Repository navigation
docs(gov): SP3 enforcement points spec + SP3a plan - #853
Merged
Merged
Conversation
Sub-project 3 of the governance-layer programme (inside the concepts umbrella). Profile becomes a first-class enforcement point; hand-written operator policies are removed by typing what they express; clearance, role principals and the implicit workspace grant are unified into the common model so groups-only clearance is enforced on every engine. Four packages: SP3a EP framing + per-EP version + capability-matrix image key (egret.N); SP3b Migrate removes operator policies; SP3c clearance→withhold + role→groups + implicit→explicit workspace grant; SP3d per-EP gate + switch the demo stack. Scope boundary: keeps read/write grant vocab (full vocab + catalog merge are SP5); in-place reversible data migration, no new runtime switch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e key Five tasks: (1) parse the egret fork image level from an image tag; (2) carry egret_image_level on BoundEngine/EpInput and populate it in ir_load; (3) add the image-level dimension to the capability matrix, gate StarRocks mask/row-filter on STARROCKS_MASK_MIN_EGRET_IMAGE, and resolve a mixed-engine EP to its most restrictive engine; (4) prove the Ranger JSON stays byte-identical on the corpus and demo stack (all on fork images); (5) rename "profile" to "enforcement point" in user-facing text only (no table/API-field rename). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nforcement) The matrix image dimension (Task 3) was inert: no production path consulted the real image level. Task 3B wires the effective image level into lower_rules and AttachedEngine so a below-level StarRocks EP lowers mask/row-filter to deny. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Design docs for governance-layer SP3 — enforcement points (the spec) and the SP3a implementation plan, bilingual (en + vi).
docs/{en,vi}/specs/2026-11-12-gov-sp3-enforcement-points.md— SP3 spec: turn today's "profile" (a Ranger authz service) into a first-class enforcement point, kill the last non-model enforcement input (manual operator policies), and unify clearance / role principals / implicit workspace grants so groups-only clearance enforces on every engine. Four packages SP3a–d, scope boundaries fixed with the user (full vocab + catalog merge + iceberg-rest stay SP5).docs/{en,vi}/plans/2026-11-12-gov-sp3a-ep-framing.md— SP3a plan: add the egret image-level matrix dimension, mixed-engine = least-capable (fail-closed), surface rename profile → enforcement point. Includes the inserted Task 3B (wire the image gate into the compile + enforcement paths).Part of the governance-layer programme (concepts #824, SP1 #833, SP2 #836/#838/#839/#844).
Verification
Docs-only. Code lands in #854 (SP3a).
🤖 Generated with Claude Code