Repository navigation
Harden template with app factory, typed boundaries and stricter gates - #206
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d3bbad182
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@codex review Note From claude-opus-5-5 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41dd8887d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Note From claude-opus-5-5 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5061ef498c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Note From claude-opus-5-5 |
|
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
What changes
Turns the template into a base that is safe to build on: the type system describes every boundary, the app is built from explicit settings instead of import-time singletons, and the gates fail on the mistakes they previously let through.
Architecture
create_app(settings)and a lifespan that owns the engine, session factory and token validator. Importingapp.mainhas no side effects. Uvicorn runs the factory.Settingsroot; module-level settings instances,global, and the session-maker proxy are removed.AuthClaimsreturned by authentication,require_role("entities:write")on write routes, the role added to both Keycloak realm exports.ProblemDetailsmodel for every error, declared per route in OpenAPI asapplication/problem+json.OperationalErrormaps to 503.Repository, predicate-basedfind_by, typedOrdering. Service depends on anEntityStoreprotocol./health/readyrunningSELECT 1; container health checks in the Dockerfile and Compose.Telemetry
auto_configureoff and health probes excluded, so it stays dormant and cannot add a second exporter.OIDC_JWKS_REFRESH_COOLDOWN_SECONDS; the cache TTL must be positive.Gates
ruff format --check,ty --error-on-warning,ANNfor tests, typos, and an AST test forbiddinggetattr/setattr/hasattr/cast/Anyinapp/.alembic checkplus downgrade round trip, coverage floor of 90% inpyproject.toml.pytest-randomly,pytest-timeout, warnings as errors, Hypothesis on parsing boundaries, weekly mutation testing.make check, pre-commit hooks,AGENTS.md,CONTRIBUTING.md,LICENSE,CODEOWNERS, PR template.Behaviour changes for API clients
PUT /entities/{id}replaces the whole resource; omittingdescriptionclears it.entities:writerealm role; reads need only a valid token.Gates
make checkis greenmake test-integrationis greentests/contract/openapi.jsonis updated and the diff is intended.docker/Full suite: 212 passed, coverage 96.3%.
Notes for the reviewer
The Lambda Web Adapter readiness path still points at
/health; moving it to/health/readywould make cold starts fail while the database is unreachable, so it is left as a separate decision.Note
From claude-opus-5-5