Repository navigation
Add Signal batch trust policy gate - #37
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a new strict-contract workflow step (step.signal_trust_policy_check_batch) that evaluates Signal trust policy across multiple trust refs in a single aggregated, fail-closed decision, and wires it through provider contracts, metadata, docs, and fixtures.
Changes:
- Adds protobuf contract types for batch trust-policy subjects/decisions plus batch step input/output/config.
- Implements store-level batch evaluation with validation (empty/duplicates/100-subject cap) and a deterministic batch policy ref.
- Exposes the new step across provider registry/contracts, plugin metadata, README documentation, tests, and a pipeline fixture.
Reviewed changes
Copilot reviewed 11 out of 13 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| testdata/pipelines/signal-trust-reset.yaml | Adds fixture usage of the new batch trust-policy step (gate + report-only). |
| README.md | Documents the new batch trust policy gate semantics and outputs. |
| proto/signal.proto | Adds public protobuf messages for batch trust policy config/subject/decision/input/output. |
| proto/signal.pb.go | Regenerates Go protobuf bindings for the new batch trust policy messages. |
| plugin.json | Registers step.signal_trust_policy_check_batch in plugin metadata. |
| plugin.contracts.json | Adds strict contract entry for the new batch step. |
| internal/trust_store.go | Implements batch policy evaluation under one lock + batch policy ref helper. |
| internal/trust_policy_test.go | Adds tests covering mixed decisions, fail-closed behavior, and batch validation. |
| internal/steps.go | Implements ExecuteSignalTrustPolicyCheckBatch and decision output mapping. |
| internal/provider.go | Registers the new typed step factory and contract registry entry. |
| internal/provider_contracts_test.go | Extends provider contract tests to include the batch step. |
| internal/contracts/signal.proto | Adds internal contract protobuf definitions for the new batch step/messages. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+379
to
+382
| output.BatchPolicyRef = signalTrustPolicyBatchRef(storeRef, output.Decisions) | ||
| if firstDenial != nil && !reportOnly { | ||
| return nil, fmt.Errorf("signal trust policy check batch: %s: %s", firstDenial.GetTrustRef(), firstDenial.GetReason()) | ||
| } |
Comment on lines
+995
to
+999
| allowedStatuses, err := normalizeSignalTrustPolicyStatuses(check.allowedLastStatuses) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| normalizedStatuses[i] = allowedStatuses |
Comment on lines
+991
to
+993
| if _, ok := seen[check.trustRef]; ok { | ||
| return nil, fmt.Errorf("signal trust policy check batch: duplicate trust_ref %q", check.trustRef) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TDD proof
With implementation reverted and tests retained:
With implementation restored:
Verification