release: promote develop eba5ec54 to main — the engines' named backlog is implemented or declared - #798
Merged
Conversation
…red; guard 73 refuses coverage-only by omission Implemented, so the OPA-only side of engine-coverage-parity.baseline.json is EMPTY on both scenarios (was 7 / 7): - TelemetryEvidenceRuleHandler decides OBS-EVD-01..03 from the satellite's dependencies — the same proxy telemetry-evidence.rego reads, the same package lists, so the same verdict. The rules declare `satellite.packageJson` and nothing they do not read; `telemetryBackend` leaves the vocabulary (84 facets). - McpRuleHandler decides MCP-05 from the server source (the tokens mcp.rego looks for) and FAILS MCP-01..03 on absent smoke evidence with the policy's own words — the evidence is an observed fact of the checkout. Declared, in the rule where the declaration belongs: - SEC-INJ-01/02, SEC-PATH-01/02, SEC-TIMING-01/02, SEC-RL-03 declare `satellite.findings`: a scanner's finding over the AST, not a regex over the tree (MM-R10). unimplemented-native 21 → 14, needs-external-system 27 → 33. - QT-05 declares `satellite.testing` and SdlcRuleHandler no longer claims it — "always passes (requires runtime analysis)" was a fixed answer. It leaves the native-only baseline (82 → 81 / 49 → 48). Recorded, and enforced: `.harness/scripts/ci/engine-coverage-decisions.json`. Every baseline entry whose class is debt (no-policy-in-bundle, unimplemented-native, handler-declined, opa-gave-no-reason, undecided) must carry a decision — native-only / opa-only / neither — or guard 73 fails it as coverage-only BY OMISSION; a decision the runs contradict (its rule decided by both engines, or by the engine it said would not) fails too. Eight decisions: SSDF, SLSA, SEC-RL-01/02, MM-R* (11 — MM-R03 is decided by both, and the guard said so on its first run), the enforcer-routed HXA-01/02/04/05, the 138 generated ADR-conformance rules as a `neither` pattern (documentation-only on both engines — OpaEvaluator now states the declaration's class for a policy-less rule whose `facts: []` say there is nothing to check), the seven scanner rules and QT-05 as `neither`. Guard 68: GOV-RULE-NON-EXECUTABLE registered with a reason of its own — on 68's `--core`-less run the native engine resolves the corpus to the CLI's bundled copy and fails the 138 ADR-conformance rules (0 non-executable) while OPA now counts 138; with `--core .` both engines emit the identical row. Moving 68 onto the export is AC5. Pins moved: native-handler 171 → 173, needs-runtime 23 → 22; blocking rules that do not run 73 → 71 (5 handlers, 21 adapters, 14 runtime, 27 postures, 4 authoring); unclaimed 106 → 104. Snapshot, ISO 5055 mapping and the standards README re-derived (backlog 14: 5 adoptable, 0 partial, 9 to author). Parity fixtures follow the handlers. OPA README, known-limitations and the CLI's bundled copy updated (EN/ES). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: aarroyo <beyondnet.peru@gmail.com>
…ster is there by omission Catalog (EN/ES): AC4 ticked with what was implemented (OBS-EVD-01..03, MCP-05, MCP-01..03 on both engines), what was declared in the rule (the seven scanner rules, QT-05), what was recorded and enforced (engine-coverage-decisions.json, eight decisions, guard 73 refusing a debt entry without one), the falsifier observed before it was trusted (MM-R03, decided by both engines, flagged on the guard's first run), the measurements (opa-only 0 / 0, native-only 81 / 48), what was NOT done as first phrased (no .rego twins for the 11 no-policy rules — a recorded decision each) and the costs (backlog 21 → 14, blocking non-running 73 → 71, one registered conflict on guard 68 that AC5 removes by moving 68 onto the export). Board (EN/ES): row note and Last Updated; counters unchanged (688 / 715 · 3 in progress · 3 pending · 21 deferred), AC5 open. maturity-evidence.json asOf follows the board date (guard 09). Derived chain replayed (guard 46 at a fixed point). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: aarroyo <beyondnet.peru@gmail.com>
…ld has no production paths CI (Test infra-providers) caught the native twin doing what `--engine opa` always did: failing a freshly initialised satellite on OBS-EVD-01..03 — "no tracing / logging / metrics package" about a repository with no request path yet. The GT-571 invariant is the right one: a scaffold does nothing wrong. The rules speak of PRODUCTION request paths and services, so they now declare `appliesFromSdlcPhase: 3` (Construction: the first phase at which a codebase with request paths and dependencies exists) — the applicability fact their prose always stated, the same move MTN-05 made for Design. It excludes them BEFORE either engine runs, so both engines agree on the scaffold too. Deferred, not disabled: from Construction on, a satellite without those packages is failed for exactly the reason the rule states. Deferral test added beside MTN-05's; catalog (EN/ES) says so. Guards 73 / 68 / 46 / 08 green; infra-providers 189/189. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: aarroyo <beyondnet.peru@gmail.com>
… Core's server, never a satellite CI (Test infra-providers, on a checkout with no `.harness/evidence/`) caught the second half of the same lesson: once the native engine decides MCP-01..03 the way the policy does (absent smoke evidence FAILS), a freshly initialised satellite validated against a Core without evidence got three blocking findings addressed to the Core — the GT-571 complaint verbatim. The laptop had the gitignored evidence file, so the local run passed; reproduced by hiding it. `scope: core-cli` always said whom the pack speaks to; `audience: core` now says it where applicability reads it (as the CLI packs do), so both engines exclude MCP-* on a satellite before running and still decide all five on the Core. MCP-01 pinned in the GT-571 exclusion list; catalog (EN/ES) says so. infra-providers 189/189 with the evidence hidden; guards 73 / 68 / 46 / 08 green. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: aarroyo <beyondnet.peru@gmail.com>
feat(engines): GT-716 AC4 — the named backlog is implemented or declared; nothing coverage-only by omission
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Promotes
developateba5ec54tomain. Since the last promotion (08253324, develop2e2a5527) it carries #797:OBS-EVD-01..03andMCP-05;MCP-01..03fail on absent smoke evidence on both engines. The OPA-only side of the engine coverage baseline is empty on both scenarios.engine-coverage-decisions.json: every debt-class coverage entry carries a recorded decision, and guard 73 fails an entry without one (coverage-only by omission) or a decision the runs contradict.satellite.findings;QT-05namessatellite.testing;OBS-EVD-01..03apply from Construction; the MCP pack declaresaudience: core.Merge commit, as the previous promotions.
🤖 Generated with Claude Code