scripts/prism_lium_attestation_e2e.py-885-894 (1)

885-894: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Dead BASE_LIVE_PROVIDER_TESTS check in _detect_live.

The if ... != "1": pass block has no effect, so auto goes live purely on credential presence — which contradicts the module docstring stating live rentals are gated on BASE_LIVE_PROVIDER_TESTS=1. Either enforce the gate or delete the block and fix the docstring.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/prism_lium_attestation_e2e.py` around lines 885 - 894, Update
_detect_live to enforce BASE_LIVE_PROVIDER_TESTS being set to "1" before
attempting credential and SSH key loading, returning False otherwise; remove the
no-op pass block while preserving the existing SystemExit handling.

packages/challenges/prism/tests/test_prod_constation_kwargs.py-5-5 (1)

5-5: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Drop _test_constation_kwargs from the import — CI ruff fails with F401.

It is never referenced; the insecure-seam behavior is exercised through _constation_ingest_kwargs.

🔧 Proposed fix

-from prism_challenge.app import _constation_ingest_kwargs, _test_constation_kwargs
+from prism_challenge.app import _constation_ingest_kwargs

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_prod_constation_kwargs.py` at line 5,
Remove the unused _test_constation_kwargs symbol from the import in
test_prod_constation_kwargs.py, retaining only _constation_ingest_kwargs, which
is the symbol used by the tests.

Source: Pipeline failures

packages/challenges/prism/tests/test_prism_attestation_routes_s8.py-7-8 (1)

7-8: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Remove the unused pytest import — it fails ruff in CI.

No fixtures, marks, or pytest APIs are used in this module.

🔧 Proposed fix

-import pytest
 from fastapi.testclient import TestClient

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_prism_attestation_routes_s8.py` around
lines 7 - 8, Remove the unused pytest import from the test module, leaving the
TestClient import and all test behavior unchanged.

Source: Pipeline failures

scripts/prism_lium_attestation_e2e.py-41-48 (1)

41-48: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Bootstrap in-repo and install prism_recipe before importing it.

packages/challenges/prism/src exists, so prism_challenge imports here need not resolve from a sibling checkout, but the path list still reaches for prism-recipe outside the repo. This script also imports prism_recipe eagerly, and there is no prism_recipe checked in at the referenced sibling path, so the first import can fail: match the other e2e bootstrap style for Prism, and add an in-repo/installable path for prism_recipe.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/prism_lium_attestation_e2e.py` around lines 41 - 48, Update the
bootstrap path setup before the eager imports in
scripts/prism_lium_attestation_e2e.py: resolve prism_challenge from the in-repo
packages/challenges/prism/src location, and add the repository’s installable
prism_recipe source/path so prism_recipe imports succeed without relying on a
sibling checkout. Follow the existing Prism e2e bootstrap convention and remove
the invalid sibling prism-recipe path.

tests/unit/test_compute_lium_client.py-1024-1025 (1)

1024-1025: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

This assertion cannot fail. str(type(err)) is the class repr (<class '...LiumTemplateDigestMismatchError'>), which never contains a template id, so the "must not silently return the stale template id" intent isn't tested. The raise itself already proves no id was returned — either drop the line or assert on str(err) content deliberately.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_compute_lium_client.py` around lines 1024 - 1025, Remove the
ineffective assertion on str(type(err)) in the test covering
LiumTemplateDigestMismatchError. The exception raise already verifies that no
template ID is returned; if retaining an assertion for the stale ID, check
str(err) deliberately instead and validate the intended message content.

packages/challenges/prism/src/prism_challenge/audit.py-94-103 (1)

94-103: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Fail-open risk when a result object has .ok = None.

getattr(constation_ok_result, "ok", None) treats an explicit None the same as “no .ok attribute”, so a result object representing an indeterminate/pending constation can fall through to bool(constation_ok_result) and grant tier 1. Use hasattr or a sentinel to distinguish these cases before evaluating .ok.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/audit.py` around lines 94 -
103, The _constation_truthy function must distinguish an explicit result object
.ok value of None from an object without an .ok attribute. Use a sentinel or
equivalent attribute-presence check, and return the boolean value of .ok when
the attribute exists so indeterminate results remain false rather than falling
through to bool(constation_ok_result).

packages/challenges/prism/src/prism_challenge/breakglass.py-41-52 (1)

41-52: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Route break-glass audit events to a durable sink.

