Skip to content

Hoop Inspector DOCs - #153

Merged
matheusfrancisco merged 4 commits into
mainfrom
hoopinspect-docs
Jul 30, 2026
Merged

Hoop Inspector DOCs#153
matheusfrancisco merged 4 commits into
mainfrom
hoopinspect-docs

Conversation

@matheusfrancisco

Copy link
Copy Markdown
Contributor

No description provided.

@netlify

netlify Bot commented Jul 30, 2026

Copy link
Copy Markdown

Deploy Preview for decap-documentation ready!

Name Link
🔨 Latest commit 61bde71
🔍 Latest deploy log https://app.netlify.com/projects/decap-documentation/deploys/6a6bacc5b8ebdf0008402738
😎 Deploy Preview https://deploy-preview-153--decap-documentation.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

Add hoop-inspect documentation section to setup/configuration

📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

Grey Divider

AI Description

• Add a new "hoop-inspect" docs group to the setup/configuration navigation.
• Introduce Get Started, Config File reference, and Components/Architecture pages.
• Explain Envoy/OPA integration, policy evaluation, masking/PII, auditing, and deployment patterns.
Diagram

graph TD
DOCS["docs.json"] --> NAV["Docs sidebar"] <-- R(["Reader"])
NAV --> GROUP["hoop-inspect section"] --> GS["Get Started"]
GROUP --> CF["Config File"] & CMP["Components"]
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Auto-generate the Config File reference from a schema
  • ➕ Reduces drift risk between implementation and documentation
  • ➕ Makes new config fields appear in docs automatically
  • ➖ Harder to keep the narrative/explanations and operational guidance cohesive
  • ➖ Requires owning a schema/source-of-truth pipeline and doc rendering conventions
2. Split the Components/Architecture page into smaller, task-focused pages
  • ➕ Easier to skim and to deep-link during incident reviews
  • ➕ Keeps diagrams and deployment guidance closer to the relevant section
  • ➖ More navigation overhead and more cross-page redundancy
  • ➖ May dilute the single end-to-end mental model this page provides

Recommendation: The PR’s approach (curated, narrative docs with diagrams and examples) is the best fit for onboarding and operational understanding. Consider schema-based generation later specifically for the field-by-field config reference, while keeping the higher-level guidance and tradeoffs as hand-written content.

Files changed (4) +1281 / -0

Documentation (3) +1273 / -0
get-started.mdxAdd hoop-inspect quickstart guide +288/-0

Add hoop-inspect quickstart guide

• Introduces hoop-inspect’s purpose and the Envoy/OPA placement model, then walks through creating/validating config, running the relay, and wiring Envoy for Postgres and HTTP lanes. Includes troubleshooting and pointers to deeper reference pages.

setup/configuration/hoop-inspect/get-started.mdx

config-file.mdxAdd full hoop-inspect configuration reference +496/-0

Add full hoop-inspect configuration reference

• Documents the config file shape, strict decoding behavior, listener inheritance rules, policy rule types, OPA integration, masking and PII configuration, audit sinks, and upstream TLS. Also enumerates validation behavior and common refusal cases with examples.

setup/configuration/hoop-inspect/config-file.mdx

components.mdxAdd hoop-inspect architecture and flow deep-dive +489/-0

Add hoop-inspect architecture and flow deep-dive

• Explains the two-tier model (Envoy/OPA reachability vs hoop-inspect payload inspection), per-lane behavior, and the internal request/response pipeline (pump → gate → inspector/codec → policy → audit/masking). Covers audit event kinds/sinks, deployment patterns (sidecar, unix sockets, Kubernetes), and known limitations.

setup/configuration/hoop-inspect/components.mdx

Other (1) +8 / -0
docs.jsonAdd hoop-inspect group to setup/configuration navigation +8/-0

Add hoop-inspect group to setup/configuration navigation

• Registers a new grouped section ("hoop-inspect") under setup/configuration and links it to three new pages (Get Started, Config File, Components).

docs.json

@mintlify

mintlify Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
hoopdev 🟢 Ready View Preview Jul 30, 2026, 7:18 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

@qodo-code-review

qodo-code-review Bot commented Jul 30, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

Context used
✅ Compliance rules (platform): 11 rules
✅ Cross-repo context
  Explored: repo: hoophq/hoop (sha: c3c56001)
  Not relevant to this PR: hoophq/changelog

