[PetrefiedThunder]

Linear: SEL-282
Fixes #110

Coding engine: grok, dispatched by Grok Bot for C.Lee.

What changed

The gateway lint gate still only selected Pyflakes (F) at this tip (611fdf3). CI’s ruff check passed, and the same tree under the Python SDK rule set (E,F,W,I,N,UP,B,C4) reported 1780 errors. The issue’s 2159 count was from an older commit.

gateway/ruff.toml now selects that SDK set. These codes stay ignored, with the reason in the file, because cleaning them here would be a large or behavior-changing rewrite: E501, I001, UP007, UP017, UP035, UP042, UP045, B904, C408, N818. Every other selected rule is enforced, including the ones the audit named (B023, B905, E402).

Existing violations of the enforced rules are fixed. Loop closures bind the loop variables. zip calls that are equal-length by construction pass strict=True. The late json import in receipts moved to the top; script imports that must follow env or sys.path setup are marked noqa. FastAPI Depends / Query / Body / Header / Security stay legal default arguments. The preflight handler no longer uses one shared PreflightRequest() as its default; an omitted body still runs the empty-override sweep. A new test locks the rule set so a later edit cannot drop back to Pyflakes-only.

I001, the ignored pyupgrade codes, B904, C408, and N818 still do not fail new code. The rest of the SDK set does.

How verified

From gateway/, ruff 0.16.10 (the CI pin):

uvx ruff@0.16.10 check . --select E,F,W,I,N,UP,B,C4 --ignore E501 --statistics before the edit: Found 1780 errors.

uvx ruff@0.16.10 check . with the old config: All checks passed!

After the edit:

uvx ruff@0.16.10 check . → All checks passed!

uvx ruff@0.16.10 format --check . → 660 files already formatted

/tmp/sel282-venv/bin/python -m pytest tests/test_ruff_gate.py tests/test_preflight.py tests/test_qa_svc_money_gaps.py::test_non_finite_transfer_moves_no_money tests/test_mcp_legacy_envelope_validation.py::test_non_finite_argument_is_refused_before_execution tests/test_mcp_transport_hardening.py::test_standard_unrenderable_json_is_refused_with_no_effect tests/test_billing.py::test_rejected_charge_does_not_inflate_velocity_counters tests/test_constant_test_loop.py::test_partner_api_key_bootstrap_json_output tests/test_constant_test_loop.py::test_malformed_tool_args_are_a_configuration_error tests/test_gateway_auth_breakit.py::test_jwt_signed_by_wrong_key_rejected tests/test_gateway_auth_breakit.py::test_expired_jwt_rejected -q --tb=short → 28 passed in 4.50s

/tmp/sel282-venv/bin/python -m pytest tests/test_preflight.py::test_preflight_omitted_body_stays_optional tests/test_ruff_gate.py -q --tb=short → 2 passed in 0.69s

A read-only Muse review of the zip, preflight, and loop-closure edits reported no defects. The full gateway pytest suite was not run.

Not done / follow-ups

Import sorting (I001), the ignored pyupgrade codes, exception chaining (B904), C408, and exception renames (N818) are still a backlog. New code of those codes will pass ruff check until each ignore is removed.

tests/test_discover_kyc_honesty.py unpacks an expected Stripe status and a KYC flag and never asserts them. The names are now marked unused. The assertions were left as they were, because the table does not match the checks in the test body.

---

Note

Low Risk
Mostly lint and style fixes; the preflight default change is a small FastAPI binding fix with a regression test, and singleton caches remain functionally equivalent.

Overview
Aligns gateway ruff check with the Python SDK rule set instead of Pyflakes-only (F), so CI now enforces bugbear/pyupgrade-style checks (e.g. B023 loop closures, B905 zip(..., strict=True), E402 import order) while keeping a documented ignore list for large backlogs (I001, selected UP* codes, B904, C408, N818, E501). FastAPI Depends/Body/etc. are whitelisted via extend-immutable-calls.

Mechanical fixes across app, failure_lab, scripts, and tests so the tree passes under the expanded gate: @lru_cache without empty parens, TimeoutError instead of asyncio.TimeoutError, modern dict/list annotations, comprehension/set tweaks, and closure fixes in invariant-attack harnesses. Behavioral tweaks: preflight uses Body(default_factory=PreflightRequest) (avoids a shared default instance; omitted body still works—covered by a new test); MCP ToolCallResponse keeps camelCase wire names with naming noqa.

Adds tests/test_ruff_gate.py to lock the selected rules and ensure audit-highlighted codes are not globally ignored.

^{Reviewed by Cursor Bugbot for commit 8e29e23. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T01:56:35.601262Z	a1e9b4f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.