Fix CI failures: black formatting, mypy types, integration test mock

- Run black on all 6 new/modified handler and test files
- Fix gateway_portal_handler.py mypy errors: add dict[str, Any] type args
  on all 4 bare `dict` return/param annotations, add type: ignore for
  untyped DockerHandler() call, fix pgmq send() to two-arg form
  send("gateway_portal_events", event)
- Add setup_dnssec to SimpleNamespace mock in test_phase_3_pki_inserts_ca_dns_record
  so the integration test survives phase_pki calling pki.setup_dnssec()
  when minimal.yaml has dnssec_enabled: true

Author: claude

netengine/handlers/gateway_handler.py

@@ -230,8 +230,8 @@ def _mirrored_internet_rules(self, config: "RealInternetConfig") -> str:
         for mirror in config.service_mirrors:
             # Allow traffic destined for the in-world service counterpart
             mirror_accepts += (
-                f'\n        ip daddr {mirror.in_world_service} tcp dport {{ 80, 443 }}'
-                ' ct state new accept'
+                f"\n        ip daddr {mirror.in_world_service} tcp dport {{ 80, 443 }}"
+                " ct state new accept"
             )
 
         return f"""\

netengine/handlers/gateway_portal_handler.py

@@ -54,10 +54,12 @@ async def execute(self, context: PhaseContext) -> None:
                 "deployed_at": datetime.utcnow().isoformat(),
             }
             context.runtime_state.save()
-            await self._emit_event(context, "gateway_portal.ready", context.runtime_state.gateway_portal_output)
+            await self._emit_event(
+                context, "gateway_portal.ready", context.runtime_state.gateway_portal_output
+            )
             return
 
-        docker = context.docker_client if context.docker_client is not None else DockerHandler()
+        docker = context.docker_client if context.docker_client is not None else DockerHandler()  # type: ignore[no-untyped-call]
         gateway = GatewayHandler(docker)
 
         # ── Real Internet ───────────────────────────────────────────────────
@@ -100,7 +102,7 @@ async def _apply_internet_policy(
         context: PhaseContext,
         gateway: GatewayHandler,
         portal: GatewayPortal,
-    ) -> dict:
+    ) -> dict[str, Any]:
         config = portal.real_internet
         context.logger.info(f"Real-internet mode: {config.mode.value}")
 
@@ -109,9 +111,7 @@ async def _apply_internet_policy(
         output: dict[str, Any] = {"mode": config.mode.value}
 
         if config.upstream_resolver_enabled and config.upstream_resolver_ip:
-            await self._configure_upstream_resolver(
-                context, config.upstream_resolver_ip
-            )
+            await self._configure_upstream_resolver(context, config.upstream_resolver_ip)
             output["upstream_resolver"] = config.upstream_resolver_ip
 
         if config.mode == GatewayRealInternetMode.MIRRORED and config.service_mirrors:
@@ -122,9 +122,7 @@ async def _apply_internet_policy(
 
         return output
 
-    async def _configure_upstream_resolver(
-        self, context: PhaseContext, resolver_ip: str
-    ) -> None:
+    async def _configure_upstream_resolver(self, context: PhaseContext, resolver_ip: str) -> None:
         """Inject an upstream forwarder into the CoreDNS root Corefile.
 
         Adds a ``forward . <resolver_ip>`` directive so that names not
@@ -137,25 +135,21 @@ async def _configure_upstream_resolver(
 
         try:
             corefile_patch = (
-                f"\n# Upstream internet resolver (gateway portal)\n"
-                f"forward . {resolver_ip}\n"
+                f"\n# Upstream internet resolver (gateway portal)\n" f"forward . {resolver_ip}\n"
             )
             corefile_append_cmd = [
-                "sh", "-c",
+                "sh",
+                "-c",
                 f"echo '{corefile_patch}' >> /etc/coredns/Corefile",
             ]
             exit_code, output = await context.docker_client.exec_command(
                 "netengine_coredns", corefile_append_cmd
             )
             if exit_code != 0:
-                context.logger.warning(
-                    f"Could not append upstream resolver to CoreDNS: {output}"
-                )
+                context.logger.warning(f"Could not append upstream resolver to CoreDNS: {output}")
             else:
                 # Reload CoreDNS to pick up the change
-                await context.docker_client.exec_command(
-                    "netengine_coredns", ["kill", "-HUP", "1"]
-                )
+                await context.docker_client.exec_command("netengine_coredns", ["kill", "-HUP", "1"])
                 context.logger.info(f"Upstream resolver configured: {resolver_ip}")
         except Exception as exc:
             context.logger.warning(f"Upstream resolver setup skipped: {exc}")
@@ -170,16 +164,15 @@ async def _apply_cross_world(
         gateway: GatewayHandler,
         docker: DockerHandler,
         portal: GatewayPortal,
-    ) -> dict:
+    ) -> dict[str, Any]:
         cross_world = portal.cross_world
 
