Repository navigation
fix: enforce tool approval and isolate legacy ownership - #133
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enforce mutation approval consistently across chat, dynamically registered MCP tools, investigation plans, and Temporal activities. Registry write classification cannot be removed by a caller's empty write set. Unknown MCP tools require confirmation, read-only skills exclude them, and refresh/disconnect removes only tools owned by that connection. MCP and durable workflow administration require administrator identity; approval payloads must contain actual JSON booleans.
Legacy view migration now moves only the owner derived from the current caller's forwarded token. It never claims another user's hash-based views, and commits zero-row updates to release database locks. Plans preserve configured write gates and caller context; unattended investigations cannot silently run write tools. Temporal phases gain write permission only through their explicit approval gate and server trust, with workflow-history compatibility preserved.
Refresh repository Markdown against current source, including setup, database, API, security, testing, architecture, release and model-facing guidance. Label historical plans and distinguish dry-run validation from live behavioral gates.
Validation: final focused safety regressions cover real chat/monitor WebSocket malformed approvals, PostgreSQL transaction release, ownership isolation, MCP refresh/collisions and classification, and plan/Temporal write gates. Full suite: 3,441 tests passed with exit 0 using an isolated PostgreSQL database and inert kubeconfig; 34 focused safety cases and 49/49 replay dry runs passed. Rebase onto merged main preserved the tested file tree. Ruff, Mypy and documentation checks passed. Real OpenShift acceptance remains pending.
CI also fetches full history and compares the explicit PR base SHA for changes under sre_agent, including model-facing references. Git errors fail detection instead of silently skipping live evaluations.
Merge gate: commit4eb46ef is published and run37101198048 is validating the live judged replay and SRE-Bench integrity checks. Await these results before merging. SRE-Bench resolution scores remain advisory under the existing workflow; passing integrity checks does not establish every scenario was resolved.