only legacy, found where they really are (#18293) #18309 refactor(chat): chat_sessions is the one durable home of a conversation turn; transcripts are read-only legacy, found where they really are (canonical(state): every chat turn is persisted twice — chat_sessions and an undeclared transcript store, already diverged once #18293)
• chore(deps): bump the all-dependencies group across 1 directory with 15 updates #18273 chore(deps): bump the all-dependencies group across 1 directory with 15 updates
• fix(sandbox): execution and pooled containers run fully hardened, and no caller can widen their reach (#17267) #18232 fix(sandbox): execution and pooled containers run fully hardened, and no caller can widen their reach (refactor(sandbox): container hardening is copy-pasted across three Docker clients, with a docstring as the only thing preventing drift #17267)
• chore(deps): bump the all-dependencies group in /autobot-infrastructure/autobot-npu-worker/docker with 3 updates #18177 chore(deps): bump the all-dependencies group in /autobot-infrastructure/autobot-npu-worker/docker with 3 updates
• chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 4 updates #18176 chore(deps): bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 4 updates
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 in the all-dependencies group #18175 chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 in the all-dependencies group
• chore(deps): update asyncpg requirement from >=0.31.0 to >=0.32.0 in /autobot-slm-backend in the all-dependencies group #18172 chore(deps): update asyncpg requirement from >=0.31.0 to >=0.32.0 in /autobot-slm-backend in the all-dependencies group
• chore(deps): bump the all-dependencies group across 1 directory with 16 updates #18157 chore(deps): bump the all-dependencies group across 1 directory with 16 updates
• chore(deps): update aiohttp requirement from >=3.14.3 to >=3.14.4 in /autobot-backend/code_analysis in the all-dependencies group across 1 directory #18156 chore(deps): update aiohttp requirement from >=3.14.3 to >=3.14.4 in /autobot-backend/code_analysis in the all-dependencies group across 1 directory
• chore(deps-dev): bump the oxlint group across 1 directory with 2 updates #18152 chore(deps-dev): bump the oxlint group across 1 directory with 2 updates
• chore(deps): update transformers requirement from >=5.18.0 to >=5.19.0 in /autobot-tts-worker in the all-dependencies group across 1 directory #18150 chore(deps): update transformers requirement from >=5.18.0 to >=5.19.0 in /autobot-tts-worker in the all-dependencies group across 1 directory
• chore(deps-dev): bump the all-dependencies group across 1 directory with 2 updates #18149 chore(deps-dev): bump the all-dependencies group across 1 directory with 2 updates
• chore(deps): bump the opentelemetry group across 1 directory with 10 updates #17999 chore(deps): bump the opentelemetry group across 1 directory with 10 updates
• feat(voice): release a reply's opening chunk at a clause or word boundary, and drop indented code from speech (#13103, #17953) #17972 feat(voice): release a reply's opening chunk at a clause or word boundary, and drop indented code from speech (Voice: first audio waits for a full terminated sentence — no sub-sentence fast start #13103, voice: the speech shaper drops ``` fences but still reads ~~~ fences and indented code blocks aloud #17953)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[mrveiss]

Security review (Opus) at ccc1cc3: blocked. There is one resolver and the vault wins over env, but the owner's ruling, "refuse if the vault holds it", is not implemented: a held key whose read fails falls back to the env var.