         if cross_world.mode == GatewayCrossWorldMode.NONE:
             context.logger.info("Cross-world mode: NONE — no peering configured")
             return {"mode": GatewayCrossWorldMode.NONE.value, "peers": []}
 
         context.logger.info(
-            f"Cross-world mode: {cross_world.mode.value} "
-            f"({len(cross_world.peers)} peer(s))"
+            f"Cross-world mode: {cross_world.mode.value} " f"({len(cross_world.peers)} peer(s))"
         )
 
         peers_output = []
@@ -198,7 +191,7 @@ async def _setup_peer(
         gateway: GatewayHandler,
         docker: DockerHandler,
         peer: CrossWorldPeer,
-    ) -> dict:
+    ) -> dict[str, Any]:
         """Wire up a single cross-world peer: trust anchor + routing + DNS."""
         context.logger.info(f"Setting up cross-world peer: {peer.name} ({peer.endpoint})")
         result: dict[str, Any] = {
@@ -213,9 +206,7 @@ async def _setup_peer(
                 await self._install_trust_anchor(context, docker, peer.name, peer.trust_anchor_cert)
                 result["trust_anchor_installed"] = True
             except Exception as exc:
-                context.logger.warning(
-                    f"Trust anchor install failed for peer {peer.name}: {exc}"
-                )
+                context.logger.warning(f"Trust anchor install failed for peer {peer.name}: {exc}")
                 result["trust_anchor_installed"] = False
                 result["trust_anchor_error"] = str(exc)
         else:
@@ -272,15 +263,11 @@ async def _install_trust_anchor(
             "netengine_gateway", ["update-ca-certificates"]
         )
         if exit_code != 0:
-            raise PKIError(
-                f"update-ca-certificates failed for peer {peer_name}: {output}"
-            )
+            raise PKIError(f"update-ca-certificates failed for peer {peer_name}: {output}")
 
         context.logger.info(f"Trust anchor installed for peer: {peer_name}")
 
-    async def _configure_peer_dns(
-        self, context: PhaseContext, peer: CrossWorldPeer
-    ) -> None:
+    async def _configure_peer_dns(self, context: PhaseContext, peer: CrossWorldPeer) -> None:
         """Add a CoreDNS forwarding zone for the peer world's TLD.
 
         Derives the peer TLD from ``<peer.name>.internal`` and adds a
@@ -304,9 +291,7 @@ async def _configure_peer_dns(
             ["sh", "-c", f"echo '{corefile_stub}' >> /etc/coredns/Corefile"],
         )
         if exit_code != 0:
-            raise GatewayError(
-                f"Could not configure DNS forwarding for peer {peer.name}: {output}"
-            )
+            raise GatewayError(f"Could not configure DNS forwarding for peer {peer.name}: {output}")
 
         # Signal CoreDNS to reload config
         await context.docker_client.exec_command("netengine_coredns", ["kill", "-HUP", "1"])
@@ -316,7 +301,9 @@ async def _configure_peer_dns(
     # Event emission
     # ─────────────────────────────────────────────
 
-    async def _emit_event(self, context: PhaseContext, event_type: str, payload: dict) -> None:
+    async def _emit_event(
+        self, context: PhaseContext, event_type: str, payload: dict[str, Any]
+    ) -> None:
         event = EventEnvelope.create(
             event_type=event_type,
             emitted_by="gateway_portal_handler",
@@ -327,6 +314,6 @@ async def _emit_event(self, context: PhaseContext, event_type: str, payload: dic
         context.logger.info(f"Event emitted: {event_type}")
         if context.pgmq_client is not None:
             try:
-                await context.pgmq_client.send(event)
+                await context.pgmq_client.send("gateway_portal_events", event)
             except Exception as exc:
                 context.logger.warning(f"Failed to queue gateway portal event: {exc}")

netengine/handlers/phase_pki.py

@@ -172,9 +172,7 @@ def _register_rotation_worker(self, context: PhaseContext, pki: PKIHandler, spec
                     rotation_interval_hours=interval,
                     expiry_warning_days=warning,
                     rotation_callback=(
-                        self._prepare_app_cert_rotation
-                        if cert_type in _callback_types
-                        else None
+                        self._prepare_app_cert_rotation if cert_type in _callback_types else None
                     ),
                 )
             )

netengine/handlers/pki_handler.py

@@ -353,38 +353,39 @@ async def setup_dnssec(
             image=bind_image,
             command=[
                 "dnssec-keygen",
-                "-f", "KSK",
-                "-a", "ECDSAP256SHA256",
-                "-n", "ZONE",
+                "-f",
+                "KSK",
+                "-a",
+                "ECDSAP256SHA256",
+                "-n",
+                "ZONE",
                 zone,
             ],
             volumes=volumes,
             environment={},
             working_dir="/keys",
         )
         if ksk_result["exit_code"] != 0:
-            raise PKIError(
-                f"DNSSEC KSK generation failed for zone '{zone}': {ksk_result['logs']}"
-            )
+            raise PKIError(f"DNSSEC KSK generation failed for zone '{zone}': {ksk_result['logs']}")
         ksk_name = ksk_result["logs"].strip()
 
         # ZSK — signs all other RRsets
         zsk_result = await self.docker.run_container_one_off(
             image=bind_image,
             command=[
                 "dnssec-keygen",
-                "-a", "ECDSAP256SHA256",
-                "-n", "ZONE",
+                "-a",
+                "ECDSAP256SHA256",
+                "-n",
+                "ZONE",
                 zone,
             ],
             volumes=volumes,
             environment={},
             working_dir="/keys",
         )
         if zsk_result["exit_code"] != 0:
-            raise PKIError(
-                f"DNSSEC ZSK generation failed for zone '{zone}': {zsk_result['logs']}"
-            )
+            raise PKIError(f"DNSSEC ZSK generation failed for zone '{zone}': {zsk_result['logs']}")
         zsk_name = zsk_result["logs"].strip()
 
         return {

tests/integration/test_dns_add_zone_record_callers.py

@@ -29,6 +29,17 @@ async def test_phase_3_pki_inserts_ca_dns_record(context_with_zone_files):
         ca_ip="10.0.0.6",
         ca_dns="ca.platform.internal",
         bootstrap=AsyncMock(),
+        setup_dnssec=AsyncMock(
+            return_value={
+                "zone": "internal",
+                "ksk_name": "Kinternal.+013+00001",
+                "zsk_name": "Kinternal.+013+00002",
+                "volume": "netengines_dnssec_keys",
+                "algorithm": "ECDSAP256SHA256",
+                "ksk_lifetime_days": 365,
+                "zsk_lifetime_days": 30,
+            }
+        ),
     )
 
     with (

tests/test_gateway_portal.py

@@ -16,10 +16,15 @@
 from netengine.errors import GatewayError
 from netengine.handlers.gateway_handler import GatewayHandler
 from netengine.handlers.gateway_portal_handler import GatewayPortalHandler
-from netengine.spec.models import CrossWorldConfig, CrossWorldPeer, GatewayPortal, RealInternetConfig, ServiceMirror
+from netengine.spec.models import (
+    CrossWorldConfig,
+    CrossWorldPeer,
+    GatewayPortal,
+    RealInternetConfig,
+    ServiceMirror,
+)
 from netengine.spec.types import GatewayCrossWorldMode, GatewayRealInternetMode
 
-
 # ─────────────────────────────────────────────
 # Fixtures
 # ─────────────────────────────────────────────
@@ -143,6 +148,7 @@ async def test_mirrored_passes_config_to_rule_generator(self, gateway, mock_dock
         def capture_open(path, mode="r", **kw):
             if isinstance(path, str) and path.endswith(".nft") and "w" in mode:
                 import io
+
                 buf = io.StringIO()
                 buf.name = path
                 written_content.append(buf)
@@ -151,12 +157,15 @@ def capture_open(path, mode="r", **kw):
 
         with patch("tempfile.NamedTemporaryFile") as mock_tmp, patch("os.unlink"):
             import io
+
             buf = io.StringIO()
             buf.name = "/tmp/fake.nft"
-            mock_tmp.return_value.__enter__ = MagicMock(return_value=MagicMock(
-                write=lambda s: written_content.append(s),
-                name="/tmp/fake.nft",
-            ))
+            mock_tmp.return_value.__enter__ = MagicMock(
+                return_value=MagicMock(
+                    write=lambda s: written_content.append(s),
+                    name="/tmp/fake.nft",
+                )
+            )
             mock_tmp.return_value.__exit__ = MagicMock(return_value=False)
             await gateway.apply_internet_policy(config)
 
@@ -339,6 +348,7 @@ def test_intermediate_ca_cert_defaults_to_none(self):
 
     def test_new_fields_survive_save_load_cycle(self, tmp_path, monkeypatch):
         import os
+
         state_path = tmp_path / "state.json"
         monkeypatch.setenv("NETENGINE_STATE_FILE", str(state_path))
 

tests/test_pki_features.py

@@ -20,7 +20,6 @@
 from netengine.handlers.pki_handler import PKIHandler
 from netengine.workers.pki_cert_rotation_worker import CertTypeRotationConfig
 
-
 # ─────────────────────────────────────────────
 # Fixtures
 # ─────────────────────────────────────────────
@@ -87,9 +86,7 @@ async def test_read_intermediate_uses_correct_path(self, pki_handler, mock_docke
         # _read_file_from_volume remaps /home/step → /data
         assert "intermediate_ca.crt" in " ".join(cmd)
 
-    async def test_bootstrap_stores_intermediate_cert_when_enabled(
-        self, mock_docker, state
-    ):
+    async def test_bootstrap_stores_intermediate_cert_when_enabled(self, mock_docker, state):
         spec = {
             "pki": {
                 "acme": {"listen_ip": "10.0.0.6", "canonical_name": "ca.platform.internal"},
@@ -103,9 +100,15 @@ async def test_bootstrap_stores_intermediate_cert_when_enabled(
         def side_effect(**kwargs):
             cmd = kwargs.get("command", [])
             if "intermediate_ca.crt" in " ".join(cmd):
-                return {"exit_code": 0, "logs": "-----BEGIN CERTIFICATE-----\nINTERMEDIATE\n-----END CERTIFICATE-----"}
+                return {
+                    "exit_code": 0,
+                    "logs": "-----BEGIN CERTIFICATE-----\nINTERMEDIATE\n-----END CERTIFICATE-----",
+                }
             if "ca.crt" in " ".join(cmd):
-                return {"exit_code": 0, "logs": "-----BEGIN CERTIFICATE-----\nROOT\n-----END CERTIFICATE-----"}
+                return {
+                    "exit_code": 0,
+                    "logs": "-----BEGIN CERTIFICATE-----\nROOT\n-----END CERTIFICATE-----",
+                }
             if "password.txt" in " ".join(cmd) and cmd[0] == "cat":
                 return {"exit_code": 0, "logs": "secret-password"}
             return {"exit_code": 0, "logs": ""}
@@ -178,9 +181,7 @@ def capture_write(**kwargs):
                 return {"exit_code": 0, "logs": json.dumps(ca_config)}
             return {"exit_code": 0, "logs": ""}
 
-        mock_docker.run_container_one_off = AsyncMock(
-            side_effect=lambda **kw: capture_write(**kw)
-        )
+        mock_docker.run_container_one_off = AsyncMock(side_effect=lambda **kw: capture_write(**kw))
 
         with patch("tempfile.NamedTemporaryFile") as mock_tmp, patch("os.unlink"):
             mock_file = MagicMock()
@@ -220,7 +221,9 @@ async def test_setup_dnssec_returns_key_names(self, pki_handler, mock_docker):
                 {"exit_code": 0, "logs": "Kinternal.+013+05678"},
             ]
         )
-        result = await pki_handler.setup_dnssec("internal", ksk_lifetime_days=365, zsk_lifetime_days=30)
+        result = await pki_handler.setup_dnssec(
+            "internal", ksk_lifetime_days=365, zsk_lifetime_days=30
+        )
         assert result["zone"] == "internal"
         assert result["ksk_name"] == "Kinternal.+013+01234"
         assert result["zsk_name"] == "Kinternal.+013+05678"
@@ -262,6 +265,7 @@ async def test_setup_dnssec_raises_on_zsk_failure(self, pki_handler, mock_docker
 
     async def test_pki_flag_reads_from_pydantic_model(self):
         from unittest.mock import MagicMock
+
         spec = MagicMock()
         spec.pki.dnssec_enabled = True
         handler = PKIHandler(MagicMock(), RuntimeState(), spec)
@@ -331,9 +335,9 @@ def test_extra_cert_types_from_overrides_are_included(self):
         assert "mail" in types
 
     def test_override_values_are_applied_to_cert_type(self):
-        ctx, spec = self._make_context({
-            "app": {"rotation_interval_hours": 6, "expiry_warning_days": 7}
-        })
+        ctx, spec = self._make_context(
+            {"app": {"rotation_interval_hours": 6, "expiry_warning_days": 7}}
+        )
         configs = self._run_and_capture(ctx, spec, PKIPhaseHandler())
         app_cfg = next(c for c in configs if c.cert_type == "app")
         assert app_cfg.rotation_interval_hours == 6