tatlock/.pql/changelog/tickets/2026-08.sql

INSERT INTO tickets (record_id, type, parent_record_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('06FZ44Z6HSN0RQS0QAYNTPEM5G', 'task', NULL, 'Type the codebase: 95 mypy errors across 31 files', NULL, 'backlog', 'high', NULL, NULL, NULL, '2026-08-11 18:26:58.318', '2026-08-11 18:26:58.318', NULL, 'd881f36d77e58aaa2f94dc08c5b5be3e', 2) ON CONFLICT(record_id) DO UPDATE SET type=excluded.type, parent_record_id=excluded.parent_record_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at >= tickets.updated_at;
INSERT INTO tickets (record_id, type, parent_record_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('06FZ44Z6HSN0RQS0QAYNTPEM5G', 'task', NULL, 'Type the codebase: 95 mypy errors across 31 files', '`make typecheck` reports 95 errors in 31 files (was 103). This is a dedicated programming pass, not lint tidying, and it is what currently blocks `make pre-push`.

MEASURED 2026-08-11 so the next session does not re-derive it:

  29 no-untyped-def   functions with no annotations — the bulk, and genuine per-function work
  18 no-any-return    mostly downstream of the above
  12 assignment
  11 arg-type
   5 unused-ignore    `# type: ignore` comments mypy says are no longer needed
   5 union-attr
   4 var-annotated
   3 override
   remainder: misc, dict-item, attr-defined, return-value, call-overload

By file: agents/tatlock.py 15, core/memory_service.py 11, responses/streaming.py 8, responses/service.py 7, core/context.py 6.

THE TWO SHARED ROOTS ARE ALREADY FIXED (dac259a), so what is left has no lever in it. For reference, they were: five conversation lists declared bare, where mypy infers the element type from the first append (a ModelRequest) and then rejects every ModelResponse; and an agent built as Agent(model, system_prompt=...) with no deps_type, inferred Agent[None, str], while every tool it registers takes RunContext[ToolCallTracker].

WORTH KNOWING BEFORE STARTING. Annotating partially made mypy count go UP before it went down — declaring `_agent: Agent | None` took agents/tatlock.py from 22 to 24, because resolving the bare Agent to Agent[None, str] surfaced four argument-type errors the Any had been hiding. Expect that shape: a rising count during this work usually means concealment ending, not damage.

The mypy config is strict — disallow_untyped_defs, disallow_incomplete_defs, warn_return_any, check_untyped_defs, strict_equality — so there is no partial-credit setting to lean on, and weakening it would be the wrong trade for a codebase this central.

TWO PRE-EXISTING TEST FACTS, both confirmed at HEAD and neither caused by the lint work:
  - test_tatlock_tool_call_logging_calculator is flaky: failed 2 of 5 full runs, on HEAD and on the lint branch, and fails in isolation at HEAD while passing in isolation after the lint pass. Order- or timing-dependent.
  - `pytest tests/` cannot collect at all: tests/e2e/test_orchestration_e2e.py uses an `e2e` marker that is not registered and the config is strict about markers. `make test` passes only because it ignores tests/e2e, tests/integration and tests/contracts.', 'backlog', 'high', NULL, NULL, NULL, '2026-08-11 18:26:58.318', '2026-08-11 18:26:58.523', NULL, 'fc047dd080d976c4ca0c551cac8fec93', 2) ON CONFLICT(record_id) DO UPDATE SET type=excluded.type, parent_record_id=excluded.parent_record_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at >= tickets.updated_at;
INSERT INTO tickets (record_id, type, parent_record_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('06FZ4JX9DZB3XAB95EP23YWXMC', 'bug', NULL, 'A revoked ANTHROPIC_API_KEY is still sitting in .env', NULL, 'backlog', 'medium', NULL, NULL, NULL, '2026-08-11 19:27:52.687', '2026-08-11 19:27:52.687', NULL, '3b00a4b729819e20a6425f971e6cb9da', 2) ON CONFLICT(record_id) DO UPDATE SET type=excluded.type, parent_record_id=excluded.parent_record_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at >= tickets.updated_at;
INSERT INTO tickets (record_id, type, parent_record_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('06FZ4JX9DZB3XAB95EP23YWXMC', 'bug', NULL, 'A revoked ANTHROPIC_API_KEY is still sitting in .env', '`.env` still carries an `ANTHROPIC_API_KEY`. That key was revoked and no longer exists on Anthropic''s side, so this is dead weight rather than an exposure — but it is dead weight that reads exactly like a live credential to anyone who finds it.

The cost is confusion, not risk. Someone debugging a Claude fallback will find a key present, assume it is configured, and look elsewhere for the failure. The absence of a key is a clear signal; a revoked key is a misleading one.

`.env` is gitignored here and has never been committed, so nothing needs rewriting — the value simply needs removing from the local file, and the line dropping or blanking in `.env.example` if it appears there too.

RELATED, and the reason this is filed separately: the workspace vault holds T-13, "Clear the revoked ANTHROPIC_API_KEY from the live Portainer stack". That ticket is scoped to the Portainer stack only. Whoever closes it will reasonably believe the key is gone once the stack is clean, and this copy will survive. The two want doing together even though they commit separately.

Context on the revocation, since it explains why nobody removed this at the time: the key was revoked on 2026-08-09 after being printed into a transcript by a redaction filter that matched on `KEY` appearing after the `=`. In `ANTHROPIC_API_KEY=...` it appears before, so the filter never fired. The response was rotation, and the leftover copies were not swept.', 'backlog', 'medium', NULL, NULL, NULL, '2026-08-11 19:27:52.687', '2026-08-11 19:27:52.823', NULL, 'a9c2ca965b3d40a924720c7761c5338d', 2) ON CONFLICT(record_id) DO UPDATE SET type=excluded.type, parent_record_id=excluded.parent_record_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at >= tickets.updated_at;