fix(nuclear-audit): Pass 1 — NoReturn annotation, host default, CHANGELOG, v1.0.1

[cryptoxdog]

Nuclear Audit Pass 1 — Gate_SDK

Audit date: 2026-05-20
Branch: fix/pass1-nuclear-audit
Closes findings: UNREACHABLE-001, SEC-CONFIG-HOST-SDK, SEMVER-001

---

Changes

🔴 UNREACHABLE-001 — raise_http_exception → NoReturn

• runtime/errors.py: Annotated raise_http_exception(exc) -> NoReturn. The function always raises HTTPException — mypy can now prove the call site never returns.
• runtime/app.py: Removed dead return JSONResponse(content={}) sentinel in /v1/execute handler. The sentinel existed only to satisfy mypy; with NoReturn it is both unnecessary and misleading.
• runtime/app.py: Added l9:scanner-fp suppression comment for SEC-SDK-CHASSIS-LEAK (FastAPI factory pattern is intentional SDK design).
• runtime/app.py: Narrowed _key_material_from_config return type from tuple[bytes | str | None, str | None] → tuple[str | None, str | None] (bytes never actually returned).

🟡 SEC-CONFIG-HOST-SDK — Bind address default

• runtime/config.py: host field default changed from "0.0.0.0" → "127.0.0.1".
• get_runtime_config(): HOST env var still respected — containers set HOST=0.0.0.0 explicitly.
• Inline comment documents the security intent.
• Blast radius: All consumer nodes inherit the safe default with zero config change required for local/dev. Container deployments must set HOST=0.0.0.0 (which they should already be doing via env vars).

🟡 SEMVER-001 — Changelog + version bump

• pyproject.toml: version bumped 1.0.0 → 1.0.1.
• CHANGELOG.md: Created at repo root. Documents all changes from this PR and the previous fix/ci-green-main (PR fix: align codebase with new CI gates — green main #7) changes that were merged without a changelog entry.

---

Verification Checklist

• mypy src — raise_http_exception call site in app.py passes without error or sentinel
• ruff check src — no new violations
• pytest — existing test suite green (no test changes in this PR)
• host default confirmed 127.0.0.1 in NodeRuntimeConfig
• CHANGELOG.md present at repo root
• pyproject.toml version = 1.0.1

---

Post-Merge

After merge: tag v1.0.1 and proceed to Pass 2 — update Gate node SDK pin to 1.0.1 and merge Gate's open PR.

Summary by CodeRabbit

• New Releases

  • Version 1.0.1 released with multiple improvements and security enhancements.

• Bug Fixes

  • Fixed runtime typing, handler control flow, observability imports, and security error handling.
  • Improved configuration validation and error messages.

• Security

  • Default host binding changed to loopback (127.0.0.1). Container deployments must explicitly set HOST=0.0.0.0.

• Documentation

  • Updated CHANGELOG with 1.0.1 release details and previous 1.0.0 release notes.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: c8afd6c5-dabb-4e64-aad0-0c9ff571ed3c

📥 Commits

Reviewing files that changed from the base of the PR and between ab9df5f and 86c09e4.

📒 Files selected for processing (5)

• CHANGELOG.md
• pyproject.toml
• src/constellation_node_sdk/runtime/app.py
• src/constellation_node_sdk/runtime/config.py
• src/constellation_node_sdk/runtime/errors.py

---

📝 Walkthrough

Walkthrough

This patch release v1.0.1 hardens the SDK with a security-focused host binding default, adds explicit type annotations for better type safety, and includes various validation and documentation improvements. The key change is defaulting to loopback (127.0.0.1) instead of all interfaces for safer default deployment behavior.

Changes

v1.0.1 Release with Type Safety & Security

Layer / File(s)	Summary
Config Security Default src/constellation_node_sdk/runtime/config.py	NodeRuntimeConfig.host defaults to 127.0.0.1 (loopback) instead of 0.0.0.0 (all interfaces), with documentation that containers must explicitly set HOST=0.0.0.0 to bind publicly.
Runtime Type Annotations src/constellation_node_sdk/runtime/errors.py, src/constellation_node_sdk/runtime/app.py	Added NoReturn import and annotation for raise_http_exception, updated route handlers to return Response and JSONResponse, lifespan context manager to return AsyncGenerator[None, None], and _key_material_from_config to return str | None.
Handler Call Formatting src/constellation_node_sdk/runtime/app.py	Multi-line reformatting of execute_transport_packet and create_error_transport_packet calls with structured argument alignment; conditional signing_key vs signing_private_key logic preserved.
Config Validation & Type Cleanup src/constellation_node_sdk/runtime/config.py	Error messages reformatted to multi-line f-strings, validate_security_profile return type changed from quoted forward reference to direct type, validate_string_tuples type annotation adjusted, and allowed_packet_types fallback expression reformatted.
Release Metadata & Dependencies CHANGELOG.md, pyproject.toml	Version bumped to 1.0.1, release notes document fixes across typing, config defaults, imports, and test expectations; types-PyYAML added as dev dependency; runtime dependencies and tool configuration (ruff, mypy) updated for stricter validation.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 A safer bind, a type so clear,
No more 0.0.0.0 to bring us fear!
With NoReturn paths and Response flows,
The handlers speak what every coder knows—
Type safety blooms in v1.0.1's spring! 🌱

---

Note

🎁 Summarized by CodeRabbit Free

Your organization has reached its limit of developer seats under the Pro Plan. For new users, CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please add seats to your subscription by visiting https://app.coderabbit.ai/login.If you believe this is a mistake and have available seats, please assign one to the pull request author through the subscription management page using the link above.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request updates the SDK to version 1.0.1, primarily focusing on security by changing the default host to 127.0.0.1 and improving type safety with refined annotations and the use of NoReturn. Review feedback identifies a critical syntax error in a return type annotation within config.py and an invalid build backend specification in pyproject.toml. Additionally, the removal of the py.typed file should be reverted to ensure the package remains PEP 561 compliant for type checkers, and the linting configuration regarding line length should be clarified.

I am having trouble creating individual review comments. Click here to see my feedback.

src/constellation_node_sdk/runtime/config.py (121)

There is a syntax error in the return type annotation. It appears to have been duplicated with an extra closing parenthesis, which will prevent the code from parsing correctly.

    def validate_string_tuples(cls, value: tuple[str, ...]) -> tuple[str, ...]:

pyproject.toml (3)

The build backend setuptools.backends.legacy:build is not a standard setuptools entry point. The recommended PEP 517 compliant backend for modern setuptools is setuptools.build_meta. Using an invalid backend will cause build failures.

build-backend = "setuptools.build_meta"

pyproject.toml (40-41)

Removing py.typed from package-data prevents PEP 561 compliant type checkers (like mypy) from recognizing the package as type-hinted when it is installed as a dependency. This file is essential for distributing type information to SDK consumers.

pyproject.toml (44-45)

Ignoring E501 (line too long) while explicitly setting a line-length of 100 is contradictory. It is better to keep this check enabled to ensure code remains readable and consistent, as the Ruff formatter will handle wrapping within the specified limit.

select = ["E", "F", "B", "I", "UP"]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 86c09e46c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud