Forward-merge release/2.2 into develop - #365
Merged
Merged
Conversation
#### Overview Correct documentation defects found during v2.2.0 documentation QA. Docs-only — no code or schema changes. - **`docs/source/customization/guardrails.md`** — the *Configuration Shape* example now includes each middleware's `workflow_functions` field selection (matching `configs/config_web_default_guardrails.yml`). Previously the example attached middleware with no field selection, which resolves to **zero guarded fields** — a boundary that looks configured but is not enforced. The surrounding prose now calls out that failure mode. - **`docs/source/customization/mcp-tools.md`** — no longer implies `configs/config_web_frag_mcp_auth.yml` declares a `per_user_mcp_client` function group (it deliberately omits it; the per-user MCP client is built in code per job). Security Guidance now shows `per_user_auth` as the nested `PerUserAuthConfig` object instead of a bare boolean. - **`deploy/.env.example`** — documents `AIQ_CONTENT_ENCRYPTION` / `AIQ_CONTENT_ENCRYPTION_KEY` (content encryption) and `OPENAI_API_KEY` (required by `configs/config_frontier_models.yml`). - **`skills/aiq-research` and `skills/aiq-deploy`** — version stamps bumped to `2.2.0`. Two related QA items were already resolved by #322 (stale MCP in-worker-refresh wording; the README config table and researcher-LLM default) and need no change here. #### DCO sign-off for the squash commit Signed-off-by: Tanner Leach <tleach@nvidia.com> #### Validation - Guardrails example parsed; its `workflow_functions` verified **byte-equal** to `config_web_default_guardrails.yml`, and a config copied from the example yields non-empty guarded targets. - `per_user_auth` example validated against the real `PerUserAuthConfig` fields and the shipped `gdrive` source. - `scripts/validate_skills.py` → 11 skills OK; no stale `2.1.x` remains in the edited skills. - Both changed docs MyST-parsed with the repo's enabled extensions and diffed against their pre-edit versions → **0 new warnings/errors**; the nested `per_user_auth` code block renders inside its list item. - `git diff --check` clean; new `.env.example` entries are commented placeholders with no values. - [x] I ran the relevant local checks or explained why they are not applicable. - [x] I added or updated tests for behavior changes. *(docs-only; no behavior change, so no tests)* - [x] I updated documentation for user-facing or contributor-facing changes. - [x] I confirmed this PR does not include secrets, credentials, or internal-only data. - [x] I certify this contribution under the Developer Certificate of Origin (DCO) and signed my commits with `git commit -s` or an equivalent sign-off. - [x] I replaced the DCO sign-off placeholder with my GitHub commit identity and kept the required angle brackets around the email address. #### Where should reviewers start? `docs/source/customization/guardrails.md` — the security-relevant change. Confirm the *Configuration Shape* example's `workflow_functions` matches `configs/config_web_default_guardrails.yml` so a config copied from the docs actually guards the agent boundary. #### Related Issues - N/A — found during v2.2.0 documentation QA; no public tracking issue. ## Summary by CodeRabbit * **Documentation** * Expanded the deployment environment example with optional frontier-model configuration and optional at-rest content encryption settings. * Improved NeMo Guardrails “Configuration Shape” examples, clarifying how guarded field selection is applied. * Updated per-user MCP OAuth guidance, including the required `per_user_auth` block structure and clearer security/token handling notes. * Updated deploy and research skill docs for Blueprint **2.2.0** compatibility. * **Configuration** * Documented the encryption mode and related encryption key variables, plus the frontier-model API key placeholder. Authors: - Tanner Leach (https://github.com/tanleach) Approvers: - Chantal D Gama Rose (https://github.com/cdgamarose-nv) URL: #359
Author
|
SUCCESS - forward-merge complete. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-merge triggered by push to release/2.2 that creates a PR to keep develop up-to-date. If this PR is unable to be immediately merged due to conflicts, it will remain open for the team to manually merge. See forward-merger docs for more info.