ingest_work_unit_result passes through break_glass_audit_log to evaluate_break_glass, but production call sites and tests only provide BreakGlassAuditLog, which stores entries only in process memory. For compliance-sensitive override records, ensure production wires a durable implementation rather than the in-memory default.
[data_integrity_and_registration]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/breakglass.py` around lines 41
- 52, Update production wiring around BreakGlassAuditLog and
ingest_work_unit_result so break-glass audit events use a durable persistent
sink instead of the in-memory default. Preserve BreakGlassAuditLog as an
injectable test double, but ensure evaluate_break_glass receives the durable
implementation in production and entries remain available through the existing
audit interface.

packages/challenges/prism/src/prism_challenge/attestation_routes.py-39-39 (1)

39-39: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Remove the unused Header import (ruff F401, failing CI).

🔧 Proposed fix

-from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/attestation_routes.py` at line
39, Remove the unused Header symbol from the FastAPI imports in the attestation
routes module, leaving the other imported symbols unchanged.

Source: Pipeline failures

packages/challenges/prism/src/prism_challenge/attestation_routes.py-92-98 (1)

92-98: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Drop _bearer_ok or wire it into authenticate_internal.

packages/challenges/prism/src/prism_challenge/attestation_routes.py defines _bearer_ok, but prism internal routes use authenticate_internal and _bearer_ok is unused in this module. If removing it preserves all intended auth behavior, drop the dead helper; otherwise connect it to the internal dependency before changing the default.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/attestation_routes.py` around
lines 92 - 98, Remove the unused _bearer_ok helper from attestation_routes.py if
authenticate_internal already preserves the intended authorization behavior;
otherwise integrate _bearer_ok into authenticate_internal’s internal-route
authentication flow before modifying any defaults.

packages/challenges/prism/tests/conftest.py-113-120 (1)

113-120: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Make no_auto_constation a registered pytest marker.

packages/challenges/prism/pyproject.toml defines only distributed_gloo under [tool.pytest.ini_options] markers, so using this undeclared marker emits PytestUnknownMarkWarning and fails with --strict-markers. If this marker should remain opt-in/unregistered, add pytest.warns(FutureWarning(FutureWarningPytestUnknownMarkWarning), ...) around this fixture instead of checking the marker directly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/conftest.py` around lines 113 - 120, Register
the no_auto_constation marker in the pytest marker configuration in
pyproject.toml, alongside distributed_gloo, with a description of its purpose.
Keep the existing request.node.get_closest_marker check in
_auto_constation_for_legacy_ingestion unchanged.

src/base/master/constation/routes.py-211-223 (1)

211-223: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Invalid variant in register_digest raises an unhandled ValueError → 500.

ImageVariant(body.variant.strip().lower()) isn't guarded; a bad client value surfaces as an internal server error instead of a clean 422.

🛡️ Proposed fix

     async def register_digest(body: RegisterDigestBody) -> dict[str, str]:
-        record = DigestRecord(
-            commit_sha=body.commit_sha,
-            tree_sha=body.tree_sha,
-            variant=ImageVariant(body.variant.strip().lower()),
-            digest=body.digest,
-        )
+        try:
+            variant = ImageVariant(body.variant.strip().lower())
+        except ValueError as exc:
+            raise HTTPException(
+                status.HTTP_422_UNPROCESSABLE_ENTITY, detail=f"invalid variant: {exc}"
+            ) from exc
+        record = DigestRecord(
+            commit_sha=body.commit_sha,
+            tree_sha=body.tree_sha,
+            variant=variant,
+            digest=body.digest,
+        )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/master/constation/routes.py` around lines 211 - 223, Update
register_digest to validate ImageVariant conversion errors and translate an
invalid body.variant into the API’s standard 422 validation response, rather
than allowing ValueError to propagate as a 500. Keep valid variant normalization
and DigestRecord registration unchanged.

src/base/compute/constation_poller.py (3)

232-234: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Stale comment.

The comment claims the interval is slept "in slices", but Line 234 issues a single sleep_fn(interval) call.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/compute/constation_poller.py` around lines 232 - 234, Update the
comment immediately above the sleep_fn(interval) call to accurately describe a
single logical sleep for the interval, removing the claim that the wait occurs
in slices.

---

350-350: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Hoist fault_class_for to the module-level import.

base.compute.constation_types is already imported at Lines 18-23; there is no cycle to break here.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/compute/constation_poller.py` at line 350, Move the fault_class_for
import from its current local scope to the existing module-level imports in
constation_poller.py, alongside the other imports from
base.compute.constation_types. Remove the redundant local import while
preserving all existing call sites.

---

105-115: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Token bucket leaks a token on every throttled call.

try_take returns the wait time but never decrements tokens on that path, and the caller at Lines 180-182 sleeps and then proceeds without re-acquiring. Each throttle event therefore issues one poll without paying a token, so the effective rate drifts above rate_limit_per_second.

♻️ Make acquisition explicit

-    def try_take(self) -> float:
-        """Return 0 if a token was taken, else seconds to wait."""
+    async def acquire(self, sleep_fn: SleepFn) -> None:
+        """Block until one token is available, then consume it."""
+        while True:
+            wait = self._try_take()
+            if wait <= 0:
+                return
+            await sleep_fn(wait)
+
+    def _try_take(self) -> float:
         now = self.now_fn()

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/compute/constation_poller.py` around lines 105 - 115, Update the
token acquisition flow around ConstationPoller.try_take so a throttled call does
not proceed after sleeping without acquiring a token. Make the caller explicitly
retry try_take after waiting, or otherwise reserve/decrement the token before
returning the wait duration; preserve immediate success for available tokens and
enforce the configured rate limit.

src/base/compute/constation_runner.py (1)

158-193: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Redundant final corroboration on the last sample.

The loop at Lines 159-176 already evaluates every sample including result.samples[-1], so Lines 178-182 recompute the same outcome. Capture the last loop result instead.

♻️ Proposed simplification

+        corr = None
         for sample in result.samples:
             corr = evaluate_corroboration(
                 lium_declared_digest=sample.lium_declared_digest,
                 sidecar_digest=sample.sidecar_digest,
             )
             if not corr.ok:
                 ...
-
-        last = result.samples[-1]
-        corr = evaluate_corroboration(
-            lium_declared_digest=last.lium_declared_digest,
-            sidecar_digest=last.sidecar_digest,
-        )
+        assert corr is not None  # samples is non-empty (checked above)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/compute/constation_runner.py` around lines 158 - 193, Remove the
redundant evaluate_corroboration call after the sample-validation loop. Capture
the loop’s corroboration result for the final sample and reuse it in the
successful _record call, while preserving the existing mismatch handling and
empty-result assumptions.

src/base/compute/constation_custody.py (2)

88-135: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Consider a revoke(miner_hotkey) API.

The module docstring calls out mid-run revocation as a mitigation, but there is no way to drop a stored token once a key is known-bad; register can only overwrite. A small revoke/discard method would let control-plane code purge on lium_auth_revoked.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/compute/constation_custody.py` around lines 88 - 135, The custody
class needs an API to remove a stored token for a known-bad key. Add a
`revoke(miner_hotkey)` or equivalent discard method alongside `unlock_api_key`,
validate the hotkey with `_require_nonblank`, and remove its entry from
`_by_hotkey` without decrypting or logging the API key; preserve safe behavior
when no token is registered.

---

46-47: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

_SupportsBalance is unused.

Nothing in this module (or __all__) references it; default_lium_probe is typed against LiumClient. Either drop it or use it to type default_lium_probe/ClientFactory so tests can pass balance-only doubles (the E2E harness in scripts/e2e_lium_attestation.py injects a non-LiumClient object).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/compute/constation_custody.py` around lines 46 - 47, Remove the
unused _SupportsBalance protocol, or apply it consistently to default_lium_probe
and ClientFactory so balance-only test doubles are accepted instead of requiring
LiumClient. Ensure the chosen approach supports the non-LiumClient object
injected by the E2E harness.

scripts/e2e_lium_attestation.py (3)

376-376: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Both ternary branches are identical.

duration_seconds=10.0 if not adversarial else 10.0 always evaluates to 10.0.

♻️ Proposed simplification

-            duration_seconds=10.0 if not adversarial else 10.0,
+            duration_seconds=10.0,

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/e2e_lium_attestation.py` at line 376, Update the duration_seconds
assignment in the relevant attestation setup to use the constant value 10.0
directly, removing the redundant conditional expression while preserving the
current behavior.

---

449-458: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

gap_obs / gap_budget are assigned identically in both branches.

Only bundle_digest and lium_for_bundle actually differ; hoist the gap values out of the conditional.

