@claude review. Focus on critical issues: bugs, security vulnerabilities, logical errors, data loss risks, performance problems. Do NOT nitpick style, naming conventions, minor formatting, or subjective preferences — only flag issues that could break functionality or cause real harm in production.

Claude finished @axisrow's task in 3m 33s —— View job

PR Review: docs/wire-shape scanner

Reviewed scripts/audit_wire_shape.py + tests/test_audit_wire_shape.py for correctness. This is an offline dev/audit tool (not production runtime), so I weighted findings by whether they would produce wrong audit results — which is the real harm vector here, since follow-up "fix" PRs are meant to act on these findings.

🔴 1. _v5_per_method_url drops the resource segment for single-segment docs bases

scripts/audit_wire_shape.py:532-541 assumes every docs base ends in a doubled segment (…/ru/campaigns/campaigns) and unconditionally chops the last segment:

base = docs_base.rstrip("/")
parent, _, tail = base.rpartition("/")
return f"{parent}/{method}" if parent else f"{base}/{method}"

But several registry entries are single-segment (resource_mapping.py:81,86,121,157) with no docs_pages override (only 1 docs_pages entry exists in the whole file):

• dynamictextadtargets → docs="…/ru/dynamictextadtargets"
• dynamicfeedadtargets → docs="…/ru/dynamicfeedadtargets"
• vcards → docs="…/ru/vcards"
• smartadtargets → docs="…/ru/smartadtargets"

For these, op get derives …/ru/get instead of …/ru/dynamictextadtargets/get — the resource name is dropped. Result: ~24 v5 method-pages across 4 groups are fetched at wrong URLs that 404/captcha, so those resources are silently not audited while still appearing in the run. Real gaps in those 4 groups would be masked.

The test at tests/test_audit_wire_shape.py:140-145 actually enshrines the wrong output (…/ru/dynamictextadtargets + get → …/ru/get), so the bug is locked in by a passing test.

Fix: only chop the tail when it duplicates the parent segment; otherwise append the method to the full base.

Fix this →

🟠 2. Parser is only validated against an idealized mock — verify findings against real HTML before acting on them

_FIELD_RE (audit_wire_shape.py:192-194) requires the closing quote to be immediately adjacent to the identifier:

r"(?:"|\")([A-Za-z][A-Za-z0-9_]*)(?:"|\")\s*:"

The only test fixture (_MOCK_LIVE_PAGE) is hand-built to match this exactly. Real Yandex docs render JSON inside syntax-highlighted <code> blocks where tokens are wrapped in <span>s; after strip_html replaces tags with spaces, "Currency" can become " Currency " — quote no longer adjacent → no match.

Because docs_field_missing_in_code is an exit-1 error kind (audit_wire_shape.py:762-768), a parser that mis-reads real HTML can emit false HIGH-severity gaps. The headline findings (GetEventsLog missing 11 fields, CreateNewForecast missing 3) are entirely parser-derived and not covered by any test against real captured HTML. Before opening the deferred per-gap fix PRs, spot-check 2–3 of these against the actual rendered docs (or add a golden test using a real captured page) so you're not fixing contracts based on extraction artifacts. The committed tests/reports_cache/raw/*.html show real captured pages are already available as fixtures.

🟡 3. Hardcoded Yandex URL literals violate the "No URL literals outside the registry" rule

CLAUDE.md: "Every Yandex docs/API URL is declared once … never write the URL as a string literal anywhere else. Captcha-poisoning of the docs cache (#426) was possible only because the same URL was duplicated."

This PR re-introduces that duplication:

• audit_wire_shape.py:71 REPORTS_SPEC_URL = "…/ru/spec" — already declared at direct_cli/reports_coverage.py:27 (REPORTS_SPEC_URLS["spec"]). Import it instead.
• audit_wire_shape.py:69-70 V4_LIVE_BASE / V4_REFERENCE_BASE — new URL literals not sourced from any registry.
• tests/test_audit_wire_shape.py:137-144 hardcodes docs URLs in assertions (the exact pattern reports drift checker: hard-coded URLs retired by Yandex (type / fields-list / period / spec.html) #426 warns against).

No automated AST guard enforces this today, so CI won't catch it, but it directly contradicts a documented invariant that exists for a security reason.

✅ Looks correct

• Captcha/thin/HTTP retry logic in fetch_doc is sound; never aborts, records captcha-after-retries, and non-ok statuses correctly continue so blocked pages don't generate false field diffs.
• _collect_example_keys recursion over nested dicts/lists is correct (verified by the per-type mis-attribution being harmless since v4 flattens to a union set).
• Reports smoke-marker check and exit-code gating are reasonable.

