Repository navigation
✨ review: add review.shadow to record would_have_held for the review gate - #12337
Merged
Merged
Conversation
…gate Hive-Run: #12104 Hive-Plan: RFC #12062 / #12068 shadow-mode gates Hive-Spec: review-shadow#would-have-held Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com> (cherry picked from commit a187caa) Signed-off-by: Andy Anderson <clubanderson@users.noreply.github.com>
…adow write path Adds a review.shadow reference in the review config handler so the Settings parity test sees the new toggle, and a round-trip test for recordReviewShadow through MergeReviewEvidenceShadow. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Signed-off-by: Andy Anderson <clubanderson@users.noreply.github.com>
…logging Review follow-ups for #12158 (review.shadow, #12104): - Branch the review-verdicts.json load warning on require_approval so a shadow-only run no longer claims merge eligibility will fail closed. - Extract writeShadowEvidence, shared by intent.shadow and review.shadow, so the two recorders cannot drift again; recordReviewShadow now gets the logger==nil fallback and logs confidence like the intent gate. - When a signing key is configured but unusable, skip the shadow write and Warn instead of rewriting a signed bundle as unsigned. - Record both shadow observations from one eligible block with a shared evaluated_at. - Move the review shadow code to review_shadow.go beside its test, and add the dashboard PUT/GET + Settings toggle parity coverage for review.shadow. Hive-Fix-Attempt: 2/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Signed-off-by: Andy Anderson <clubanderson@users.noreply.github.com>
…w signing-key change Add review.shadow to the /api/config/review GET response and PUT request schemas in dashboard/openapi.json so the spec matches what handleReviewConfigGet/Put emit and accept. Add a changed- changelog fragment for writeIntentShadow now skipping (Warn) instead of writing unsigned when a configured signing key fails to load. Hive-Fix-Attempt: 3/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Signed-off-by: Andy Anderson <clubanderson@users.noreply.github.com>
…drop the toggle's inline style - TestRecordReviewShadowSigningKeyUnusable pointed SigningKeyFile at a missing file, which LoadSigningKey treats as "no key" (records unsigned by design). Write a malformed key so the test exercises the guard that skips the write with a Warn. - The new Settings toggle added an inline style="margin-top:10px", pushing operator index.html over the style-ratchet baseline; .config-toggle already spaces stacked toggles via margin-bottom, so drop it. - Document the signing-key caveat in review-swarm.md / intent-verification.md and list review.shadow in hive.yaml.example (swarm docs-currency notes). Signed-off-by: Andy Anderson <clubanderson@users.noreply.github.com>
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
the
dco-signoff: yes
kubestellar-prow
Bot
added
the
size/L
Contributor
Open PR overlap checkBase branch: Conflicts are checked with every PR merged onto the current tip of
|
github-actions
Bot
added
the
conflicts-with-open-pr
Contributor
|
merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at 85247ed. |
Contributor
|
Thank you for your contribution! Your PR has been merged. We'd love to hear how your experience was: share feedback |
23 of 28 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #12104
Adds
review.shadow(default false). When on, the review-approval gate is evaluated asrequire_approvalwould (including the artifact-unavailable case) but the PR stays merge-eligible;shadow.review_gate.would_have_held+ reason/confidence is recorded on the evidence bundle and an audit log line is emitted.require_approval: truestill blocks. Nothing here can block a merge.Behavior note (intent.shadow):
writeIntentShadownow uses the sharedwriteShadowEvidencehelper. Whenevidence.signing_key_pathpoints at a key that exists but fails to load, the shadow observation is skipped with aWarninstead of being written unsigned (previously it fell back tokey = nil), so a misconfigured key can't downgrade a signed bundle to"signed": false. An absent key path/missing key file still records unsigned as before. Covered bychangelog.d/changed-12104-intent-shadow-signing-key.md.Includes dashboard PUT + Settings toggle, docs, changelog fragment, and a table test (shadow on / off / require_approval on). Not run locally per AGENTS.md; CI is the verdict.
— hive: backend=copilot model=claude-sonnet-5.5
🐝 Hive Agent:
contributor| SHA:ccd1e5722Supersedes #12158 (taken over to finish rebase/CI; original commits by @mrbobbytables and the scanner follow-ups preserved). Beyond the rebase onto
v5, the changes are:TestRecordReviewShadowSigningKeyUnusablenow writes a malformed key file (a missing file is "no key" by design, so the old fixture never reached the guard); the new Settings toggle drops its inlinestyle="margin-top:10px"to satisfy the style ratchet (.config-togglealready spaces stacked toggles); and the signing-key caveat is documented inreview-swarm.md/intent-verification.mdplusshadow: falselisted inhive.yaml.example(swarm docs-currency notes).