feat: the guardrail gains its public request-an-action entry (ADR-0047 §5) - #508
Merged
Conversation
…7 §5)
Extracts the guardrail's rule-evaluation into a callable core in
guardrailsvc (EvaluateStep/EvaluateAction) that the execution gate and
the new public RequestGuardedAction entry both call -- one rule
plane, two entry points, never a second policy evaluation.
RequestGuardedAction(ctx, GuardedAction{Kind, Attributes, Description,
Source}) lets a non-workflow caller (an agent today, a plugin once the
out-of-tree loader ships) submit an action for the same rules a
workflow step already evaluates against. allow/deny resolve
immediately; ask parks a PendingGuardedAction -- decoupled from
composition.ExecContext, an in-memory analogue of
executionsvc.PendingApproval -- and blocks until resolved,
ctx-cancelled (a clean withdrawal), or the same 24h fail-safe every
other park in this codebase already uses.
Not Wails-bound this slice; the MCP rebase onto this entry and any
Review/floating-prompt UI wiring for a non-workflow park are the next
slice.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
guardrailsvc(EvaluateStep/EvaluateAction) shared by the execution gate and a new publicRequestGuardedActionentry -- one rule plane, two entry points.RequestGuardedAction(ctx, GuardedAction{Kind, Attributes, Description, Source})lets a non-workflow caller submit an action for the same rules a workflow step already evaluates against: allow/deny resolve immediately; ask parks aPendingGuardedAction(decoupled fromcomposition.ExecContext) and blocks until resolved, ctx-cancelled, or a 24h fail-safe timeout.Test plan
go test ./internal/services/guardrailsvc/... ./internal/services/executionsvc/... ./internal/domain/guardrail/...-- all green, including the full pre-existingexecutionsvcguardrail-gate suite UNMODIFIED (the byte-identical-behavior proof).go test -race -run 'TestRequestGuardedAction|TestEvaluateAction' ./internal/services/guardrailsvc/...EvaluateActionagainst seeded rules (allow/ask/deny precedence, kind-scoped matching),RequestGuardedActionallow/deny immediate paths, ask→resolved-approve unblocking, ask→resolved-deny unblocking, and ctx-cancel clean withdrawal (pending removed, stale resolve is a no-op).go-build-desktop,go-build-server,go-vet,golangci-lint,go-test,comment-hygiene,file-loc-limit,gocognit-new,depguard-new,doc-paths,root-file-naming).🤖 Generated with Claude Code
https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq