fix(boundary-check): address review comments

- Use full relative path for wrapper exemption, not basename-only
- Normalize paths with as_posix() for cross-platform consistency
- Catch eval/exec as bare calls and builtins.eval, not session.exec()
- Add os.system, subprocess.*, popen to FORBIDDEN_CALLS
- Exempt pre-existing subprocess.run sites as known tech debt
- Fail closed on SyntaxError instead of silent skip
- Move boundary check after setup-python in CI

Author: rahuldass19

.github/workflows/ci.yml

@@ -39,14 +39,14 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - name: Boundary Check (QWED Rules)
-      run: python scripts/check_boundary.py
-
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: "3.11"
 
+    - name: Boundary Check (QWED Rules)
+      run: python scripts/check_boundary.py
+
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip

fix_cache.py

@@ -0,0 +1 @@
+

scripts/check_boundary.py

@@ -13,10 +13,25 @@
 REPO_ROOT = Path(__file__).resolve().parent.parent
 SRC_DIR = REPO_ROOT / "src"
 
-# Files that are intentionally exempt because they ARE the approved boundary
-APPROVED_WRAPPER_FILES = {
-    "safe_parser.py",
-    "safe_evaluator.py",
+# Approved wrapper paths (relative to repo root) — basename matching is too broad
+APPROVED_WRAPPER_PATHS = {
+    "src/qwed_new/core/safe_parser.py",
+    "src/qwed_new/core/safe_evaluator.py",
+    # TODO: refactor these to safe_shell() — pre-existing debt, tracked in #tech-debt
+    "src/qwed_new/guards/state_guard.py",
+    "src/qwed_new/core/symbolic_verifier.py",
+}
+
+# Full call names that are forbidden outside approved wrappers (dotted names)
+FORBIDDEN_CALLS = {
+    "os.system",
+    "os.popen",
+    "subprocess.Popen",
+    "subprocess.call",
+    "subprocess.run",
+    "subprocess.check_call",
+    "subprocess.check_output",
+    "popen",
 }
 
 
@@ -42,28 +57,49 @@ def check_file(filepath: Path) -> list[str]:
     errors = []
     try:
         tree = ast.parse(filepath.read_text(encoding="utf-8"))
-    except SyntaxError:
+    except SyntaxError as exc:
+        errors.append(
+            f"  [PARSE_ERROR] {filepath.relative_to(REPO_ROOT)}:{exc.lineno}: "
+            "File could not be parsed; boundary check must fail closed"
+        )
         return errors
 
-    filename = filepath.name
+    relpath = filepath.relative_to(REPO_ROOT).as_posix()
+    in_wrapper = relpath in APPROVED_WRAPPER_PATHS
 
     for node in ast.walk(tree):
         if not isinstance(node, ast.Call):
             continue
 
         call_names = get_call_names(node)
-
-        if "parse_expr" in call_names and filename not in APPROVED_WRAPPER_FILES:
-            errors.append(
-                f"  [BARE_PARSE_EXPR] {filepath.relative_to(REPO_ROOT)}:{node.lineno}: "
-                f"Use safe_parse_expr() instead of bare parse_expr()"
-            )
+        if not call_names:
+            continue
 
         for name in call_names:
-            if name in {"eval", "exec"} and filename not in APPROVED_WRAPPER_FILES:
+            leaf = name.split(".")[-1]
+
+            # bare eval/exec → always dangerous
+            if leaf in {"eval", "exec"} and not in_wrapper:
+                # Flag if bare (exec(...)) or qualified as builtins.eval(...)
+                # Do NOT flag session.exec(...) or similar ORM method calls
+                if "." not in name or name.startswith("builtins."):
+                    errors.append(
+                        f"  [BARE_EVAL] {relpath}:{node.lineno}: "
+                        f"Disallowed call '{name}()' — use approved wrappers"
+                    )
+
+            # parse_expr: flag both bare and qualified (sympy.parse_expr etc.)
+            if leaf == "parse_expr" and not in_wrapper:
+                errors.append(
+                    f"  [BARE_PARSE_EXPR] {relpath}:{node.lineno}: "
+                    f"Disallowed call '{name}()' — use approved wrappers"
+                )
+
+            # os.system, subprocess.*, popen, system, spawn
+            if name in FORBIDDEN_CALLS and not in_wrapper:
                 errors.append(
-                    f"  [BARE_EVAL] {filepath.relative_to(REPO_ROOT)}:{node.lineno}: "
-                    f"Call to '{name}()' is not allowed \u2014 use approved wrappers"
+                    f"  [BARE_SHELL] {relpath}:{node.lineno}: "
+                    f"Disallowed call '{name}()' — use safe_shell() or approved wrapper"
                 )
 
     return errors