STATUS -- rmi-backend

Owner: Rug Munch Media LLC Engineering Last updated: 2026-07-07 -- Phase 4 domain consolidation in progress; P4.1-P4.8 + P5.1 complete.

What This Repo Is

rmi-backend -- Rugmuncher Intel FastAPI backend.

Stack: Python 3.12 / FastAPI / SQLAlchemy / async / Playwright / Pydantic v2 / Redis / Vectis / ClickHouse.

643 .py files, 241k LOC under app/. Production deploy on Talos: /srv/rmi-infra/.

Current Status

Phase 4 (domain consolidation) is active. Foundation (Phase 1) is solid, dead-router wiring (Phase 2) is partial, god-file splitting (Phase 3) is deferred, and standardization (Phase 5) has begun with CI trustworthiness and mypy config cleanup.

Phase 1 -- DONE

Committed to main:

e404e90 -- app/main.py entrypoint delegating to factory
c1d157a -- tests/ package (__init__.py everywhere)
da2696a -- pyproject.toml:tool.setuptools.packages.find makes app importable
e0d0ae3 -- main.py.bak .gitignored + removed from index
9c62549 -- JWT_SECRET fail-fast in prod (Field(...) no default + validator)
f4d4276 -- ruff.toml deleted (pyproject canonical)
13255d6 -- .github/workflows/ci.yml: 2 gating jobs (build + test), 6 informational
7a9043f -- pre-commit install wired into make install
e8f9b09 -- tests/test_rag.py + run_tests.py moved to tests/manual/
92a01ff + 5294983 -- AppError hierarchy in app/core/errors.py, wired through error_handlers.py
cd02714 + 2fb571e -- author amend (canonical identity: cryptorugmunch <admin@rugmunch.io>)

Phase 2 -- IN PROGRESS (partial)

Rather than deleting 148 routers, we validated and mounted the useful ones in app/mount.py Wave 1-3 (2026-07-07). Dead routers remain in tree and will be archived in a later pass.

Phase 3 -- NOT STARTED

God-files (x402_tools.py, x402_enforcement.py, auth.py, databus/providers.py, telegram_bot/bot.py, wallet_manager_v2.py) still await splitting.

Phase 4 -- IN PROGRESS

Domain consolidation (AUDIT-2026-Q3 P4.x) — committed to main:

dca458e -- P4.1 billing (app/billing/ + app/facilitators/ → app/domains/billing/)
7109a16 -- P4.2 wallet (app/wallet/ → app/domains/wallet/)
948e41c -- P4.3 auth (app/auth/ → app/domains/auth/)
cab9740 -- P4.4 tokens (app/tokens/ → app/domains/tokens/)
ed5b830 -- P4.5 databus (providers/ + _generated/ → app/domains/databus/)
56075cf -- P4.6 telegram (rugmunchbot/ → app/domains/telegram/rugmunchbot/)
3b7ef42 -- P4.7 rename app/domain/ → app/domains/ + consolidate
7cced4e + 4686cb3 -- P4.8 scanners (app/scanners/ → app/domains/scanners/)

Remaining Phase 4:

Finish databus root migration (app/databus/ engine → app/domains/databus/)
Finish telegram migration (app/telegram_bot/ → app/domains/telegram/)
Clean up deprecated shim dirs (app/auth/, app/wallet/, app/billing/, app/facilitators/, app/scanners/, app/domain/)
Consolidate bulletin, intelligence, markets, admin, referral, MCP domains

Phase 5 -- STARTED

d666ad2 -- P5.1 HEALTH_CHECK_DURATION + test_factory_has_minimum_routes
4686cb3 -- mypy config fixes (mypy.ini regex, disallow_any_explicit typo, app.domains.* module pattern)
Still open: alembic, real coverage gate, structured logging, Sentry wiring, Prometheus middleware

What Phase 1-4 DID NOT do (deferred)

~2K ruff warnings in legacy code (Phase 5)
Real coverage 8.17% -> 80% gate (Phase 5)
Alembic migrations (still MISSING; Phase 5)
God-files split (Phase 3)

Open Issues

(None blocking deploy. Track via Forgejo issues as they arise.)

Recent Activity (last 12 commits)

cd02714 test(rmi-backend,audit): move tests/test_rag.py to tests/manual/ (P1.9)
2fb571e build(rmi-backend,audit): install pre-commit hooks + wire into make install (P1.7)
13255d6 ci(rmi-backend,audit): split gating vs informational jobs (P1.6)
5294983 refactor(rmi-backend,audit): wire error_handlers.py to AppError at import time (P1.10 wiring)
92a01ff feat(rmi-backend,audit): AppError hierarchy in app/core/errors.py (P1.10)
da2696a build(rmi-backend,audit): declare app/ as installable Python package (P1.3)
9c62549 fix(rmi-backend,audit): jwt_secret is required, fail-fast in prod (P1.5)
f4d4276 chore(rmi-backend,audit): delete ruff.toml -- pyproject.toml [tool.ruff] is canonical (P1.8)
e0d0ae3 chore(rmi-backend,audit): gitignore main.py.bak (P1.4)
c1d157a test(rmi-backend,audit): add tests __init__.py for package discovery (P1.2)
e404e90 feat(rmi-backend,audit): add app/main.py entrypoint delegating to factory (P1.1)
1c815c0 docs(audit): add 2026-Q3 audit + 6-phase production-grade roadmap (master ref for rmi-backend/frontend)

Security

JWT_SECRET mandatory in prod (Field(...) no default + validator catching dev secret). Fail-fast verified across 5 scenarios.
gitleaks detect reports 28 findings -- all public ERC-20/Solana token contract addresses (USDC, WETH, MATIC, BONK, DAI, plus cryptoscam-address dataset). NOT secrets. Suppressed via .gitleaksignore + .gitleaks.toml [allowlist]. No rotation needed.
All secrets live in gopass under rmi/contacts/admin_recovery etc.

Next: Phase 4 completion

Finish app/databus/ engine migration to app/domains/databus/.
Finish app/telegram_bot/ migration to app/domains/telegram/rugmunchbot/.
Remove deprecated shim directories (app/auth/, app/wallet/, app/billing/, app/facilitators/, app/scanners/, app/domain/).
Consolidate bulletin, intelligence, markets, admin, referral, MCP into app/domains/.

See AUDIT-2026-Q3.md for the full 6-phase plan.

5.6 KiB Raw Blame History