From d8b13afc59d1bfa998b278363915627a0887a737 Mon Sep 17 00:00:00 2001 From: 1445043649 <> Date: Thu, 14 May 2026 13:54:31 +0800 Subject: [PATCH] =?UTF-8?q?docs(backend):=20PR7=20T7.5=20=E2=80=94=20docum?= =?UTF-8?q?ent=20workspace=20boundary=20scan=20in=20CLAUDE.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extends the existing "Boundary check" section with two new entries: - tests/test_workspace_boundary.py — AST static scan for direct imports of langgraph.checkpoint.* (and the third-party postgres/sqlite packages) outside tests/boundary_allowlist.toml. Notes the TYPE_CHECKING exemption and points readers to `app.gateway.deps.get_checkpointer` as the intended path; documents the "append to allowlist in the same PR" contract for new legitimate importers. - tests/test_workspace_boundary_self.py — self-tests guarding the scanner from silent-empty regressions. Co-Authored-By: Claude Opus 4.7 (1M context) --- backend/CLAUDE.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/CLAUDE.md b/backend/CLAUDE.md index 080c61ca..15a324fd 100644 --- a/backend/CLAUDE.md +++ b/backend/CLAUDE.md @@ -102,6 +102,8 @@ Regression tests related to Docker/provisioner behavior: Boundary check (harness → app import firewall): - `tests/test_harness_boundary.py` — ensures `packages/harness/deerflow/` never imports from `app.*` +- `tests/test_workspace_boundary.py` — AST static scan that forbids direct imports of `langgraph.checkpoint.*` (and the third-party `langgraph_checkpoint_postgres` / `langgraph_checkpoint_sqlite` packages) outside the allowlist in `tests/boundary_allowlist.toml`. Everywhere else must obtain a checkpointer via `app.gateway.deps.get_checkpointer` or the harness `deerflow.runtime.checkpointer` factory. Imports inside `if TYPE_CHECKING:` blocks are exempt automatically (they do not enter runtime). When a legitimate new importer is genuinely needed, append its path to `boundary_allowlist.toml` in the same PR +- `tests/test_workspace_boundary_self.py` — self-tests for the scanner above (9 cases over synthetic `.py` files) guarding against silent-empty regressions CI runs these regression tests for every pull request via [.github/workflows/backend-unit-tests.yml](../.github/workflows/backend-unit-tests.yml).