Problem
With violations_as_exceptions=True, CPEX 0.1.x raises PluginViolationError after a control returns continue_processing=False. CPEX 0.1.4 correctly preserves trusted exc.executions (#147), but discards the denying result metadata. ContextForge can emit a denial summary span but cannot emit structured telemetry for the actual denying control.
Expected behavior
Framework-generated PluginViolationError exposes a safe immutable denial outcome containing: trusted denying ControlExecutionRecord; plugin identity and hook; violation code; protocol/HTTP status where supplied; explicitly approved low-cardinality denial metadata, such as rate limiter allowed, throttled, and backend.
Security requirements
Do not attach raw PluginResult. Exclude payloads, modified payloads, headers, PluginViolation.details, user/tenant IDs, credentials, free-form sensitive text, and arbitrary plugin metadata. Existing message, violation, and executions APIs must stay compatible. Direct plugin-raised PluginViolationError has no framework-generated outcome.
Scope
Implement in CPEX 0.1.x framework exception/executor path, with sequential and concurrent regression tests. Gateway follow-up consumes this outcome for cpex.control.result telemetry.
Original report: IBM/cpex-plugins#180
Problem
With
violations_as_exceptions=True, CPEX 0.1.x raisesPluginViolationErrorafter a control returnscontinue_processing=False. CPEX 0.1.4 correctly preserves trustedexc.executions(#147), but discards the denying result metadata. ContextForge can emit a denial summary span but cannot emit structured telemetry for the actual denying control.Expected behavior
Framework-generated
PluginViolationErrorexposes a safe immutable denial outcome containing: trusted denyingControlExecutionRecord; plugin identity and hook; violation code; protocol/HTTP status where supplied; explicitly approved low-cardinality denial metadata, such as rate limiterallowed,throttled, andbackend.Security requirements
Do not attach raw
PluginResult. Exclude payloads, modified payloads, headers,PluginViolation.details, user/tenant IDs, credentials, free-form sensitive text, and arbitrary plugin metadata. Existingmessage,violation, andexecutionsAPIs must stay compatible. Direct plugin-raisedPluginViolationErrorhas no framework-generated outcome.Scope
Implement in CPEX 0.1.x framework exception/executor path, with sequential and concurrent regression tests. Gateway follow-up consumes this outcome for
cpex.control.resulttelemetry.Original report: IBM/cpex-plugins#180