Evil0ctal e5316e580d feat(core): foundation contracts and toolchain ...

Python 3.12 + uv. Establishes the shared contracts every other module
imports, authored as one piece so parallel work has a fixed target.

- core/types.py    stable enums; these are wire identifiers and are never
                   translated (docs/design/14-i18n.md)
- core/errors.py   17 error codes with HTTP mapping and a non-retryable set.
                   UpstreamChanged carries the missing field path so "the
                   platform changed shape" stays distinguishable from rate
                   limiting - V4 conflated them and the change never got
                   reported
- core/crypto.py   AES-256-GCM with the record id as AAD, so a blob cannot be
                   moved between rows. Refuses to derive a key from a short or
                   missing DTK_SECRET_KEY rather than falling back to a default
- core/logging.py  redaction in the processor chain, not at call sites: a call
                   site that forgets is exactly how V4 leaked a live session
                   cookie
- core/config.py   33 runtime settings across four scopes; the SSRF allowlist
                   and CORS origins are `sensitive`. CORS defaults to empty
                   rather than '*', which would hand API keys to any site
- models/content.py normalized contract. Ids are strings (aweme_id exceeds the
                   JS safe integer range); absent metrics are None, never 0

Verified against the real dependency set: wreq 0.12.1 reproduces a genuine
Chrome JA4 (t13d1516h2_8daaf6152771_d8a2da3f94cd) and Chrome149/Firefox151
emulation profiles exist, matching the design's assumption.

Test fixtures run only through `docker compose -p dtk-test`, torn down with
`down -v`, so no loose containers are left behind.

2026-09-07 04:28:51 -07:00

0 lines

0 B

Python

Raw Permalink Blame History

The file is empty.