Scope of this X-ray
Target: data/sample-service/, not User Story #31866.
Step 1 of the brief asks for the real work item first, and the bundled sample if it is
not at hand.
#31866 carries no commit, branch, or pull request link, so nothing on it points at code, and no repo from that project is cloned on this machine. The scenario asks for a repo touched this month. There was none behind the story inside the two-minute budget, so this X-ray covers the bundled sample instead.
Every number below comes from running this code in this session. Nothing is copied from the README, and nothing is estimated.
Modules
Four Python files, 62 lines total. One file holds the store, the money math, and both route handlers, so a single edit there moves every response the service returns.
| Path | Owns | Lines |
|---|
Config: pytest.ini sets
testpaths=tests and pythonpath=..
requirements.txt lists fastapi, httpx,
pytest, all unpinned.
Endpoints
Both routes read from the in-memory ORDERS dict and both call
order_total(), so both report the same wrong money today. The last row of each card
is the live response captured in this session next to the hand-computed correct value.
Test summary
Output of pytest -q against a clean venv on 2026-09-07.
| Test | What it actually asserts | Result |
|---|
The failure, verbatim
Coverage gaps
Top three risks, ranked
Click a risk to open its evidence. Each one names the file and line it lives on.
Proposed fix for the worst one
The defect is one character: order_total() adds quantity to unit price
where it should multiply, and the docstring above it ("Sum of qty * unit across lines") already
describes the intent the code misses. Changing + to * alone takes the suite
to 5 passed. The patch below does that and adds the shape guard from risk #3, because a correct
formula over an unvalidated record still returns a 500 instead of naming the bad field. Both
halves were applied to a scratch copy and run: 5 passed, and every total below was read back off
the running service.
What changes after the fix
| Response field | Today | After fix |
|---|
How to verify
cd data/sample-service
pytest -q # verified on a scratch copy: 5 passed, 2 warnings in 0.18s
# the two assertions the suite never makes, worth adding with the patch.
# without them, risk #2 stays open and the next money bug ships green:
# assert client.get("/orders/A-1001").json()["total"] == 2400.0
# assert client.get("/accounts/Account A/total").json()["total"] == 4050.0
# and one for the guard, which closes risk #3:
# with pytest.raises(ValueError):
# order_total({"id": "X", "lines": [{"qty": 1}]})