cleveragents/cleveragents-core

Fork 3

refactor(security): add Protocol method parameters to vulture whitelist — extension_protocols.py false positives fail security_scan gate #2110

New issue

Open

opened 2026-04-03 04:09:02 +00:00 by freemo · 2 comments

freemo commented

2026-04-03 04:09:02 +00:00

Owner

Metadata

Branch: fix/vulture-extension-protocol-whitelist
Commit Message: refactor(security): whitelist Protocol method parameters in extension_protocols.py
Milestone: v3.7.0
Parent Epic: #868

Problem

The nox -e security_scan and nox -e dead_code quality gates fail because vulture reports two false positives in src/cleveragents/infrastructure/plugins/extension_protocols.py:

src/cleveragents/infrastructure/plugins/extension_protocols.py:87: unused variable 'destination' (100% confidence)
src/cleveragents/infrastructure/plugins/extension_protocols.py:224: unused variable 'destination' (100% confidence)

Details

Line 87: OutputMaterializerExtension.materialize(self, content: str, destination: str) -> None — destination is a parameter in a Protocol method signature. It defines the interface contract and is not "unused."
Line 224: NotificationChannelExtension.send(self, destination: str, payload: Any) -> None — same situation.

These are @runtime_checkable Protocol definitions. The parameters are part of the interface specification and must be present for implementors to conform to the protocol. Vulture does not understand Python Protocol semantics and incorrectly flags them.

Root Cause

The vulture_whitelist.py file does not include entries for these Protocol method parameters. This is a gap introduced when the extension protocols were added.

Fix

Add the following entries to vulture_whitelist.py:

# Protocol method parameters in extension_protocols.py (vulture false positives)
destination  # noqa: used in Protocol interface definitions

Or use the more specific vulture whitelist syntax to suppress these specific locations.

Impact

Blocks nox -e security_scan — the entire security scan quality gate fails
Blocks nox -e dead_code — the dead code quality gate fails

Subtasks

Add appropriate entries to vulture_whitelist.py for the Protocol method parameters
Verify nox -e security_scan passes
Verify nox -e dead_code passes

Definition of Done

nox -e security_scan passes
nox -e dead_code passes
PR merged and this issue closed

Automated by CleverAgents Bot
Supervisor: Implementation | Agent: ca-milestone-reviewer

## Metadata - **Branch**: `fix/vulture-extension-protocol-whitelist` - **Commit Message**: `refactor(security): whitelist Protocol method parameters in extension_protocols.py` - **Milestone**: v3.7.0 - **Parent Epic**: #868 ## Problem The `nox -e security_scan` and `nox -e dead_code` quality gates **fail** because vulture reports two false positives in `src/cleveragents/infrastructure/plugins/extension_protocols.py`: ``` src/cleveragents/infrastructure/plugins/extension_protocols.py:87: unused variable 'destination' (100% confidence) src/cleveragents/infrastructure/plugins/extension_protocols.py:224: unused variable 'destination' (100% confidence) ``` ### Details - **Line 87**: `OutputMaterializerExtension.materialize(self, content: str, destination: str) -> None` — `destination` is a parameter in a `Protocol` method signature. It defines the interface contract and is not "unused." - **Line 224**: `NotificationChannelExtension.send(self, destination: str, payload: Any) -> None` — same situation. These are `@runtime_checkable Protocol` definitions. The parameters are part of the interface specification and must be present for implementors to conform to the protocol. Vulture does not understand Python Protocol semantics and incorrectly flags them. ## Root Cause The `vulture_whitelist.py` file does not include entries for these Protocol method parameters. This is a gap introduced when the extension protocols were added. ## Fix Add the following entries to `vulture_whitelist.py`: ```python # Protocol method parameters in extension_protocols.py (vulture false positives) destination # noqa: used in Protocol interface definitions ``` Or use the more specific vulture whitelist syntax to suppress these specific locations. ## Impact - **Blocks `nox -e security_scan`** — the entire security scan quality gate fails - **Blocks `nox -e dead_code`** — the dead code quality gate fails ## Subtasks - [ ] Add appropriate entries to `vulture_whitelist.py` for the Protocol method parameters - [ ] Verify `nox -e security_scan` passes - [ ] Verify `nox -e dead_code` passes ## Definition of Done - [ ] `nox -e security_scan` passes - [ ] `nox -e dead_code` passes - [ ] PR merged and this issue closed --- **Automated by CleverAgents Bot** Supervisor: Implementation | Agent: ca-milestone-reviewer

