T-2THY-deny-state-path-bypass
State: planning/proposed · Impact: low · Complexity: medium
Turn the fleet-bypass guard from a warning into an error once every internal app is migrated. The
template copies the deny config in T-GQ9Y.
For Rust this changes only local runs: CI clippy already runs with -D warnings, so the warn level
fails CI today. The oxlint flip is the part that changes CI.
| Location | Role today |
|---|---|
Root clippy.toml, [workspace.lints.clippy] | disallowed_methods = "warn" once T-1KOY lands |
solutions/determined/crates/determined-platform/clippy.toml | Repeats the banned list |
.oxlintrc.json | no-restricted-imports and no-restricted-properties at warn |
| TS hits outside every app | 18, none in an app this task depends on: packages/ts/detect-runners/src/{cache,config,config-command,trust-command,clean-command,cli}.ts, packages/ts/cli-tool/{trust/store.ts,devlink/ops.ts,config/tests/paths.test.ts}, packages/ts/waypost/src/{cli,serve}.ts, packages/ts/repo-cleaner/{resolve.ts,tests/config.test.ts}, scripts/{sdlc-install,install-desktop-apps}.ts, solutions/determined/packages/photo-annotator/src/machine.ts, apps/ontological-legacy/.claude/hooks/*.js |
apps/ontological-legacy | Its own Cargo workspace, so the root [workspace.lints] does not reach it |
Proposed
Section titled “Proposed”disallowed_methods = "deny" in the workspace lints and the oxlint rule at error.
Approach
Section titled “Approach”- Fix or annotate the 18 TS hits above. Real state that bypasses fleet (the
detect-runnerscache, thecli-tooltrust store) moves to fleet; a~/.claudeor content path gets anoxlint-disable-next-linewith a reason. - Confirm clippy and oxlint report zero unannotated hits.
- Flip both levels.
| Area | Note |
|---|---|
Cargo.toml, .oxlintrc.json | Levels |
Acceptance criteria
Section titled “Acceptance criteria”- AC-1: A new
dirs::data_dir()call outside fleet failscargo clippy. - AC-2: A new
os.homedir()call outsidepackages/ts/fleetfails oxlint.
Out of scope
Section titled “Out of scope”- Hits inside the apps; the phase-2 tasks migrate those.
apps/ontological-legacy’s own lint table; the app is superseded.- The template’s lint config (
T-GQ9Y).
Dependencies
Section titled “Dependencies”T-1KOYfor the guard.- Every internal app migration:
T-GXNH,T-UU4J,T-AAR2,T-KOTJ,T-JPFC,T-TLET. T-LJLH, which gates phase 4 of the milestone.
Discovery context
Section titled “Discovery context”- Starting at warn lets the guard land before every app is migrated.
Depends on
Section titled “Depends on”T-1KOY, T-GXNH, T-UU4J, T-AAR2, T-KOTJ, T-JPFC, T-TLET, T-LJLH