No Keyring & No Fallback Policies
Relevant source files
The following files were used as context for generating this wiki page:
The flext-quality project enforces "No Keyring" and "No Fallback" policies as part of its universal engineering core and strict execution rules. These policies ensure that the system operates with explicit authorization and fails immediately when dependencies, configurations, or operations do not meet strict requirements.
The project classifies normalized failures, fallbacks, and keyring usage as defects. These rules apply to all implementation phases, including agent execution, runtime behavior, and quality gates.
Sources: AGENTS.md:120-130, AGENTS.md:162-175
Strict Execution Framework
The project applies a cumulative set of policies under the "Strict Execution" rule. This framework mandates that every agent and process within the project rejects partial success or alternative execution paths.
No Fallback Policy
The "No Fallback" policy prohibits the system from attempting alternative methods when a primary operation fails. If a selected authorization, configuration, or required result is invalid, the system must fail without attempting a fallback.
- Non-optional: Existing behavior that uses fallbacks is a blocking violation.
- Immediate Failure: Errors must escape with a traceback and cause.
- No Normalization: Failures cannot be "caught" or normalized to appear successful.
Sources: .claude/rules/runtime--no-fallback.md:1-10, AGENTS.md:130-140, AGENTS.md:162-175
No Keyring Policy
The "No Keyring" policy forbids the use of local system keyrings or hidden credential stores for authentication. All required credentials must be provided explicitly via authorized environment variables or configuration files.
- Explicit Tokens: External token validation requires the token to be present; if missing, the operation is recorded as
NOT EXECUTED. - Direct Invocation: If a user directly invokes a tool requiring a token, the token becomes strictly required.
- Zero Hidden State: No background probes for credentials are permitted.
Sources: .claude/rules/runtime--no-keyring.md:1-10, AGENTS.md:130-135, AGENTS.md:144-150
Implementation in Quality Workflows
These policies govern how the system handles scheduled maintenance, external tool integrations, and notification channels.
Failure Logic in Maintenance
Scheduled maintenance tasks must follow strict error handling configurations. While retries are permitted if configured, the system must not "fallback" to older backups or partial states if a task fails definitively.
The diagram shows the strict flow where invalid configurations lead to immediate termination without fallback.
Sources: src/flext_quality/_models/flextqualitymodels_part_02.py:73-95
Notification Channel Validation
The system validates notification targets, such as Slack webhooks, against an allowlist before execution. If a target is not allowlisted, the system fails closed rather than falling back to a default channel.
| Component | Policy Requirement | Violation Example |
|---|---|---|
| Slack Notifier | Target must be in allowlist | Falling back to general channel if specific fails |
| Email Notifier | Password must be provided | Searching local keyring for SMTP credentials |
| Webhook Notifier | URL must be valid and authorized | Retrying with a secondary fallback URL |
Sources: tests/unit/test_docs_notifications.py:195-215, AGENTS.md:144-150
Related Data Structures
The policies are reflected in the configuration models, where defaults are kept typed and explicit rather than relying on dynamic discovery.
Execution Request Model
The ExecutionRequest model requires explicit paths and runtimes, preventing the system from guessing or falling back to system defaults if a specific runtime is missing.
class ExecutionRequest(_WebModels.ManagedModel):
"""Request payload for a deferred command execution."""
script_path: Path = _WebModels.Field(
description="Filesystem path of the script to execute.",
)
runtime: str = _WebModels.Field(
description=(
"Runtime used to execute the script (e.g. python, ruff)."
),
)
timeout_ms: int = _WebModels.Field(
description="Maximum time in milliseconds before termination.",
)
Sources: src/flext_quality/_models/flextqualitymodels_part_02.py:598-618
Summary
The "No Keyring" and "No Fallback" policies are non-optional constraints within flext-quality. They ensure that technical debt, such as symptom workarounds or hidden credential dependencies, is eliminated at the source. By requiring explicit inputs and failing loudly on error, the project maintains a zero-debt baseline and verifiable runtime behavior.
Sources: AGENTS.md:130-135, AGENTS.md:162-170