Follow-up from the review of #763 (the no-telemetry-import SOFT validator check backing PRINCIPLE 10).
The check works correctly, but its enforcement scope is narrower than the guarantee stated in tools/egress-gateway/tool.md. Tracking the gaps here so #763 can merge:
- Scan scope is
src/-only. validate_no_telemetry_imports only descends into tools/<name>/src/, but several substrate tools keep Python at the tool root (e.g. pr-management-stats/{dashboard,reference}.py, security-tracker-stats-dashboard/{fetch_roster,fetch_prs,render}.py, dashboard-generator/reference.py). A network import in any of those isn't caught — yet tool.md promises "a substrate tool that accidentally grows a network import is caught before it is merged." Either broaden the scan to all *.py under the tool dir (minus tests/), or soften the tool.md wording.
from socket import … not matched. The socket pattern is ^\s*import\s+socket\b only; add a ^\s*from\s+socket\s+import\b companion. Note the library list is deliberately non-exhaustive.- SOFT-only. The check is advisory unless
--strict, so an accidental import merges without --strict — worth noting in the guarantee wording.
Raised in the #763 review; deferred to keep the working check moving.
Follow-up from the review of #763 (the
no-telemetry-importSOFT validator check backing PRINCIPLE 10).The check works correctly, but its enforcement scope is narrower than the guarantee stated in
tools/egress-gateway/tool.md. Tracking the gaps here so #763 can merge:src/-only.validate_no_telemetry_importsonly descends intotools/<name>/src/, but several substrate tools keep Python at the tool root (e.g.pr-management-stats/{dashboard,reference}.py,security-tracker-stats-dashboard/{fetch_roster,fetch_prs,render}.py,dashboard-generator/reference.py). A network import in any of those isn't caught — yettool.mdpromises "a substrate tool that accidentally grows a network import is caught before it is merged." Either broaden the scan to all*.pyunder the tool dir (minustests/), or soften thetool.mdwording.from socket import …not matched. Thesocketpattern is^\s*import\s+socket\bonly; add a^\s*from\s+socket\s+import\bcompanion. Note the library list is deliberately non-exhaustive.--strict, so an accidental import merges without--strict— worth noting in the guarantee wording.Raised in the #763 review; deferred to keep the working check moving.