**One-line summary:** Phase 1 is structurally complete, behaviorally verified (all offline-testable paths green), and secure for a single-learner tech-validation harness. The two unverifiable exit criteria (live audio session + live latency measurement) are blocked on voice-service key provisioning, not on code defects — auto-generated tests in `tests/test_pending_keys.py` will exercise them when keys are present. Two risk-free cosmetic P0 fixes were applied (a misspelled constant `_DEBRIFF_` → `_DEBRIEF_` and a dead-code line in `debrief.py`); neither changed runtime behavior (verified by re-running the full suite).
No referenced file is missing. `server/asr/__init__.py` exists but is empty (an organizational placeholder — ASR uses Pipecat's Deepgram service directly in `pipeline.py`; no adapter needed for v0.1 since Deepgram is the only ASR). Acceptable.
### 1.2 Imports resolve (no dangling references)
Ran `python3 -c "import ..."` for every server/db module + the public API:
### 1.3 No stub implementations or TODO placeholders left behind
Grep for `TODO|FIXME|XXX|HACK|NotImplemented|NotImplementedError` → **0 matches** in `.py` files (no `NotImplementedError` stubs; no TODO/FIXME markers).
`pass` statements found: 9 — all legitimate (bare `except: pass` / `except ImportError: pass` in probe graceful-degradation paths and one no-op branch in `session_recorder.py:70` which is an intentional placeholder for future real audio-minute metering, documented in a comment). No empty-function-body stubs.
### 1.4 Declared exports exist
Verified each `__all__` entry resolves to a real symbol in its module. No dangling exports.
### 1.5 Client typecheck + build
```
npm run typecheck → tsc -b --noEmit → clean (exit 0, no output)
npm run build → vite build → ✓ built in 636ms (152 modules, dist/ produced)
```
**PASS.** (One vite chunk-size warning >500kB — a cosmetic bundling advisory, not an error; acceptable for a v0.1 single-page client.)
### 1.6 Python syntax check
`python3 -m py_compile` on all 20 key server/db/script modules → **PY_COMPILE OK** (no syntax errors).
> **Note on Pipecat LSP static-type noise:** `pipeline.py` / `__main__.py` / `e2e_smoke.py` show Pyright/LSP errors (dataclass-settings API: `No parameter named "api_key"`/`"allow_interruptions"`; `LLMContextAggregator` "abstract"; `_FakeLLM` not assignable to `LLMProvider`). These are **static-type-only** — they stem from Pipecat's dataclass-`Settings` pattern (fields valid at runtime, not visible to the static analyzer) and test fakes that structurally satisfy the ABC but aren't registered as subclasses. **Runtime imports, the e2e smoke test, and all 73 tests pass despite the static warnings.** This matches the documented EXECUTE state. Flagged as P2 (maintainability) — see Quality findings.
The 1 warning is a benign `DeprecationWarning: 'audioop' is deprecated` from Pipecat's `audio/utils.py` (third-party, Python 3.13 advisory — not actionable in v0.1).
**Coverage: 15/15 P1 REQ-IDs covered by code.** All have at least one offline test except where the requirement is inherently live-key-dependent (REQ-VOICE-03 live number, REQ-LLM-01/02 live call) — those are covered by auto-generated pending-key tests that activate when keys are provisioned.
### 2.5 Auto-generated tests for unverifiable items
`tests/test_pending_keys.py` (NEW — 9 tests, all skip cleanly without keys):
| Test | Verifies | Activates when |
|---|---|---|
| `test_r1_deepgram_first_partial_latency` | R1 probe runs live | DEEPGRAM_API_KEY |
| `test_r2_cartesia_first_audio_latency` | R2 probe runs live | CARTESIA_API_KEY |
Threat model context: v0.1 is a **single-learner tech-validation harness** (G-008), local SQLite, no auth (D-007), no PII beyond a hardcoded display name, no network exposure beyond the pilot host. STRIDE findings are dispositioned per the auto-policy (low=accept, medium=mitigate, high=escalate).
| **Spoofing** | No auth in v0.1 (D-007 — single hardcoded learner "Alex"). Anyone who can reach the Pipecat server's `/pipecat/webrtc` endpoint could start a session. | Low (pilot) | **Accept** | D-007 explicitly defers auth. Single-learner harness; the server binds `0.0.0.0:8789` but is intended for a single pilot host. CORS is `allow_origins=["*"]` (dev) — acceptable for v0.1, **flag for tightening before any multi-learner milestone** (P1). |
| **Tampering** | SQLite local file (`praxis.db`) — no integrity protection. A local user can `sqlite3 praxis.db` and edit session/outcome/cost rows. | Low (pilot) | **Accept** | D-007: local pilot, single-learner. Trust model assumes the pilot host is trusted. No tamper-evidence needed for tech-validation. Documented in `db/schema.sql` header. |
| **Repudiation** | Sessions are logged with auto-generated ids (`sess-<uuid>`) and timestamps; no signed audit trail. A learner could dispute "I never did that session." | N/A (pilot) | **Accept** | Single hardcoded learner, no auth → no multi-party repudiation surface. Sessions are for learner self-review, not compliance. |
| **Info Disclosure** | (a) `.ciagent/.env.secrets` is `0600` perms + gitignored — ✅ verified. (b) `.env`, `.env.secrets`, `.env.*` all in `.gitignore` — ✅ verified. (c) `git ls-files` confirms **no secret/key/db files tracked**. (d) Grep for hardcoded API keys (`sk-...`, `*_API_KEY="..."` assignments) → **0 matches** in non-example files. (e) `db/*.db` gitignored — no learner data leaked. | Low | **Accept** | Secrets handling is correct. The local `.ciagent/.env.secrets` contains a `DEEPGRAM_API_KEY` value (40 chars) but it is **not committed** (gitignored, 0600) — this is the intended dev-secret pattern. No info-disclosure vulnerability found. |
| **Denial of Service** | No rate limiting on the FastAPI/Pipecat server; no connection cap; a client can open many WebRTC sessions. `asyncio.create_task(runner.run(task))` fires-and-forgets per request. | Low-Medium (pilot) | **Accept (v0.1) / Flag (P1)** | D-007/D-012: single-learner pilot, no adversarial threat model. Acceptable for v0.1. **Flag for P1 post-hoc review**: before any multi-learner exposure, add connection limits + task lifecycle management (the current `create_task` without tracking could leak tasks on disconnect). |
| **Elevation of Privilege** | No auth → no privilege ladder → no escalation surface. | N/A | **Accept** | N/A for v0.1. |
### Injection-vector review (security persona)
| Vector | Status | Evidence |
|---|---|---|
| **YAML scenario loading** | ✅ Safe | `server/scenarios/loader.py` uses `yaml.safe_load` (not `yaml.load`) — no arbitrary Python object construction. Scenario files are repo-authored (D-007: no user-uploaded scenarios in v0.1). |
| **LLM prompt construction** | ✅ Contained | `classifier.py::_build_user_prompt` and `debrief.py::_render` interpolate learner text into the prompt via string replacement. A malicious learner ASR transcript could inject prompt text, but: (a) the LLM is role-playing a customer (no tool calls / no DB writes from LLM output), (b) the guardrail output filter runs on the response, (c) the branch classifier output is JSON-parsed leniently with fallback. Prompt injection impact is bounded to a misclassified branch or a weird debrief — not a security boundary for v0.1. **Accept.** |
| **Path traversal (scenario id)** | Low | `loader.load(scenario_id)` builds `base / f"{scenario_id}.yaml"` — a `scenario_id` containing `../` could escape `scenarios/`. In v0.1 the id comes from the env var `PRAXIS_SCENARIO` (operator-controlled), not user input. **Accept for v0.1; flag for P1** if scenario ids ever become user-selectable. |
**Layer 3 verdict: ACCEPT.** No high-severity STRIDE findings. 3 P1 flags for future hardening (CORS tightening, DoS/connection limits, path-traversal guard) — all appropriate for a post-pilot milestone, not v0.1 blockers.
---
## Layer 4 — Quality (multi-persona review)
### P0 fixes applied (2)
Both are risk-free cosmetic cleanups with no logic/behavior change. Verified by re-running the full suite (73 passed, 9 skipped, 0 failed) + e2e smoke after each fix.
| # | File:line | Issue | Fix | Verification |
|---|---|---|---|---|
| P0-1 | `server/guardrails/customer_service.py:119,123` | Misspelled constant `_DEBRIFF_LEGAL_REDIRECT` (two F's; should be `_DEBRIEF_`). Worked at runtime only because the method references the constant by the same misspelled name and Python resolves globals at call time — but the typo is a latent trap: any future refactor that renames one occurrence would silently break the debrief filter, causing legal-action recommendations to pass unfiltered (a safety regression). | Renamed both occurrences to `_DEBRIEF_LEGAL_REDIRECT`. | `test_debrief_guardrail_blocks_legal_action` passes; manual end-to-end check confirms legal-action text still replaced by the redirect. |
| P0-2 | `server/debrief.py:31` | Dead code: `rel = template_id.replace("/", ".") ...` computed but never used (the actual path resolution uses `template_id.split('/')[-1]`). Confusing for maintainers and flagged by linters. | Removed the dead line. | `test_debrief_*` (5 tests) pass; template loading verified. |
| Q-1 | P1 | Maintainability | `server/pipeline.py`, `server/__main__.py`, `scripts/e2e_smoke.py` | Pipecat LSP static-type noise (~12 Pyright errors: dataclass-`Settings` fields, `LLMContextAggregator` abstractness, `_FakeLLM` not subclassing `LLMProvider`). Runtime is fine; static analysis is noisy. | Add `# type: ignore[...]` annotations with reasons, or wrap Pipecat service construction in typed helper functions. Register test fakes via `LLMProvider.register` or duck-type with `Protocol`. Non-blocking. |
| Q-2 | P1 | Correctness | `server/latency.py:106-112` | `TextFrame` is treated as an LLM-first-token proxy, but `TextFrame` is generic — it can carry non-LLM text (e.g. the opening-line TTS input), which could misattribute the first-token timestamp. The `LLMFullResponseEndFrame` branch (L99) is a better proxy but also imperfect. | For v0.1 accept (latency is logged, not enforced); for Phase 2 use Pipecat's `LLMTokenUsageFrame` / metrics service for accurate TTFT. |
| Q-3 | P1 | Adversarial/Security | `server/scenarios/loader.py:34` | `load(scenario_id)` builds `base / f"{scenario_id}.yaml"` without sanitizing `../` — path traversal possible if `scenario_id` is ever user-controlled. Currently env-var-controlled (operator), so low risk. | Add a guard: reject `scenario_id` containing path separators or `..`, or resolve + verify the result stays within `base`. |
| Q-4 | P1 | Security/DoS | `server/__main__.py:96-98` | `asyncio.create_task(runner.run(task))` is fire-and-forget — no tracking of running tasks, no cap on concurrent sessions, no cancellation on client disconnect. Acceptable for single-learner pilot but would leak resources at scale. | Track tasks in a set; cancel on disconnect; cap concurrency. Defer to multi-learner milestone. |
| Q-5 | P1 | Security | `server/__main__.py:55` | CORS `allow_origins=["*"]` — dev setting. Acceptable for v0.1 single-origin pilot but must be tightened before any non-local exposure. | Make CORS origin env-configurable (`PRAXIS_CORS_ORIGINS`); default to the client dev origin. |
| Q-6 | P2 | Testing | `tests/test_e2e.py:16-37` | The 3 e2e test functions each call `asyncio.run(run_e2e(...))` independently — the full loop runs 3× per test session (wasteful, ~3× the DB writes). Also `test_e2e_debrief_non_empty` re-runs the whole loop just to assert `debrief_chars > 50`. | Refactor to a session-scoped fixture that runs `run_e2e` once and shares the result dict across the 3 assertions. Non-blocking. |
