feat(scenarios): expand Terraform and Kubernetes corpus to Network-level depth - #51
Merged
wonkwonlee merged 22 commits intoJul 31, 2026
Merged
Conversation
…rnetes/Terraform replay) (#48) * feat: add app review contract schemas * fix: validate contract version mismatches * test: pin network regression baseline * test: probe blocked simulation directly * test: guard core domain presentation boundaries * feat(ui): add semantic design tokens * feat(ui): add static review workbench shell * test: guard design token regex captures * fix(ui): ground static shell in replay fixture * feat(ui): expose public replay workbench route * test(ui): baseline workbench responsive semantics * feat(ui): disclose workbench runtime variants * fix(ui): distinguish queue review-record storage * test(e2e): baseline public workbench * test(e2e): harden workbench static boundary * test(e2e): intercept workbench data requests * test(e2e): add workbench visual baseline * test(e2e): make workbench baseline portable * test(e2e): add platform-specific workbench baselines * feat: add v1 domain review transport contracts * fix: enforce review risk and replay fallback contracts * feat: add closed domain runtime registry * fix: compose immutable session capabilities * fix: source durability from transport capability * feat: add pure review workflow controller * fix: correlate review controller attempts * fix: bind review input identity at initialization * feat: add v1 review analyze API contracts * feat: add registry-backed review analyze route * feat: add review controller React hook * fix: bind hook results to active attempts * refactor: lazily load domain runtimes * feat: complete review controller lifecycle * fix: bind receipts to active review workflow * fix: bind receipt identity provenance * feat: expose review hook lifecycle actions * fix: validate review rebind before abort * feat: add public replay review transport * refactor: isolate review API contracts * feat: add network review examples * feat: compose network review receipts * feat: publish network policy version in examples * fix: bind receipts to session policy version * fix: version review policy binding contract * feat: add network workflow compatibility facade * fix: bind legacy analyses to review session * fix: bind replay responses to requested fixture * fix: bind replay provenance to requested fixture * test: reject authored synthetic fixture substitution * feat: make network workbench replay interactive * fix: improve workbench replay accessibility * fix: mark review canvas busy during replay * test: prove network review parity * test: bind parity provenance to fixtures * test: prove workbench replay provenance * test: make workbench route assertion order-insensitive * feat: add Terraform replay examples * feat: resolve Terraform public replay * fix: bundle Terraform replay context safely * feat: add Terraform public replay workbench * test: prove Terraform replay parity * fix: keep public replay decision-free * fix: preserve legacy network review lifecycle * test: distinguish durable review hook sessions * feat: add Kubernetes replay examples * test: prove Kubernetes replay derivation * fix: isolate Kubernetes YAML parser boundary * fix: isolate kubernetes offline metadata * feat: resolve Kubernetes public replays * fix: load Kubernetes runtime through offline boundary * feat: add Kubernetes public replay workbench * fix: match Kubernetes selectors against pod labels * test: prove Kubernetes public replay parity * feat: add durable review proof contracts * fix: bind durable intake and receipt proofs * fix: verify durable records before persistence * feat: add durable review record store * fix: harden durable review store integrity * fix: block durable review replace conflicts * fix: guard explicit durable review sequence replacement * fix: migrate durable review conflict trigger * feat: split pending durable review resolution * feat: split durable review pending records * fix: bind durable resolution to parent at database boundary * feat: add authenticated durable review endpoints * fix: scope durable review intake provenance * fix: isolate durable review owner identities * fix: migrate ownerless durable review schema * fix: quarantine ownerless review migrations * fix: preserve exact durable review migrations * feat: resolve durable reviews server-side * fix: serialize durable receipt issuance * fix: harden durable decision claim lifecycle * feat: expose durable receipt proof * fix: verify durable recovery authorship * fix: expose corrupted receipt proof evidence * feat: add authenticated self-hosted workbench * fix: harden self-hosted workbench state * feat: expose domain policy coverage * feat: document future domain capability boundary * fix: validate runtime policy coverage metadata * feat: add accessible network topology tables * fix: enforce client telemetry privacy * fix: close client telemetry bypasses * feat: harden public workbench accessibility * fix: meet WCAG contrast for muted text * fix: harden large workbench evidence * fix: close public workbench review gaps * test: close domain route family gaps * test: enforce public client bundle budgets * fix: harden public client bundle verification * fix: scan every emitted client chunk * fix: guard self-hosted client dependencies * feat: cut over to vnext network workbench * docs: align operator guidance with vnext workbench * chore: remove retired live rate limiter * docs: correct vnext release references * refactor: retire legacy local review authority * build: refresh shipped CLI bundle * test: keep Action self-test fixtures available * docs: refresh public bundle baselines * chore: complete multidomain console ultragoal * Create 2026-07-29-multidomain-console-vnext-g001.md * fix: adapt vNext scenario consumers to the reorganized scenarios API Merging origin/main (#47) renamed ScenarioDefinition.bundle to .input and scenario.title to .label, and split fixtures out as nullable. Update the public reviews/analyze route, ReviewWorkbenchShell, and the durable review store test to the new shape. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: restore the Network route's domain bundle boundary after the scenarios reorg Merging origin/main pulled in scenarios/index.ts's unified registry, which resolves every domain (network, terraform, kubernetes) through scenarios/domains.ts at module scope. Any importer — including app/page.tsx's Network workbench — therefore pulled in @changesafe/domain-terraform and @changesafe/domain-kubernetes too, violating the per-route bundle boundary enforced by tests/unit/workbench-performance-boundaries.test.ts. Add scenarios/network.ts as a self-contained, network-only scenario registry (no dependency on scenarios/domains.ts), have scenarios/index.ts compose SCENARIOS from it instead of duplicating the definitions, and repoint the Network route's browser-reachable consumers (ReviewWorkbenchShell, features/domains/network/examples) at it directly. Update the remaining test files for the renamed ScenarioDefinition fields (.bundle -> .input, .title -> .label) and the hardcoded pre-reorg fixture paths in packages/server/tests/reviews.test.ts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
…es parity) Plans 12 new scenarios to bring Terraform and Kubernetes coverage up to Network's existing risk-level and policy-surface depth. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…CAL, adversarial)
…ITICAL, adversarial)
…TICAL, adversarial)
…, CRITICAL, adversarial)
checkOne called domain.parseInput with only the raw incident JSON, so the terraform domain's context (used for UNTRUSTED_INSTRUCTION detection) was always dropped on the CLI path even though the test-harness registry already forwarded it, letting scenario-p-injected-pr-context silently pass CI's corpus-check job with the wrong verdict.
…narrative Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e49df6c74b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
4 tasks
Owner
Author
|
Addressed in commit
Verification: |
5 tasks
Owner
Author
|
Addressed Codex review feedback: P1 - Parse the receipt decision values returned by the server
P2 - Bind Kubernetes results to the snapshot identifier
Verification: npm test (1112 passed), npm run lint (clean), npm run typecheck (clean) |
…avigation-and-workbench-2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Notable fixes found along the way
context(untrusted PR/commit text) field through the test-facing scenario registry (scenarios/domains.ts) soUNTRUSTED_INSTRUCTIONcan be exercised for Terraformpackages/cli/src/domains.tsviapackages/cli/src/scenario.ts) during final verification — this is the registry CI's corpus job actually uses (scenario check --dir <domain> --domain <domain>), and without this second fix one scenario would have passednpm testlocally but failed CIcontextfield indocs/SCENARIO_AUTHORING.mdTest plan
npm test— 1111 passed / 4 skippednpm run lint— cleannpm run typecheck— cleanchangesafe scenario check --dir scenarios/network --domain network— 9/9 okchangesafe scenario check --dir scenarios/terraform --domain terraform— 7/7 okchangesafe scenario check --dir scenarios/kubernetes --domain kubernetes— 9/9 okchangesafe scenario gallery --check— current, no driftDesign:
docs/superpowers/specs/2026-07-30-scenario-corpus-expansion-design.mdPlan:
docs/superpowers/plans/2026-07-30-scenario-corpus-expansion.md🤖 Generated with Claude Code