UAT: core.namespace config key accepts reserved and provider namespace values without validation — setting core.namespace to openai or system is not rejected #2154

Open
opened 2026-04-03 04:29:41 +00:00 by freemo · 1 comment
Owner

Metadata

  • Branch: fix/config-namespace-reserved-validation
  • Commit Message: fix(config): reject reserved and provider namespace values for core.namespace config key
  • Milestone: v3.7.0
  • Parent Epic: #362

Summary

config_service.py registers core.namespace as a plain str type with no domain-level validation. The validate_type() method only checks that the value is a string — it does not validate against RESERVED_NAMESPACES or PROVIDER_NAMESPACES defined in src/cleveragents/domain/models/core/project.py.

Per docs/specification.md §Configuration and ADR-002, built-in provider namespaces (openai/, anthropic/, google/, etc.) and reserved namespaces (system, admin, local, etc.) must not be used for custom entity registration. Setting core.namespace to any of these values should be rejected with a clear error message.

Reproduction

# These should fail but don't:
agents config set core.namespace openai
# Expected: Error: 'openai' is a reserved provider namespace
# Actual: Successfully sets core.namespace to 'openai'

agents config set core.namespace system
# Expected: Error: 'system' is a reserved namespace
# Actual: Successfully sets core.namespace to 'system'

agents config set core.namespace anthropic
# Expected: Error: 'anthropic' is a reserved provider namespace
# Actual: Successfully sets core.namespace to 'anthropic'

Expected Behaviour (per spec §Configuration and ADR-002)

  • core.namespace must reject any value that appears in RESERVED_NAMESPACES (e.g., system, admin, local) with a descriptive error.
  • core.namespace must reject any value that appears in PROVIDER_NAMESPACES (e.g., openai, anthropic, google, gemini, deepseek, mistral, perplexity, qwen, amazon) with a descriptive error.
  • Valid custom namespace values (e.g., myorg, myproject) must continue to be accepted.

Actual Behaviour

validate_type() in config_service.py accepts any string for core.namespace, including all reserved and provider namespace values. Once set, all subsequent entity creation commands use the reserved/provider namespace as the default, potentially causing entity resolution failures or namespace conflicts with built-in LLM actors.

Affected Files

  • src/cleveragents/application/services/config_service.pycore.namespace registration (~line 159–165) and validate_type() method (~line 1376)
  • src/cleveragents/domain/models/core/project.pyRESERVED_NAMESPACES, PROVIDER_NAMESPACES (lines 41–64) — constants to be used for validation

Subtasks

  • Add a domain-level validator for core.namespace in config_service.py that imports and checks against RESERVED_NAMESPACES and PROVIDER_NAMESPACES from src/cleveragents/domain/models/core/project.py
  • Ensure the validator raises a descriptive ValueError (or equivalent config error) identifying the specific reserved or provider namespace that was rejected
  • Verify that valid custom namespace values (e.g., myorg, myproject) continue to be accepted without error
  • Write Behave unit tests (in features/) covering: reserved namespace rejection, provider namespace rejection, and valid custom namespace acceptance for core.namespace
  • Run nox -e typecheck and confirm no Pyright errors introduced

