[david-ruiz-cko]

Summary

Security hardening: input validation for request paths. Reported internally.

Changes

• checkout_sdk/client.py: input validation and encoding in the shared path builder (build_path); docstring added.
• checkout_sdk/payments/sessions/sessions_client.py, checkout_sdk/events/events_client.py: request building moved to the shared helpers.
• checkout_sdk/apm/sepa_client.py, checkout_sdk/payments/googlepay/googlepay_client.py, checkout_sdk/instruments/instruments_client.py: path constants refactored into single segments; request paths unchanged.
• README.md: "Exception handling" documents how identifiers are handled.
• tests/client_test.py: new; path segment encoding and validation tests.
• tests/compliancerequests/compliance_requests_client_test.py: expects CheckoutArgumentException for a None identifier.

API Reference

None. No operation or schema change; request paths for valid identifiers are unchanged.

Breaking changes

• Client methods raise CheckoutArgumentException before sending when an identifier is not a valid path segment, for example None or empty (None previously raised TypeError). Migration: pass identifiers as returned by the API.
• Identifiers are encoded by the SDK, so an identifier that is already encoded is encoded again. Migration: pass identifiers unencoded.
• Client.build_path treats each argument as one path segment. Migration: pass each segment as its own argument.

Tests

• Existing tests pass
• Serialization tests cover every new or changed property (no request or response type changed)
• README updated if documented usage changed

Unit tests added; pytest and flake8 pass.

Related

None.

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• no_low_class_matched
• prod_source_modified

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

The diff only bumps the version string from 4.9.1 to 4.9.2, but the PR description claims extensive changes to input validation, path encoding, client refactoring, new tests, and README updates across many files — none of which appear in the diff.

For you to decide

• The diff contains exactly one line changed (VERSION in properties.py), but the PR description claims changes to checkout_sdk/client.py, sessions_client.py, events_client.py, sepa_client.py, googlepay_client.py, instruments_client.py, README.md, tests/client_test.py, and tests/compliancerequests/compliance_requests_client_test.py — a reviewer must confirm whether this is a partial diff or whether those changes are missing.
• If the substantive security hardening and refactoring described in the PR body are not included in this diff, the version bump alone is not meaningful and the security fix has not shipped.
• If this diff is intentionally just the version bump and the other changes were merged separately, the reviewer needs to verify that dependency before approving.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud