## operator transfer paths and add audit-trail tests - #547
Merged
Conversation
…_operator lets an admin bypass the canonical two-step protocol silently
### Problem `set_operator` (single-step, admin-only, no new operator consent) and the two-step `propose_operator`/`accept_operator` handoff coexisted without documentation explaining when each is appropriate. Consumers couldn't distinguish consented from non-consented operator changes from the event stream, and no tests covered the interaction between the two paths. ### Changes **Documentation** - Added module-level docs in `governance.rs` explaining both operator transfer paths: consent semantics, event trails, intended use, and security implications - Updated `set_operator` function docs with detailed sections on consent, break-glass use, pending-slot interaction, and gating - Updated `propose_operator`/`accept_operator` docs to clearly identify them as the canonical two-step path - Updated `op_set` event schema in `event_schema.rs` to note the new operator did not consent, and that consumers can distinguish paths by event name - Updated public API doc comments in `lib.rs` for consistency **Tests** (5 new) - `test_set_operator_emits_only_op_set_event` — single-step emits `op_set`, not `op_prop`/`op_acc` - `test_two_step_operator_emits_op_prop_and_op_acc` — two-step emits `op_prop`+`op_acc`, not `op_set` - `test_set_operator_does_not_clear_pending_operator_slot` — pending proposals survive `set_operator` - `test_set_operator_does_not_require_new_operator_consent` — documents admin-only auth - `test_set_operator_after_propose_does_not_invalidate_proposal` — mixed-path event trail ### Verification - `cargo test --lib`: 598 passed, 0 failed - `cargo clippy --lib -- -D warnings`: clean - `cargo fmt --check`: clean ### Out of scope Removing `set_operator` (ABI change, companion issue) or altering its semantics to require new operator auth.
|
@akargi Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #471
Description
Brief description of the changes in this PR.
Type of Change
Closes The config-freeze gate is applied unevenly across admin functions: governance mutations are frozen-gated but pause, unpause, and migrate are not, with no documented boundary #473
Related Issues
Fixes #(issue number) or relates to #(issue number)
Closes #480
Changes Made
Testing
Describe the testing performed to validate these changes:
Checklist
Screenshots (if applicable)
Add screenshots or logs if applicable.
Closes #485