Grey Divider


Action required

1. Future-facing note in Identity 📘 Rule violation ✧ Quality
Description
The new docs include an internal/future-facing statement (Until that function is written...)
rather than describing current product behavior. This can mislead readers about what
identity/principal support exists today.
Code

setup/configuration/hoop-inspect/components.mdx[R443-445]

+Every session records `principal: anonymous` unless a deployment fills it. The plumbing runs end to end: the session carries a subject, and the proxy exposes a seam a deployment fills from a verified JWT, an mTLS peer cert or a credential token. A listener names its `identity_header`, and the current implementation contributes only the peer address.
+
+Until that function is written, a Rego policy keyed on `input.context.user` reads `anonymous` from every lane.
Relevance

●●● Strong

Prior precedent removing internal/future-facing notes from user docs.

PR-#97

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
PR Compliance ID 2280165 forbids internal/future-facing notes. The added Identity section explicitly
references unfinished work (Until that function is written...), which is future-facing rather than
a description of current behavior.

Rule 2280165: Docs must match actual product behavior and avoid internal/future-facing notes
setup/configuration/hoop-inspect/components.mdx[441-446]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`setup/configuration/hoop-inspect/components.mdx` includes an internal/future-facing note (`Until that function is written...`) which violates the requirement that docs reflect current product behavior and avoid internal roadmap/implementation notes.

## Issue Context
The docs should describe what the system does now (and, if needed, document current limitations) without implying incomplete internal work.

## Fix Focus Areas
- setup/configuration/hoop-inspect/components.mdx[441-446]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

2. CLI docs command mismatch 🔗 Cross-repo conflict ≡ Correctness
Description
The new hoop-inspect docs instruct users to run hoop start inspect --config ... --validate, but
the pinned hoophq/hoop CLI only defines hoop start agent and hoop start gateway (no inspect
subcommand, and no --config/--validate flags). Users following these docs against the current Hoop
CLI will get “unknown command/unknown flag” errors unless the CLI surface is added in hoophq/hoop
and released in coordination with these docs.
Code

setup/configuration/hoop-inspect/get-started.mdx[R74-76]

+```bash
+hoop start inspect --config config.yaml --validate
+```
Relevance

●●● Strong

Docs/behavior mismatches usually get corrected to prevent user-facing errors.

PR-#94
PR-#97

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The PR docs explicitly instruct running hoop start inspect ...; the pinned hoophq/hoop CLI’s
start command registers only agent and gateway subcommands, so inspect (and its flags)
cannot work for users on that version.

setup/configuration/hoop-inspect/get-started.mdx[70-94]
setup/configuration/hoop-inspect/config-file.mdx[442-448]
External repo: hoophq/hoop, client/cmd/start.go [16-84]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The documentation repo now publishes commands for a `hoop start inspect` subcommand (`--config`, `--validate`) that is not present in the pinned `hoophq/hoop` CLI snapshot. This breaks the docs↔CLI contract: users cannot execute the documented commands.

## Issue Context
In `/cross_repos/hoop` (pinned), `hoop start` only exposes `agent` and `gateway` subcommands.

## Fix Focus Areas
- setup/configuration/hoop-inspect/get-started.mdx[70-94]
- setup/configuration/hoop-inspect/config-file.mdx[442-448]

## What to change
Choose one coordinated path:
1) **If hoop-inspect is not yet shipped in `hoophq/hoop`:**
  - Update these docs to reflect currently available CLI commands, or clearly mark the feature as unreleased/preview and remove/replace the `hoop start inspect ...` invocations.

2) **If hoop-inspect is intended to be shipped:**
  - Coordinate a `hoophq/hoop` change that adds `hoop start inspect` with the documented flags (`--config`, `--validate`) and then only publish these docs once that CLI release is available.

Keep the docs and CLI behavior consistent for the same released version.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Informational

3. Sidebar label kebab-case ✓ Resolved 🐞 Bug ⚙ Maintainability
Description
The new navigation group label is set to the literal string hoop-inspect, which will likely be
displayed verbatim in the sidebar and is inconsistent with the Title Case group labels used
elsewhere in docs.json. If this isn’t intentional branding, it reduces sidebar
readability/discoverability.
Code

docs.json[R209-215]

+                  {
+                    "group": "hoop-inspect",
+                    "pages": [
+                      "setup/configuration/hoop-inspect/get-started",
+                      "setup/configuration/hoop-inspect/config-file",
+                      "setup/configuration/hoop-inspect/components"
+                    ]
Relevance

●● Moderate

Could be intentional branding; no close precedent on sidebar group label casing.

