docs(security): design purpose-limited PII protection - #762
Conversation
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughPII 목적 제한 권한 부여와 필드 단위 암호화 경계를 정의하는 ADR 0011을 추가했다. Principal 검증, 목적 기반 정책, AEAD envelope, 감사 순서, 마이그레이션, 키 수명주기 및 롤아웃 검증을 포함한다. ChangesPII 보호 경계
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🟡 Moderate · up to The change adds a proposed PII authorization and encryption policy, but the current design still leaves encryption serialization and envelope rules ambiguous, while the admin display can imply that an unimplemented protection is active. These bounded issues could lead to incompatible implementations or mislead operators, so merge should wait for correction or explicit owner acceptance. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3b685af971036fe61153b43eab674f4bc534390f. -
Head SHA:
3b685af971036fe61153b43eab674f4bc534390f -
Workflow run: 32286004134
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
S1 --> I1["operator or user guidance"]
I1 --> R1["Review risk: Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
R1 --> V1["docs review"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: admin.py"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: admin.py"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_admin_contract.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_admin_contract.py"]
R3 --> V3["targeted test run"]
|
|
@opencode-agent Re-review exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3b685af971036fe61153b43eab674f4bc534390f. -
Head SHA:
3b685af971036fe61153b43eab674f4bc534390f -
Workflow run: 32311240842
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
S1 --> I1["operator or user guidance"]
I1 --> R1["Review risk: Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
R1 --> V1["docs review"]
|
@opencode-agent Review exact current head SHA 3b685af. Use only same-head required Checks and changed-file evidence; publish a fresh formal verdict. Approve only when all required evidence and protected review conditions are satisfied. |
|
@opencode-agent Review exact rebased head |
|
@opencode-agent Review exact current head |
|
@opencode-agent Review exact head |
|
@coderabbitai review |
|
|
@opencode-agent Exact current head is now |
|
@opencode-agent Review exact head |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent Addressed all 11 still-valid CodeRabbit findings in exact current head |
|
@opencode-agent Review exact current head |
|
Review exact current head be6b6c7. The PII ADR now includes default-deny route-purpose startup validation, producer schema/classification rejection, immutable EncryptionContext with AEAD binding, canonical cross-database envelopes, migration/legal-hold verification, durable audit release gating, key-reference counts before revocation, leakage-control separation, replay/unknown-envelope tests, and corrected APA 7 references. Please publish a formal current-head verdict using same-head evidence only. |
|
Current-head gate: be6b6c7 has security/package/fuzz/Strix checks passing; coverage-evidence is still pending and the review record has no qualifying independent approval. This ADR-only PR does not complete purpose-limited PII authorization or field-level encryption; keep the follow-up explicit before normal protected merge. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current-head repair: 8f87bca. The admin control now labels the purpose-authorization and field-encryption policy Proposed, so the console does not claim an unimplemented runtime control. ADR 0011 now fixes one version-1 EncryptionContext serializer (NFC, fixed order, length-prefixed UTF-8, field-path grammar), one AES-GCM envelope field set with key_version and detached tag_b64, and explicit adapter-parity/mixed-legacy rejection evidence. Focused admin/security proof: 22 passed; Ruff, compileall, and diff check passed. Please review this exact head only. |
|
Exact-head validation for PR #762:
Please have |
|
Exact current HEAD 8f87bca was rechecked against the latest review guidance. The ADR now defines default-deny route-purpose registration, producer schema/classification enforcement, purpose-independent credential redaction, immutable canonical EncryptionContext AEAD serialization, one versioned envelope shape, legacy migration/rollback, audit-before-release, and key-rotation reference verification; the admin surface labels PII-001 as Proposed and its contract test asserts that status. Focused admin/security proof: 22 passed; compileall and diff-check passed. Hosted coverage-evidence is still queued and independent protected approval remains required. |
Exact-head validation — PR #762
@opencode-agent please review only exact current HEAD |
opencode-agent
Bot
added
area: security
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head8f87bcaeddff0866e26900e41deeafe208d8f9e4. -
Head SHA:
8f87bcaeddff0866e26900e41deeafe208d8f9e4 -
Workflow run: 32686097085
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: admin.py"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: admin.py"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: 0011-pii-purpose-authorization-and-field-encryption.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_admin_contract.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_admin_contract.py"]
R3 --> V3["targeted test run"]
|
@opencode-agent review — Current head |
…icy-20260819 # Conflicts: # contextual_orchestrator/admin.py
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
#803 enforcement landed; the admin console row now describes the active control (purpose-authorized roles, field encryption, audited release) instead of the pre-implementation Proposed label.
|
Merge-gate evidence (2026-08-25): All required checks green on current head except strix where applicable (org-wide NVIDIA NIM quota exhaustion — external provider-capacity blocker; serialization fix in ContextualWisdomLab/.github#1297). Local verification green. |
1 participant
Summary
adminan authentication scope rather than an implicit raw-PII purpose;Review repairs
The current ADR now specifies:
Scope
Design only. No runtime authorization, decryption, encryption, or KMS behavior is claimed as implemented. ADR 0010 remains explicit that the gateway must preserve authorized PII rather than disabling work through blanket masking.
Exact current identity
main@e226e1197bdfc890c9d8e5b9b648c78857d7e465be6b6c792165061e16f7d05a06251e5b8ee47519Merge only through the protected branch rules after the remaining current-head review and authorization gates complete. Predecessor-head evidence does not transfer.
Summary by CodeRabbit
문서
관리자 화면