Definition of Done

  • agents config set core.namespace openai raises a clear error identifying openai as a reserved provider namespace
  • agents config set core.namespace system raises a clear error identifying system as a reserved namespace
  • agents config set core.namespace myorg succeeds as expected
  • Validation reuses RESERVED_NAMESPACES and PROVIDER_NAMESPACES constants from project.py (no duplication)
  • Behave feature file added with scenarios for all reserved and provider namespace rejection cases for core.namespace
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/config-namespace-reserved-validation` - **Commit Message**: `fix(config): reject reserved and provider namespace values for core.namespace config key` - **Milestone**: v3.7.0 - **Parent Epic**: #362 ## Summary `config_service.py` registers `core.namespace` as a plain `str` type with no domain-level validation. The `validate_type()` method only checks that the value is a string — it does not validate against `RESERVED_NAMESPACES` or `PROVIDER_NAMESPACES` defined in `src/cleveragents/domain/models/core/project.py`. Per `docs/specification.md` §Configuration and ADR-002, built-in provider namespaces (`openai/`, `anthropic/`, `google/`, etc.) and reserved namespaces (`system`, `admin`, `local`, etc.) must not be used for custom entity registration. Setting `core.namespace` to any of these values should be rejected with a clear error message. ## Reproduction ```bash # These should fail but don't: agents config set core.namespace openai # Expected: Error: 'openai' is a reserved provider namespace # Actual: Successfully sets core.namespace to 'openai' agents config set core.namespace system # Expected: Error: 'system' is a reserved namespace # Actual: Successfully sets core.namespace to 'system' agents config set core.namespace anthropic # Expected: Error: 'anthropic' is a reserved provider namespace # Actual: Successfully sets core.namespace to 'anthropic' ``` ## Expected Behaviour (per spec §Configuration and ADR-002) - `core.namespace` must reject any value that appears in `RESERVED_NAMESPACES` (e.g., `system`, `admin`, `local`) with a descriptive error. - `core.namespace` must reject any value that appears in `PROVIDER_NAMESPACES` (e.g., `openai`, `anthropic`, `google`, `gemini`, `deepseek`, `mistral`, `perplexity`, `qwen`, `amazon`) with a descriptive error. - Valid custom namespace values (e.g., `myorg`, `myproject`) must continue to be accepted. ## Actual Behaviour `validate_type()` in `config_service.py` accepts any string for `core.namespace`, including all reserved and provider namespace values. Once set, all subsequent entity creation commands use the reserved/provider namespace as the default, potentially causing entity resolution failures or namespace conflicts with built-in LLM actors. ## Affected Files - `src/cleveragents/application/services/config_service.py` — `core.namespace` registration (~line 159–165) and `validate_type()` method (~line 1376) - `src/cleveragents/domain/models/core/project.py` — `RESERVED_NAMESPACES`, `PROVIDER_NAMESPACES` (lines 41–64) — constants to be used for validation ## Subtasks - [ ] Add a domain-level validator for `core.namespace` in `config_service.py` that imports and checks against `RESERVED_NAMESPACES` and `PROVIDER_NAMESPACES` from `src/cleveragents/domain/models/core/project.py` - [ ] Ensure the validator raises a descriptive `ValueError` (or equivalent config error) identifying the specific reserved or provider namespace that was rejected - [ ] Verify that valid custom namespace values (e.g., `myorg`, `myproject`) continue to be accepted without error - [ ] Write Behave unit tests (in `features/`) covering: reserved namespace rejection, provider namespace rejection, and valid custom namespace acceptance for `core.namespace` - [ ] Run `nox -e typecheck` and confirm no Pyright errors introduced ## Definition of Done - [ ] `agents config set core.namespace openai` raises a clear error identifying `openai` as a reserved provider namespace - [ ] `agents config set core.namespace system` raises a clear error identifying `system` as a reserved namespace - [ ] `agents config set core.namespace myorg` succeeds as expected - [ ] Validation reuses `RESERVED_NAMESPACES` and `PROVIDER_NAMESPACES` constants from `project.py` (no duplication) - [ ] Behave feature file added with scenarios for all reserved and provider namespace rejection cases for `core.namespace` - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator
freemo added this to the v3.7.0 milestone 2026-04-03 04:29:48 +00:00
freemo self-assigned this 2026-04-03 16:58:00 +00:00
Author
Owner

MoSCoW classification: Should Have

Rationale: This issue addresses an important spec requirement or quality improvement. The project should include this fix but it is not strictly essential for the milestone.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

MoSCoW classification: **Should Have** Rationale: This issue addresses an important spec requirement or quality improvement. The project should include this fix but it is not strictly essential for the milestone. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo removed this from the v3.7.0 milestone 2026-04-07 01:19:35 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#362 Epic: Security & Safety Hardening
cleveragents/cleveragents-core
Reference
cleveragents/cleveragents-core#2154
No description provided.