Repository navigation
CodeQL quality follow-ups in trading paths: S16 catch-base-exception, S10-S12 hygiene #473
Description
Handoff from the foundation integrity wave (plan move M4, CodeQL quality suites). No trading file was changed by the foundation lane; your lane picks the fix and runs its own suite.
Source: the CodeQL CLI 2.27.1 code-quality measurement in #450 (d58526a), triage table in docs/decisions/2026-09-27-codeql-quality-suites.md L119-133. Default setup was kept, so these findings are not raised as alerts.
S16, reliability (real). blueprints/us-equities/engine-nautilus/spy-parity/distribution_module.py:165 catches BaseException inside process(), records it and returns None, so KeyboardInterrupt and SystemExit are swallowed. CodeQL's query help for py/catch-base-exception (https://codeql.github.com/codeql-query-help/python/py-catch-base-exception/) says to handle Exception separately from KeyboardInterrupt and SystemExit. One form that keeps the evidence the comment asks for: append the error, then re-raise when isinstance(error, (KeyboardInterrupt, SystemExit)).
Hygiene (real, low priority).
- S10
py/import-and-import-from:tests/test_adaptive_paper_runner.py:4469 - S11
py/repeated-import:tests/test_adaptive_paper_runner.py:3448 - S12
py/unused-local-variable:tests/test_adaptive_paper_selector.py:265
Not included: S08 and S09 sit in retained gap-wave2 evidence blueprints (hash-registered), which stay unedited.
Coming later (acknowledgement needed). observability/grand-dashboard/state.json is a shared hot file (docs/lanes.md L26), so the dashboard refresh after the actionlint gate swap will be a lane:shared PR and needs a trading-lane acknowledgement as a comment on that PR (docs/lanes.md L146-149). It changes only foundation gate rows.
Activity
seathatflowsinourveins commentedon Sep 29, 2026
Resolution, checked at main
cf3fb72eon 2026-09-28: no in-place fix. Fold these into the next revision of the pinned files.Each file is sha-pinned by sealed trading evidence:
blueprints/us-equities/engine-nautilus/spy-parity/distribution_module.py(sha256eefee070b0dbe6ad…). It is recorded inspy-parity/receipt-v2.jsonlocal_source_sha256, indeviation-acceptance-v2.json,replay-history-v2.jsonandreview-record-v2-cc4503f.json, and in the frozenSHA256SUMSof five adaptive-paper trials andibkr-paper-orders.tests/test_spy_parity.pyL753-754 treats that pin as required (local_source_not_recorded). Editing the module in place would make those records describe code that no longer exists.tests/test_adaptive_paper_runner.py(29c4c48a…) andtests/test_adaptive_paper_selector.py(27b431ac…). Both are pinned inblueprints/us-equities/adaptive-paper/source-hashes.json, whichrunner.pyL174-204 checks at run time andscripts/trading_gates.pyL217 uses as the gate manifest. The selector test is also inadaptive-paper/receipt.json. A hygiene-only edit would force a regeneration of the live paper engine's pinned source set.Where each fix belongs:
py/catch-base-exception, reliability): in the next spy-parity revision (v3), with a fresh native parity run and new receipts. The code comment's intent can be kept: record the error, then re-raiseKeyboardInterruptandSystemExit.source-hashes.json.Owner: the trading lane holder (
ecosystem-roadmap-2026since about 00:45Z on 2026-09-29), with no date. The foundation lane made no change here.