✨ feat(examples): EX-S06 REF-EX C1-C4 in-tree fixtures - #62
Merged
Conversation
EX-S06 — extend the S02/S03 topic-registry and service-catalog packs with four generalized reference-derived patterns, each proven both-polarity via a dedicated assent test directory: - C1 list-no-shrink (topic-registry): identity-keyed `consumers` map; a key DELETE requires review (reuses the non-destructive obligation), a key ADD proves silently. Pointer-scoped to /*/consumers/*, vacuous on every S02 golden (none declare consumers). - C2 privilege-tier allow-list (service-catalog): /services/*/tier must be in [1,2,3]; an out-of-range value (e.g. 0) fails on top of the existing only-safe-fields escalation. Reuses the allowed-fields obligation; no unkeyed nested list reintroduced (D-061). - C3 wildcard-grant block (topic-registry): nested acl.grants map keyed by principal; a grant keyed by the literal wildcard "*" BLOCKs, an explicit named principal does not. New `wildcard-grant` obligation added to bindings.yaml require: (safe — coverage marks an obligation covered the instant an enforce rule names it, independent of whether any subject matches). - C4 soft-delete-as-field-add (topic-registry): adding `status: retired` (a field base lacked) requires review instead of silently approving; adding any other status value proves silently. An explicit edge case proves an unrelated field modify does not fire the rule. Verified: `assent test --coverage` green on both packs (8/8 rules covered in both polarities each); all pre-existing S02/S03 goldens unchanged and green; empirically confirmed REQ-EX-S06-05 by deleting each new rule file and observing the pack gate go red (lint for the required wildcard-grant obligation, --coverage for the reused-obligation rules).
Review finding F1: the C2 privilege-tier positive fixture (tier 1->3) was decorative, not load-bearing — deleting it left `assent test --coverage` still reporting tier-allow-list COVERED, because the pre-existing S02 allowed-fields/negative golden coincidentally moves tier 1->2, which was already inside the old [1,2,3] allow-list and silently supplied the rule's proving-polarity credit on its own. Narrow the allow-list to [1, 3] (tier 2 deprecated/consolidated, existing tier-2 services grandfathered since they never trigger a tier MODIFY). This flips that S02 fixture's 1->2 change to a tolerated failing firing instead of a proving one, making this pack's own privilege-tier/ positive fixture (1->3, unaffected by the narrower list) the sole source of proving-polarity credit. Empirically re-verified: with only the positive fixture deleted, `--coverage` now reports "MISSING catalog/tier-allow-list: no proving case" (red); restored, green again (8/8 rules, both polarities). Full `assent test`/`--coverage`/`lint` clean on both packs; `task check` green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes REF-EX C1–C4 by extending the already-merged
topic-registryandservice-catalogexample packs with four new rules + both-polarity test fixtures:consumersmap intopic-registry; a key-delete drives a non-APPROVE decision.service-catalog'stierfield restricted to[1,3], deliberately excluding2so the lane's own fixture — not a coincidental pre-existing golden — supplies the proving-polarity coverage credit.acl.grantscontaining"*"drives a BLOCK; vacuous (no-op) whenaclis absent.status: retireddrives a non-APPROVE decision; unrelated field modifies don't fire it.Went through two independent-review rounds. Round 1 found the C2 fixture was decorative — a pre-existing S02 golden coincidentally supplied its coverage credit — root-caused and fixed by narrowing the allow-list so the new fixture is now structurally exclusive per
internal/adoptertest/coverage.go's coverage-crediting mechanism. Round 2 verdict: APPROVE, only non-blocking P3 notes remain (tracked below, not blockers).Rebased onto
origin/main@befce0f(EX-S08's dogfood-discovery refactor). Only overlap with EX-S08 wasCHANGELOG.md(both branches appended to the same section) — resolved by regenerating viatask changelog-writerather than hand-editing. All other files are disjoint.Test plan
task checkgreen (incl.changelog-verify, depguard, lint, workflow-pins, dogfood-wiring, ci-audit)task coveragegreen — 91.1% (required 91%)./bin/assent test --coverage examples/packs/topic-registry— 8/8 rules COVERED, both polarities./bin/assent test --coverage examples/packs/service-catalog— 8/8 rules COVERED, both polaritiesKnown non-blocking follow-ups (P3, not blockers)
tier-allow-listinteraction is undocumented inallowed-fields/negative/expect.yaml.