Summary: One real correctness bug (#1, with a test that locks it in) that causes 4 v5 resource groups to be silently mis-audited; one methodological risk (#2) worth resolving before the follow-up fix PRs land; one convention/security-hygiene issue (#3). None block the tool from running, but #1 and #2 affect the trustworthiness of the findings this PR is meant to produce.
· audit/full-project-docs-wire-shape

Триаж ревью (проверено по реальному коду):

🔴 Находка 1 (FIX — исправлено в 801324c): баг подтверждён. _v5_per_method_url безусловно резал хвост, и для одиночных docs-баз (vcards, smartadtargets, dynamictextadtargets, dynamicfeedadtargets — реальные записи в resource_mapping.py без doubling) метод get давал …/ru/get, теряя имя ресурса → 4 группы молча не аудировались. Теперь хвост режется только если он дублирует родительский сегмент; одиночные базы дополняются методом к полной базе. Тест, закреплявший …/ru/get, исправлен + добавлен regression-guard для vcards.

🟡 Находка 3 (частично FIX — исправлено в 801324c): REPORTS_SPEC_URL теперь импортирует REPORTS_SPEC_URLS["spec"] из реестра вместо дублирования литерала (как требует CLAUDE.md). По V4_LIVE_BASE/V4_REFERENCE_BASE: этих URL нет ни в одном реестре проекта вовсе (v4-доки не имеют выделенного registry-модуля) — это пограничный случай, вынос в реестр оставлен как отдельный follow-up, чтобы не расширять scope этого PR. AST-гарда на URL-литералы в CI сейчас нет, так что инвариант не гейтится автоматически.

🟠 Находка 2 (SKIP / follow-up): риск реальный (regex _FIELD_RE требует кавычку вплотную; golden-фикстура только синтетическая). Но заголовочные находки парсера (GetEventsLog 9+5 полей, CreateNewForecast 6 полей) я независимо сверил с живыми dg-v4/live/* доками — они совпали, т.е. это риск будущих ложных срабатываний, а не текущий баг. Добавление golden-теста на захваченном HTML вынесено в follow-up, не блокирует merge.

Локально: ruff check . чисто, полный offline-набор pytest -m 'not integration' — 1923 passed, 46 skipped (вкл. новые кейсы).

@claude review. Focus on critical issues: bugs, security vulnerabilities, logical errors, data loss risks, performance problems. Do NOT nitpick style, naming conventions, minor formatting, or subjective preferences — only flag issues that could break functionality or cause real harm in production.

Claude finished @axisrow's task in 1m 9s —— View job

Re-review: docs/wire-shape scanner (post-801324c)

Re-checked the three prior findings against the current code, plus a fresh pass for new critical issues.

✅ Finding #1 (_v5_per_method_url) — correctly fixed

scripts/audit_wire_shape.py:547-553 now only chops the tail when it duplicates the parent segment:

parent, _, tail = base.rpartition("/")
if parent:
    grandparent, _, parent_tail = parent.rpartition("/")
    if tail == parent_tail:
        return f"{parent}/{method}"
return f"{base}/{method}"

Traced both paths:

• Doubled …/ru/campaigns/campaigns + add → tail="campaigns", parent_tail="campaigns" → match → …/ru/campaigns/add ✅
• Single …/ru/dynamictextadtargets + get → tail="dynamictextadtargets", parent_tail="ru" → no match → …/ru/dynamictextadtargets/get ✅ (resource name preserved)

The test at tests/test_audit_wire_shape.py:133-158 was corrected and a vcards regression guard added. The 4 mis-audited v5 groups (vcards/smartadtargets/dynamic*) are now fetched at the right URLs. Resolved.

✅ Finding #3 (URL literals) — primary case fixed

REPORTS_SPEC_URL now imports REPORTS_SPEC_URLS["spec"] (audit_wire_shape.py:75) instead of duplicating the literal. V4_LIVE_BASE/V4_REFERENCE_BASE remain literals, but there is genuinely no v4 docs registry to source them from — deferring the registry extraction to a follow-up is a reasonable scope call. Acceptable.

✅ Finding #2 (parser regex) — risk acknowledged, deferred

Still no golden test against captured real HTML, but you independently cross-checked the headline dg-v4/live/* findings against the rendered docs. Adding a real-HTML fixture before the per-gap fix PRs land remains the right follow-up. No new blocker.

New observation (low severity — not a blocker)

notes_points_at_reference_url can fire on captcha'd pages. At audit_wire_shape.py:419-436, url_used only switches to reference_url when the live page returns http-404/http-410. A captcha response keeps url_used == live_url, so the FINDING_NOTES_REFERENCE_URL check at line 427 fires even though the live page was never actually verified to contain a Live 4 schema.

Since this is an exit-1 error kind and 15/16 v4 methods were captcha-blocked in this run, the finding asserts "live exists, switch off reference" on the basis of a page we couldn't read. It's not a false read of code state (the notes check is static), but it overstates confidence in the live page's existence. Tightening it to require fetched.status == "ok" before flagging would make the finding trustworthy under captcha:

if "dg-v4/reference/" in notes and url_used == live_url and fetched.status == "ok":

Fix this →

Verdict

All three prior findings are resolved or reasonably deferred. The _v5_per_method_url fix is correct and test-guarded. No new critical bugs, security issues, or data-loss risks. The one observation above is a minor robustness improvement to finding trustworthiness under captcha — it does not block merge, especially since this is an offline audit tool whose findings already require manual triage before any contract fix lands.

LGTM to merge.
· audit/full-project-docs-wire-shape