Skip to content

OSS readiness: reddit-consensus render bug, ruff + packaging/license hygiene, docs, fresh-history release tooling#10

Open
m0ntydad0n wants to merge 7 commits into
mainfrom
chore/oss-readiness-fixes
Open

OSS readiness: reddit-consensus render bug, ruff + packaging/license hygiene, docs, fresh-history release tooling#10
m0ntydad0n wants to merge 7 commits into
mainfrom
chore/oss-readiness-fixes

Conversation

@m0ntydad0n

@m0ntydad0n m0ntydad0n commented Jun 9, 2026

Copy link
Copy Markdown
Owner

Outcome of an end-to-end open-source-readiness review, plus the follow-ups it surfaced. The engine itself is strong (clean install, full suite green, real safety design); this PR fixes what blocks a confident public v0.1.0. Per the owner's decision, the Cloudflare/Turnstile challenge-resolution feature is intentionally kept — its config gates are genuine, and the NOTICE/README changes make keeping it defensible.

CI: green on Python 3.10 / 3.11 / 3.12 / 3.13 / 3.14, all extras. Full suite locally: 688 passed, 0 failed.

Round 1 — readiness fixes

  • fix: reddit-consensus render bug (schema+prompt but no renderer → could generate, never publish). Added the renderer + a SCHEMA_REGISTRY == _RENDER_REGISTRY parity test. Lazy anthropic imports.
  • chore: adopted ruff + cleared the 43-finding baseline (caught & fixed an autofix that removed a used import pytest); requirements.txt fix; .dockerignore secret exclusions; NOTICE (Camoufox/Firefox MPL-2.0) + README/CONTRIBUTING.
  • docs: restored the deleted quickstart (+ guard test, verified vs current CLI) and added docs/ARCHITECTURE.md.
  • chore: removed docs/plans/ (private-data leak) and added scripts/prepare_public_release.sh (fresh-history release tool; run end-to-end, scans clean).

Round 2 — deferred follow-ups (now addressed)

  • fix: stop_on was decorative — wired it so the browser collectors halt on configured states (with halt tests for both); removed two dead spoofed _UA constants. auto_unpublish was dead config — surfaced it in the post-publish report (the gate a downstream workflow checks) + test.
  • chore: honest User-Agent across all 12 plain-HTTP collectors (was spoofing desktop Chrome, contradicting the project's own guidelines); updated the guidelines' current-status note.
  • chore: made anthropic optional (moved to the llm extra; core-only install verified). This surfaced a latent bug — pydantic was only present transitively via anthropic; now declared as an explicit core dependency. Broadened CI to Python 3.13/3.14 and the llm/mcp/analytics extras.

Not in this PR (by design)

  • The actual public release. History still contains prior-client material, so do not flip this repo public — run scripts/prepare_public_release.sh and push the materialized tree to a new repo (OPEN_SOURCE_RELEASE_CHECKLIST.md §1).

🤖 Generated with Claude Code

reddit-consensus had a schema, prompt template, and generation path but no
entry in render._RENDER_REGISTRY, so a draft on that template could be
generated yet never rendered or published (render_article raised
"Unsupported template"). Add _render_reddit_consensus and a
SCHEMA_REGISTRY<->_RENDER_REGISTRY parity test so the gap cannot recur.

Move `import anthropic` in enrich.py and image_planner.py into the functions
that use it (matching generate.py's lazy litellm import) so importing these
modules no longer requires the Anthropic SDK at module-load time. Update the
image_planner tests to patch anthropic.Anthropic at its source.
Add a [tool.ruff] config (select = ["F"], __init__ re-exports ignored) and
ruff to the dev extra; clear the resulting baseline of 43 pyflakes findings
(unused imports/vars, an empty f-string). One ruff autofix wrongly removed a
used `import pytest` from test_init.py (caught by ruff's own F821 and the test
suite) and is restored as a single top-level import.

requirements.txt: drop the heavy playwright/camoufox browser deps and pytest,
add litellm, so the non-editable install path is a minimal core+generation set
(browser collection stays opt-in via the extra).

.dockerignore: exclude .env*, keys, and service-account/credentials JSON so a
build context never copies real secrets into an image.

NOTICE: document the Camoufox/Firefox MPL-2.0 attribution and trademark caveat
the browser extra pulls in; reference it from README + the browser-extra line.
CONTRIBUTING: add the ruff lint step to the PR checklist.
Restore docs/QUICKSTART_CONTENT_CREATION.md and its guard test (dropped in the
sync-engine pass). Verified every command, flag, review subcommand, and
data/<slug> output path against current main; quoted the editable-install
extras for zsh.

Add docs/ARCHITECTURE.md: a stage->module map (configure -> discover -> generate
-> review -> publish -> schedule -> monitor, plus the GEO, eval, sources, and
browser subsystems), the data/<slug> layout, the schema<->renderer parity rule,
and the safety/review-gating model. Link both from the README Quick start.
docs/plans/ held internal AI-agent implementation plans that leaked private
data into the public tree — other live properties (golfbuyerslab, nesteggnumbers),
a third party's handle, and "For Claude:" agent directives — violating the
repo's own no-private-data promise. Remove all 6.

Add scripts/prepare_public_release.sh: builds the required fresh-history release
tree (tracked HEAD only, no .git history) after scanning for secrets, machine-
local paths, tracked runtime artifacts, and an optional gitignored maintainer
denylist (.release-denylist; see .release-denylist.example). The script hardcodes
no client names so it cannot republish them. Per OPEN_SOURCE_RELEASE_CHECKLIST.md
sec. 1 the existing private repo must not be flipped public; publish the
materialized tree as a new repository.
stop_on was parsed and tested as config but never read as control flow — the
browser collectors hardcoded "skip any non-ok page" and kept crawling. Now
browser_page/browser_site consult bcfg.stop_on: a state on the list halts
collection (the documented behavior); other non-ok states still skip-and-continue.
Add halt tests for both. Also remove the dead spoofed _UA constant from both
(browser collection uses the real Camoufox browser, not a requests UA).

auto_unpublish was likewise dead config. Surface it in the post-publish report
so a downstream publisher workflow can gate auto-removal on it; default False
keeps unpublish_candidate advisory-only. Add a test.
The plain-HTTP collectors sent a spoofed desktop-Chrome User-Agent, contradicting
docs/SCRAPING_GUIDELINES.md ("plain HTTP collectors should not masquerade as
Chrome"). Replace it with an honest identifying UA across all 12 collectors
(pseo-engine/0.1 + repo URL). Undocumented first-party endpoints (instagram,
tiktok, twitter/x, reddit_expanded, ...) may now refuse a non-browser UA — the
expected, honest outcome; they remain opt-in. Update the guidelines' current-
status note to match.
Move anthropic from core dependencies into the `llm` extra (it is used only by
enrich/image_planner, both lazy-imported), so a Gemini/OpenAI-only user no longer
installs the Anthropic SDK. Guard test_image_planner's plan_images tests with
skipif when anthropic is absent.

Declare pydantic>=2.0 as an explicit core dependency: it backs the schema and
guardrail layer and was previously satisfied only transitively via anthropic.
Removing anthropic from core surfaced the gap (21 collection errors in a
core-only install). Verified a clean `.[dev]` install (no anthropic) now
collects and passes with optional-dep skips only.

CI: add Python 3.13 and 3.14 to the matrix (the README advertises 3.14) and
install the llm/mcp/analytics extras so those paths are exercised too.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant