[groupthinking]

Canonical issue

Closes #2665.

Refs #2168 (AUDIT-006). This is a partial slice; do not close the broad audit issue. The dedicated tracking issue scopes this fix; the broader audit remains open.

Result

Expected deployment CLI and shared-store setup failures are caught by type; unexpected failures reach explicit logged boundaries. Deployment responses preserve completed GitHub work when a later Vercel step fails, while reporting overall failure. A partial GitHub receipt cannot make a failed Vercel handoff successful.

• Redact configured credentials in both expected CLI stderr/stdout failures and repr-escaped subprocess tracebacks.
• Validate malformed database URL ports separately; unrelated store-construction ValueErrors still propagate.
• Clear ambient database configuration before test imports and for each test.
• Inspect AST exception handlers, including tuple, multiline, bare and except* syntax, rather than counting matching lines.
• Integrate current main 512a2558f73d6281b6a880548bedf140b7e30292 without discarding either implementation.
• Disable automatic Vercel deployment for this exact review branch in root and app git.deploymentEnabled configuration.

Verification — November 12, 2026

Published head: 541845423e4838fbf1d6cdd903a4db7f8bf7ba3e. GitHub tree a6ce695b331d443a8285fc5b00f6fc0378a69e91 exactly matches the local tested tree. Branch ref readback verified publication.

Python 3.12.14; pytest 9.2.0; pytest-asyncio 1.5.0. No network, deployment, live database or model calls in the tests.

env -u DATABASE_URL -u EVENTRELAY_SHARED_STATE_DATABASE_URL PYTHONPATH=src python -m pytest tests/unit/test_exception_boundaries_2168.py tests/unit/test_agent_orchestrator.py tests/unit/test_deployment_handoff_failures.py tests/unit/test_antigravity_orchestration.py tests/unit/test_antigravity_backend.py tests/unit/test_one_click_deploy_precheck.py -o addopts='' -o log_cli=false -q

138 passed, exit 0 after main integration. One pre-existing unawaited-AsyncMock warning remains. Added regressions failed before their corresponding fixes: five initial cases for escaped credentials, partial receipts and malformed URL; five of six additional expected-CLI redaction cases. Whitespace checks pass; Ruff retains pre-existing Optional annotation findings, with no new import findings. Independent review identified the expected-CLI leak and the resulting correction is included.

Remaining gates

Keep draft and unmerged. New-head hosted CI and security results must be checked; prior-head green results do not cover this commit. No production or preview deployment is requested. The closing-keyword gate is not waived or weakened. Production deployment and full audit completion remain outside this slice.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Nov 9, 2026 6:28am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

⚠️ Repository reconciliation: this PR does not reference exactly one canonical issue.

Please add a Closes #<issue> reference in the PR description so it can be tracked against the delivery plan.

See governance: #898

[Copilot]

🟡 Changes recommended

Unresolved critical defects can expose deployment tokens in timeout logs, abort imports on malformed database URLs, and allow tests to read or write a real database.

5 open issues

• Redact escaped tokens before formatting timeout tracebacks · New
• Handle malformed database URLs without aborting imports · New
• Prevent ambient database access before test patches are active · New
• Preserve GitHub results when the Vercel step fails · New
• Detect broad exception handlers with AST analysis · New

What changed in this PR

This PR delivers the first slice of issue #2168’s exception-handling audit in UVAI’s internal agent runtime, focusing on deployment handoff and orchestration rather than repository-wide remediation.

Changes:

• Narrow deployment-step and shared SQL setup handlers to expected exception types.
• Add contextual exception logging, token redaction, and explicit boundary markers.
• Add simulated-failure tests and document handling standards and remaining work.

File	Description
tests/​unit/​test_exception_boundaries_2168.py	Tests failure reporting, exception propagation, redaction, and boundary markers.
src/​youtube_extension/​services/​agents/​adapters/​agent_orchestrator.py	Narrows shared-store setup handling and adds contextual boundary logs.
src/​agents/​mcp_tools/​deployment_tool.py	Narrows step handlers and adds identity errors and redacted failure reporting.
docs/​EXCEPTION_HANDLING_STANDARDS.md	Defines boundary markers and records this remediation slice and remaining scope.

_{Review effort: Max}

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (619 lines changed)