Function init

src/init.py:63–112

Bootstrap initialization. Idempotent across multiple callers. Substeps (each profiled): 1. ``apply_safe_config_environment_variables`` — pre-trust env subset. 2. ``setup_graceful_shutdown`` — SIGINT/SIGTERM handlers. 3. ``start_api_preconnect`` — DNS+TLS warmup (moved from cli.main)

()

@cache
def init() -> None:
    """Bootstrap initialization. Idempotent across multiple callers.

    Substeps (each profiled):
    1. ``apply_safe_config_environment_variables`` — pre-trust env subset.
    2. ``setup_graceful_shutdown`` — SIGINT/SIGTERM handlers.
    3. ``start_api_preconnect`` — DNS+TLS warmup (moved from cli.main).
    4. Placeholder for plan-phase-2: remote-managed-settings init.
    5. Placeholder for plan-phase-2: policy-limits init.

    The placeholder substeps are no-ops for plan phase 1; they exist
    to mark the seam where future work plugs in.
    """
    profile_checkpoint("init_function_start")

    # ch02 round-2 PR-1 (G1): consume the keychain + MDM prefetches that
    # ``src/cli.py`` fires at module import. The Popens are already
    # running; ``wait_and_read_*`` blocks for at most the supplied
    # timeout. Both helpers return ``None`` on any failure — silent
    # degrade is intentional (TS behavior).
    _logger.info("init: consuming keychain + MDM prefetches")
    stash_keychain_credentials(
        wait_and_read_keychain(get_or_start_keychain_prefetch(), timeout=5.0)
    )
    mdm_payload = wait_and_read_mdm(get_or_start_mdm_raw_read(), timeout=2.0)
    mdm_env = extract_mdm_env(mdm_payload)
    profile_checkpoint("init_after_prefetch_consumption")

    # ch02 round-3: the pre-trust pass applies the TRUSTED tiers in full
    # (global config env — including stored API keys like TAVILY_API_KEY —
    # and user settings env), the SAFE subset of the project-scoped tiers,
    # and the MDM policy env last. Project/local tiers apply in full only
    # after trust (run_pre_action seeding or a trust-gate accept). The old
    # secret_store startup applier is gone — it copied the MERGED env
    # (committable project tiers included) with no trust gate.
    _logger.info("init: applying pre-trust env (trusted tiers + safe subset)")
    apply_safe_config_environment_variables(extra_env=mdm_env)
    profile_checkpoint("init_safe_env_vars_applied")

    _logger.info("init: setting up graceful shutdown")
    setup_graceful_shutdown()
    profile_checkpoint("init_after_graceful_shutdown")

    _logger.info("init: starting API preconnect")
    start_api_preconnect()
    profile_checkpoint("init_after_api_preconnect")

    _placeholder_initialize_remote_managed_settings()
    _placeholder_initialize_policy_limits()
    profile_checkpoint("init_function_end")


def _placeholder_initialize_remote_managed_settings() -> None: