docs(rfc-0010): audit-stream queries + template drift surface - #164
Merged
Conversation
Fills the audit-stream query gap RFC 0002 §6.3 deferred: a first-class, contained `drift` query head over the per-tenant RFC 0005 audit/ Parquet stream that encapsulates the fixed RFC 0001 §6.7 drift aggregation (filter widening/type-expansion events in [t1, t2), group by template_id, project widening_count + version/time bounds, order by count desc). Deliberately does not require RFC 0002's deferred general count/agg pipeline; the §5 criteria (RFC0010.1-.8) discharge RFC 0001 scenario H5.3. Spec-only (status drafted); extends RFC 0002 without reopening it and reads — does not redefine — the RFC 0005 audit schema. Adds the nav entry in docs/SUMMARY.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
Contributor
There was a problem hiding this comment.
Pull request overview
Drafts RFC 0010 to specify a first-class drift query head over the per-tenant RFC 0005 audit/ Parquet stream, filling the previously-deferred audit-stream query surface (RFC 0002 §6.3) and defining acceptance criteria intended to discharge RFC 0001 hazard scenario H5.3.
Changes:
- Add new RFC document: RFC 0010 — Audit-stream queries & template drift (status:
drafted), including proposed DSL surface, semantics, and acceptance criteria. - Add the RFC 0010 entry to the mdBook navigation (
docs/SUMMARY.md).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| docs/SUMMARY.md | Adds RFC 0010 to the RFCs table of contents. |
| docs/rfcs/0010-audit-stream-queries.md | Introduces the RFC 0010 draft specifying the drift query surface and related criteria. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughThis PR adds RFC 0010: a specification for a dedicated ChangesRFC 0010: Audit-stream drift queries specification
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…fix dep statuses Maintainer confirmed the dedicated drift query head (not the general aggregation pipeline) on 2026-06-09 — bump drafted→specified. Fix the §2.1 dependency-status claim: RFC 0001 is specified + RFC 0005 drafted, not all accepted/green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docs/rfcs/0010-audit-stream-queries.md (1)
261-271: ⚡ Quick winClarify how
drift_queryintegrates into the top-level grammar.The EBNF production defines
drift_querybut does not show how it integrates with the existing RFC 0002 grammar. Line 269 states it's "a top-level alternative to RFC 0002'spredicate { | stage }query," suggesting the overall grammar now has multiple top-level alternatives. Consider adding a brief note showing the updated top-level production, e.g.:query = log_query | drift_query ; log_query = predicate , { "|" , stage } ; drift_query = "drift" , "from" , time , "to" , time ;This would make the grammar extension explicit and unambiguous for implementers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/rfcs/0010-audit-stream-queries.md` around lines 261 - 271, Add an explicit top-level production to show how drift_query is integrated: state that the top-level nonterminal query now alternates between the existing log_query (the RFC0002 predicate with optional "|" stage(s)) and the new drift_query (the "drift" from time to time form), and clarify that drift_query is a standalone top-level alternative that does not accept "|" stages; update the grammar paragraph around drift_query and the examples to reflect this change and reference the existing predicate and stage nonterminals.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/rfcs/0010-audit-stream-queries.md`:
- Around line 387-393: Update the documentation cross-reference and/or RFC
wording to explicitly state the half-open boundary semantics used by the
querier: mention that Stage::Range(from, to) in
crates/ourios-querier/src/compile.rs compiles to the predicate `TIME_UNIX_NANO
>= start AND TIME_UNIX_NANO < end` (i.e., [from, to) lower-inclusive,
upper-exclusive), and add that exact wording to RFC 0002 §6.1 (or change RFC
0010’s reference to point at a new § documenting the boundary contract) so the
claim that RFC0010.2 and RFC0002 agree is backed by explicit text; reference the
symbols Stage::Range, TIME_UNIX_NANO, RFC 0002 §6.1, and RFC 0010.2 when making
the edits.
---
Nitpick comments:
In `@docs/rfcs/0010-audit-stream-queries.md`:
- Around line 261-271: Add an explicit top-level production to show how
drift_query is integrated: state that the top-level nonterminal query now
alternates between the existing log_query (the RFC0002 predicate with optional
"|" stage(s)) and the new drift_query (the "drift" from time to time form), and
clarify that drift_query is a standalone top-level alternative that does not
accept "|" stages; update the grammar paragraph around drift_query and the
examples to reflect this change and reference the existing predicate and stage
nonterminals.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1b127819-f538-4d55-9a2a-69d7137f1256
📒 Files selected for processing (2)
docs/SUMMARY.mddocs/rfcs/0010-audit-stream-queries.md
…laim Hazards are numbered items under CLAUDE.md §4 / docs/hazards.md, not §4.5 /§4.6 subsections — cite H5/H6. README has no §5 — cite its Required-sections acceptance-criteria format. And RFC 0002 does not pin range boundary semantics, so RFC 0010 defines the drift window as half-open [from,to) on its own (recommending range converge) rather than claiming RFC 0002 already does. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jensholdgaard
changed the title
…02 range Remove the remaining attributions that RFC 0002 §6.1 range specifies half-open [from,to) (it does not): the RFC0010.2 §5 criterion, the §6.5 parenthetical, and the boundary-test golden reference now state the half-open semantics this RFC defines. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tter Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… throughout Bare [§6.7] read as an internal ref (this RFC has no §6.7) — now [RFC 0001 §6.7]. Closed [t1,t2] in the summary + §5 criteria conflicted with the half-open [from,to) window — now [t1,t2) everywhere for consistency with §6.5. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
RFC 0002 §7 timestamps are bare lexical tokens, not quoted strings — unquote the absolute-window example so it parses. And [§3.7]/(§3.7) are CLAUDE.md (multi-tenancy), not in-document sections — cite explicitly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ner-confirmed) The status note says the verb-head surface was confirmed 2026-06-09, so the §9 open question for it is now checked [x]; the remaining forks (window, tie-break, version aggregation) stay open. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ing) RFC 0005 §3.7 is the audit-event file schema; §6 is its testing strategy. Fix the columns / event-kind-mapping / predicate-pushdown / references citations to §3.7 (keeping §3.4 for the partition layout). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
event_kind is Arrow UInt8 / INTEGER(8, unsigned) (not INT32); template_id is UInt64; old_version/new_version are UInt32 and OPTIONAL (relaxed for the compaction kind, required-by-convention for template kinds) — matching ourios-parquet audit_schema(). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
RFC 0010 — Audit-stream queries & template drift (doc-only,
status: specified; dedicateddriftsurface maintainer-confirmed2026-06-09). Adds
docs/rfcs/0010-audit-stream-queries.md+ thedocs/SUMMARY.mdnav entry. No code.The gap
Three RFCs leave one hole between them:
gained a version in
[t1, t2]") as SQL "for spec clarity" and says theuser-visible form is the RFC 0002 DSL — which was never specified.
to a future RFC.
audit/Parquet series (
ParquetAuditSink/AuditReader/audit_schema()),but nothing turns them into an operator query.
Design
A dedicated, contained
drift from <t1> to <t2>verb head over theper-tenant
audit/stream — NOT RFC 0002's deferred general aggregationpipeline. Half-open
[from, to)window defined locally (RFC 0002 does notpin
rangeboundaries). §5 carries RFC0010.1–.8 (RFC0010.1 dischargesRFC 0001 H5.3); implementation follows once specified.
🤖 Generated with Claude Code
Summary by CodeRabbit