feat(core): bind enterprise approvals to immutable intent - #220
feat(core): bind enterprise approvals to immutable intent#220seonghobae wants to merge 63 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughopaque principal 검증, 불변 승인 범위, maker-checker 승인 수명주기를 추가했다. 승인 전환에 단조 시간과 만료 처리를 적용했다. 소비 결과를 비복제 일회성 정책 평가 사용으로 변경하고 공개 API, 테스트 및 ADR을 추가했다. Changes엔터프라이즈 승인
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🔵 Low · up to The approval lifecycle and privacy-ordering changes are supported by passing repository checks and complete production coverage. Merge is reasonable with owner follow-up for the ADR authority-boundary wording and for tightening clock-rollback coverage to assert the required error type. Sequence Diagram(s)sequenceDiagram
participant Requester
participant EnterpriseApprovalRequest
participant EnterpriseApprovalUse
participant PolicyEvaluator
Requester->>EnterpriseApprovalRequest: 정확한 ApprovalScope로 consume
EnterpriseApprovalRequest-->>Requester: 비복제 EnterpriseApprovalUse 반환
Requester->>EnterpriseApprovalRequest: checker가 revoke 수행
EnterpriseApprovalRequest->>EnterpriseApprovalUse: 공유 revocation signal 설정
Requester->>EnterpriseApprovalUse: evaluate_at 호출
EnterpriseApprovalUse->>EnterpriseApprovalUse: 시간과 철회 신호 검증
EnterpriseApprovalUse->>PolicyEvaluator: private PolicyContext로 승인 평가
PolicyEvaluator-->>Requester: Decision 반환
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 72.73% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 55 functions across 5 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heade0740a6f3a41067a4460249378e0266815018a74. -
Head SHA:
e0740a6f3a41067a4460249378e0266815018a74 -
Workflow run: 32934969677
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (10 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (10 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (4 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (4 files)"]
R2 --> V2["docs review"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
…val-intent-lifecycle # Conflicts: # CHANGELOG.md # docs/README.md # docs/adr/README.md # docs/doctoring.md
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current-head governance audit:
|
|
Exact-head blocker audit for
|
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
CHANGELOG.md— repository behaviorcrates/originweave-policy/src/enterprise_approval.rs— Rust workspace crate API and testscrates/originweave-policy/src/lib.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_clone_contract.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_lifecycle.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_principal_invisible_format.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_scope_privacy.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_single_use.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_time_integrity.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_transition_guards.rs— Rust workspace crate API and testscrates/originweave-policy/tests/enterprise_approval_use_scope_binding.rs— Rust workspace crate API and testsdocs/README.md— operator or user guidancedocs/adr/0017-enterprise-maker-checker-approval.md— operator or user guidancedocs/adr/README.md— operator or user guidancedocs/doctoring.md— operator or user guidance
Changed behavior
classDiagram
class ApprovalPrincipalRef
class new
class issuer
class subject
class ApprovalPrincipalRefError
class ApprovalLifecycleState
class EnterpriseApprovalUse
class evaluate_at
Changed API
ApprovalPrincipalRefnewissuersubjectApprovalPrincipalRefErrorApprovalLifecycleStateEnterpriseApprovalUseevaluate_atEnterpriseApprovalRequestapprovedenywithdrawconsumerevokeApprovalLifecycleErrorDecisionDenialReasonevaluate_mcpevaluate
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
b11db2be68f9b6d71aa4c4290b97a8b22097b353 - Workflow run: 33190553132
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
classDiagram
class ApprovalPrincipalRef
class new
class issuer
class subject
class ApprovalPrincipalRefError
class ApprovalLifecycleState
class EnterpriseApprovalUse
class evaluate_at
1 participant
Partial implementation of #202. This PR owns the bounded in-memory enterprise maker-checker approval lifecycle and one-shot policy-use boundary.
Authority boundary
EnterpriseApprovalRequestbinds an exact immutableApprovalScope, opaque already-authenticated principal references, trusted validity window, monotonic transition time, and bounded use count. The policy crate enforces exact(issuer, subject)requester/checker tuple separation, state/time invariants, expiry, use accounting, one-shot evaluation, and process-local outstanding-use terminal invalidation. It does not authenticate principals, prove that two aliases/federated identities represent distinct real actors, establish checker role, resolve tenant membership, or grant business authorization. Those checks remain the responsibility of the trusted identity/workflow boundary beforeapprove/deny.Successful
consumereturns a non-cloneableEnterpriseApprovalUserather than reusable approval evidence. The use retains the exact approved scope, consumption time, exclusive expiry deadline, and shared process-local terminal invalidation state.evaluate_atconsumes the use and revalidates the live request's exact action/origin/intent scope before lifecycle/time state, then applies trusted-time rollback/expiry and terminal expiry/revocation checks before introducing approval evidence into a private cloned policy context. R5 legal consent remains non-delegable.Exact-current state and evidence
main:542ca1e9c0a863595b8b6697790005d2471f5413;b11db2be68f9b6d71aa4c4290b97a8b22097b353;ahead,behind_by=0), so the PR is not carrying a stale base;33172710222: success;33172710374: success;33172710215: success;APPROVEDreview exists.The latest current-head OpenCode review (
33190553132) reports its separate central coverage-evidence gate as failure. That result is not promoted to passing evidence and is not treated as an OriginWeave product finding without source-backed proof. Historical coverage/check/review evidence from predecessor heads is not transferred tob11db2be68f9b6d71aa4c4290b97a8b22097b353.Test-first repair lineage
Earlier RED→GREEN work on this branch established monotonic trusted-time transitions, non-cloneable one-shot use, evaluation-time expiry/rollback enforcement, revocation of issued uses including the final exhausted-but-unexecuted use, actor-before-lifecycle privacy ordering, process-local revocation/expiry invalidation, explicit crash/durability limits, and exact request-scope binding before lifecycle disclosure. Those predecessor runs remain historical; the current-head evidence above is the only evidence claimed here.
Scope and durability boundary
The terminal signal coordinates only the live
EnterpriseApprovalRequestand its issued uses in the same process. Once an evaluation has passed its validity check it is considered in flight. This crate does not persist or reconstruct consumption, expiry, or revocation state after process failure and does not provide distributed cancellation/consensus. Crash-safe/distributed consumption and revocation, canonical actor correlation, tenant identity, signed/auditable evidence, operator workflow, and durable enterprise control-plane semantics remain owned by #202 and must preserve exact-scope, real-actor separation-of-duties, monotonic-time, expiry, terminal-state, one-shot, and privacy-ordering invariants.Protected-main
AGENTS.mdremains authoritative. This scheduled writer does not merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, tag, release, or publish.