chore: remove orphaned TLS proxy + reproducer (now dead code) - #39
Merged
Conversation
With PR #36's flare reactor-side TLS path shipped, the following files are no longer reachable from the production binary: - opengateway/mojo_bridge/tls_proxy.py -- vendored stdlib-ssl proxy. The reactor-side bind_tls/serve_tls in main.mojo replaces it; the wrapper was reverted from main.mojo when we discovered the proxy's daemon-thread recv stalls when the reactor also calls into the Python bridge (later diagnosed as a cert hostname issue, not the proxy). Kept around as a "vendored fallback" for the flare v0.9.0 pin, but nothing in main.mojo imports it and the diagnostic it was designed to enable is no longer relevant. - tests/test_tls_proxy.py -- the 3 tests for the above. Validated the proxy worked in pure Python (pytest passed), but with the proxy unwired they're pure overhead. - opengateway/mojo/repro_tls_thread.mojo + opengateway/mojo_bridge/_repro_tls.py -- the minimal reproducer for the stdlib-ssl + Mojo-runtime daemon-thread interaction that was filed as modular/modular#6865. That issue was closed (the only observable "stall" was cert hostname verification, not a runtime bug), and the reproducer no longer serves a purpose. Also add uv.lock to .gitignore -- opengateway uses pixi for env management, uv-generated lockfiles shouldn't be in the repo. Cleaned up opengateway/mojo_bridge/__init__.py to drop the start_tls_proxy import/export, and removed the corresponding "vendored fallback" paragraph from ADR-003 #4 since the fallback no longer exists. Verified: 39 pytest pass (down from 42 -- the 3 tls_proxy tests gone), ruff + mypy clean, Mojo router tests pass. Co-authored-by: opencode-agent <noreply@opencode.ai>
johnnyhuy
force-pushed
the
cleanup/remove-orphaned-tls-stuff
branch
from
August 9, 2026 07:09
8dbde26 to
e2e5a44
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
With PR #36's flare reactor-side TLS path shipped, several files left over from earlier investigation are no longer reachable from the production binary:
opengateway/mojo_bridge/tls_proxy.py— vendored stdlib-ssl proxy. Was meant as a fallback path when flare reactor TLS wasn't available; never wired into main.mojo after the fallback was reverted.tests/test_tls_proxy.py— 3 tests for the above (verified the proxy worked in pure Python).opengateway/mojo/repro_tls_thread.mojo+opengateway/mo_bridge/_repro_tls.py— the Mojo + Python halves of the minimal reproducer for the stdlib-ssl + daemon-thread interaction filed as [BUG] stdlib-ssl daemon thread recv/send stalls while Mojo reactor calls into Python bridge modular/modular#6865. That issue was closed (the only observable "stall" turned out to be cert hostname verification, not a runtime bug), so the reproducer no longer serves a purpose.Also:
uv.lock→.gitignore. opengateway uses pixi for env management; a uv-generated lockfile shouldn't be in the repo.Cleanup also touches
opengateway/mojo_bridge/__init__.py: drop thestart_tls_proxyimport and__all__entry.adr/003-mojo-default.mdAdd routing guardrails for cost caps and provider fallback #4: remove the "vendored fallback for the v0.9.0 pin" paragraph since the fallback no longer exists.Verification
uv run pytest— 39 passed (down from 42 — the 3 tls_proxy tests are gone).make mojo-test— 8 Mojo router tests passed.uv run ruff check opengateway/ tests/— clean.uv run ruff format --check opengateway/ tests/— clean.uv run mypy opengateway/— no issues found.