From 05dda8d2764f60890e629609bc67c3e722ccd494 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 24 Aug 2026 23:34:34 +0200 Subject: [PATCH] fix(classification): allow the allowed-values path to be configured _allowed_path() tried three developer workstation checkouts and nothing else, so in a container none exist and every classification write fails with a 500. That is why repo classification could only ever be written from a workstation. Adds REPO_CLASSIFICATION_ALLOWED_PATH, checked first, and names it in the error when no candidate is found. Refs CUST-WP-0067-T04 Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 --- api/classification.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/api/classification.py b/api/classification.py index a2955bb..43aef85 100644 --- a/api/classification.py +++ b/api/classification.py @@ -9,8 +9,16 @@ import re from dataclasses import dataclass, field from pathlib import Path +import os + import yaml +# Explicit override first — every other candidate below is a developer +# workstation path, so in a container none of them exist and classification +# validation fails outright. Set REPO_CLASSIFICATION_ALLOWED_PATH in any +# deployment that does not carry a the-custodian checkout (CUST-WP-0067-T04). +_ENV_ALLOWED = os.environ.get("REPO_CLASSIFICATION_ALLOWED_PATH") + # Workstation checkout, railiance01 fleet checkout, then state-hub sibling fallback. _PRIMARY_ALLOWED = Path( "/home/worsch/the-custodian/canon/standards/repo-classification.allowed.yaml" @@ -70,12 +78,21 @@ class ClassificationData: def _allowed_path() -> Path: + if _ENV_ALLOWED: + candidate = Path(_ENV_ALLOWED) + if candidate.is_file(): + return candidate + raise FileNotFoundError( + f"REPO_CLASSIFICATION_ALLOWED_PATH is set to {candidate}, which is not a file" + ) for candidate in (_PRIMARY_ALLOWED, _RAILIANCE_ALLOWED, _FALLBACK_ALLOWED): if candidate.is_file(): return candidate raise FileNotFoundError( "repo-classification.allowed.yaml not found at " - f"{_PRIMARY_ALLOWED}, {_RAILIANCE_ALLOWED}, or {_FALLBACK_ALLOWED}" + f"{_PRIMARY_ALLOWED}, {_RAILIANCE_ALLOWED}, or {_FALLBACK_ALLOWED}. " + "Set REPO_CLASSIFICATION_ALLOWED_PATH when running without a " + "the-custodian checkout (for example in a container)." )