♻️ Proposed simplification

+    gap_obs = run_record.constation_observed_max_gap_seconds
+    gap_budget = run_record.constation_gap_budget_seconds
     if adversarial:
         bundle_digest = DIGEST_SWAPPED
         lium_for_bundle: str | None = DIGEST_HONEST  # Lium still declares original
-        gap_obs = run_record.constation_observed_max_gap_seconds
-        gap_budget = run_record.constation_gap_budget_seconds
     else:
         bundle_digest = sidecar_digest
         lium_for_bundle = lium_declared
-        gap_obs = run_record.constation_observed_max_gap_seconds
-        gap_budget = run_record.constation_gap_budget_seconds

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/e2e_lium_attestation.py` around lines 449 - 458, Hoist the identical
assignments to gap_obs and gap_budget out of the adversarial conditional. Keep
the if/else branches focused only on assigning bundle_digest and
lium_for_bundle, preserving their existing branch-specific values.

---

384-384: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Temp directory is never cleaned up.

run_offline is invoked four times by tests/unit/test_e2e_lium_attestation_offline.py (two direct calls plus two CLI runs), each leaving a staged training corpus, artifacts, and a SQLite DB behind. The path is returned in the bag for debugging, so consider cleaning it on success (or honoring an env flag to keep it).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/e2e_lium_attestation.py` at line 384, Update the temporary-directory
lifecycle around the run_offline flow that creates tmp with tempfile.mkdtemp:
clean up the staged corpus, artifacts, and SQLite database after successful
completion while preserving the returned path for debugging as required. Ensure
cleanup also occurs on failure where appropriate, and provide an
environment-controlled option to retain the directory when debugging is
requested.

tests/unit/test_attestation_nonce_repository.py (1)

144-163: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Test name/docstring claims a race but the consumes are sequential.

r1/r2 are awaited one after the other, so this only covers repeat consumption across handles, not concurrency. Consider asyncio.gather (or rename) so the atomic-claim path is actually exercised.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_attestation_nonce_repository.py` around lines 144 - 163, The
test test_atomic_double_consume_from_two_handles currently performs sequential
consumes despite claiming to exercise a race. Run a.consume and b.consume
concurrently with asyncio.gather, preserving the existing assertions that
exactly one result is NonceConsumeHit and the other is ALREADY_CONSUMED.

scripts/prism_lium_attestation_e2e.py (1)

816-819: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Redundant assertion.

The first clause is subsumed by the startswith("miner_fault") check, and _ingest(expect_score=False) already asserts the same thing. Also, the comment promises a "tampered bundle is forced" case that this code does not exercise (bundle=None).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/prism_lium_attestation_e2e.py` around lines 816 - 819, Update the
tampered-bundle assertion near _ingest to remove the redundant reason check,
since _ingest(expect_score=False) already validates the miner-fault outcome.
Ensure this test actually forces a tampered bundle instead of passing
bundle=None, and revise the misleading comment to match the exercised scenario.

packages/challenges/prism/tests/test_prism_no_tee_absence.py (1)

454-468: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Re-raising defeats the guard's intent.

Any ResultIngestionError (even a non-tee_required one) now propagates and fails the test, so the "never raises tee_required" assertion can never be the reported reason. Prefer failing explicitly with the reason in the message.

♻️ Proposed change

     except ResultIngestionError as exc:
-        assert exc.reason != "tee_required"
-        raise
+        pytest.fail(f"ingestion raised unexpectedly: {exc.reason}")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_prism_no_tee_absence.py` around lines
454 - 468, Update the ResultIngestionError handling around
ingest_work_unit_result so it does not re-raise the exception after checking its
reason. Instead, explicitly fail the test with the captured error reason, while
preserving the assertion that the reason must not be "tee_required".

tests/unit/test_attestation_http.py (1)

171-195: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Dead first payload/key setup. key from the fixture and the initial AttestationPayload (with the placeholder "a"*64 response) are both immediately overwritten. Drop the first block.

