Repository navigation
[Config Phase 3] Migrate guidestar_lens.py, language_lens.py, supply_chain_firewall.py off direct gitgalaxy_config.py imports #335
Description
Depends on
Phase 1 (resolver) and Phase 2 (galaxyscope.py's own migration, for the
calling-convention precedent) should land first.
Problem
guidestar_lens.py, language_lens.py, and supply_chain_firewall.py each
import directly from gitgalaxy_config.py at module load time:
from gitgalaxy.standards.gitgalaxy_config import (
ALLOWLIST_PATHS, STRICT_IMPORT_MODE, APPROVED_IMPORTS, BLACKLISTED_IMPORTS,
)This is a permanent, load-time value copy -- no override from any source
(YAML, CLI, PROJECT_OVERRIDES) can ever reach these values, even after
Phase 1/2 land, because these files never receive anything from
galaxyscope.py's resolved config. supply_chain_firewall.py additionally has
its own standalone main()/argparse entrypoint and can run entirely
independently of galaxyscope.py -- it has zero YAML-config-loading logic of
its own.
Fix
- Convert each of the 3 files' relevant functions to accept a config
parameter (a ResolvedConfig or the specific fields they need) instead of
reading module-level imports. E.g.
run_firewall_audit(parsed_files, alias_map=None, config: ResolvedConfig = None),
defaulting toresolve_config()with no overrides if not provided (so
existing direct callers/tests don't break). - Update galaxyscope.py's orchestrated pipeline to pass its already-resolved
config into these functions instead of relying on their independent
imports. - Give supply_chain_firewall.py's standalone
main()its own--config
flag and call into the same Phase 1resolve_config()-- so
python supply_chain_firewall.py results.json --config .galaxyscope.yaml
behaves identically to running the same policy through the orchestrated
galaxyscope.py pipeline.
Tests
- Existing tests that monkeypatch these files' module-level constants
directly (e.g.monkeypatch.setattr(firewall_module, "STRICT_IMPORT_MODE", True))
will need updating to instead pass a config object -- audit
test_supply_chain_firewall.py and equivalent test files for this pattern. - Add a test proving a YAML override for e.g. STRICT_IMPORT_MODE or
BLACKLISTED_IMPORTS actually changes standalone supply_chain_firewall.py
behavior -- this is the concrete "the gap is closed" proof, since no such
test can currently exist (the gap it's proving closed didn't exist as
reachable behavior before this phase).
Explicitly out of scope
Documentation of the final precedence rules for end users (separate
follow-up, or fold into Phase 0's design doc once implementation confirms
it matches what was decided).
Activity
squid-protocol commentedon Jul 23, 2026
File list correction from Phase 0 (#332)
Phase 0's audit (full write-up in #332) found this issue's file
list is incomplete. The unreachable-direct-import bug this phase exists to
fix affects 7 files, not 3:
Same pattern as the 3 already listed (module-level
from gitgalaxy.standards.gitgalaxy_config import (...)with a try/exceptImportErrorfallback) — add these to scope:gitgalaxy/tools/supply_chain_security/vault_sentinel.py(importsALLOWLIST_PATHS,DENYLIST_PATTERNS)gitgalaxy/tools/supply_chain_security/binary_anomaly_detector.py(imports
ALLOWLIST_PATHS,DENYLIST_PATTERNS,XRAY_BYPASS_EXTENSIONS,XRAY_BYPASS_PATHS)A variant of the same bug, worth folding into this phase (or a 3b) rather
than leaving open — these import the whole module under an alias and
read config off it with
getattr, instead of importing individual names,but the effect is identical (permanent disconnection from any override):
gitgalaxy/metrics/chronometer.py:23—from gitgalaxy.standards import gitgalaxy_config as config, then readsCHRONOMETER_CONFIGandAPERTURE_CONFIGoff it. This one matters more than it looks: it meanseven the 4
APERTURE_CONFIGkeysgalaxyscope.py'smain()alreadymerges correctly today (
SECRETS_EXACT,IGNORED_DIRECTORIES,CONTRABAND_PATTERNS,VENDOR_MINIFICATION_PATHS) never reach theChronometer, because it never receives the merged config at all.
gitgalaxy/recorders/gpu_recorder.py:23,364—from gitgalaxy.standards import gitgalaxy_config, thengetattr(gitgalaxy_config, "PROJECT_STORIES", {}).Updated task list for this phase:
guidestar_lens.py,language_lens.py,supply_chain_firewall.py,vault_sentinel.py,binary_anomaly_detector.py,chronometer.py, andgpu_recorder.pytoaccept a
ResolvedConfig(or the specific fields they need) instead ofreading module-level imports, defaulting to
resolve_config()with nooverrides if not provided.
galaxyscope.py's orchestrated pipeline to pass its resolvedconfig into all of these instead of relying on their independent imports.
supply_chain_firewall.py's standalonemain()a--configflagper the original plan.
Not in scope for this phase (flagged in #332, tracked separately):
STATIC_ARCHETYPESinsignal_processor.pyhas an unrelated pre-existingbug (wrong module aliased as
config, so its default never loadsregardless of any override) — needs its own bug ticket, not a resolver
migration.
ORCHESTRATOR_RULES/POPULARITY_STOP_STEMSappears to be deadcode with no consumer anywhere — candidate for deletion rather than
migration, pending confirmation.
Test-audit scope (monkeypatching module-level constants directly) now needs
to cover
vault_sentinel.py,binary_anomaly_detector.py,chronometer.py, andgpu_recorder.py's test files too, not justtest_supply_chain_firewall.py.Migrate galaxyscope.py main() to use the ResolvedConfig resolver (#334)
Migrate galaxyscope.py main() to use the ResolvedConfig resolver (#334)…
Migrate 7 direct gitgalaxy_config.py importers off module-level const…