1 line
3.3 KiB
Plaintext
1 line
3.3 KiB
Plaintext
Project Sentinel: Python Language ProfileVersion: 3.0.0-EnterpriseModule: 27-Lang-PythonMaps to: examples/python/Scope: Active enforcement of PEP8, Type Hinting, Virtual Environment isolation, and Jupyter Notebook safety.1. The Python Environment AdapterPython's environment management is a frequent source of Agent failure. Sentinel enforces a strict "VirtualEnv Only" policy.1.1 The Virtual Environment LockRule: Never install packages globally (pip install without venv).Enforcement:Sentinel checks sys.prefix != sys.base_prefix.If Agent attempts pip install outside a venv:Action: BLOCKED.Message: "Environment Violation: Active venv not detected. Use poetry add or pipenv install."1.2 Dependency PinningRule: requirements.txt must have pinned versions (==).Enforcement:Sentinel scans requirements.txt commits.Regex: ^[a-zA-Z0-9\-_]+$ (Unpinned).Action: Reject. Suggest: "Run pip freeze to get pinned versions."2. Static Analysis & TypingSentinel enforces modern Python (3.10+) standards.2.1 Mandatory Type Hints (mypy)Rule: All function signatures must be typed.Enforcement:Sentinel runs mypy --strict.Check: def process_data(data): -> FAIL.Check: def process_data(data: Dict[str, Any]) -> bool: -> PASS.Action: Code without type hints is rejected from main branch.2.2 PEP8 / Black FormattingWorkflow:Agent writes code.Sentinel automatically runs black formatter on the buffer.Sentinel runs ruff (linter).If ruff finds logical errors (e.g., F841 unused variable), Sentinel blocks the write.3. Data Science Guardrails (Jupyter)Agents often use Notebooks for data analysis. This is a high-risk vector for PII leaks.3.1 The Output ScrubberThreat: Agent prints a DataFrame containing Customer Emails.Enforcement:Sentinel intercepts the .ipynb save operation.It parses the JSON structure of the notebook.Scan: It scans the outputs cells for PII patterns (Regex).Action: If PII found, it clears the output cell before saving to disk.Message: "Sanitized Notebook: Cleared output cells containing PII."3.2 Cell Execution OrderRule: Notebooks must be reproducible (Linear Execution).Enforcement:Sentinel checks the execution_count metadata.If they are out of order (e.g., Cell 10, then Cell 5), Sentinel warns: "Notebook is non-linear. Run 'Restart Kernel and Run All' before committing."4. Security & Serialization4.1 Pickle PreventionThreat: pickle is insecure and allows arbitrary code execution.Enforcement:Sentinel scans for import pickle or cPickle.Action: BLOCKED.Message: "Security Violation: pickle is banned. Use json, msgpack, or joblib (safe mode)."4.2 SQL Injection Guard (f-strings)Threat: query = f"SELECT * FROM users WHERE name = '{name}'"Enforcement:Sentinel scans SQL execution calls.If it detects an f-string or .format() inside cursor.execute():Action: BLOCKED.Message: "SQL Injection Risk: Use parameterized queries (e.g., execute(query, (name,)))."5. Testing (Pytest)5.1 Conftest ManagementRule: Fixtures should be scoped appropriately.Enforcement:Sentinel analyzes conftest.py.If a fixture with scope="session" modifies a database:Warning: "Session-scoped DB fixture detected. Ensure DB cleanup runs at end of session."5.2 Async TestingRule: Use pytest-asyncio correctly.Enforcement:Sentinel checks for async def test_... without the @pytest.mark.asyncio marker (unless strict mode configured).Auto-Fix: Sentinel can auto-inject the marker. |