[P1][phase:b] Dependency-manifest classification: requirements*.txt is not runtime; local/stub modules are not third-party #117

New issue

Open

opened 2026-06-15 22:56:49 +02:00 by claude · 0 comments

claude commented

2026-06-15 22:56:49 +02:00

Collaborator

Source: evidence-derived from the 2026-06-15 real-world precision audit (docs/dogfood/real-world-precision-2026-06-15.md).

Problem

The dependency-hygiene rules misclassify two kinds of input:

requirements*.txt read as runtime-dependency manifests. runtime-dependency-used-only-in-tests measured 0% precision (7/7 FP) — every finding came from treating a dev/test/docs pin file as a runtime declaration.
Local modules / stub namespaces read as third-party distributions. from settings import *, import apps, from _typeshed import ... are flagged as missing third-party packages.

Evidence (real repos)

httpx/requirements.txt (header literally: "Used in our test cases") → chardet, cryptography, trustme, uvicorn flagged as "runtime dependency used only in tests"
celery/requirements/test.txt, celery/requirements/docs.txt → moto, sphinx-testing flagged the same way
django-oscar/sandbox/settings_postgres.py: from settings import * → settings flagged as a missing third-party package (it is the local sandbox settings.py)
django-oscar/sandbox/urls.py: from apps.sitemaps import ... → apps flagged as third-party (it is a local package)
flask, pydantic, httpx: from _typeshed import ... → typeshed flagged as a missing dependency (_typeshed is a typeshed-internal stub namespace, never an installable package)

Proposed fix

Only treat [project.dependencies] (PEP 621) / install_requires as runtime declarations. Do not read requirements*.txt, requirements/*.txt, or test/docs extras as the runtime manifest.
Resolve local modules before flagging third-party: if an import target resolves to a module within the analyzed roots (or a sibling top-level module like settings/apps in the same tree), it is not a missing third-party dependency.
Exclude known stub-only namespaces (_typeshed, and anything only reachable under TYPE_CHECKING) from dependency rules — analogous to the stdlib exclusion.

Acceptance criteria

No requirements*.txt entry is reported as a runtime dependency.
Local modules (settings, apps, relative imports) are never flagged missing-runtime-dependency.
_typeshed is never flagged as a missing dependency.
benchmarks/fp-cases/requirements-txt-not-runtime/ and .../local-module-not-dist/ fixtures added and pass.

Priority

P1. Systematic and fully deterministic to fix; removes an entire class of confident-but-wrong findings on the dependency rules.

Opened by claude (Opus 4.8) from the 2026-06-15 precision audit. Audit PR: #113.

**Source:** evidence-derived from the 2026-06-15 real-world precision audit (`docs/dogfood/real-world-precision-2026-06-15.md`). ## Problem The dependency-hygiene rules misclassify two kinds of input: 1. **`requirements*.txt` read as runtime-dependency manifests.** `runtime-dependency-used-only-in-tests` measured **0% precision** (7/7 FP) — every finding came from treating a dev/test/docs pin file as a runtime declaration. 2. **Local modules / stub namespaces read as third-party distributions.** `from settings import *`, `import apps`, `from _typeshed import ...` are flagged as missing third-party packages. ### Evidence (real repos) - `httpx/requirements.txt` (header literally: *"Used in our test cases"*) → `chardet`, `cryptography`, `trustme`, `uvicorn` flagged as "runtime dependency used only in tests" - `celery/requirements/test.txt`, `celery/requirements/docs.txt` → `moto`, `sphinx-testing` flagged the same way - `django-oscar/sandbox/settings_postgres.py`: `from settings import *` → `settings` flagged as a missing third-party package (it is the local sandbox `settings.py`) - `django-oscar/sandbox/urls.py`: `from apps.sitemaps import ...` → `apps` flagged as third-party (it is a local package) - `flask`, `pydantic`, `httpx`: `from _typeshed import ...` → `typeshed` flagged as a missing dependency (`_typeshed` is a typeshed-internal stub namespace, never an installable package) ## Proposed fix 1. **Only treat `[project.dependencies]` (PEP 621) / `install_requires` as runtime declarations.** Do not read `requirements*.txt`, `requirements/*.txt`, or test/docs extras as the runtime manifest. 2. **Resolve local modules before flagging third-party**: if an import target resolves to a module within the analyzed roots (or a sibling top-level module like `settings`/`apps` in the same tree), it is not a missing third-party dependency. 3. **Exclude known stub-only namespaces** (`_typeshed`, and anything only reachable under `TYPE_CHECKING`) from dependency rules — analogous to the stdlib exclusion. ## Acceptance criteria - No `requirements*.txt` entry is reported as a runtime dependency. - Local modules (`settings`, `apps`, relative imports) are never flagged `missing-runtime-dependency`. - `_typeshed` is never flagged as a missing dependency. - `benchmarks/fp-cases/requirements-txt-not-runtime/` and `.../local-module-not-dist/` fixtures added and pass. ## Priority **P1.** Systematic and fully deterministic to fix; removes an entire class of confident-but-wrong findings on the dependency rules. --- *Opened by `claude` (Opus 4.8) from the 2026-06-15 precision audit. Audit PR: #113.*

claude added the

phase:b

label

2026-06-15 22:56:49 +02:00

claude referenced this issue from a commit

2026-06-17 23:09:21 +02:00

fix: avoid dependency false positives from manifests and local stubs

claude referenced this issue from a commit

2026-06-17 23:09:21 +02:00

fix: tighten local import and reexport heuristics