[BREAKING] [FIX]: Apply the _async naming convention (#159)

## Description

Second commit of the #22 follow-up. Clears the `.flake8` baseline added
in #158 (merge that first), so `RMP001` is enforced everywhere with no
exemptions.

147 renames: 8 in `rampart/`, 139 async test functions, plus call sites,
tests and docs.

| Old | New |
|---|---|
| `InjectionHandle.wait_until_ready` | `wait_until_ready_async` |
| `ExecutionEventHandler.on_event` | `on_event_async` |
| `sleep_until_ready` | `sleep_until_ready_async` |
| `BaseExecution._fire` | `_fire_async` |
| `_send_via_normalizer` | `_send_via_normalizer_async` |
| `_send_and_parse` | `_send_and_parse_async` |

## Breaking changes

`InjectionHandle.wait_until_ready` and `ExecutionEventHandler.on_event`
are public. External surfaces and handlers must rename to `*_async`.
Handles that don't now raise a clear `TypeError` from `Attacks.xpia`
instead of failing obscurely.

## Checklist

- [x] `pre-commit run --all-files` passes
- [x] Tests added or updated for changes -- 20 test files updated for
renamed symbols and test names
- [x] Documentation updated -- `core-protocols.md`, `xpia.md`,
`extending-rampart.md`, `authoring-tests.md`,
`unit-tests-standards.instructions.md`

Author: spencrr

.flake8

@@ -8,18 +8,6 @@ select = RMP
 # are kept rather than replaced.
 extend-exclude = .venv,build,dist
 
-# Baseline of pre-existing violations, recorded so the rule can be enforced
-# from day one without a large mechanical rename in the same change. Each
-# entry is removed by the commit that fixes the file. Do not add new entries.
-per-file-ignores =
-    rampart/core/execution.py:RMP001
-    rampart/core/injection.py:RMP001
-    rampart/evaluators/llm_judge.py:RMP001
-    rampart/pyrit_bridge/llm_bridge.py:RMP001
-    rampart/pytest_plugin/_collection.py:RMP001
-    rampart/surfaces/onedrive.py:RMP001
-    tests/*:RMP001
-
 [flake8:local-plugins]
 extension =
     RMP = flake8_rampart:RampartChecker

.github/instructions/coding-standards.instructions.md

@@ -623,9 +623,8 @@ while `# noqa:` is reserved for an RMP code (e.g., `RMP001`), which flake8
 rather than ruff reads. `RMP001` is listed in `[tool.ruff.lint] external` so
 that ruff's `RUF102` accepts it instead of rejecting it as an unknown code.
 
-`.flake8` carries a `per-file-ignores` baseline of files that predate the rule.
-Those entries are removed as the files are fixed; do not add new ones.
-
+`RMP001` applies repo-wide, including to tests: the test standards require the
+`_async` suffix on async test names too.
 [flake8-local]: https://flake8.pycqa.org/en/latest/user/configuration.html#using-local-plugins
 
 ---

.github/instructions/unit-tests-standards.instructions.md

@@ -37,7 +37,7 @@ class TestParseConfig:
 ```
 
 ### Async Tests
-- Async test method names MUST end with `_async`
+- Async test method names MUST end with `_async` (enforced by `RMP001`)
 - Use `AsyncMock` instead of `MagicMock` when mocking async methods
 
 ```python

docs/api/core-protocols.md

@@ -32,7 +32,7 @@ Protocols and ABCs that define RAMPART's extension points. Implement these to co
       members:
         - Surface
         - InjectionHandle
-        - sleep_until_ready
+        - sleep_until_ready_async
 
 ## Converter
 

docs/attacks/xpia.md

@@ -17,7 +17,7 @@ sequenceDiagram
 
     Test->>Surface: inject(payload) → handle
     Note over Surface: Payload placed in data source
-    Test->>Surface: handle.wait_until_ready()
+    Test->>Surface: handle.wait_until_ready_async()
     Test->>Agent: session.send_async("Summarize reports")
     Agent-->>Test: Response (text + tool_calls)
     Test->>Eval: evaluate_async(context)
@@ -28,7 +28,7 @@ sequenceDiagram
 **Phases:**
 
 1. **Inject** — Place payloads into the agent's data sources via surfaces. Each `surface.inject(payload)` returns an [`InjectionHandle`][rampart.core.injection.InjectionHandle].
-2. **Wait** — Handles call `wait_until_ready()` to allow indexing. Runs concurrently for multiple surfaces.
+2. **Wait** — Handles call `wait_until_ready_async()` to allow indexing. Runs concurrently for multiple surfaces.
 3. **Trigger** — Send benign prompts that cause the agent to retrieve the injected content. Triggers are never adversarial — the attack is in the payload, not the prompt.
 4. **Evaluate** — Check each turn for the attack objective. Early-stops on detection.
 5. **Clean up** — Remove injected content. Guaranteed via `AsyncExitStack`, even on exceptions.