♻️ Proposed cleanup

-    key: bytes = harness["key"]
-    payload = AttestationPayload(
-        nonce="nonce-1",
-        digest=DIGEST,
-        pod_id=BINDING.pod_id,
-        variant="cuda",
-        sealed_manifest_hashes=dict(MANIFEST),
-        build_secret_response="a" * 64,
-    )
-    # build_secret_response must be valid hex from real helper for structure;
-    # sign with derived key after computing real response.
     from base.attestation.payload import compute_build_secret_response
 
     secret = b"build-secret-fixture"
     key = derive_attestation_key(secret)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_attestation_http.py` around lines 171 - 195, Remove the
initial harness key assignment and placeholder AttestationPayload construction
in the affected test, retaining only the later key derivation and payload built
with compute_build_secret_response. Keep the signing and attestation flow
unchanged.

tests/unit/test_compute_lium_client.py (1)

896-898: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Tautological assertions. pytest.raises(LiumAuthError) already guarantees a non-None exception of that type; lines 897-898 add nothing. Keep only the status_code check.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_compute_lium_client.py` around lines 896 - 898, Remove the
redundant non-None and type assertions from the pytest.raises validation,
retaining only the status_code assertion for the captured exception.

packages/challenges/prism/tests/test_prod_constation_http_ingest.py (1)

83-88: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Misleading helper name. _zip_b64 returns raw zip bytes, not base64; it's posted as application/octet-stream. Rename to _zip_bytes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_prod_constation_http_ingest.py` around
lines 83 - 88, Rename the helper function _zip_b64 to _zip_bytes to accurately
reflect that it returns raw ZIP bytes. Update every reference to this helper,
preserving its current byte output and application/octet-stream usage.

tests/unit/test_compute_attestation_nonce.py (1)

223-230: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Test name overstates coverage. NonceBinding validates in its own constructor, so the ValueError fires in _binding(...) before svc.issue is reached; this asserts binding validation, not issue-time rejection. Consider renaming or constructing the invalid binding outside pytest.raises.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_compute_attestation_nonce.py` around lines 223 - 230, The
test name and assertions incorrectly attribute constructor validation to
svc.issue. Rename test_issue_rejects_blank_binding_fields to reflect
NonceBinding validation, or construct each invalid binding before the
pytest.raises block so the test specifically exercises issue-time rejection.

tests/unit/test_compute_constation_service.py (2)

385-413: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

test_poller_poll_cap_fail_closed never exercises the cap. With duration_seconds=0.0 only start+end run, so the max_polls=2 limit is never exceeded and the fail-closed branch is untested. Add a case with a duration that would require interval polls and assert the poll-cap failure reason.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_compute_constation_service.py` around lines 385 - 413, The
test test_poller_poll_cap_fail_closed currently uses duration_seconds=0.0, so it
never exceeds max_polls. Add a duration requiring interval polls, run the poller
with the existing max_polls=2 configuration, and assert the result is
unsuccessful with the poll-cap failure reason while preserving the existing
start/end success assertion if useful.

---

452-469: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Move import re (and Path) to module scope. Re-importing inside the loop body adds noise for no benefit.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_compute_constation_service.py` around lines 452 - 469, Move
the Path and re imports from test_corroboration_module_never_claims_independent
to module scope, keeping the test’s existing file-reading loop and
regular-expression assertions unchanged.

packages/challenges/prism/tests/test_constation_scoring_gate.py (3)

347-347: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Local dataclasses.replace imports repeated inline.

from dataclasses import replace is imported inside two separate test bodies instead of once at module scope. Minor, but hoisting it to the top-level imports removes the duplication.

Also applies to: 446-446

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_constation_scoring_gate.py` at line 347,
Move the dataclasses.replace import from the two test bodies to the module-level
imports in test_constation_scoring_gate.py, then remove both inline imports
while preserving the existing replace usages in those tests.

---

192-203: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Unused duplicate of _ok_checkers.

_fail_manifest_checkers is byte-identical to _ok_checkers (lines 179-189) and no call site references it in this file. Its name is also misleading — sealed-manifest mismatch in the tests is actually forced by mutating reported_sealed_manifest_hashes on the bundle (see lines 349-352, 448-451), not by this checker set. Consider removing it to avoid confusing future readers.

🧹 Proposed removal

-def _fail_manifest_checkers():
-    def allow(**_k: Any) -> CheckOutcome:
-        return CheckOutcome(ok=True, reason="ok")
-
-    def nonce(**_k: Any) -> CheckOutcome:
-        return CheckOutcome(ok=True, reason="ok")
-
-    def sig(_s: object) -> CheckOutcome:
-        return CheckOutcome(ok=True, reason="ok")
-
-    return allow, nonce, sig
-
-

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_constation_scoring_gate.py` around lines
192 - 203, Remove the unused, duplicate _fail_manifest_checkers helper and its
nested allow, nonce, and sig checkers. Keep _ok_checkers and the existing
sealed-manifest mismatch setup that mutates reported_sealed_manifest_hashes
unchanged.

---

363-658: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Repeated boilerplate across the todo-22/23 async tests.

test_valid_bundle_writes_score_with_attestation_mode, test_no_bundle_writes_no_score_miner_fault, test_manifest_mismatch_miner_fault_no_score, test_infra_fault_constation_unavailable_no_score, test_revoked_digest_no_score, test_breakglass_admits_infra_run_and_writes_score, and test_breakglass_refuses_miner_fault all repeat the same setup: stage train data, monkeypatch DockerExecutor.run, build the app, derive the signer, and seed a submission. Extracting a shared async fixture (e.g. yielding app, signer, db_path) would cut a large amount of duplicated setup and make future test additions cheaper.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_constation_scoring_gate.py` around lines
363 - 658, Extract the repeated setup from the seven async tests into a shared
async pytest fixture, yielding the initialized app, signer, database path, and
seeded submission as appropriate. Update
test_valid_bundle_writes_score_with_attestation_mode,
test_no_bundle_writes_no_score_miner_fault,
test_manifest_mismatch_miner_fault_no_score,
test_infra_fault_constation_unavailable_no_score, test_revoked_digest_no_score,
test_breakglass_admits_infra_run_and_writes_score, and
test_breakglass_refuses_miner_fault to consume the fixture while preserving each
test’s distinct hotkey or submission-specific setup.

packages/challenges/prism/src/prism_challenge/constation_checkers.py (2)

82-83: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Silent exception swallowing hurts observability.

Catching bare Exception and returning only a stringified reason, with no logging, means production transport failures (timeouts, DNS errors, 5xx) leave no trace for on-call debugging — this is especially important given they currently get folded into the same fail-closed bucket as genuine miner rejections (see companion comment in constation.py).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/constation_checkers.py` around
lines 82 - 83, Update the exception handler in the checker method containing the
CheckOutcome return to log the caught transport exception with appropriate
context before returning the fail-closed outcome. Preserve the existing reason
and outcome behavior, while ensuring timeouts, DNS failures, and server errors
are visible to operational logs.

---

73-88: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Reuse a single HTTP client; verify this isn't a blocking call inside an async handler.

Each call to _post_outcome spins up a brand-new httpx.Client (Lines 76-78), so a single constation_ok evaluation opens/tears down up to 3 separate connections instead of reusing one. Store the client (or an httpx.Client/httpx.AsyncClient instance) on self and reuse it across calls, closing it via an explicit close()/context-manager on the BaseHttpConstationClient itself.

Separately: this uses the synchronous httpx.Client, making a blocking network call. Given the context snippet shows ingestion.py calling constation_ok(...) without await, please confirm this code path never runs inside an async def request handler — if it does, these sequential blocking calls (up to timeout_s each) would stall the event loop under load.

♻️ Reuse client across calls

     def __init__(
         self,
         *,
         base_url: str,
         token: str,
         timeout_s: float = 10.0,
         transport: httpx.AsyncBaseTransport | httpx.BaseTransport | None = None,
     ) -> None:
         if not base_url.strip():
             raise ValueError("constation base_url must be non-empty")
         self._base_url = base_url.rstrip("/")
         self._token = token
         self._timeout_s = timeout_s
         self._transport = transport
+        self._client = httpx.Client(timeout=timeout_s, transport=transport)
+
+    def close(self) -> None:
+        self._client.close()
@@
     def _post_outcome(self, path: str, body: dict[str, Any]) -> CheckOutcome:
         url = f"{self._base_url}{path}"
         try:
-            with httpx.Client(
-                timeout=self._timeout_s, transport=self._transport
-            ) as client:
-                response = client.post(url, json=body, headers=self._headers())
-                response.raise_for_status()
-                data = response.json()
+            response = self._client.post(url, json=body, headers=self._headers())
+            response.raise_for_status()
+            data = response.json()
         except Exception as exc:  # noqa: BLE001 - map to checker fail-closed
             return CheckOutcome(ok=False, reason=f"checker_transport_error:{exc}")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/constation_checkers.py` around
lines 73 - 88, Update BaseHttpConstationClient to create and retain one HTTP
client, reuse it in _post_outcome, and close it through the class’s explicit
lifecycle or context-manager API. Inspect the constation_ok call path to verify
synchronous _post_outcome never runs inside an async request handler; if it
does, convert the path to use httpx.AsyncClient and await the network calls.

packages/challenges/prism/src/prism_challenge/config.py (1)

305-307: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider file-based loading for constation_internal_token, consistent with other secrets in this class.

Every other internal-auth secret here (shared_token, docker_broker_token, hf_token) has a companion _file field plus a resolution helper (internal_token(), hf_token_value()) so production can mount the secret instead of passing it via raw env var. constation_internal_token currently has neither, even though it's used the same way (bearer token for BASE's internal constation endpoints).

♻️ Suggested addition mirroring the existing `shared_token_file` pattern

     constation_base_url: str | None = None
     constation_internal_token: str | None = Field(default=None, repr=False)
+    constation_internal_token_file: str | None = Field(default=None, repr=False)
+
+    def resolved_constation_internal_token(self) -> str | None:
+        if self.constation_internal_token:
+            return self.constation_internal_token
+        if self.constation_internal_token_file and Path(self.constation_internal_token_file).exists():
+            return Path(self.constation_internal_token_file).read_text(encoding="utf-8").strip()
+        return None

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/config.py` around lines 305 -
307, Update the configuration class around constation_internal_token to add a
companion file-based secret field and a resolution helper, mirroring the
existing shared_token_file/internal_token and hf_token/hf_token_value patterns.
Ensure callers use the resolved token so mounted-file secrets take precedence or
follow the established precedence behavior, while preserving the current
raw-token fallback.

packages/challenges/prism/src/prism_challenge/ingestion.py (3)

543-551: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Type repository instead of Any.

_reject_no_score only needs submission_status; annotating with the concrete repository type (as used elsewhere in this module) keeps the helper checkable.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/ingestion.py` around lines 543
- 551, Update the repository parameter annotation in _reject_no_score from Any
to the concrete repository type already used elsewhere in this module, while
preserving its existing submission_status usage and behavior.

---

306-319: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

score_written=True on the conflict path is misleading.

This call writes nothing; the flag reads as "this ingest wrote a score". Callers distinguishing "score exists" from "score written now" will get the wrong signal. Consider documenting the intended semantics on the field (or setting False here) so the conflict and idempotent paths are unambiguous.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/ingestion.py` around lines 306
- 319, Update the conflict-path IngestionOutcome construction to set
score_written to False, since this path does not write a score. Preserve the
existing outcome fields and semantics for the idempotent and successful
ingestion paths.

---

489-497: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Dead conditional in the retry-exhausted branch.

This return is only reachable when constation_attempt >= max_constation_attempts, so the ternary's else reason arm can never be taken. Simplify to avoid implying a second behavior.

♻️ Proposed simplification

         return _ConstationGate(
             admit=False,
             constation_ok=False,
-            reason=infra_fault_reason(INFRA_FAULT_RETRY_EXHAUSTED)
-            if constation_attempt >= max_constation_attempts
-            else reason,
+            reason=infra_fault_reason(INFRA_FAULT_RETRY_EXHAUSTED),
             message="infra fault retry budget exhausted; no score",
             retryable=False,
         )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/ingestion.py` around lines 489
- 497, In the retry-exhausted return constructing _ConstationGate, remove the
unreachable conditional around reason and always use
infra_fault_reason(INFRA_FAULT_RETRY_EXHAUSTED) for the reason field. Keep the
existing admission, retryability, message, and other return values unchanged.

packages/challenges/prism/tests/test_constation_ok.py (1)

345-352: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Asserting on docstring prose is brittle.

test_module_docstring_states_sole_elevation_predicate_m14 breaks on innocuous rewording while proving nothing about behavior. The neighbouring test_module_exposes_no_tier_grant_api already enforces the real contract.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/test_constation_ok.py` around lines 345 -
352, Remove the brittle prose-based test function
test_module_docstring_states_sole_elevation_predicate_m14, including its
docstring-content assertions. Retain the neighboring
test_module_exposes_no_tier_grant_api, which already verifies the intended
behavioral contract.

packages/challenges/prism/src/prism_challenge/routes.py (1)

49-53: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Mid-module import for router wiring.

from .attestation_routes import build_attestation_public_router sits below module-level statements. If it isn't there to break an import cycle, move it to the top with the other imports (and add a comment if it is).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/routes.py` around lines 49 -
53, Move the build_attestation_public_router import to the top import section in
routes.py alongside the other module imports, unless it is required to break an
import cycle; if so, retain its position and document that reason with a
comment.

src/base/master/constation/__init__.py (1)

8-19: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Test-app builder exported from the production package surface.

create_constation_test_app imports FastAPI and exists for unit tests; re-exporting it in __all__ puts a test helper on the public API. Consider having tests import it from base.master.constation.routes directly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/master/constation/__init__.py` around lines 8 - 19, Remove
create_constation_test_app from the production package’s __all__ and its
corresponding import in base.master.constation.__init__.py; update tests to
import it directly from base.master.constation.routes while preserving
build_constation_router’s public export.

packages/challenges/prism/src/prism_challenge/attestation_routes.py (1)

101-129: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value

_signed_from_wire indexes required payload keys directly.

pl_raw["nonce"] etc. raise KeyError, which verify_signature catches (→ signature_error:…) but build_constation_router's master-side twin maps to 422. Here the internal verify_attestation route has no guard, so a malformed body yields a 500. Convert missing keys to ValueError for consistent handling.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/attestation_routes.py` around
lines 101 - 129, Update _signed_from_wire to validate all required fields in
pl_raw before constructing AttestationPayload, converting missing nonce, digest,
pod_id, variant, sealed_manifest_hashes, or build_secret_response keys into
ValueError instead of allowing KeyError. Preserve the existing payload parsing
and error message handling for valid input.

packages/challenges/prism/src/prism_challenge/app.py (1)

88-104: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Silent except Exception: pass hides checker wiring failures.

A misconfigured in-process service degrades to the bundle-only path (fail-closed, good) but leaves no trace for operators. Log at warning with the exception.

♻️ Proposed change

-        except Exception:
-            pass
+        except Exception:  # noqa: BLE001 - degrade to fail-closed, but make it visible
+            logger.warning("in-process constation checkers unavailable", exc_info=True)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/src/prism_challenge/app.py` around lines 88 - 104,
Update the exception handler around make_inprocess_checkers in the app setup
flow to log a warning that includes the caught exception, then retain the
existing bundle-only fallback behavior.

packages/challenges/prism/tests/conftest.py (1)

150-167: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff

Autouse patching of a production function is a wide default-on seam.

Every prism test outside prod_constation* modules gets a valid bundle injected unless it happens to pass one of the three sentinel kwargs. A newly added fail-closed test that forgets the marker will silently pass through the seam. An explicit opt-in fixture (used by the legacy tests) would keep the default honest; at minimum, key the opt-out on the marker only, not on kwarg shape.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/challenges/prism/tests/conftest.py` around lines 150 - 167, The
autouse wrapper around ingest_work_unit_result is too broad and can mask
fail-closed tests. Replace the default-on injection behavior with an explicit
opt-in fixture or marker used by the legacy tests; if retaining the wrapper,
gate it solely on that marker rather than checking sentinel kwargs, while
preserving the existing production-module exclusions and bound-name patching.

src/base/master/constation/routes.py (1)

161-168: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated phase-normalization logic.

The random/mid→interval remap and {start,interval,end} validation block is copy-pasted between attestation_challenge and issue_nonce. Extract a small _normalize_phase(phase: str) -> str helper to keep the two code paths in sync.

Also applies to: 189-196

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/master/constation/routes.py` around lines 161 - 168, Extract the
shared random/mid-to-interval remapping and allowed-phase validation from
attestation_challenge and issue_nonce into a _normalize_phase(phase: str) -> str
helper. Replace both duplicated blocks with calls to this helper, preserving the
existing normalized values and HTTPException behavior.

src/base/cli_app/main.py (1)

1154-1158: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Hardcoded nonce TTL instead of a settings-driven value.

DurableAttestationNonceService(session_factory, ttl=timedelta(hours=2)) is a magic constant, unlike the neighboring SqlAlchemyMinerNonceStore(..., ttl_seconds=settings.master.upload_nonce_ttl_seconds) pattern in the same function. Consider adding a settings.master.constation_nonce_ttl_seconds (or similar) so ops can tune it without a code change.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/base/cli_app/main.py` around lines 1154 - 1158, Replace the hardcoded
two-hour TTL in the constation nonce service initialization with a
settings-driven value, adding and wiring an appropriate master configuration
field such as constation_nonce_ttl_seconds and converting it to a timedelta.
Follow the existing settings-based nonce TTL pattern used nearby while
preserving DurableAttestationNonceService behavior.