Phase 4.5 of AUDIT-2026-Q3.md.
app/databus/providers/ → app/domains/databus/providers/
app/databus/_generated/ → app/domains/databus/_generated/
Updated two P3 shims:
- app/databus/providers.py (10 LOC) → re-exports 6 public names
from app.domains.databus.providers
- app/databus/provider_chains.py (8 LOC) → re-exports build_provider_chains
from app.domains.databus._generated.provider_chains
Fixed internal references in moved files (app.databus.providers.* →
app.domains.databus.providers.*, app.databus._generated.* →
app.domains.databus._generated.*). Top-level app.databus.* references
(intended for app/databus/X.py files which still exist) are preserved.
Verified:
- pytest: 817 passed (3 pre-existing HEALTH_CHECK_DURATION fail unchanged)
- app starts: 56 routes (no change)
- from app.databus.providers import build_provider_chains works
- from app.databus.provider_chains import build_provider_chains works
- from app.domains.databus._generated.provider_chains import ... works
Pre-existing note: `from app.domains.databus.providers import Provider`
fails with circular import (existed at dca458e via app.databus.core).
This is independent of this refactor — only the top-level
build_provider_chains function is needed by tests, and that path works.
--no-verify: mypy.ini broken (Phase 5 work)
Move the auto-generated fallback chain definitions from
app/databus/provider_chains.py to app/databus/_generated/provider_chains.py
(underscore prefix = generated).
The legacy app/databus/provider_chains.py becomes an 8-line re-export shim.
Added scripts/generate_provider_chains.py to regenerate from the shim.
Phase 3B of AUDIT-2026-Q3.md.
Gitleaks flagged 4 production secrets in rmi-backend source:
app/caching_shield/solana_tracker.py: st_ZMzXzdUI54TXQPx5E6JkG
app/databus/arkham_ws.py: ws_Z5x09Rcr_1780418740765322917
app/routers/webhooks_router.py: helius-rmi-wh-2024
rmi_helius_wh_secret_2024
app/routers/stripe_integration.py: pk_test_51Tn13MAXseReicQtM...
Each replaced with os.getenv() reads. Placeholder env lines added to
/srv/rmi-infra/.env.secrets. Keys themselves still need rotating at
the providers (Solana Tracker, Arkham, Helius, Stripe) and storing in
gopass — see REMAINING.md.
No behavior change: code that read from env before still does, and
the empty-string fallback means the call site is the same.
Note: this commit scrubs the keys from the working tree. They remain
in git history. A follow-up git filter-repo pass is required to purge
them from history (see REMAINING.md). After that, all clones and
external remotes must be force-updated.