### Per-persona summary
**Correctness:** Logic is sound across the hot path. `classify_branch_sync_heuristic` correctly scores branches by signal-keyword overlap and tie-breaks to the first branch (deterministic). `derive_cost` arithmetic verified (`test_derive_cost_piper_zero_tts` confirms Piper $0 path). `LatencyRecord.e2e_asr_to_tts_ms` math correct (550ms in test). Branch classifier parser is lenient (handles code fences, malformed JSON, empty input) with safe fallbacks. **No correctness P0s.**
**Testing:** 73 tests are meaningful — they cover schema validation, adapter graceful degradation, guardrail block categories, cost math, store CRUD, recorder lifecycle, debrief generation/filter, latency math, and the full e2e loop with DB assertions. Coverage is broad; gaps are the live-key paths (now covered by `test_pending_keys.py` skips) and client-side (no React component tests — v0.1 relies on e2e smoke per `package.json` "test" script). The `_FakeLLM`/`_StubDebriefLLM` fakes structurally satisfy the `LLMProvider` contract. **No testing P0s.** One P2 (test redundancy, Q-6).
**Performance:** No O(n²) in the voice-loop hot path. `LatencyObserver.process_frame` is O(1) per frame (passes through + records a timestamp). `lru_cache` on registry getters avoids repeated adapter construction. `SessionRecorder.log_turn` is O(1) per turn. The classifier runs once at session end (D-P1-05 — offline from the latency path). **No performance P0s.** One observation: `LLMContextAggregator` + Pipecat's context object grow with conversation length (unbounded turn history) — acceptable for v0.1 short sessions; flag for Phase 2 if sessions exceed ~50 turns.
**Maintainability:** Interfaces (`TTSProvider`/`LLMProvider`/`Guardrail`) are clean ABCs with typed dataclasses (`TTSResult`, `LLMStreamChunk`, `GuardrailVerdict`, `GuardrailContext`). The registry centralizes env-based selection. Adapters are thin and consistently degrade gracefully on missing keys/models. Naming is clear. The one maintainability defect was the `_DEBRIFF` typo (fixed as P0-1). Pipecat static-type noise (Q-1) is the remaining friction. **No maintainability P0s after fixes.**
**Adversarial:** What if the LLM returns malicious content? → Guardrail output filter (`_DEBRIEF_LEGAL_ACTION_RE` + 4 category regexes) blocks legal/financial/medical/impersonation; the debrief path replaces blocked content with a coaching redirect. What if the YAML scenario is malformed? → Pydantic `ValidationError` raised at load (typed, tested). What if the classifier returns garbage? → `_parse_branch` falls back to scanning for a known branch id, then to the first branch — never crashes. What if a probe key is missing? → `KEY_MISSING` banner, exit 0. **No adversarial P0s.** The guardrail regexes are heuristic (not LLM-based) and could be evaded by paraphrase — acceptable for v0.1 Customer Service (low-risk domain per D-019); the pluggable interface allows a stronger ruleset for high-risk domains later.
**Overall: PASSED (with documented gaps).** The two key-pending exit criteria are environment gaps (no voice-service keys provisioned), not code defects — `tests/test_pending_keys.py` will verify them automatically when keys are present. The codebase is ready for SHIP subject to the orchestrator's decision on the key-pending items.
---
*End of Phase 1 verification report. VERIFY only — SHIP is the orchestrator's next step.*
asserte2e.get("median_ms",0)>0,"median latency is not a real positive number"
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Praxis CI