feat(config)!: registry-key adapter resolution, drop unsafe _target_ (#301)

[stanlrt]

Summary

Closes the config-level _target_ arbitrary-callable RCE surface (#301) across every raitap module. Configs now select an implementation by a short use: <registry_name> key resolved through the closed _BUILDERS registry — _target_ no longer appears on any config surface (inline YAML, Hydra presets, programmatic builders). The same closed registry now feeds editor autocomplete and generated docs.

Rebased onto main — #301-only (24 commits). Breaking (pre-1.0, no shim): _target_: <ClassName> → use: <registry_name> in all configs.

Design — two layers

• Config layer (untrustable): selection is use: <key> + typed fields. No dotted paths anywhere.
• Resolution layer (trusted, in-code): a single seam raitap.configs.registry_resolve maps a use key to the vetted class FQN baked at registration; _target_ lives only here. reject_config_target recurses and rejects a _target_ key at any depth (hydra instantiate recurses, so a nested constructor._target_ was a real hole — now closed).

All six resolvers (adapter_factory, reporting, metrics, tracking, evaluation/step, data parsers) plus the reporting/tracking/orchestrator "is-configured" guards follow reject → resolve → pop-use → instantiate.

Autocomplete + docs (the push beyond the gate)

• build_config_schema() emits a JSON Schema with per-group use enums.
• Committed src/raitap/schema/raitap.schema.json (shipped in the wheel) + raitap config-schema CLI (regenerates including installed plugins) + a CI freshness gate.
• Sphinx build hook generates adapter reference tables from the registry.
• Editor one-liner: # yaml-language-server: $schema=./raitap.schema.json.

Also

• Renamed the adapter decorator kwarg library= → import_name (it feeds importlib.import_module).
• Removed the now-dead configs.utils.resolve_target prefix helper.

Verification

Per-task TDD + spec/quality review each; two whole-branch passes (correctness: clean; refactor: 2 mechanical de-dups applied). Security invariant smoke-tested end-to-end (nested _target_ rejected, use resolves, unknown key errors). raitap --demo runs green. Full suite runs in CI.

Known follow-ups (pre-existing, not regressions)

• tracking/mlflow absent from the generated schema: a swallowed circular import in tracking/__init__.py on the register_configs path (documented in _config_schema.py). Order-harden then regen.
• smoke_test_mlflow.py never set use (skips tracking) — predates this work.
• 4 refactor-advisory notes recorded for triage.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PdLtUmYVtwhPRfwpEvyshD

Checklist

• CI — Required checks are green
• Breaking changes — Title uses ! (feat(config)!:). _target_ -> use: is a necessary, non-deferrable config break (pre-1.0, closes the RCE surface before config-sharing lands).
• Contributor guide — Read Pull requests and commit messages.

Optional

• Issue (optional) — Closes Drop unsafe Hydra _target_ (arbitrary-callable RCE surface) #301.
• Docs (optional) — User + contributor docs migrated; adapter tables generated from registry; config-schema documented.
• Tests (optional) — Security-reject + resolution tests per resolver; recursive-reject + drift-guard tests.