ipor-fusion 4.0.0.dev200__tar.gz → 4.0.0.dev206__tar.gz

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/.github/workflows/cd.yml

@@ -12,12 +12,13 @@ jobs:
       SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
 
   build:
-    needs: notify
     uses: ./.github/workflows/python-build.yml
     secrets:
       ETHEREUM_PROVIDER_URL: ${{ secrets.ETHEREUM_PROVIDER_URL }}
       ARBITRUM_PROVIDER_URL: ${{ secrets.ARBITRUM_PROVIDER_URL }}
       BASE_PROVIDER_URL: ${{ secrets.BASE_PROVIDER_URL }}
+    with:
+      require-live: ETHEREUM_PROVIDER_URL,ARBITRUM_PROVIDER_URL,BASE_PROVIDER_URL,GITHUB
 
   report:
     if: ${{ always() }}

ipor_fusion-4.0.0.dev206/.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - "**"
+
+jobs:
+  notify:
+    uses: ./.github/workflows/notify-slack.yml
+    secrets:
+      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+  # No secrets: what the code proves offline, on every supported Python.
+  offline:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    uses: ./.github/workflows/python-build.yml
+    with:
+      python-version: ${{ matrix.python-version }}
+      format-code-enabled: ${{ matrix.python-version == '3.12' }}
+      static-code-analysis-enabled: ${{ matrix.python-version == '3.12' }}
+      build-enabled: ${{ matrix.python-version == '3.12' }}
+      coverage-artifact-name: coverage-offline-${{ matrix.python-version }}
+
+  # Live providers, for pull requests from this repository only (a fork gets
+  # no secrets); a provider or GitHub outage fails it instead of skipping.
+  live:
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    uses: ./.github/workflows/python-build.yml
+    secrets:
+      ETHEREUM_PROVIDER_URL: ${{ secrets.ETHEREUM_PROVIDER_URL }}
+      ARBITRUM_PROVIDER_URL: ${{ secrets.ARBITRUM_PROVIDER_URL }}
+      BASE_PROVIDER_URL: ${{ secrets.BASE_PROVIDER_URL }}
+    with:
+      format-code-enabled: false
+      static-code-analysis-enabled: false
+      build-enabled: false
+      coverage-artifact-name: coverage-live
+      require-live: ETHEREUM_PROVIDER_URL,ARBITRUM_PROVIDER_URL,BASE_PROVIDER_URL,GITHUB
+
+  report:
+    if: ${{ always() }}
+    needs:
+      - notify
+      - offline
+      - live
+    uses: ./.github/workflows/report-slack.yml
+    secrets:
+      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+    with:
+      success: ${{ needs.offline.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.live.result) }}
+      slack-status-msg-id: ${{ needs.notify.outputs.slack-status-msg-id }}

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/.github/workflows/python-build.yml

@@ -5,11 +5,11 @@ on:
 
     secrets:
       ARBITRUM_PROVIDER_URL:
-        required: true
+        required: false
       BASE_PROVIDER_URL:
-        required: true
+        required: false
       ETHEREUM_PROVIDER_URL:
-        required: true
+        required: false
 
     inputs:
       python-version:
@@ -42,6 +42,16 @@ on:
         type: boolean
         default: true
         required: false
+      coverage-artifact-name:
+        description: "Name of the uploaded coverage artifact (unique per call in a run)"
+        type: string
+        default: coverage-report
+        required: false
+      require-live:
+        description: "Comma-separated live sources whose tests must run, not skip (tests/_live.py)"
+        type: string
+        default: ""
+        required: false
 
 jobs:
   python:
@@ -93,6 +103,7 @@ jobs:
           ETHEREUM_PROVIDER_URL: ${{ secrets.ETHEREUM_PROVIDER_URL }}
           ARBITRUM_PROVIDER_URL: ${{ secrets.ARBITRUM_PROVIDER_URL }}
           BASE_PROVIDER_URL: ${{ secrets.BASE_PROVIDER_URL }}
+          IPOR_FUSION_REQUIRE_LIVE: ${{ inputs.require-live }}
         id: tests
 
       - name: Coverage summary
@@ -104,6 +115,6 @@ jobs:
         if: inputs.test-enabled && always() && steps.tests.outcome != 'skipped'
         uses: actions/upload-artifact@v4
         with:
-          name: coverage-report
+          name: ${{ inputs.coverage-artifact-name }}
           path: coverage.xml
 

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/AGENTS.md

@@ -27,7 +27,7 @@ uv sync --all-extras --locked                                 # install, same as
 uv run ruff format ./                                         # format (CI runs --check)
 uv run ruff check ./                                          # lint: bandit S, C901 max-complexity 10, PLR limits
 uv run pyright                                                # types, basic mode, src + tests + examples + scripts
-uv run pytest                                                 # all tests + coverage gate (fail_under = 95)
+uv run pytest                                                 # all tests + coverage gate (fail_under = 98, mcp/ included)
 uv run pytest -m "cli or mcp" --no-cov                        # fast offline subset
 uv run pytest --run-readiness -m readiness --no-cov -rA       # opt-in live Ethereum-hub POC checks
 uv run python scripts/crosschain_readiness.py --output /tmp/crosschain-readiness.json # live Arbitrum/HyperEVM report
@@ -54,13 +54,26 @@ the sequence in `.github/workflows/python-build.yml`. When ruff `C901` trips,
 extract helpers, never suppress.
 
 **Offline vs network.** `test_cli_*` and `test_mcp_*` need no network
-(auto-tagged `cli` / `mcp` in `conftest.py`; everything else is `sdk`).
+(auto-tagged `cli` / `mcp` in `conftest.py`, `test_examples_*` `examples`;
+everything else is `sdk`). Most `sdk` tests are offline too: the suite with no
+provider set still clears the coverage gate.
 Integration tests (`test_simulate_*`, `test_vault_info_onchain_*`) run against
 live RPCs via `eth_simulateV1`, no Docker or Anvil (`ANVIL_WALLET` is just a
 named address constant). They auto-skip unless `ETHEREUM_PROVIDER_URL`,
 `BASE_PROVIDER_URL` and `ARBITRUM_PROVIDER_URL` are set (`.env` is loaded via
-python-dotenv) and the provider supports `eth_simulateV1`. CI has all three as
-secrets. Never print `.env` or a provider URL: they embed API keys.
+python-dotenv) and the provider supports `eth_simulateV1`. Every such gate goes
+through `tests/_live.py` (`provider_url`, `archive_context`, `unavailable`): it
+skips locally and fails when the source is named in `IPOR_FUSION_REQUIRE_LIVE`
+(comma-separated env var names, `GITHUB` for the Solidity mirrors). CI
+(`ci.yml`) runs an offline job without secrets on Python 3.11, 3.12 and 3.13
+and, for pull requests from this repository, a live job with the three
+provider secrets that requires all of them and GitHub: a skip for one of those
+sources being unavailable is a failure there (state-dependent skips such as a
+pilot vault's preconditions remain skips, and the offline job still reads the
+public Solidity sources from GitHub). Skip only for an unavailable source; an
+exception from the
+SDK is a test failure, never a skip. Never print `.env` or a provider URL: they
+embed API keys, so skip and fail messages carry the exception type only.
 `HYPEREVM_PROVIDER_URL` is used by the HyperEVM lifecycle/deployment tests and
 the readiness script; general PR CI does not supply it.
 `test_simulate_crosschain_hyperevm.py` rehearses Arbitrum → HyperEVM on pinned blocks,

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ipor-fusion
-Version: 4.0.0.dev200
+Version: 4.0.0.dev206
 Summary: The IPOR Fusion SDK for Python
 Project-URL: homepage, https://ipor.io
 Project-URL: repository, https://github.com/IPOR-Labs/ipor-fusion.py

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ipor-fusion"
-version = "4.0.0.dev200"
+version = "4.0.0.dev206"
 description = "The IPOR Fusion SDK for Python"
 authors = [
     { name = "Adam Mydlarz", email = "amydlarz@gmail.com" },
@@ -123,12 +123,10 @@ executionEnvironments = [
 [tool.coverage.run]
 source = ["src/ipor_fusion"]
 data_file = ".coverage_data/.coverage"
-omit = ["src/ipor_fusion/mcp/*"]
 
 [tool.coverage.report]
 show_missing = true
-fail_under = 95
-omit = ["src/ipor_fusion/mcp/*"]
+fail_under = 98
 
 [tool.semantic_release]
 # Runs inside the python-semantic-release Docker container, not on the runner

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/src/ipor_fusion/core/context.py

@@ -156,7 +156,7 @@ class Web3Context:
         return self._signer
 
     @classmethod
-    def from_url(  # proctor: ignore[primitives-too-many-params]
+    def from_url(
         cls,
         url: str,
         *,

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/src/ipor_fusion/core/fusion_factory.py

