Enable ruff exception rules (TRY, EM, BLE)

[anth-volk]

Fixes #782

Same-Repository Draft PR Check

• This PR is a draft.
• This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Summary

Phase 1 step 1.8, group 5: exceptions and messages. Stacked on #779.

• Rules: ruff.toml gains TRY, EM and BLE. All 1,029 findings at the base are fixed, one commit per project: executor 522, contract 226, Stage 12 persistence 102, entry 70, gateway 52, repo scripts 28, integration tests 12, fastapi 11, observability 6.
• Messages (EM and TRY003): ruff's fix builds each message in a variable before the raise (520 places). A script put every message back inline: all 74 files reproduce the base's syntax tree exactly, so the message text is unchanged. No tracked Python file used msg before.
  • Error codes renamed: where the first argument of SPMInputError or ParityMismatch is an error code, the hoisted variable is named error_code, not msg (46 places).
• Raises inside try blocks (TRY301 9, TRY300 4): each raise moves into a small private helper, or the return moves into an else:. Each handler still receives the same exceptions: for example, contract spm.py still wraps the helpers' ValueError in the same SPMInputError.
• Exception types (TRY004 10):
  • Changed (2): src/modal/utils/qualify_stage12_parity.py raises TypeError for its two type checks. It's an operator command-line tool that nothing calls or catches.
  • Kept (8), each with a reason: a caller catches the current type, the error crosses a Modal boundary, telemetry records the type name, or a test asserts it. None are in Pydantic validators.
• Broad except Exception catches (BLE001 13): none narrowed, all kept with an inline reason. Telemetry must never fail a request or a Modal call; a worker failure must become a failed-job or failed-batch response; and a token decode failure must become a 403, never a 500. Ruff accepts only a traceback-logging call instead, which would raise log levels.
  • Older suppressions: seven noqa: BLE001 comments, inert until now, had no reason or used the - reason style. They now carry a reason in the standard # reason form.
• Error logs (TRY400 9):
  • Gains a traceback (1): the gateway's auth misconfiguration log, with the same message.
  • Same output (1): observability's error log uses logger.exception and still logs the original exception's traceback.
  • Kept traceback-free (7), with a reason:
    • Four Stage 12 logs record only the error type, so request and calculation data can't leak.
    • One timeout log is fully described by its timeout_seconds field.
    • Two bad-token logs in the JWT decoder: callers control the token, so a traceback per bad token would let them flood the logs.
• TRY201 (1): raise err becomes a bare raise in the JWT decoder.
• Modal images: files in both the executor and gateway images change. _image_setup.py:fetch_artifacts is a build step and only its messages moved, but expect that layer and the snapshot layer after it to rebuild on the next deploy.
• Registry: sim.quality.ruff-lint now lists BLE, EM and TRY. The shared rules tool needed no changes and is still byte-identical with the Public API (tool sha256 db83d5ad2aa4). The Public API's group 5 is Enable ruff exception rules (TRY, EM, BLE) policyengine-api#3913.

Testing

• All seven projects' test suites pass at this branch's tip, with the same counts as the base:

  Project	Passed
  fastapi	14
  contract	145
  observability	30
  stage12	12
  entry	224
  gateway	214
  executor	743

  The executor count includes the 10 stacked-PR gate tests from Make CI enforcement trustworthy before the rules registry #754 and Add a rules registry that makes every enforced and unenforced rule visible #752.

• The gateway golden OpenAPI test passes, and the golden file is unchanged.

• ruff check (0.15.22) is clean repo-wide, and ruff format --check is unchanged.

• The rules guard, the ci-scripts guard and the rules tool unittest pass.

• The integration tests and authenticated_tests need live services, so they were only byte-compiled.

• CI: this PR is above the bottom of its stack, so it runs only CI complete, which fails and says why (step 0.7, Make CI enforcement trustworthy before the rules registry #754). Its full run starts once the PRs below it merge.

🤖 Generated with Claude Code