Release 0.8.0 — Oversight - #157
Merged
Merged
Conversation
Every guarantee before this one verifies the principal that acts. Nothing was
asked of the principal that permits. v0.8 asks the question all seven put only
to the acting side: who may say yes, and can the kernel tell?
G17 an unentitled approver refused
G18 the requester cannot approve
G19 one principal counts once
G20 a credential revoked before its exp
G21 an unapproved policy decides nothing
plus break-glass, which carries no guarantee id because the roadmap assigned
five to v0.8 and G22 to G24 to v0.9; its evidence is its tests, one of which
greps the shipped package for sixteen spellings a flag would take.
The definition of done, checked rather than asserted:
- `import ctrlrun` imports nothing from an extra, and neither verify nor
conformance: asserted in a subprocess.
- `ctrlrun demo` runs eight receipts in 0.1s with no network.
- No setting relaxes a check; T338's control plants one and finds it.
- A shipped example exercises the new paths: examples/authority/payments.yaml
reports 19/19 with two not applicable, so G17 and G19 are graded against
something this repository ships rather than N/A on everything.
Both adapters' kernel range moves to `>=0.5,<0.9`. The v0.5 contract is not
reopened -- `ApprovalAnswer` keeps its shape -- and the one behavioural change
in `InterruptApprovalProvider` appears only under `approvals_required`, a
policy key that did not exist before this version: a partial grant is an
`ApprovalTimeout` naming what is outstanding, never a denial, because `None`
from the store means "recorded, short of N" and `None` from `wait` means a
human's no. Four files state that range and the tests refused the bump until
all four moved.
CITATION.cff moves to 0.8.0.
Signed-off-by: arpan <contact@arpanghoshal.com>
|
Warning Review limit reachedNext included review available in 34 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (5)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (9)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe release metadata moves to 0.8.0, documents the Oversight guarantees, and widens both adapters' ChangesRelease metadata and adapter compatibility
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Merge Risk: ⚪ Minimal · up to The release metadata and adapter version ranges are internally consistent, with no remaining merge-blocking risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
A command that cannot succeed in any configuration the CLI can load is a claim the CLI makes that the code does not honour, and this project refuses that shape everywhere else. `Control.from_file` -- what the CLI builds -- wires no ApproverIdentity and there is no configuration key for one, so `ctrlrun break-glass` always exited 1 telling an operator to build a Control with an argument the CLI cannot pass. It failed closed, and `delegate --parent <an envelope>` is refused by name, so the gated path was the only path either way. Failing closed is the right direction and not a reason to ship a door that does not open. The other two ways out were worse, and §14.5 now records why rather than listing them as open. A configuration key naming the approver's identity provider would let whoever holds the policy file decide who verifies approvers, which is the direction §8.4 refuses for require_approved_policy and for the same reason. A credential option on the one command needs the whole JWT configuration the CLI does not have -- issuer, audience, key source, algorithm list -- so it is ten flags invented under release pressure and reviewed by nobody. The mechanism is untouched and fully tested: the envelope in the policy hash, containment on every dimension, max_ttl re-checked on every evaluation, created_via, the receipt field, revocation and attenuation. Only the shell entry point defers, to the milestone that gives the CLI a way to verify an approver. What it costs is stated rather than hidden: break-glass in 0.8.0 is reachable only from an application that builds its own Control, and an operator whose incident response is a shell has nothing here yet. 3952 tests, 3m29s, plus 56 serial. Signed-off-by: arpan <contact@arpanghoshal.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Item 8 of v0.8. Version, changelog, citation, adapter ranges.
Every guarantee shipped before this milestone verifies the principal that acts. G7 refuses an action whose requester cannot be resolved; nothing whatever was asked of the principal that permits it.
approverwas a non-empty string,ctrlrun delegate --aswas an assertion typed at a shell, and the operator MCP server authenticated who answered without checking they were entitled to. v0.8 asks the question all seven put only to the acting side: who may say yes, and can the kernel tell?expPlus break-glass, which carries no guarantee id: the roadmap assigned five to v0.8 and G22–G24 to v0.9, so inventing a sixth would collide or renumber, and a renumber is the maintainer's change. Its evidence is its tests.
Definition of done, checked rather than asserted
import ctrlrunimports nothing from an extra, and neitherverifynorconformance— asserted in a subprocess.ctrlrun demoruns eight receipts in 0.1s with no network.examples/authority/payments.yamldeclares anapprover_roleand a threshold of two, and reports 19/19 with two not applicable — so G17 and G19 are graded against something this repository ships rather thanN/Aon everything.Adapter ranges
Both adapters move to
ctrlrun>=0.5,<0.9. The v0.5 contract is not reopened —ApprovalAnswerkeeps its shape — and the one behavioural change inInterruptApprovalProviderappears only underapprovals_required, a policy key that did not exist before this version: a partial grant is anApprovalTimeoutnaming what is outstanding, never a denial, becauseNonefrom the store means "recorded, short of N" whileNonefromwaitmeans a human's no. Four files state that range and the tests refused the bump until all four moved.What v0.8 does not close, in one place
Still open, and it is a decision rather than a defect
ctrlrun break-glasscannot succeed in any configuration the CLI can load.Control.from_filewires noApproverIdentityand there is no configuration key for one, so the command always exits 1 saying an approver identity is needed — advice the CLI cannot act on. It fails closed, anddelegate --parent <an envelope>is refused by name, so the gated path is the only path. But §5.3's shell example does not run today, and break-glass is reachable only from an embedding application that built its ownControl.Three ways out, each adding surface §11.1 does not list: a configuration key naming an approver identity provider; a credential option on that one command; or striking the shell example and saying the command serves deployments that configure one in code. Recorded in §14.5 as open rather than decided by a build item.
3952 tests, 3m27s with Postgres, plus 56 serial.
Merge order: this, then the tag, then
CTRLRun/ctrlrun-docs#7— the readiness block readspyproject.tomland states 0.8.0 before it is on PyPI.🤖 Generated with Claude Code
Summary by CodeRabbit
Release
Compatibility
Documentation