Add immutable AgentCapabilities core data models - #671
Conversation
|
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
📝 WalkthroughWalkthroughAdds frozen ChangesCapability models
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Analysis CompleteGenerated ECC bundle from 1 commits | Confidence: 50% View Pull Request #672Repository Profile
Changed Files (3)
Top hotspots
Top directories
Analysis Depth Readiness (commit-history, 7%)ECC Tools uses this to decide whether recommendations should stay at commit-history/setup guidance or expand into CI, security, harness, reference-set, AI-routing, and team backlog work.
Reference Set Readiness (0/7, 0%)
Generated Instincts (13)
After merging, import with: Files
|
🧪 PR Test Results
Python 3.12 · commit a0e9df2 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
tests/test_capabilities.py (3)
8-8: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winTest the public
agentwatch.coreAPI.Importing from
agentwatch.core.capabilitiesbypasses the package re-export, so these tests will pass even if the public export is broken. Import throughagentwatch.coreand assert both names are present in__all__.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_capabilities.py` at line 8, Update the imports in the capabilities tests to use the public agentwatch.core API instead of agentwatch.core.capabilities. In the tests covering AgentCapabilities and Capability, verify both names are exposed through agentwatch.core.__all__ while preserving the existing behavior assertions.
29-33: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winTest immutability of supplied collections.
This only checks field reassignment. Add a case that passes a mutable set, mutates the original or stored collection, and verifies the model retains an immutable snapshot.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_capabilities.py` around lines 29 - 33, Extend test_agent_capabilities_are_immutable to construct AgentCapabilities with a mutable set, mutate the original set or stored collection, and assert the model retains an immutable snapshot with the original contents. Keep the existing FrozenInstanceError field-reassignment check.
11-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAlso verify
Capabilityimmutability.
Capabilityis frozen, but this test only checks construction. Add aFrozenInstanceErrorassertion for assigningcap.name.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_capabilities.py` around lines 11 - 13, Extend test_capability_instantiation to verify the frozen Capability contract by asserting that assigning a new value to cap.name raises FrozenInstanceError. Preserve the existing construction and name assertion, and import the appropriate exception or testing utility if needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agentwatch/core/__init__.py`:
- Line 1: Update agentwatch/core/__init__.py to add AgentCapabilities and
Capability to __all__ while following the existing re-export convention. In
tests/test_capabilities.py, import both names through agentwatch.core and verify
they are publicly exported.
In `@agentwatch/core/capabilities.py`:
- Around line 18-22: The Capability dataclass must normalize all whitelist
inputs to immutable frozensets during construction. In
agentwatch/core/capabilities.py lines 18-22, add __post_init__ normalization for
read_paths, write_paths, network_domains, db_tables, and exec_binaries; in
tests/test_capabilities.py lines 29-33, add a mutable-input test that verifies
later changes to the original inputs cannot alter stored permissions.
---
Nitpick comments:
In `@tests/test_capabilities.py`:
- Line 8: Update the imports in the capabilities tests to use the public
agentwatch.core API instead of agentwatch.core.capabilities. In the tests
covering AgentCapabilities and Capability, verify both names are exposed through
agentwatch.core.__all__ while preserving the existing behavior assertions.
- Around line 29-33: Extend test_agent_capabilities_are_immutable to construct
AgentCapabilities with a mutable set, mutate the original set or stored
collection, and assert the model retains an immutable snapshot with the original
contents. Keep the existing FrozenInstanceError field-reassignment check.
- Around line 11-13: Extend test_capability_instantiation to verify the frozen
Capability contract by asserting that assigning a new value to cap.name raises
FrozenInstanceError. Preserve the existing construction and name assertion, and
import the appropriate exception or testing utility if needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a1113318-0c46-4997-afef-33f9f3c56ecb
📒 Files selected for processing (3)
agentwatch/core/__init__.pyagentwatch/core/capabilities.pytests/test_capabilities.py
| @@ -1,3 +1,4 @@ | |||
| from agentwatch.core.capabilities import AgentCapabilities, Capability | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Validate the complete public agentwatch.core export contract.
agentwatch/core/__init__.py#L1-L1: addAgentCapabilitiesandCapabilityto__all__and follow the configured re-export convention.tests/test_capabilities.py#L8-L8: import throughagentwatch.coreand verify both names are publicly exported.
📍 Affects 2 files
agentwatch/core/__init__.py#L1-L1(this comment)tests/test_capabilities.py#L8-L8
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agentwatch/core/__init__.py` at line 1, Update agentwatch/core/__init__.py to
add AgentCapabilities and Capability to __all__ while following the existing
re-export convention. In tests/test_capabilities.py, import both names through
agentwatch.core and verify they are publicly exported.
Source: Path instructions
| read_paths: frozenset[Path] = field(default_factory=frozenset) | ||
| write_paths: frozenset[Path] = field(default_factory=frozenset) | ||
| network_domains: frozenset[str] = field(default_factory=frozenset) | ||
| db_tables: frozenset[tuple[str, str]] = field(default_factory=frozenset) | ||
| exec_binaries: frozenset[str] = field(default_factory=frozenset) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Preserve immutability across construction and testing.
frozen=True does not freeze mutable sets passed to the constructor.
agentwatch/core/capabilities.py#L18-L22: normalize every whitelist withfrozenset(...)in__post_init__.tests/test_capabilities.py#L29-L33: add a mutable-input test proving the stored permissions cannot be changed.
📍 Affects 2 files
agentwatch/core/capabilities.py#L18-L22(this comment)tests/test_capabilities.py#L29-L33
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agentwatch/core/capabilities.py` around lines 18 - 22, The Capability
dataclass must normalize all whitelist inputs to immutable frozensets during
construction. In agentwatch/core/capabilities.py lines 18-22, add __post_init__
normalization for read_paths, write_paths, network_domains, db_tables, and
exec_binaries; in tests/test_capabilities.py lines 29-33, add a mutable-input
test that verifies later changes to the original inputs cannot alter stored
permissions.
|
The core data models look correct, but the CI pipeline is failing on 'Python Lint & Type Check'. We enforce a strict 0-warning policy. Fix the lint errors and ping me when CI is green. |
2 participants
Summary
Implements the core data models for the Capability Lattice.
Changes
Capabilitydata model.AgentCapabilitiesdata model.read_pathswrite_pathsnetwork_domainsdb_tablesexec_binariesCloses #652
Summary by CodeRabbit
New Features
Tests