Conversation
added 2 commits
July 19, 2026 19:27
… + async Work Requests Two fixes that make execute/observe/destroy/invoke usable against real OCI: - execBinding.base_path: the OCI API version prefix (e.g. /20160918 for core) is prepended to every operation path via opPath(). Without it the URL was https://host/vcns instead of https://host/20160918/vcns. The canonical string and the wire path both use the full path, so signing stays consistent. - Async Work Requests: a 202 (or an opc-work-request-id header) is not a completion — execute surfaces work_request_id on the step and marks the overall result "accepted" (not "succeeded"), so the caller polls the Work Request to a terminal state instead of assuming done. poll already GETs a work-request path. Backward compatible: an empty base_path prepends nothing. Test TestExecuteAsyncAndBasePath covers both (URL prefixing + accepted/work_request_id). Full local CI green (golang.quality, wasm.build/integrity/test full suite, check, verify-release, manifest, pytest). --- [signing-metadata] key = cic-my-sign-key signature = vault:v1:MEUCIEKSbIS7nr1o7ENwe6yUJwm66ClqszxDMMggNNPg5EQSAiEA26Kc8mb39tm6tS1lQaGniG2DJGzxqSArSbGPjAjuzts= hash-algorithm = sha256 digest = WW5P/rreiC1gT639lpe4s7Hdq19LXC7UGmPfzcG25FA= [certificate] -----BEGIN CERTIFICATE----- MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0 lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW -----END CERTIFICATE-----
…ns (P0.4)
observe now completes effective_config with hand-authored semantic
correspondences the SDK tags cannot express, so it is truly comparable to intent.
- module/correspondence/vcn.json: derivations {field, from, rule}. First real
rule: isIpv6Enabled (input-only) is derived from a non-empty ipv6CidrBlocks
(output-only) — enabled iff the list is non-empty. Without it a reconciler sees
false drift against an intent that sets isIpv6Enabled.
- correspondence.go: embeds the contracts (lazy-parsed, //go:embed), applies
derivations in observe after the structural projection. Rules: bool-from-nonempty,
bool-invert, rename. Hand-authored + reviewed as code, separate from the
generated schema so `make oci.generate` stays idempotent.
- Honest scope: name↔ID resolution (intent name → observed OCID) needs a provider
lookup and stays out; host-side satisfies() is P4.1.
TestObserve asserts the derived isIpv6Enabled. Roadmap P0.4 → mostly done. Full
local CI green.
---
[signing-metadata]
key = cic-my-sign-key
signature = vault:v1:MEUCIQDgRW/OUwZAW1h/VbM5ebbvc8wIHp0ZC3ocL5iv317UaQIgeqssTn+OAOozAHLfTxF/mi0hgQGRRKT6jxGME5teR3c=
hash-algorithm = sha256
digest = QNwVbwLheoomYp0ggGmLWBfVn1AbaR65mLu1vd2jD5Q=
[certificate]
-----BEGIN CERTIFICATE-----
MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw
QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV
BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy
MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb
MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D
AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe
i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU
yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS
WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF
BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0
lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW
-----END CERTIFICATE-----
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Full CI green (36 tests, including the real crypto relay-integration).