UAT: `NamespacedName` in `plan.py` does not reject provider namespaces (`openai/`, `anthropic/`, etc.) — spec requires these to be reserved #4419

New issue

Open

opened 2026-04-08 12:27:59 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-08 12:27:59 +00:00

Owner

Metadata

Branch: fix/namespaced-name-provider-namespace-check
Commit Message: fix(domain): add provider namespace check to NamespacedName.validate_namespace() in plan.py
Milestone: Backlog
Parent Epic: #399

Bug Report

What was tested: NamespacedName validation in src/cleveragents/domain/models/core/plan.py against ADR-002 namespace system spec.

Expected behavior (from spec, ADR-002):

Built-in provider namespaces (openai/, anthropic/, google/, etc.) are reserved for built-in LLM actors. Cannot be used for custom actors.
Constraint: "Built-in provider namespaces (openai/, anthropic/, google/, etc.) are reserved and must not be used for custom entity registration."

Actual behavior:
NamespacedName(namespace="openai", name="my-action") succeeds without error. The validate_namespace() method in plan.py only checks that the namespace is alphanumeric with hyphens — it does NOT check against the provider namespace reserved list.

Code location: src/cleveragents/domain/models/core/plan.py, lines 219-228:

@field_validator("namespace")
@classmethod
def validate_namespace(cls: type[NamespacedName], v: str) -> str:
    """Validate namespace format."""
    if not v:
        return "local"
    # Namespace should be lowercase alphanumeric with hyphens
    if not all(c.isalnum() or c == "-" for c in v):
        raise ValueError("Namespace must be alphanumeric with hyphens only")
    return v.lower()

Contrast with parse_namespaced_name() in project.py (lines 130-143):

if namespace in PROVIDER_NAMESPACES:
    raise ValueError(
        f"Namespace '{namespace}' is reserved for built-in LLM actors "
        f"and cannot be used for projects"
    )

The project.py implementation correctly checks PROVIDER_NAMESPACES = frozenset({"openai", "anthropic", "google", "gemini", "deepseek", "mistral", "perplexity", "qwen", "amazon"}), but NamespacedName in plan.py does not.

Impact: Custom plans and actions can be created with provider namespaces like openai/my-plan or anthropic/my-action, violating the spec constraint. This could cause confusion with built-in LLM actor names and break the namespace isolation guarantee.

Steps to reproduce (code-level):

from cleveragents.domain.models.core.plan import NamespacedName
# Should raise ValueError but doesn't:
nn = NamespacedName(namespace="openai", name="my-action")
print(nn)  # Prints: openai/my-action — should be rejected

Fix: Add PROVIDER_NAMESPACES check to NamespacedName.validate_namespace() in plan.py, mirroring the check in parse_namespaced_name() in project.py.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Metadata - **Branch**: `fix/namespaced-name-provider-namespace-check` - **Commit Message**: `fix(domain): add provider namespace check to NamespacedName.validate_namespace() in plan.py` - **Milestone**: Backlog - **Parent Epic**: #399 ## Bug Report **What was tested:** `NamespacedName` validation in `src/cleveragents/domain/models/core/plan.py` against ADR-002 namespace system spec. **Expected behavior (from spec, ADR-002):** > Built-in provider namespaces (`openai/`, `anthropic/`, `google/`, etc.) are reserved for built-in LLM actors. Cannot be used for custom actors. > Constraint: "Built-in provider namespaces (`openai/`, `anthropic/`, `google/`, etc.) are reserved and must not be used for custom entity registration." **Actual behavior:** `NamespacedName(namespace="openai", name="my-action")` succeeds without error. The `validate_namespace()` method in `plan.py` only checks that the namespace is alphanumeric with hyphens — it does NOT check against the provider namespace reserved list. **Code location:** `src/cleveragents/domain/models/core/plan.py`, lines 219-228: ```python @field_validator("namespace") @classmethod def validate_namespace(cls: type[NamespacedName], v: str) -> str: """Validate namespace format.""" if not v: return "local" # Namespace should be lowercase alphanumeric with hyphens if not all(c.isalnum() or c == "-" for c in v): raise ValueError("Namespace must be alphanumeric with hyphens only") return v.lower() ``` **Contrast with `parse_namespaced_name()` in `project.py`** (lines 130-143): ```python if namespace in PROVIDER_NAMESPACES: raise ValueError( f"Namespace '{namespace}' is reserved for built-in LLM actors " f"and cannot be used for projects" ) ``` The `project.py` implementation correctly checks `PROVIDER_NAMESPACES = frozenset({"openai", "anthropic", "google", "gemini", "deepseek", "mistral", "perplexity", "qwen", "amazon"})`, but `NamespacedName` in `plan.py` does not. **Impact:** Custom plans and actions can be created with provider namespaces like `openai/my-plan` or `anthropic/my-action`, violating the spec constraint. This could cause confusion with built-in LLM actor names and break the namespace isolation guarantee. **Steps to reproduce (code-level):** ```python from cleveragents.domain.models.core.plan import NamespacedName # Should raise ValueError but doesn't: nn = NamespacedName(namespace="openai", name="my-action") print(nn) # Prints: openai/my-action — should be rejected ``` **Fix:** Add `PROVIDER_NAMESPACES` check to `NamespacedName.validate_namespace()` in `plan.py`, mirroring the check in `parse_namespaced_name()` in `project.py`. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 referenced this issue

2026-04-08 12:30:30 +00:00

UAT: NamespacedName in plan.py does not reject reserved namespaces (system, internal, admin, root) — spec requires these to be blocked #4423