Repository navigation
feat(gov): SP3b — per-EP migration status (rollup + endpoint + Migrate badge) - #857
Merged
Merged
Conversation
…EP migration status ep_migration_status partitions a profile's classified operator policies into migrated / pending / blocked and reports complete only when every one is migrated. Pure over the existing classifier output; compiler/infra rows are skipped. This is the signal SP3d's per-EP gate will consume. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GET .../services/{service_id}/migration-status returns the EP's migration
standing (migrated/pending/blocked, complete). Read-only; rolls up the existing
classification. OpenAPI + generated client regenerated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The badge reads the migration-status endpoint and tells the operator whether the EP's manual policies are all in the model, how many remain, and which are blocked and why. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Thin package: the Migrate flow already exists (SP4d-3); SP3b adds only the per-EP migration-status rollup + endpoint + badge. No operator→engine-privilege mapping (decision 2: nothing to map on the demo stack). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Governance SP3b — per-enforcement-point migration status
Exposes, per enforcement point, whether any operator (manual) policy has not yet migrated into the model — the signal SP3d's per-EP gate will consume, surfaced today as a badge on the Migrate tab.
What this adds (additive, read-only)
ep_migration_status(&[ClassifiedPolicy])(classify.rs): a pure rollup that partitions a profile'smanaged_by='operator'policies into migrated / pending / blocked.completeis fail-closed — an EP is complete only when every operator policy has migrated (pending == 0and noblocked). Compiler/infra policies are ignored.GET /perm/policies/services/{service_id}/migration-status(routes.rs): read-only endpoint mirroringclassify_service_policies(authpolicy:read), registered inApiDoc.What this does NOT do
No migration runs here; the Migrate flow (classify → grant/rule, provenance
perm.migrated_from, undo, equivalence probes) already exists from SP4d-3. No compiled artifact, golden, or classify logic changes.ep_migration_statusis the function SP3d's gate will call — not wired to any gate here.Scope (decision ②)
The demo stack has exactly one operator policy (a flat access policy, already convertible to a grant) and zero engine-capability shapes, so no operator→typed-engine-privilege mapping is built — deferred until a real shape exists.
Verification
cargo fmt --check,cargo clippy --workspace --all-targets -D warningsclean.egret-perm-compiletests pass (incl. 5ep_migration_statusunit tests);routes.rsDB-gated tests pass against the demo postgres.committed_openapi_json_is_current: regeneratedegret openapidiffs 0 against the committed file.MigrateTab.test.tsx: 22 vitest pass.Docs: badge documented in
egret-data/docs(separate PR); SP3d owns the live screenshot (demo backend lacks the endpoint until then).🤖 Generated with Claude Code