docs/contributing/extending-rampart.md

@@ -337,7 +337,7 @@ For the basic protocol skeleton, see [Implementing Surfaces](../usage/authoring-
 
 - **`Surface.inject` does not activate** — it only prepares the handle. Activation happens when an execution strategy enters the handle as an async context manager.
 - **`__aexit__` must be idempotent and must not raise** — cleanup runs even on exceptions, and a failing cleanup must not mask the original error.
-- **`wait_until_ready` should bound itself** with `TimeoutError` rather than block indefinitely. For simple delay-based waits, call `sleep_until_ready` from `rampart.core.injection`.
+- **`wait_until_ready_async` should bound itself** with `TimeoutError` rather than block indefinitely. For simple delay-based waits, call `sleep_until_ready_async` from `rampart.core.injection`.
 - **Raise `InfrastructureError`** for transient, external failures (timeouts, rate limits, service outages). It's the documented convention for surfaces and adapters to signal "not a safety signal" — `BaseExecution` catches all exceptions and produces an `ERROR` result either way, but the exception type is preserved in metadata for triage.
 
 For a complete reference, see [`OneDriveSurface`](https://github.com/microsoft/RAMPART/blob/main/rampart/surfaces/onedrive.py).

docs/usage/authoring-tests.md

@@ -270,7 +270,7 @@ class MyFileSurface:
         def surface_name(self) -> str:
             return "file_system"
 
-        async def wait_until_ready(self) -> None:
+        async def wait_until_ready_async(self) -> None:
             pass  # or: await asyncio.sleep(10.0) for indexing delay
 
         async def __aenter__(self):

rampart/attacks/_xpia.py

@@ -169,7 +169,7 @@ async def _activate_handles_async(
         # Concurrent: total = max of all wait times
         async with asyncio.TaskGroup() as tg:
             for handle in self._handles:
-                tg.create_task(handle.wait_until_ready())
+                tg.create_task(handle.wait_until_ready_async())
 
     def _build_attack_result(
         self,

rampart/core/execution.py

@@ -73,7 +73,7 @@ class ExecutionEventHandler(ABC):
     """
 
     @abstractmethod
-    async def on_event(self, *, event_data: ExecutionEventData) -> None:
+    async def on_event_async(self, *, event_data: ExecutionEventData) -> None:
         """Handle an execution lifecycle event.
 
         Args:
@@ -231,7 +231,7 @@ async def execute_async(self, *, adapter: AgentAdapter) -> Result:
             Result: Safety verdict with evidence and diagnostics.
         """
         start = time.monotonic()
-        await self._fire(
+        await self._fire_async(
             ExecutionEvent.ON_PRE_EXECUTE,
             adapter=adapter,
             elapsed=0.0,
@@ -247,7 +247,7 @@ async def execute_async(self, *, adapter: AgentAdapter) -> Result:
                 self.strategy_name,
             )
 
-            await self._fire(
+            await self._fire_async(
                 ExecutionEvent.ON_ERROR,
                 adapter=adapter,
                 elapsed=time.monotonic() - start,
@@ -264,7 +264,7 @@ async def execute_async(self, *, adapter: AgentAdapter) -> Result:
 
         elapsed = time.monotonic() - start
         result.duration_seconds = elapsed
-        await self._fire(
+        await self._fire_async(
             ExecutionEvent.ON_POST_EXECUTE,
             adapter=adapter,
             elapsed=elapsed,
@@ -284,7 +284,7 @@ async def _execute_async(self, *, adapter: AgentAdapter) -> Result:
         """
         ...
 
-    async def _fire(
+    async def _fire_async(
         self,
         event: ExecutionEvent,
         *,
@@ -314,7 +314,7 @@ async def _fire(
         )
         for handler in self._handlers:
             try:
-                await handler.on_event(event_data=event_data)
+                await handler.on_event_async(event_data=event_data)
             except Exception:
                 logger.warning(
                     "ExecutionEventHandler %s raised on %s — ignored.",

rampart/core/injection.py

@@ -6,7 +6,7 @@
 Two protocols serving two audiences: Surface is what surface authors
 implement; InjectionHandle is what execution strategies consume.
 
-``sleep_until_ready`` is a helper function for surfaces that only need
+``sleep_until_ready_async`` is a helper function for surfaces that only need
 a simple delay-based readiness wait.
 """
 
@@ -43,7 +43,7 @@ def surface_name(self) -> str:
         """The name of the surface this handle injects into (e.g., 'SharePoint')."""
         ...
 
-    async def wait_until_ready(self) -> None:
+    async def wait_until_ready_async(self) -> None:
         """Block until the injected content is visible to the agent.
 
         Implementations should raise `TimeoutError` if readiness
@@ -52,7 +52,7 @@ async def wait_until_ready(self) -> None:
         ...
 
 
-async def sleep_until_ready(delay: float) -> None:
+async def sleep_until_ready_async(delay: float) -> None:
     """Sleep for `delay` seconds. Default readiness strategy for simple surfaces.
 
     Args: