UN-3636 [MISC] Drop the ENVIRONMENT gate on the LLM mock

[chandrasekharan-zipstack]

Follow-up to #2170, removing a guard that PR added.

Why

The gate required ENVIRONMENT ∈ {test, development} on top of UNSTRACT_LLM_MOCK_RESPONSE before the SDK would mock a completion. It was added for this review comment — the hazard being a worker env block copied out of the test overlay into a real deployment, where litellm's synthetic 10/20/30 token usage would flow into the usage tables indistinguishable from real spend.

It does not defend that case:

• The gate was written into that same overlay block, next to the mock var, so a copy carries the gate along with it.
• docker/docker-compose.yaml sets ENVIRONMENT=development on both workers that run the injection, so any deployment derived from base compose — which is how Unstract is self-hosted — satisfied the gate anyway.

That leaves one case it genuinely catches: the mock var set alone somewhere that sets no ENVIRONMENT at all. That holds by accident (nothing sets the variable in k8s) rather than by design, and it costs a dependency on a variable nothing else in the codebase reads — 16 of its 20 declarations across the compose files are dead.

What still guards the hatch

Unchanged: it is off unless someone sets UNSTRACT_LLM_MOCK_RESPONSE, and it logs a warning once per process while active.

The defence worth having is making mocked spend distinguishable downstream — an is_mock marker on the usage record, which config checks can't be copy-pasted around. Not in this PR.

Changes

• unstract/sdk1/src/unstract/sdk1/llm.py — drop _ENVIRONMENT_ENV, _MOCK_ALLOWED_ENVIRONMENTS, _warn_mock_refused, and the gate
• unstract/sdk1/tests/test_mock_response.py — drop the 4 gate tests and the autouse env fixture (9 tests remain, all passing)
• tests/compose/docker-compose.test.yaml — drop the two ENVIRONMENT=test lines added for the gate
• tests/README.md — record why it was removed, so it doesn't get re-added

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

LLM mocking no longer depends on ENVIRONMENT. Setting UNSTRACT_LLM_MOCK_RESPONSE enables mock response injection, while Docker Compose configurations and tests remove explicit environment gates.

Changes

LLM mocking behavior

Layer / File(s)	Summary
Mock response injection and validation unstract/sdk1/src/unstract/sdk1/llm.py, unstract/sdk1/tests/test_mock_response.py, tests/README.md	Mock responses are injected when UNSTRACT_LLM_MOCK_RESPONSE is set, with one active warning per process; environment-refusal tests and documentation are removed.
Compose environment wiring docker/docker-compose.yaml, tests/compose/docker-compose.test.yaml	Explicit ENVIRONMENT overrides are removed, and the test worker configuration uses UNSTRACT_LLM_MOCK_RESPONSE.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description covers the rationale and changes, but it omits most required template sections such as How, breakage, testing, and checklist.	Add the missing template sections, especially How, breakage impact, Database Migrations, Env Config, testing notes, related issues, and the checklist.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: removing the ENVIRONMENT gate from the LLM mock.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/un-3636-drop-environment-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[greptile-apps]

Greptile Summary

This PR removes the environment gate from the LLM mock path. The main changes are:

• UNSTRACT_LLM_MOCK_RESPONSE now controls SDK mock injection by itself.
• The old environment refusal helper and related tests were removed.
• Compose files no longer set ENVIRONMENT for base or test services.
• Test documentation now describes the env-var-only mock behavior.

Confidence Score: 4/5

The LLM mock path needs a production-safe guard before merging.

• A real worker can now mock completions when UNSTRACT_LLM_MOCK_RESPONSE is set.
• Mocked LiteLLM usage can flow into normal usage records without a marker.
• The compose ENVIRONMENT removals appear safe because no remaining code path reads that variable.

unstract/sdk1/src/unstract/sdk1/llm.py

Security Review

A real worker with a stray non-empty UNSTRACT_LLM_MOCK_RESPONSE can now bypass provider calls and record mocked usage without a mock marker.

Important Files Changed

Filename	Overview
unstract/sdk1/src/unstract/sdk1/llm.py	Removes the ENVIRONMENT allow-list before LiteLLM mock injection.
unstract/sdk1/tests/test_mock_response.py	Removes tests for environment-based refusal while keeping unset, empty, set, override, warning, and completion-path checks.
docker/docker-compose.yaml	Removes ENVIRONMENT=development from compose services.
tests/compose/docker-compose.test.yaml	Removes ENVIRONMENT=test from test services while keeping mock-response forwarding for the main execute-path workers.
tests/README.md	Updates the test documentation for the removed gate and remaining mock behavior.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
unstract/sdk1/src/unstract/sdk1/llm.py:55-56
**Mocked Completions Reach Production**

When a real worker has a non-empty `UNSTRACT_LLM_MOCK_RESPONSE`, this path now injects `mock_response` without any runtime gate. All SDK completion paths can then return canned LiteLLM output and persist synthetic token usage as normal usage records, with no in-band mock marker for billing or dashboards to filter.

_{Reviews (1): Last reviewed commit: "UN-3636 [MISC] Drop the unread ENVIRONME..." | Re-trigger Greptile}

[github-actions]

Unstract test results

Per-group results

Status	Group	Tier	Passed	Failed	Errors	Skipped	Duration (s)
✅	e2e-api-deployment	e2e	3	0	0	0	16.8
✅	e2e-coowners	e2e	1	0	0	0	1.9
✅	e2e-etl	e2e	1	0	0	0	8.4
✅	e2e-login	e2e	2	0	0	0	1.3
✅	e2e-prompt-studio	e2e	1	0	0	0	4.9
✅	e2e-smoke	e2e	2	0	0	0	1.1
✅	e2e-workflow	e2e	1	0	0	0	16.8
✅	integration-backend	integration	124	0	0	27	68.3
✅	integration-connectors	integration	1	0	0	7	8.1
✅	unit-backend	unit	160	0	0	0	22.1
✅	unit-connectors	unit	63	0	0	0	9.7
✅	unit-core	unit	27	0	0	0	1.3
✅	unit-platform-service	unit	15	0	0	0	2.6
✅	unit-rig	unit	76	0	0	0	4.5
✅	unit-sdk1	unit	480	0	0	0	24.8
✅	unit-workers	unit	723	0	0	0	47.2
	TOTAL		1680	0	0	34	239.8

Critical paths

⚠️ Critical paths not yet covered

• workflow-execution-fan-out — Multi-file workflow execution fans out to file-processing workers and rejoins. (declared coverage: no groups declared)

✅ Covered critical paths

• auth-login — covered by e2e-login
• adapter-register-llm — covered by integration-backend
• workflow-author — covered by integration-backend
• co-owner-manage — covered by integration-backend, e2e-coowners
• workflow-create-execute — covered by e2e-workflow
• api-deployment-provision — covered by integration-backend
• api-deployment-auth — covered by integration-backend
• api-deployment-run — covered by e2e-api-deployment
• prompt-studio-author — covered by integration-backend
• prompt-studio-fetch-response — covered by e2e-prompt-studio
• connector-register-test — covered by integration-backend
• pipeline-etl-execute — covered by e2e-etl
• usage-aggregate-read — covered by integration-backend
• usage-token-tracking — covered by e2e-api-deployment
• callback-result-delivery — covered by e2e-api-deployment