@@ -79,9 +79,7 @@ class FusionInstance:
     price_manager: ChecksumAddress
 
     @classmethod
-    def from_dict(  # proctor: ignore[primitives-untyped-dict]
-        cls, data: Mapping[str, object]
-    ) -> FusionInstance:
+    def from_dict(cls, data: Mapping[str, object]) -> FusionInstance:
         """Rebuild an instance from its JSON form (``dataclasses.asdict``),
         parsing every field: role addresses through their parsers, the rest
         checksummed, integers and strings type-checked. Raises ``ValueError``

ipor_fusion-4.0.0.dev206/tests/_live.py

@@ -0,0 +1,67 @@
+"""Gates of the tests that need a live provider or network source.
+
+Locally a missing or unreachable source skips the test. A run that names the
+source in ``IPOR_FUSION_REQUIRE_LIVE`` (comma-separated: provider env var names
+such as ``BASE_PROVIDER_URL``, or ``GITHUB`` for the Solidity mirrors) fails
+instead, so a green CI run means the live checks ran rather than skipped.
+Messages carry the exception type only: provider URLs embed API keys.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import NoReturn
+
+import pytest
+import requests
+from web3 import Web3
+from web3.exceptions import Web3Exception
+
+from ipor_fusion import Web3Context
+
+
+def required() -> frozenset[str]:
+    return frozenset(
+        name.strip()
+        for name in os.environ.get("IPOR_FUSION_REQUIRE_LIVE", "").split(",")
+        if name.strip()
+    )
+
+
+def unavailable(source: str, reason: str) -> NoReturn:
+    """Skip, or fail when this run requires ``source``."""
+    if source in required():
+        pytest.fail(f"{source} is required in this run: {reason}", pytrace=False)
+    pytest.skip(reason)
+
+
+def provider_url(env_var: str) -> str:
+    url = os.environ.get(env_var)
+    if not url:
+        unavailable(env_var, f"{env_var} not set")
+    return url
+
+
+# A provider that cannot be reached, refuses the key, or has pruned the state.
+_INFRA_ERRORS = (Web3Exception, requests.RequestException, OSError)
+
+
+def archive_context(env_var: str, block: int, contract: str) -> Web3Context:
+    """A context pinned to ``block`` on the provider in ``env_var``, once it
+    has connected and served ``contract``'s code at that block (historical
+    state, not just the header); later SDK errors are test failures, not
+    infrastructure."""
+    url = provider_url(env_var)
+    # The failure is reported outside the except block: a chained traceback
+    # would print the request URL, which embeds the API key.
+    failure: str | None = None
+    try:
+        ctx = Web3Context.from_url(url)
+        code = ctx.web3.eth.get_code(Web3.to_checksum_address(contract), block)
+    except _INFRA_ERRORS as exc:
+        failure = type(exc).__name__
+    if failure is not None:
+        unavailable(env_var, f"{env_var} cannot serve state at {block}: {failure}")
+    if not code:
+        unavailable(env_var, f"{env_var} returned no code for {contract} at {block}")
+    return ctx.at_block(block)

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/tests/conftest.py

@@ -1,11 +1,11 @@
 import importlib.util
-import os
 from collections.abc import Callable
 from pathlib import Path
 from types import ModuleType
 from unittest.mock import patch
 
 import pytest
+from _live import provider_url, unavailable
 from _multicall import SequentialMulticall
 from dotenv import load_dotenv
 from web3 import Web3
@@ -72,40 +72,38 @@ def pytest_collection_modifyitems(config, items):
 
 
 def _connected_web3(env_var: str) -> Web3:
-    """Build a Web3 client from `env_var`; skip the test if missing/unreachable."""
-    url = os.environ.get(env_var)
-    if not url:
-        pytest.skip(f"{env_var} not set")
-    w3 = Web3(Web3.HTTPProvider(url))
+    """Build a Web3 client from `env_var`; skip the test if missing/unreachable
+    (fail when the run requires it, see `_live`)."""
+    w3 = Web3(Web3.HTTPProvider(provider_url(env_var)))
     if not w3.is_connected():
-        pytest.skip(f"cannot reach RPC at {env_var}")
+        unavailable(env_var, f"cannot reach RPC at {env_var}")
     return w3
 
 
-def _ensure_simulate_v1(web3: Web3) -> None:
+def _ensure_simulate_v1(web3: Web3, env_var: str) -> None:
     """Skip if the provider does not implement `eth_simulateV1`."""
     if not is_simulate_v1_supported(web3):
-        pytest.skip("provider does not support eth_simulateV1")
+        unavailable(env_var, f"{env_var} does not support eth_simulateV1")
 