Severity	Location	Finding	Fix
High (fail-open)	services/provider_key_vault.py:341-343	_hydrate_one_key catches every read or decrypt exception and returns False, without recording that the key is held. resolve_provider_key (:171-185) then treats "held, read failed" as "not held" and returns the env value.	Track failed reads in a set (or a tri-state cache). The resolver raises a refusal for a held+failed name and never returns env.
High (fail-open)	initialization/lifespan.py:432-440	A vault outage (DB down, root key missing, an exception finding the system secret) aborts hydration at debug, labelled "non-critical", so every key resolves from env.	Treat an outage as "held status unknown": refuse the names that have an env value, or fail startup. Log at ERROR.
Medium	provider_key_vault.py:171-185	Only two of the three branches exist (vault, env). There is no refusal branch.	Add it in this one resolver.
Medium	tests	No test covers read-failure → refuse, or outage during hydration. The migration tests skip without Postgres.	Unit tests: read raises with the env var set → refusal; outage during hydration → refusal or startup failure.
Medium	voice_processing/providers/lv/tilde_provider.py:45, autobot_shared/paperclip_client.py:123, services/execution/modal_backend.py:133	TILDE_API_KEY, PAPERCLIP_API_KEY and MODAL_TOKEN_* read env directly, outside VAULT_RESOLVED_CREDENTIAL_NAMES.	Route them through resolve_provider_key, or record them as out of scope in #18094 with the reason.
Low	provider_key_vault.py:342, lifespan.py:438	Key names are logged without the frozenset-label pattern used at :195/:310. No values are logged.	Use the same label pattern.

Checked and fine: the plugin trust anchoring in 32de2e3 (core path anchored to the module file, symlinks resolved, core searched before community), and the floor re-pins in 522f014.

[mrveiss]

Security re-review (Opus) at 2326fde: blocked on one remaining High. H1, M, L and the Celery hook all hold. Verified:

• _hydrate_all (:500-512) refuses held names without a root key, with a contrast test at :83;
• the cache is rebuilt from rows (:501/:517);
• the swap is atomic (one tuple assignment, :517);
• the Celery worker_process_init hook hydrates whether or not a root key is set;
• a failed DB read refuses.

Severity	Location	Finding	Fix
High	services/provider_key_vault.py:247, pinned by provider_key_outage_18094_test.py:193	Lazy hydration runs only when _root_key_configured(). A process outside the lifespan (CLI, operator script, MCP embedded, spawned subprocess) with no root key never lists rows, so it serves env for held names, which is what the ruling forbids. The stated residual is avoidable: listing needs no root key (_hydrate_all already lists and refuses without one), and the Celery hook already hydrates ungated. The body's residual line contradicts the module docstring (:44).	Drop the and _root_key_configured() gate, so every unhydrated process lists rows. An unreachable DB then refuses, which the ruling accepts. Turn :193 into a contrast: no root key and the row held → refused; no row → env.
Low	provider_key_process_init.py:41-54	worker.join() has no timeout and holds the lock for the whole join, so a hung DB connect blocks every first caller, including the event-loop thread.	join(timeout) from an env-backed constant; on timeout, set VAULT_UNREACHABLE.
Low	provider_key_process_init.py:42, provider_key_vault.py:256	UNREACHABLE is permanent (only NOT_HYDRATED re-hydrates), so a transient blip at worker init refuses keys for the worker's whole lifetime. That fails closed, but the docstring says "until a hydration succeeds".	Retry with backoff, or document that a restart is needed.
Low	provider_key_outage_18094_test.py:223-233	The Celery hook test only checks the decorator via AST.	Call the hook with hydrate_this_process stubbed.

Logs are clean: labels and exception type names only.

[mrveiss]

Security delta review (Opus) at a275bea: approve. The owner's "refuse if the vault holds it" ruling now holds on every path:

• Gate removed: provider_key_vault.py:240 hydrates whenever the state is NOT_HYDRATED/UNREACHABLE, and _root_key_configured is deleted.
• Real contrast test: provider_key_outage_18094_test.py:~198 runs the real hydration with the root key unset. A held name raises "could not be read"; a no-row name gets env.
• Testkit fixture: test-only (the one importer is autobot-backend/conftest.py:45), and the outage tests still drive the real hydration.
• Join timeout: releases the lock via with and fails closed, tested.
• Backoff: refuses while UNREACHABLE (:250), retries lazily on resolution, and is capped at 20×.
• Logs: type names and registry labels only.

Follow-ups are filed as #18426. None fails open:

• Medium: the synchronous retry joins on the request path, so a vault outage can stall the event loop for up to 30s per retry window.
• Lows: a late stale-snapshot swap, needing a generation check; unclamped env reads; and registry wording that describes the race as intended.

Queued for the next merge train.