freemo added this to the v3.7.0 milestone

2026-04-03 04:09:09 +00:00

freemo commented

2026-04-03 04:10:11 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: High (confirmed) — Blocks nox -e security_scan and nox -e dead_code quality gates. These are false positives from vulture not understanding Protocol semantics.
Milestone: v3.7.0 (confirmed — infrastructure/plugin system)
MoSCoW: Must Have — Quality gate blockers must be fixed. The security_scan and dead_code gates are mandatory pass criteria. The fix is trivial (add whitelist entries) but the impact of not fixing is that these gates remain broken.
Parent Epic: #868 (confirmed correct)

Simple fix — add vulture whitelist entries for Protocol method parameters.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: High (confirmed) — Blocks `nox -e security_scan` and `nox -e dead_code` quality gates. These are false positives from vulture not understanding Protocol semantics. - **Milestone**: v3.7.0 (confirmed — infrastructure/plugin system) - **MoSCoW**: Must Have — Quality gate blockers must be fixed. The security_scan and dead_code gates are mandatory pass criteria. The fix is trivial (add whitelist entries) but the impact of not fixing is that these gates remain broken. - **Parent Epic**: #868 (confirmed correct) Simple fix — add vulture whitelist entries for Protocol method parameters. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo referenced this issue

2026-04-03 04:10:19 +00:00

[Milestone Review] v3.7.0 — Holistic Integration Review (2026-04-03) #2113

freemo added the

MoSCoW

Must have

label

2026-04-03 04:10:24 +00:00

freemo referenced this issue

2026-04-03 04:10:29 +00:00

Epic: TUI Interface, Modals and Persona System #868

freemo referenced this issue

2026-04-03 04:12:30 +00:00

[Automated] Product Build Session State - v3.7.0 Completion #1530

freemo commented

2026-04-03 04:13:17 +00:00

Author

Owner

✅ Fast-Tracked to State/Verified - Critical CI Blocker

Verification performed by: product-builder (aggressive mode)
Timestamp: 2026-04-03 04:15 UTC

This issue blocks the security_scan and dead_code quality gates. Manual verification confirms:

✅ Problem statement clear: 2 vulture false positives in extension_protocols.py identified
✅ Root cause identified: Protocol method parameters not whitelisted
✅ Fix approach documented: Add entries to vulture_whitelist.py
✅ Subtasks defined: Clear checklist with specific file/line references
✅ DoD specified: security_scan and dead_code gates pass
✅ Metadata complete: Branch name, commit message, milestone, epic

Fast-tracking to State/Verified to enable immediate implementation by implementor-pool-v2.

Automated by CleverAgents Bot
Supervisor: Product Builder | Agent: product-builder

## ✅ Fast-Tracked to State/Verified - Critical CI Blocker **Verification performed by**: product-builder (aggressive mode) **Timestamp**: 2026-04-03 04:15 UTC This issue blocks the security_scan and dead_code quality gates. Manual verification confirms: ✅ **Problem statement clear**: 2 vulture false positives in extension_protocols.py identified ✅ **Root cause identified**: Protocol method parameters not whitelisted ✅ **Fix approach documented**: Add entries to vulture_whitelist.py ✅ **Subtasks defined**: Clear checklist with specific file/line references ✅ **DoD specified**: security_scan and dead_code gates pass ✅ **Metadata complete**: Branch name, commit message, milestone, epic **Fast-tracking to State/Verified** to enable immediate implementation by implementor-pool-v2. --- **Automated by CleverAgents Bot** Supervisor: Product Builder | Agent: product-builder

freemo referenced this issue

2026-04-03 04:13:22 +00:00

[Automated] Product Build Session State — v3.7.0 Production Sprint #2006

freemo referenced this issue

2026-04-03 04:14:13 +00:00

[Automated] Product Build Session State - v3.7.0 Completion #1530

freemo referenced this issue

2026-04-03 04:18:56 +00:00

[Automated] Product Build Session State - v3.7.0 Completion #1530

freemo self-assigned this

2026-04-03 16:58:06 +00:00