Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

3 of 6 InspectionResult values are declared but unreachable

Open
  • Is something wrong?
#764 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@dinakarjs is already working on this.

Since Oct 18, 2026.

  • #781 by @dinakarjs — open

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
backend

Research direction

Start with the InspectionResult Literal at src/cmcp_runtime/audit/chain.py (around lines 44-46), then run the two rg searches in the issue to confirm which values response_inspection_result is actually assigned. The fix depends on a maintainer choice among the three options, so confirm the direction in the thread before editing. Done means the type matches the emitted values, or the unreachable values are documented as reserved, with any affected tests passing.

Written by the indexing model from the issue text.

Description

Summary

InspectionResult in cmcp_runtime.audit.chain declares six Literal values, but only three are ever assigned to response_inspection_result anywhere in the codebase:

Value Emitted? Where
size_exceeded ✅ proxy.py — size-check terminal path
injection_detected ✅ proxy.py — injection-scan terminal path
n/a ✅ chain.py — _append_session_start default
schema_violation ❌ Stage 2 schema violations flow to policy_decision, never to response_inspection_result
surplus_stripped ❌ Schema redaction emits policy_decision="redact", not a response_inspection_result
pass ❌ Inspection pipeline returns "allow"/"deny" as decisions; "pass" is never written

The type definition at chain.py:44–46:

InspectionResult = Literal[
    "pass", "injection_detected", "schema_violation",
    "surplus_stripped", "size_exceeded", "n/a"
]

Repro

# from repo root, at main HEAD
rg '"schema_violation"|"surplus_stripped"' src/cmcp_runtime/ --type py
# returns zero matches for response_inspection_result assignment

rg '"pass"' src/cmcp_runtime/audit/ --type py
# only match is the "pass" literal inside the Literal[] type itself

Impact

  • Downstream consumers that branch on "schema_violation" or "surplus_stripped" from a TRACE claim or audit record will never see those values.
  • The type overstates the vocabulary the gateway actually emits, which is a spec-vs-implementation drift.

Options

  1. Implement the missing paths — wire Stage 2 schema violations to emit response_inspection_result="schema_violation", surplus-field stripping to "surplus_stripped", and clean inspection passes to "pass".
  2. Trim the type — remove the three unreachable values from InspectionResult and document that schema violations are recorded only in policy_decision.
  3. Intentional forward-reservation — if these are placeholders for planned inspection stages, document that in the type or a # TODO so the gap is explicit.
Dominant language
Python
Stars
33
Forks
24
Avg merge
19h 50m
Merged PRs (30d)
75

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/cmcp

All issues in agentrust-io/cmcp

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.