PR-#64

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The newly added group uses kebab-case (hoop-inspect) while other nearby groups use Title Case
names like Development Environments and Live Data Masking, suggesting the new label may be
inconsistent with established navigation conventions.

docs.json[154-166]
docs.json[190-216]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`docs.json` introduces a new navigation group with the label `hoop-inspect`. In the rest of the navigation, group labels are generally human-readable (Title Case). If the docs renderer displays group labels verbatim (common behavior), this will show up as a kebab-case label in the sidebar.

### Issue Context
This is not a functional break (the pages/paths look correct); it’s a consistency/readability improvement unless the kebab-case label is intentional product branding.

### Fix Focus Areas
- docs.json[209-216]

### Suggested change
Change the group label string to a human-readable display name (e.g., `Hoop Inspect` or `Hoop Inspect (hoop-inspect)`), while keeping the page paths unchanged.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

To customize comments, go to the Qodo configuration screen, or learn more in the docs.

Qodo Logo

Comment on lines +443 to +445
Every session records `principal: anonymous` unless a deployment fills it. The plumbing runs end to end: the session carries a subject, and the proxy exposes a seam a deployment fills from a verified JWT, an mTLS peer cert or a credential token. A listener names its `identity_header`, and the current implementation contributes only the peer address.

Until that function is written, a Rego policy keyed on `input.context.user` reads `anonymous` from every lane.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Future-facing note in identity 📘 Rule violation ✧ Quality

The new docs include an internal/future-facing statement (Until that function is written...)
rather than describing current product behavior. This can mislead readers about what
identity/principal support exists today.
Agent Prompt
## Issue description
`setup/configuration/hoop-inspect/components.mdx` includes an internal/future-facing note (`Until that function is written...`) which violates the requirement that docs reflect current product behavior and avoid internal roadmap/implementation notes.

## Issue Context
The docs should describe what the system does now (and, if needed, document current limitations) without implying incomplete internal work.

## Fix Focus Areas
- setup/configuration/hoop-inspect/components.mdx[441-446]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Comment thread docs.json
Comment on lines +74 to +76
```bash
hoop start inspect --config config.yaml --validate
```

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

3. Cli docs command mismatch 🔗 Cross-repo conflict ≡ Correctness

The new hoop-inspect docs instruct users to run hoop start inspect --config ... --validate, but
the pinned hoophq/hoop CLI only defines hoop start agent and hoop start gateway (no inspect
subcommand, and no --config/--validate flags). Users following these docs against the current Hoop
CLI will get “unknown command/unknown flag” errors unless the CLI surface is added in hoophq/hoop
and released in coordination with these docs.
Agent Prompt
## Issue description
The documentation repo now publishes commands for a `hoop start inspect` subcommand (`--config`, `--validate`) that is not present in the pinned `hoophq/hoop` CLI snapshot. This breaks the docs↔CLI contract: users cannot execute the documented commands.

## Issue Context
In `/cross_repos/hoop` (pinned), `hoop start` only exposes `agent` and `gateway` subcommands.

## Fix Focus Areas
- setup/configuration/hoop-inspect/get-started.mdx[70-94]
- setup/configuration/hoop-inspect/config-file.mdx[442-448]

## What to change
Choose one coordinated path:
1) **If hoop-inspect is not yet shipped in `hoophq/hoop`:**
   - Update these docs to reflect currently available CLI commands, or clearly mark the feature as unreleased/preview and remove/replace the `hoop start inspect ...` invocations.

2) **If hoop-inspect is intended to be shipped:**
   - Coordinate a `hoophq/hoop` change that adds `hoop start inspect` with the documented flags (`--config`, `--validate`) and then only publish these docs once that CLI release is available.

Keep the docs and CLI behavior consistent for the same released version.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

@matheusfrancisco
matheusfrancisco merged commit 1a384c3 into main Jul 30, 2026
7 checks passed
@matheusfrancisco
matheusfrancisco deleted the hoopinspect-docs branch July 30, 2026 20:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants