Repository navigation
cli: extend managed deadlines and prepare bounded transports - #685
Merged
Merged
Conversation
aaltshuler
changed the title
aaltshuler
changed the title
aaltshuler
changed the title
aaltshuler
force-pushed
the
codex/managed-load-demo
branch
from
September 16, 2026 14:16
91c727c to
e0a9c37
Compare
aaltshuler
marked this pull request as ready for review
September 16, 2026 14:16
This was referenced Sep 16, 2026
aaltshuler
added a commit
that referenced
this pull request
Sep 16, 2026
Signed credentials currently duplicate graph/action permissions already held in policy. Version 2 credentials authenticate a principal for one cluster; the applied Cedar policy owns graph, schema and configuration permissions. Minimal discovery exposes every effective graph ID/name without granting access to data, schema or query definitions. The shared cluster API authorizes the complete configuration plan against current applied policy, repeats checks under the existing lock, and refuses candidate self-grants, changed bases and pending recovery. Initial policy installation uses an exact first-initialization boundary. The new recovery probe inspects bounded storage metadata without opening or repairing the graph. The CLI preserves complete typed HTTP errors for both `--json` and `--format json`. Denial regressions verify structured errors and unchanged graph snapshots/branch inventory. Compatibility: - Normal managed issuance uses identity-only credentials. Published version-1 restricted credentials remain an explicit OSS compatibility profile and are never silently upgraded. - Direct/static authentication and storage-holder entry points retain their contracts. - Existing policy files need an explicit `config_manage` rule before identity-authorized configuration execution. Public exhaustive policy matches need the new `ConfigManage`/`Cluster` variants. - This change introduces no stored graph format change. It does not implement the configuration proposal in #675. The accepted design is `docs/rfcs/2026-09-09-identity-credentials-and-applied-policy.md`. This PR builds on the merged bounded-transport change in #685. Validation: the JSON-format failure was reproduced before the fix; four focused remote CLI tests and six policy-enforcement cases pass. Formatting, documentation and link checks pass; recovery code and tests use current seam APIs. On the final head, canonical local workspace/failpoint tests pass (3,182 passed, 25 ignored), as do 149 GQT library and 14 runner-dispatch tests. Full workspace, GQ, DST, server AWS, both RustFS suites and format/upgrade CI pass. Locally unconfigured cloud/predecessor fixtures are qualified by their configured CI jobs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Managed queries and mutations can outlast the current 10-second deadline. Allow 30 seconds for connection and the complete response, retaining the 10-second connection limit, 8 MiB response bound, and no redirects or automatic retries. A timed-out mutation can have committed and must be reconciled before resubmission.
Prepare the existing load and commit-read transports to use the same bounded response decoder. Managed load limits the exact UTF-8 request to 32 MiB and waits at most 300 seconds for its receipt. This PR does not activate managed routing for load or commit commands. Version-1 signed-grant fixtures retain their existing compatibility contract; they do not require other identity credentials to carry graph permissions.
The implemented boundary is recorded in accepted RFC 0053. The broader named-connection proposal in #675 is not part of this change. Upcoming release notes are in v0.12; released v0.11 notes are unchanged.
Validation at the rebased head: 14 focused managed unit tests and eight CLI routing tests passed, as did the canonical workspace/failpoint graph with CI's documented 16 MiB debug stack setting. Formatting, documentation checks, spelling and diff checks passed. All GitHub checks are green, including full workspace, GQ, AWS server, both RustFS suites and genuine-version upgrade/format checks. The initial local default-stack overflow in an unchanged cluster test was reproduced and passed with the existing CI setting; no source workaround was added.