Repository navigation
docs: revise configuration/CLI proposal for remaining connection selection gaps - #675
Draft
aaltshuler wants to merge 3 commits into
Draft
aaltshuler wants to merge 3 commits into
aaltshuler wants to merge 3 commits into
Conversation
This was referenced Sep 6, 2026
This was referenced Sep 16, 2026
aaltshuler
added a commit
that referenced
this pull request
Sep 16, 2026
Managed queries and mutations can outlast the current 10-second deadline. Allow 30 seconds for connection and the complete response, retaining the 10-second connection limit, 8 MiB response bound, and no redirects or automatic retries. A timed-out mutation can have committed and must be reconciled before resubmission. Prepare the existing load and commit-read transports to use the same bounded response decoder. Managed load limits the exact UTF-8 request to 32 MiB and waits at most 300 seconds for its receipt. This PR does not activate managed routing for load or commit commands. Version-1 signed-grant fixtures retain their existing compatibility contract; they do not require other identity credentials to carry graph permissions. The implemented boundary is recorded in accepted RFC 0053. The broader named-connection proposal in #675 is not part of this change. Upcoming release notes are in v0.12; released v0.11 notes are unchanged. Validation at the rebased head: 14 focused managed unit tests and eight CLI routing tests passed, as did the canonical workspace/failpoint graph with CI's documented 16 MiB debug stack setting. Formatting, documentation checks, spelling and diff checks passed. All GitHub checks are green, including full workspace, GQ, AWS server, both RustFS suites and genuine-version upgrade/format checks. The initial local default-stack overflow in an unchanged cluster test was reproduced and passed with the existing CI setting; no source workaround was added.
aaltshuler
added a commit
that referenced
this pull request
Sep 16, 2026
Signed credentials currently duplicate graph/action permissions already held in policy. Version 2 credentials authenticate a principal for one cluster; the applied Cedar policy owns graph, schema and configuration permissions. Minimal discovery exposes every effective graph ID/name without granting access to data, schema or query definitions. The shared cluster API authorizes the complete configuration plan against current applied policy, repeats checks under the existing lock, and refuses candidate self-grants, changed bases and pending recovery. Initial policy installation uses an exact first-initialization boundary. The new recovery probe inspects bounded storage metadata without opening or repairing the graph. The CLI preserves complete typed HTTP errors for both `--json` and `--format json`. Denial regressions verify structured errors and unchanged graph snapshots/branch inventory. Compatibility: - Normal managed issuance uses identity-only credentials. Published version-1 restricted credentials remain an explicit OSS compatibility profile and are never silently upgraded. - Direct/static authentication and storage-holder entry points retain their contracts. - Existing policy files need an explicit `config_manage` rule before identity-authorized configuration execution. Public exhaustive policy matches need the new `ConfigManage`/`Cluster` variants. - This change introduces no stored graph format change. It does not implement the configuration proposal in #675. The accepted design is `docs/rfcs/2026-09-09-identity-credentials-and-applied-policy.md`. This PR builds on the merged bounded-transport change in #685. Validation: the JSON-format failure was reproduced before the fix; four focused remote CLI tests and six policy-enforcement cases pass. Formatting, documentation and link checks pass; recovery code and tests use current seam APIs. On the final head, canonical local workspace/failpoint tests pass (3,182 passed, 25 ignored), as do 149 GQT library and 14 runner-dispatch tests. Full workspace, GQ, DST, server AWS, both RustFS suites and format/upgrade CI pass. Locally unconfigured cloud/predecessor fixtures are qualified by their configured CI jobs.
aaltshuler
changed the title
Contributor
Author
|
The 0.13 audit leaves a smaller unresolved scope here. #878 replaced the deployment/CLI baseline, and #676 already covered part of the targeting problem. The draft must be rewritten before acceptance; it should not merge as written or be closed as implemented. Carry forward explicit managed data connections/profiles/aliases, independently selected endpoint/credential binding, and the tests that prove destination and credential choice. Keep #653 as its separate served-catalog feature. Rebase the design on the current v2 identity and |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current scope after 0.13
This draft needs a rewrite before it can be reviewed for acceptance. It is not implemented or ready to merge. The server and cluster work in #878, together with the earlier targeting fixes in #676, invalidates much of the September baseline.
Preserve these remaining proposals when narrowing or replacing it:
Rewrite against the current
cluster ... --managedand server-owned deployment contracts. Do not restore removedimport,refresh,approve, legacy compatibility aliases, or v1 credentials to satisfy the old text. Retain current explicit direct access where supported. Remove restart-only activation assumptions and duplicate framework documentation; keep only unresolved decisions and their evidence gates.Keep this PR open until the surviving requirements have a revised proposal or explicit replacement links. The original description below is historical context; its validation does not qualify a rewritten proposal.
Original proposal description (September 2026)
What & why
Add draft RFC 0059 for cluster-first managed connection selection and
compatible CLI routing, plus
docs/dev/config-cli-framework.mdfor theconfiguration/CLI framework, ASCII model, operation contracts, invariants and
review guidance. The RFC distinguishes inspected historical behavior from
proposed requirements and updates the documentation indexes and registry.
CC-11 now specifies a 10-second connection limit within a 30-second total
managed query/mutation deadline, including the complete response body. The
narrow deadline agreement is coordinated with
PR #685; it does not accept
the broader resolver proposal. CC-17 includes late success, connection and
response deadlines, and unknown mutation outcomes with no automatic retry.
Backing issue / RFC
Accepted issue #653 is included as a separately testable served catalog CLI
extension. This PR does not implement or close it. Deferred additions from
#550, #565 and #432 are excluded.
Checklist
deny-list exception requested.
Local verification
Documentation checks passed: agent/index links (47 links, 45 docs), Markdown
links and structure (133 files), spelling and
git diff --check. Runtimeacceptance criteria remain future evidence gates for the broader proposal.
RFC 0059 remains
draft/not-started. The framework preserves the inspectedbaseline's 10-second deadline as a historical fact and labels 30 seconds as
the proposed contract. Offline credentials, permission-based execution and
Core configuration ownership remain intact.