Edison runner: make repo .env authoritative over ambient key (403 footgun)#245
Merged
Conversation
…tgun) load_api_key() preferred an ambient EDISON_PLATFORM_API_KEY over the repo .env, and load_dotenv() doesn't override already-exported vars — so a stale EDISON_PLATFORM_API_KEY left in a terminal session silently shadowed a freshly-updated .env key and failed with 403 at /auth/login. Required an `env -u EDISON_PLATFORM_API_KEY` workaround on every causal run. Read the .env FILE explicitly via dotenv_values and prefer it (either key name) over ambient env; fall back to the environment only when .env supplies no key. Verified: with a stale ambient EDISON_PLATFORM_API_KEY present, load_api_key() now returns the .env key and /auth/login returns 200. black/ruff/mypy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes an Edison runner authentication footgun by making the repo root .env file authoritative for resolving the Edison API key, preventing a stale ambient EDISON_PLATFORM_API_KEY from silently shadowing a freshly updated .env key and causing 403s at login.
Changes:
- Update
load_api_key()to prefer values read directly from the repo.env(viadotenv_values) over inherited environment variables. - Expand
load_api_key()’s docstring to document the precedence rules and the underlyingload_dotenvnon-override behavior.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
101
to
+105
| load_dotenv(REPO_ROOT / ".env") | ||
| key = os.environ.get("EDISON_PLATFORM_API_KEY") or os.environ.get("EDISON_API_KEY") | ||
| file_vals = dotenv_values(REPO_ROOT / ".env") | ||
| key = ( | ||
| file_vals.get("EDISON_PLATFORM_API_KEY") | ||
| or file_vals.get("EDISON_API_KEY") |
realmarcin
added a commit
that referenced
this pull request
Jul 22, 2026
Add directed `downstream` causal edges to the four existing ecological_interactions of CommunityMech:000268, from the Edison causal-graph run (PaperQA3; PMID:25814583 Byrne et al. 2015 Science, + doi:10.1126/science.aaa4834). Wiring — the reversible magnetite "battery" loop: - Phototrophic Magnetite Fe(II) Oxidation -> Anaerobic Magnetite Fe(III) Reduction (TIE-1 photo-oxidation of Fe(II) supplies the Fe(III) acceptor G. sulfurreducens reduces). - Anaerobic Magnetite Fe(III) Reduction -> Phototrophic Magnetite Fe(II) Oxidation (Geobacter regenerates the Fe(II) donor for TIE-1; reversible in co-cultures) — closing the 2<->3 redox loop. - Phototrophic ... Oxidation, Anaerobic ... Reduction, and Magnetite-Mediated Electron Sharing all -> Biogeochemical Battery Function (the two half-reactions + electron sharing constitute the emergent, reusable mineral electron store). InteractionDownstream carries target + causal description only; evidence stays on the parent nodes (existing PMID:25814583 snippets). Schema validates; no new snippets or terms. Record HTML page regenerated. First causal record curated via a normal `just research-community-causal` run after the .env-precedence fix (#245) — no `env -u` workaround. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
realmarcin
added a commit
that referenced
this pull request
Jul 22, 2026
Add directed `downstream` causal edges to the four existing ecological_interactions of CommunityMech:000268, from the Edison causal-graph run (PaperQA3; PMID:25814583 Byrne et al. 2015 Science, + doi:10.1126/science.aaa4834). Wiring — the reversible magnetite "battery" loop: - Phototrophic Magnetite Fe(II) Oxidation -> Anaerobic Magnetite Fe(III) Reduction (TIE-1 photo-oxidation of Fe(II) supplies the Fe(III) acceptor G. sulfurreducens reduces). - Anaerobic Magnetite Fe(III) Reduction -> Phototrophic Magnetite Fe(II) Oxidation (Geobacter regenerates the Fe(II) donor for TIE-1; reversible in co-cultures) — closing the 2<->3 redox loop. - Phototrophic ... Oxidation, Anaerobic ... Reduction, and Magnetite-Mediated Electron Sharing all -> Biogeochemical Battery Function (the two half-reactions + electron sharing constitute the emergent, reusable mineral electron store). InteractionDownstream carries target + causal description only; evidence stays on the parent nodes (existing PMID:25814583 snippets). Schema validates; no new snippets or terms. Record HTML page regenerated. First causal record curated via a normal `just research-community-causal` run after the .env-precedence fix (#245) — no `env -u` workaround. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
realmarcin
added a commit
that referenced
this pull request
Jul 22, 2026
#245) (#248) Add CommunityMech:000268 (Rhodopseudomonas-Geobacter magnetite battery) to the causal "done" list (~60/304), point Next at ORNL trophic model 000176, and replace the Edison env-shadowing workaround note with the runner fix (#245): load_api_key() now treats the repo .env FILE as source of truth, so a plain `just research-community-causal <id>` works with no `env -u`. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
realmarcin
added a commit
that referenced
this pull request
Jul 22, 2026
* Rhodopseudomonas-Geobacter magnetite redox: curate causal graph Add directed `downstream` causal edges to the four existing ecological_interactions of CommunityMech:000268, from the Edison causal-graph run (PaperQA3; PMID:25814583 Byrne et al. 2015 Science, + doi:10.1126/science.aaa4834). Wiring — the reversible magnetite "battery" loop: - Phototrophic Magnetite Fe(II) Oxidation -> Anaerobic Magnetite Fe(III) Reduction (TIE-1 photo-oxidation of Fe(II) supplies the Fe(III) acceptor G. sulfurreducens reduces). - Anaerobic Magnetite Fe(III) Reduction -> Phototrophic Magnetite Fe(II) Oxidation (Geobacter regenerates the Fe(II) donor for TIE-1; reversible in co-cultures) — closing the 2<->3 redox loop. - Phototrophic ... Oxidation, Anaerobic ... Reduction, and Magnetite-Mediated Electron Sharing all -> Biogeochemical Battery Function (the two half-reactions + electron sharing constitute the emergent, reusable mineral electron store). InteractionDownstream carries target + causal description only; evidence stays on the parent nodes (existing PMID:25814583 snippets). Schema validates; no new snippets or terms. Record HTML page regenerated. First causal record curated via a normal `just research-community-causal` run after the .env-precedence fix (#245) — no `env -u` workaround. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Extend drift check to mech_shared.yaml; retire schema-pin Fold the shared LinkML module mech_shared.yaml into the shared-reference drift check and retire its self-referential sha256 pin (same fix as the id-label set): - check_vendored_sync.sh: add a path-mapped entry for src/*/schema/mech_shared.yaml (local glob -> hub src/culturemech/schema/...). Now diffs 6 files against CultureBotAI/CultureMech@<.vendored_canon_ref>; pinned ref already carries it, no ref bump. Verified 6-file OK. - Retire verify-/refresh-schema-pin + SHARED_SCHEMA_MODULE; delete src/communitymech/schema/.mech_shared.sha256. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
scripts/research_community_edison.py::load_api_key()resolved the key asos.environ.get("EDISON_PLATFORM_API_KEY") or os.environ.get("EDISON_API_KEY"), andload_dotenv()does not override already-exported vars. So a staleEDISON_PLATFORM_API_KEYinherited into a terminal session silently shadowed a freshly-updated.envkey and failed with 403 Forbidden at/auth/login— forcing anenv -u EDISON_PLATFORM_API_KEYworkaround on every causal run.Fix
Read the
.envfile explicitly viadotenv_valuesand prefer it (either key name) over ambient env; fall back to the environment only when.envsupplies no key. The repo.envis now the source of truth.Verification
With the stale ambient
EDISON_PLATFORM_API_KEYstill present:load_api_key()returns the.envkey (not the stale one)POST /auth/login→ 200black --check/ruff/mypyall cleanNo
env -uworkaround needed anymore, in this session or future ones.🤖 Generated with Claude Code