[Shards-inc]

Scope

• Move all 59 implementation package files from kernels/ to shards_kernel/ and update Python consumers/tests/examples.
• Keep the PyPI distribution named shards-kernel and rename the console entrypoint to shards-kernel.
• Update CI, package build, wheel import checks, README and migration guidance.
• Explicitly remove automatic PyPI publishing from the release workflow pending owner approval.
• Add regression tests for distribution/import/CLI identity and built-wheel namespace.

Compatibility

Intentional breaking import change: from kernels ... becomes from shards_kernel .... No legacy kernels import alias is shipped because that top-level namespace collides with the unrelated Hugging Face PyPI package.

Verification gates

Awaiting GitHub CI, coverage, smoke demos and wheel build. This PR remains draft until verified. No PyPI publishing authorized.

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 critical · 1 medium · 1 minor

Alerts:
⚠ 3 issues (≤ 0 issues of at least minor severity)

Results:
3 new issues

Category	Results
Security	1 minor 1 critical 1 medium

View in Codacy

🟢 Metrics 1045 complexity · 29 duplication

Metric	Results
Complexity	1045
Duplication	29

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T22:27:17.125558Z	0397001	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

Three high-confidence blocking issues remain: the FastAPI adapter permits wildcard CORS by default, the async kernel relies on an optimization-strippable assertion for runtime control flow, and the Flask adapter registers duplicate policy routes. These can expose unintended API access or produce incorrect runtime behavior.

The documented async import and setup entry point are also broken. Packaging validation lacks regression coverage for legacy namespace leakage, and the release workflow lacks an automated check confirming that PyPI publishing remains disabled.

4 comments outside of the diff

shards_kernel/async_support/async_kernel.py

_{line 154 🔴 HIGH RISK}
Replace the assertion with an explicit exception so the invariant remains enforced in optimized execution.

shards_kernel/integrations/fastapi_adapter.py

_{line 82 🔴 HIGH RISK}
Make the default CORS policy deny-by-default, require explicitly configured trusted origins, and reject wildcard origins when credentials are enabled. Add tests for default and credentialed configurations.

shards_kernel/integrations/flask_adapter.py

_{line 104 🔴 HIGH RISK}
Remove the duplicate policy route or give the handlers distinct endpoints, and add an HTTP regression test confirming the intended route is registered once.

shards_kernel/integrations/langchain_adapter.py

_{line 162 🟡 MEDIUM RISK}
Suggestion: Rename input to tool_input or raw_input and update internal references and callers, preserving keyword compatibility if required.

Test suggestions

• Import the public API and verify it is identical between shards_kernel and shards_kernel.api.
• Verify distribution metadata and the shards-kernel console entry point.
• Invoke python -m shards_kernel --version successfully.
• Build a wheel and reject missing canonical files or leaked legacy namespace members.
• Run migrated CLI validate and replay commands.
• Verify migrated integrations, SDK, async wrappers, persistence, permits, and kernel variants.
• Verify the release workflow contains no PyPI publishing job.
• Run all documented demos and smoke checks using only the new namespace.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Build a wheel and reject missing canonical files or leaked legacy namespace members.
2. Verify the release workflow contains no PyPI publishing job.

Low confidence findings

• Verify that all supported Python versions can parse and run the migrated code, particularly the newer union-type syntax, or adjust the declared support matrix accordingly.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Replace this syntactically invalid import with the implemented shards_kernel.async_support package path.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

[codacy-production]

_{🟡 MEDIUM RISK}

Update this command to the implemented server entry point or add the missing module so the documented deployment path is executable.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: Add a narrowly scoped comment or suppression documenting that the executable and arguments are fixed test inputs and shell execution is disabled.

See Issue in Codacy
See Issue in Codacy

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0397001bd2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the retained Codacy scan to the new namespace

The namespace migration leaves .github/workflows/codacy.yml:38 running bandit -r kernels implementations -ll. Repository-wide search confirms that the implementation now lives exclusively under shards_kernel/, so the retained “Codacy Security Scan” no longer scans the main package on pushes, pull requests, or its weekly schedule. Updating the separate security workflow here does not update that job. Bandit's documentation defines -r as “find and process files in subdirectories”; its explicit target must also be changed to shards_kernel. See the Bandit CLI documentation.

Useful? React with 👍 / 👎.