test(policy): separate extension proposal grant from action policy - #74
test(policy): separate extension proposal grant from action policy#74seonghobae wants to merge 8 commits into
Conversation
📝 WalkthroughWalkthrough확장 프로그램에 Changes확장 프로그램 변경 격리
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
crates/originweave-policy/tests/extension_mutation_isolation.rs (1)
122-145: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy lift확장 제안 테스트를 실제 경계와 일치시키십시오.
evaluate_extension_access는ExtensionAgentGrant만 평가하며ActionRequest를 생성하지 않습니다. 현재 확장 제안 어댑터도 없습니다. 따라서assert_extension_can_propose(&grant)와InstructionSource::User요청은 서로 독립적입니다. 실제 어댑터가 추가되면 해당 경로로 정책 결과를 검증하고, 그렇지 않으면 테스트 이름과 설명을 독립된 권한 및 정책 테스트에 맞게 수정하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/originweave-policy/tests/extension_mutation_isolation.rs` around lines 122 - 145, Update the test around assert_extension_can_propose and the InstructionSource::User ActionRequest so it matches the implemented boundary: evaluate_extension_access only evaluates ExtensionAgentGrant and no extension proposal adapter creates ActionRequest values. Until such an adapter exists, separate or rename the assertions to represent independent grant authorization and policy evaluation; if an adapter is introduced, verify the policy result through that adapter instead.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@crates/originweave-policy/tests/extension_mutation_isolation.rs`:
- Around line 122-145: Update the test around assert_extension_can_propose and
the InstructionSource::User ActionRequest so it matches the implemented
boundary: evaluate_extension_access only evaluates ExtensionAgentGrant and no
extension proposal adapter creates ActionRequest values. Until such an adapter
exists, separate or rename the assertions to represent independent grant
authorization and policy evaluation; if an adapter is introduced, verify the
policy result through that adapter instead.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6096f5d0-719c-4310-81fb-6cfe34f5b117
📒 Files selected for processing (1)
crates/originweave-policy/tests/extension_mutation_isolation.rs
seonghobae
changed the title
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head9ce259834095cef91052db1e826f283689fb688f. -
Head SHA:
9ce259834095cef91052db1e826f283689fb688f -
Workflow run: 32132782350
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: extension_mutation_isolation.rs"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: extension_mutation_isolation.rs"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: extension_mutation_isolation.rs"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: extension_mutation_isolation.rs"]
R1 --> V1["required checks"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head9ce259834095cef91052db1e826f283689fb688f. -
Head SHA:
9ce259834095cef91052db1e826f283689fb688f -
Workflow run: 32139246118
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: extension_mutation_isolation.rs"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: extension_mutation_isolation.rs"]
R1 --> V1["required checks"]
1 participant
Partial implementation of #27.
Buyer/security gap
OriginWeave has an extension-access decision for
ExtensionAgentCapability::ProposeTypedActionand a separate core action-policy evaluator, but no production adapter currently converts an extension proposal into anActionRequest. This test lane therefore proves the two implemented boundaries independently without implying a nonexistent composition path.Exact scope and live topology
The current exact protected-main base is
0841d2ab3d8b5e60a03c0a8e818cf438e2716829. The current exact branch head is9ce259834095cef91052db1e826f283689fb688f.Fresh exact comparison reports ahead 8 / behind 0, with merge base exactly equal to the current protected-main base. No predecessor-head evidence is transferred.
The tests keep the evaluators separate:
evaluate_extension_accessproves only that the exact extension/session/context grant permitsProposeTypedAction;Review correction
CodeRabbit's predecessor-head
COMMENTEDreview correctly found that earlier naming implied a composition path that does not exist. The current test names and module-level explanation distinguish extension proposal permission from ordinary action-policy evaluation. That predecessor review is not an approval and is not transferred to the moved head. Current inline review threads returned by GitHub: none.Current exact-head evidence
At unchanged exact head
9ce259834095cef91052db1e826f283689fb688f:31976695423: success;31976695399: success;31976695489: success;CodeRabbit: success, which is status-only evidence and not independent approval;COMMENTEDreview on a predecessor head, not approval; andA current-head Manifest V3 workflow run was not returned for this test-only head, so Manifest V3 evidence is absent rather than passing. Central OpenCode/Noema/Strix evidence not returned for this exact head is likewise absent rather than inferred from predecessor or status-only evidence. No predecessor, skipped, queued, cancelled, absent, synthetic-merge, status-only, or model-only evidence is promoted as current proof.
GitHub reports the PR open and Ready for review. Passing automation is not independent approval, and this scheduled actor does not merge or self-approve.
Truth boundary
A Chrome/extension permission remains extension-access permission only. This test-only PR does not prove a real extension proposal flows through OriginWeave action policy, because that adapter does not yet exist. A future composed adapter requires a separate integration regression and authority review.