feat(decider): close the gaps the decider crate-family audit opened - #539
Merged
Conversation
The stack left several of its own guarantees to caller convention: backpressure, authorization, write preconditions, and module provenance were documented as gaps rather than enforced by a contract, so nothing in the stack could tell whether one had been honored. Three of the ADRs this implements were still draft, which ADR#0000 forbids building against. Their open questions are resolved in the ADRs themselves and flagged as needing review rather than settled. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
PR SummaryHigh Risk Overview Native and WASM execution paths are documented and aligned on shared behavior: total CI conformance replaces the bash Adds draft ADR#0057 (single Downstream ADR/glossary/session docs are updated to reference subject scope instead of tenant value objects and to reflect which dependencies are now accepted vs still draft. Reviewed by Cursor Bugbot for commit 595e067. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
Important Review skippedToo many files! This PR contains 164 files, which is 64 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (33)
📒 Files selected for processing (164)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…buf client - A caller that already speaks google.rpc should not have to learn a decider-specific error vocabulary to read a decider reply. - The hand-rolled fault family lost the distinction between a caller with no credentials and a caller with the wrong ones, which are different next moves. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…the repo policy lints Both violations predate the lint run that caught them, and leaving them means the policy gate cannot go green on this branch. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…lds it to Tenant isolation rested entirely on the caller's resolver composing the right prefix, with nothing on the store side able to tell a correct subject from an escaped one, and the store cannot check a fact the caller supplies both halves of. ADR#0027 drafted a Tenant value object required on every resolver; the tenancy vocabulary belongs to the consumer, and the one in-repo resolver with a real isolation boundary draws a module boundary rather than a tenant one. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…machine The remaining work is all P4 and spans several sessions and reviewers, so the record of what was decided and why needs to outlive the working copy it was written in. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
…e conflict A caller reading the retry advice of a contended append would loop forever on a revision no stream state can ever satisfy. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 779ed98. Configure here.
…d of in comments A comment asserting which code and reason an arm carries is something a reader has to take on trust; a template is something they can resolve. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…TS impls out Coverage builds drop the JetStream trait impls the host reaches through, so without a stand-in the whole coverage run stops compiling and reports nothing. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…e change stranded Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…k gates Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
|
Code Coverage SummaryDetailsDiff against mainResults for commit: 595e067 Minimum allowed coverage is ♻️ This comment has been updated with latest results |
…repo coverage floor The audit landed the host, the identity types and the startup path without exercising them, so a regression in an authorization identifier or in the configuration a host refuses to start on would have shipped unnoticed. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
yordis
added
the
rust:coverage-baseline-reset
…s a message rewording Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…olved Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…0016 already defines A hand-rolled subject scheme and a five-arm outcome union meant no generated client could reach the decider and no micro-aware intermediate could tell a working host from a broken one. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…ead of trusting that someone wrote it Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…pending on the decider adapter Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…r than let them drift Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
… answer it held Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…er failure already uses A caller had to decode a second error union inside the response to learn a command was refused, while every other outcome was already legible from the reply's status headers. One failure channel means one thing to check. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
…essage inside it The response type already means the command was decided and its events appended, so a wrapper carrying that same meaning gave a caller one more envelope to open for nothing. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
draft, which ADR#0000 forbids building against; their open questions are resolved in the ADRs themselves and flagged as needing review rather than treated as settled.DecideResponsecarried an error union of its own, so a caller had to decode a second envelope to learn a command was refused while every other outcome was already legible from the reply's status headers. A refusal now travels the way every other failure does, which costsnum_errorsits purity as a health signal; ADR#0057 records that trade and points an operator atErrorInfo.domainto separate a refused command from a broken one.Related
Decision::Actin the WASM path, which was already implemented and stale