CI checks a branch against the kernel branch of the same name, or main; pages regenerated for v0.10 items 1 to 5 - #15
Merged
Conversation
The kernel's main has carried item 1 (the hop) since PR #174 and item 2 (identity and the receipt across a hop) since PR #176, and these pages still described 0.9.0. Every kernel run since then failed at `render_api.py --check` against this repository's main, and PR #14 here, regenerated against the whole five-item stack, was red the other way round. The pages on main now match the kernel's main, which is what the next commit makes the rule. Rendered, by the generators: 15 API pages (four signatures gained `hop`, `Control.__init__` gained `upstream`, line numbers moved), the receipt and event schemas page (`Receipt.hop`, `ctrlrun.receipt/v7`), the readiness block (6,005 tests, 26 guarantees) and its copies on docs.mdx and docs/production/index.mdx, and CLAIMS.md repointed (59 citations, none unresolved). Quoted, from a real run: the `ctrlrun verify` transcripts on docs/verify.md, the CI guide and the GitHub Actions recipe now show catalogue v6 with G25 and G26, 24/24 against the payments example and 15/15 with 11 N/A against the guide's policy. Written: the OWASP mapping gains G25 (a hop narrows or it is refused) and G26 (a hop is named on both sides), each mapped partly to ASI03, ASI07 and ASI10 with its limits stated in the row, and ASI07 moves from "Not yet" to the partial half: authority across a hop is bounded and evidenced, the channel is not CTRLRun's. Two entries are now unaddressed rather than three, and the test that keeps that sentence true says so. Not touched: ROADMAP.md, THREAT_MODEL.md and authority.md, which the release item reconciles; G27 arrives with item 3 and gets its row on that branch. Signed-off-by: arpan <contact@arpanghoshal.com>
The mirror image of CTRLRun/ctrlrun's `docs` job, which from the same-named branch there checks out the branch here named after the kernel branch under test, and main otherwise. A page describes a commit, and the page for a commit that has not merged cannot be on main yet, so a branch here regenerated for a kernel branch was red until that branch merged, by construction, for the length of a release cycle; PR #14 is the example. Now a branch here is checked against the kernel branch of the same name when there is one. A dispatch still names its commit. Everything else, main included, is checked against the kernel's main, so the pages on main are expected to match it at all times: the docs branch merges when the kernel branch does, the code first. The branch name reaches the shell through `env:` and never inline in the script, and the match is exact and fixed-string, for the reasons the kernel's commit gives. README's "How the two repositories stay in step" says the rule. Signed-off-by: arpan <contact@arpanghoshal.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
|
Warning Review limit reachedNext included review available in 47 seconds. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (32)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Regenerated against CTRLRun/ctrlrun's v0.10/3-upstream-pinning, the branch of the same name, which the kernel's docs job now checks this one against. Rendered: the API pages and the errors page (the two upstream refusals), the readiness block (6,019 tests, 27 guarantees) and its two copies, CLAIMS.md repointed (54 citations, none unresolved), the three verify transcripts at catalogue v6 with G27. Written: docs/reference/policy-yaml.mdx names `upstream`, the action-entry key `ctrlrun.policy/v8` adds, with its three pins and the three places one rule is checked, and the version table gains the v7 and v8 rows it was missing. The OWASP mapping gains G27 (a swapped upstream is denied), mapped partly to ASI02 and ASI07 with its three limits in the row, and the ASI04 row keeps its "out of scope" verdict and gains the one sentence SPEC-v0.10 §4.1 allows it. Signed-off-by: arpan <contact@arpanghoshal.com>
Regenerated against CTRLRun/ctrlrun's v0.10/4-one-ordered-list, the branch of the same name. Rendered only: API pages whose line numbers moved with the refactor of control.py, the readiness block (6,033 tests) and its two copies, CLAIMS.md repointed (48 citations, none unresolved). Item 4 adds no key, no guarantee and no schema, so nothing here is written by hand. Signed-off-by: arpan <contact@arpanghoshal.com>
This was referenced Sep 13, 2026
Merged
arpanghoshal
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One rule, and the pages that follow it
CI checks a branch against the kernel branch of the same name, or main. The mirror image of CTRLRun/ctrlrun#180. A page describes a commit, and the page for a commit that has not merged cannot be on
mainyet, so a branch here regenerated for a kernel branch was red until that branch merged, for the length of a release cycle; #14 was the example. Now a branch here is checked against the kernel branch of the same name when there is one, a dispatch still names its commit, and everything else,mainincluded, is checked against the kernel'smain. The pages onmainare expected to match it at all times: the docs branch merges when the kernel branch does, the code first. README's "How the two repositories stay in step" says the rule.Pages regenerated for v0.10 items 1 to 5, one commit per item, each made on the branch named after the kernel item and folded here once the kernel merged them all (#16 and #17 were those branches' PRs). Rendered by the generators: API pages, the schemas and errors pages, the readiness block and its two embedded copies, CLAIMS.md repointed, the three
ctrlrun verifytranscripts from real runs (catalogue v6, G25 to G27). Written by hand, because no generator can: the OWASP mapping's G25, G26 and G27 rows with their limits in the row,ASI07moved from "Not yet" to the partial half (two entries unaddressed rather than three, and the test that keeps that sentence true says so),ASI04keeping its verdict with the one sentence SPEC-v0.10 §4.1 allows, andpolicy-yaml.mdxnamingupstreamwith the v7 and v8 rows its version table was missing. ROADMAP.md, THREAT_MODEL.md and authority.md are left for the release item.Merge order
CTRLRun/ctrlrun#180 first, then this. From then on each kernel branch that changes a docstring, a
--help, a schema, a guarantee or a policy key comes with a same-named branch here, merged right after it.Checks
./scripts/check.shagainst the kernel'smain(items 1 to 5): ruff clean, 1689 passed. The nine generators'--check,snippets.py,lint.pyandlinks.py, which is what the kernel'sdocsjob runs, all clean.🤖 Generated with Claude Code