 
 @pytest.fixture(scope="session")
 def web3_eth() -> Web3:
     w3 = _connected_web3("ETHEREUM_PROVIDER_URL")
-    _ensure_simulate_v1(w3)
+    _ensure_simulate_v1(w3, "ETHEREUM_PROVIDER_URL")
     return w3
 
 
 @pytest.fixture(scope="session")
 def web3_base() -> Web3:
     w3 = _connected_web3("BASE_PROVIDER_URL")
-    _ensure_simulate_v1(w3)
+    _ensure_simulate_v1(w3, "BASE_PROVIDER_URL")
     return w3
 
 
 @pytest.fixture(scope="session")
 def web3_arb() -> Web3:
     w3 = _connected_web3("ARBITRUM_PROVIDER_URL")
-    _ensure_simulate_v1(w3)
+    _ensure_simulate_v1(w3, "ARBITRUM_PROVIDER_URL")
     return w3
 
 
@@ -113,5 +111,5 @@ def web3_arb() -> Web3:
 def web3_hyperevm() -> Web3:
     """HyperEVM simulation fixture; general PR CI does not supply its RPC secret."""
     w3 = _connected_web3("HYPEREVM_PROVIDER_URL")
-    _ensure_simulate_v1(w3)
+    _ensure_simulate_v1(w3, "HYPEREVM_PROVIDER_URL")
     return w3

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/tests/test_readiness_selection.py

@@ -22,7 +22,8 @@ pytest_plugins = ["pytester"]
 def test_readiness_requires_explicit_opt_in(pytester, args, passed, deselected):
     pytester.makeconftest(Path(__file__).with_name("conftest.py").read_text())
     pytester.makepyfile(
-        _multicall=Path(__file__).with_name("_multicall.py").read_text()
+        _multicall=Path(__file__).with_name("_multicall.py").read_text(),
+        _live=Path(__file__).with_name("_live.py").read_text(),
     )
     pytester.makeini("[pytest]\nmarkers =\n    sdk\n    cli\n    mcp\n    readiness\n")
     pytester.makepyfile(

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/tests/test_solidity_mirrors.py

@@ -14,6 +14,7 @@ from functools import cache
 
 import pytest
 import requests
+from _live import unavailable
 from eth_utils import function_signature_to_4byte_selector
 
 from ipor_fusion.config.roles import Roles
@@ -58,11 +59,11 @@ def _solidity_source(path: str) -> str:
     try:
         resp = requests.get(url, timeout=15)
     except requests.RequestException as exc:
-        pytest.skip(f"cannot fetch {path} from GitHub: {exc}")
+        unavailable("GITHUB", f"cannot fetch {path} from GitHub: {type(exc).__name__}")
     if resp.status_code == 404:
         pytest.fail(f"{url} not found — wrong pinned ref or moved file")
     if resp.status_code != 200:
-        pytest.skip(f"GitHub returned HTTP {resp.status_code} for {path}")
+        unavailable("GITHUB", f"GitHub returned HTTP {resp.status_code} for {path}")
     return resp.text
 
 

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/tests/test_vault_info_onchain_base.py

@@ -17,11 +17,10 @@ historical block requires an archive node.
 
 from __future__ import annotations
 
-import os
 from collections import Counter
 from unittest.mock import patch
 
-import pytest
+from _live import archive_context, provider_url
 from web3 import Web3
 from web3.providers.rpc import HTTPProvider
 
@@ -35,15 +34,8 @@ EXPECTED_IDLE_USDC = 10 * 10**6  # 10 USDC (6 decimals) sitting idle on the vaul
 
 
 def test_idle_underlying_reconciles_on_real_base_vault():
-    url = os.environ.get("BASE_PROVIDER_URL")
-    if not url:
-        pytest.skip("BASE_PROVIDER_URL not set")
-
-    try:  # pylint: disable=broad-except
-        validation = validate_vault(Web3Context.from_url(url), VAULT, block=BLOCK)
-    except Exception as exc:  # pylint: disable=broad-except
-        # Infra problem (provider unreachable or non-archive) — skip, don't fail.
-        pytest.skip(f"BASE on-chain read failed (provider missing/non-archive?): {exc}")
+    ctx = archive_context("BASE_PROVIDER_URL", BLOCK, VAULT)
+    validation = validate_vault(ctx, VAULT, block=BLOCK)
 
     # Sanity: confirm we are reading the expected vault/chain state at this block.
     recon = validation.reconciliation
@@ -64,9 +56,8 @@ MAX_ETH_CALLS = 20
 
 
 def test_fetch_stays_within_round_trip_budget():
-    url = os.environ.get("BASE_PROVIDER_URL")
-    if not url:
-        pytest.skip("BASE_PROVIDER_URL not set")
+    archive_context("BASE_PROVIDER_URL", BLOCK, VAULT)  # skips without an archive
+    url = provider_url("BASE_PROVIDER_URL")
 
     methods: Counter[str] = Counter()
     make_request = HTTPProvider.make_request
@@ -75,15 +66,12 @@ def test_fetch_stays_within_round_trip_budget():
         methods[method] += 1
         return make_request(provider, method, params)
 
-    try:  # pylint: disable=broad-except
-        # web3 binds make_request when the provider is built, so the context
-        # must be created under the patch for any request to be counted.
-        with patch.object(HTTPProvider, "make_request", counting):
-            ctx = Web3Context.from_url(url)
-            methods.clear()
-            data = fetch_vault_data(ctx, VAULT, block=BLOCK)
-    except Exception as exc:  # pylint: disable=broad-except
-        pytest.skip(f"BASE on-chain read failed (provider missing/non-archive?): {exc}")
+    # web3 binds make_request when the provider is built, so the context
+    # must be created under the patch for any request to be counted.
+    with patch.object(HTTPProvider, "make_request", counting):
+        ctx = Web3Context.from_url(url)
+        methods.clear()
+        data = fetch_vault_data(ctx, VAULT, block=BLOCK)
 
     assert data.total_assets == EXPECTED_IDLE_USDC
     assert methods["eth_call"] > 0, "requests were not counted"

{ipor_fusion-4.0.0.dev200 → ipor_fusion-4.0.0.dev206}/tests/test_vault_info_onchain_base_no_withdraw_manager.py

@@ -16,12 +16,10 @@ code under test runs unguarded, so a regression fails instead of skipping.
 
 from __future__ import annotations
 
-import os
-
-import pytest
+from _live import archive_context
 from web3 import Web3
 
-from ipor_fusion import PlasmaVault, Web3Context
+from ipor_fusion import PlasmaVault
 from ipor_fusion.vault_data import fetch_vault_data
 
 VAULT = Web3.to_checksum_address("0x45aa96f0b3188D47a1DaFdbefCE1db6B37f58216")
@@ -30,22 +28,9 @@ CHAIN_ID = 8453
 BLOCK = 50788912
 
 
-def _connect(url: str) -> tuple[Web3Context, PlasmaVault]:
-    """Skip on infra problems only (unreachable or non-archive provider)."""
-    try:
-        ctx = Web3Context.from_url(url).at_block(BLOCK)
-        pv = PlasmaVault(VAULT)
-        pv.underlying_asset_address().call(ctx)  # state read at BLOCK needs archive
-    except Exception as exc:  # noqa: BLE001
-        pytest.skip(f"BASE on-chain read failed (provider missing/non-archive?): {exc}")
-    return ctx, pv
-
-
 def test_vault_without_withdraw_manager_fetches_on_real_base_vault():
-    url = os.environ.get("BASE_PROVIDER_URL")
-    if not url:
-        pytest.skip("BASE_PROVIDER_URL not set")
-    ctx, pv = _connect(url)
+    ctx = archive_context("BASE_PROVIDER_URL", BLOCK, VAULT)
+    pv = PlasmaVault(VAULT)
 
     withdraw_manager = pv.read_withdraw_manager_address(ctx)
     data = fetch_vault_data(ctx, pv.address, block=BLOCK)

ipor_fusion-4.0.0.dev200/.github/workflows/ci.yml

@@ -1,32 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-    branches:
-      - "**"
-
-jobs:
-  notify:
-    uses: ./.github/workflows/notify-slack.yml
-    secrets:
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-
-  build:
-    needs: notify
-    uses: ./.github/workflows/python-build.yml
-    secrets:
-      ETHEREUM_PROVIDER_URL: ${{ secrets.ETHEREUM_PROVIDER_URL }}
-      ARBITRUM_PROVIDER_URL: ${{ secrets.ARBITRUM_PROVIDER_URL }}
-      BASE_PROVIDER_URL: ${{ secrets.BASE_PROVIDER_URL }}
-
-  report:
-    if: ${{ always() }}
-    needs:
-      - notify
-      - build
-    uses: ./.github/workflows/report-slack.yml
-    secrets:
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-    with:
-      success: ${{ needs.build.result == 'success' }}
-      slack-status-msg-id: ${{ needs.notify.outputs.slack-status-msg-id }}