docs: record 8 operator rulings from 2026-08-16 session - #59
Merged
Conversation
Adds D-144 through D-151 to the decision log — the rule-7/OPA mechanism (unblocks E11-S03/S04), the writes:false enforcement gate, the GUARD-1 BLOCK channel, provider credentials, the changelog PR gate, the apiVersion domain rename (suspended pending the assent.dev transfer), the Sonar test-complexity route, and the OpenSSF Best Practices project. Strikes the corresponding open-questions.md rows plus two rows that were already resolved by prior decisions (stale duplicate OQ-28, OQ-9).
…IdP claims policy-profiles.md now states plainly that the recorder-only invariant holds for `assent compare` but not yet for `assent run` (D-145 closes the gap). vision.md and ADR-0004 stop implying Keycloak/LDAP ship as built-in providers — they need a broker or (planned, D-147) a host-side credential resolver, since no provider transport carries a credential in-process by design (ADR-0015 §7).
…undary Records D-144's resolution of D-141's blocking sub-question: the Rego evaluator lives in internal/core/policy, and Amendment 3's net/** link-deny narrows for that package alone to capability-enforced (compile-time sandbox + golden allowlist) rather than link-enforced, closing the gap where neither existing purity gate is transitive. Folds Amendment 3's enforcement mechanism into the Invariants section and fixes one stale cross-reference (ADR-0007 amendment -> amendment 1).
Records D-147's resolution of OQ-32: providers gain a credential path for token-authenticated IdPs (Entra ID, Keycloak) without reopening the hostile-provider isolation proof. Repo-side config gains exactly one new opaque credentialRef field; the host resolves it via env, file, or a pluggable backend, binds it to a fixed origin, and injects the auth header — an MR can name a credential but never choose or redirect one. Exec-tier ScrubEnv/ScrubArgv stripping is explicitly unchanged.
Editorial pass over ADR-0002, ADR-0007, and ADR-0017 folding later amendment findings back into their originating Context/Decision sections, so the set reads as a deliberate architectural arc rather than reactive patches. No dates, evidence, or rejected-option text changed; vulnerability-timeline material (ADR-0013, ADR-0015 SEC-*) is out of scope for this pass and untouched. Renames ADR-0007's first unlabelled "## Amendment" to "## Amendment 1" to match how every existing external citation already refers to it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/decisions/decisions.md: rule-7/OPA mechanism (unblocks E11-S03/S04),writes:falseenforcement gate, GUARD-1 BLOCK channel, provider credentials, changelog PR gate, apiVersion domain rename (suspended pending theassent.devtransfer), Sonar test-complexity route, OpenSSF Best Practices project.open-questions.mdrows (duplicate un-struck OQ-28, already-closed OQ-9) and strikes the rows answered by this session's rulings.policy-profiles.mdnow states thewrites:falseinvariant is unenforced on therunpath;vision.md/ADR-0004 stop implying Keycloak/LDAP ship as built-in providers.Docs-only change — no code, no schema.
Test plan
task checkgreen locally before commit (fmt + vet + lint + test + build, all gates)mkdocs build --strictclean (0 warnings/errors) — verifies new cross-references resolveverify,Analyze (go),Analyze (actions),CodeQL)