Remove Python fallback paths

Signed-off-by: lucarlig <luca.carlig@ibm.com>

Author: lucarlig

README.md

@@ -2,6 +2,12 @@
 
 Monorepo for managed CPEX plugins that are implemented in Rust and published as Python packages.
 
+## Runtime Requirements
+
+These packages target the CPEX release-candidate framework API and intentionally depend on `cpex>=0.1.0rc1,<0.2`. The RC dependency is the migration target for this repository; it is not an accidental pre-stable dependency.
+
+Rust plugin packages require their compiled PyO3 extension at import/runtime. They do not ship Python fallback implementations for missing Rust extensions.
+
 ## Layout
 
 Managed plugins live under `plugins/rust/python-package/<slug>/`.
@@ -41,7 +47,7 @@ See [TESTING.md](TESTING.md) for detailed testing guidelines and cross-repositor
 
 ### Current Architecture (Transitional)
 
-Plugins are implemented as **pure Python** or **pure Rust** — each plugin uses one language for its logic. There is no dual-path where a plugin ships both Rust and Python implementations with a Rust fallback.
+Plugins are implemented as **pure Python** or **pure Rust** — each plugin uses one language for its logic. There is no dual-path where a plugin ships both Rust and Python implementations with a Python fallback for a missing Rust extension.
 
 For Rust plugins, the current approach wraps the Rust implementation with PyO3/maturin bindings as a packaging layer:
 - Plugin logic implemented entirely in Rust
@@ -145,4 +151,4 @@ See [TESTING.md](TESTING.md) for cross-repository testing workflow.
 - [DEVELOPING.md](DEVELOPING.md) - Plugin development workflows
 - [TESTING.md](TESTING.md) - Testing strategy and guidelines
 - [CONTRIBUTING.md](CONTRIBUTING.md) - Contribution guidelines
-- [SECURITY.md](SECURITY.md) - Security policy
+- [SECURITY.md](SECURITY.md) - Security policy

plugins/rust/python-package/encoded_exfil_detection/README.md

@@ -23,6 +23,10 @@ High-performance encoded exfiltration detection for ContextForge and MCP Gateway
 make install
 ```
 
+## Runtime Requirements
+
+This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+
 ## Usage
 
 The plugin scans these hooks:

plugins/rust/python-package/pii_filter/README.md

@@ -20,6 +20,10 @@ High-performance PII detection and masking library for ContextForge.
 make install
 ```
 
+## Runtime Requirements
+
+This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+
 ## Usage
 
 The Python plugin requires the compiled Rust extension and uses it for all detection and masking operations.

plugins/rust/python-package/pii_filter/cpex_pii_filter/pii_filter.py

@@ -3,13 +3,7 @@
 
 from __future__ import annotations
 
-try:
-    from cpex.framework import Plugin
-except ModuleNotFoundError:
-    class Plugin:  # type: ignore[no-redef]
-        def __init__(self, config) -> None:
-            self.config = config
-
+from cpex.framework import Plugin
 from cpex_pii_filter.pii_filter_rust import PIIDetectorRust, PIIFilterPluginCore
 
 

plugins/rust/python-package/rate_limiter/README.md

@@ -4,6 +4,10 @@
 
 Enforces rate limits per user, tenant, and tool across `tool_pre_invoke` and `prompt_pre_fetch` hooks. Supports pluggable counting algorithms (fixed window, sliding window, token bucket), an in-process memory backend (single-instance), and a Redis backend (shared across all gateway instances).
 
+## Runtime Requirements
+
+This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+
 ## Hooks
 
 | Hook | When it runs |

plugins/rust/python-package/rate_limiter/cpex_rate_limiter/rate_limiter.py

@@ -5,27 +5,7 @@
 
 import logging
 
-try:
-    from cpex.framework import Plugin, PromptPrehookResult, ToolPreInvokeResult
-except ModuleNotFoundError:
-    class Plugin:  # type: ignore[no-redef]
-        def __init__(self, config) -> None:
-            self.config = config
-
-    class PromptPrehookResult:  # type: ignore[no-redef]
-        def __init__(self, continue_processing=True, violation=None, metadata=None, http_headers=None):
-            self.continue_processing = continue_processing
-            self.violation = violation
-            self.metadata = metadata
-            self.http_headers = http_headers
-
-    class ToolPreInvokeResult:  # type: ignore[no-redef]
-        def __init__(self, continue_processing=True, violation=None, metadata=None, http_headers=None):
-            self.continue_processing = continue_processing
-            self.violation = violation
-            self.metadata = metadata
-            self.http_headers = http_headers
-
+from cpex.framework import Plugin, PromptPrehookResult, ToolPreInvokeResult
 from cpex_rate_limiter.rate_limiter_rust import (
     RateLimiterPluginCore,
     compat_default_config as _compat_default_config,

plugins/rust/python-package/rate_limiter/src/redis_backend.rs

@@ -9,9 +9,7 @@
 // Uses EVALSHA with NOSCRIPT fallback to EVAL (REDIS-02).
 //
 // Key format: `{prefix}:{dimension_key}:{window_seconds}`
-// This matches the Python RedisBackend key format exactly so that instances
-// running the Rust backend and instances running the Python fallback share the
-// same Redis counters during a rolling upgrade.
+// This preserves the existing Redis counter namespace during rolling upgrades.
 
 use std::cmp::max;
 use std::sync::OnceLock;

plugins/rust/python-package/retry_with_backoff/README.md

@@ -18,6 +18,10 @@ High-performance retry and backoff policy engine for ContextForge and MCP Gatewa
 make install
 ```
 
+## Runtime Requirements
+
+This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+
 ## Usage
 
 The plugin runs on `tool_post_invoke` and `resource_post_fetch`.
@@ -54,7 +58,7 @@ Use `tool_overrides` to change retry behavior for a specific tool:
 - Successful responses clear retry state for the `(tool, request_id)` pair.
 - Retry state expires after a short TTL so abandoned request state does not accumulate indefinitely.
 - If `check_text_content` is disabled, the hot path uses the Rust state manager directly.
-- If `check_text_content` is enabled, the plugin falls back to Python-side payload inspection before applying retry policy.
+- If `check_text_content` is enabled, Python-side payload inspection supplements the Rust state manager before applying retry policy.
 
 ## Returned Metadata
 

plugins/rust/python-package/retry_with_backoff/cpex_retry_with_backoff/retry_with_backoff.py

@@ -27,7 +27,6 @@
 from cpex_retry_with_backoff.retry_with_backoff_rust import RetryStateManager
 
 log = logging.getLogger(__name__)
-_RUST_AVAILABLE = True
 
 
 @dataclass
@@ -205,7 +204,7 @@ async def tool_post_invoke(
             }
         }
 
-        if self._rust is not None and not cfg.check_text_content:
+        if not cfg.check_text_content:
             is_error = isinstance(result, dict) and result.get("isError") is True
             status_code: int | None = None
             if isinstance(result, dict):

plugins/rust/python-package/secrets_detection/README.md

@@ -2,6 +2,10 @@
 
 Rust-backed secrets detection plugin for MCP Gateway / CPEX.
 
+## Runtime Requirements
+
+This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+
 ## What it does
 
 This plugin scans hook payloads for likely secrets and can either: