Write the operator migration note the fail-closed policy defaults need.
Why
#127 stated the note must ship. The enforcement shipped in #235; the note did not.
[policy].capabilities and [policy].http_deny are enforced at supervisor/load.rs and host/http.rs, and the model is fail-closed by capacity: a component the operator never named still receives defaults and still counts against the total.
An operator upgrading into that needs to know what refuses that did not refuse before, and what to write to restore it deliberately.
Scope
Name every refusal an existing deployment can newly hit, and the config that resolves each.
State the defaults, and that omitting a [policy.component.<id>] row is a decision rather than an oversight.
Note for whoever writes it: six comment threads on the old policy cluster carry the spelling [policy.module.<key>]. The landed spelling is [policy.component.<id>], keyed on [[modules]].id. Do not propagate the wrong one.
Done when
An operator can upgrade without discovering a refusal at boot.
Write the operator migration note the fail-closed policy defaults need.
Why
#127 stated the note must ship. The enforcement shipped in #235; the note did not.
[policy].capabilitiesand[policy].http_denyare enforced atsupervisor/load.rsandhost/http.rs, and the model is fail-closed by capacity: a component the operator never named still receives defaults and still counts against the total.An operator upgrading into that needs to know what refuses that did not refuse before, and what to write to restore it deliberately.
Scope
Name every refusal an existing deployment can newly hit, and the config that resolves each.
State the defaults, and that omitting a
[policy.component.<id>]row is a decision rather than an oversight.Note for whoever writes it: six comment threads on the old policy cluster carry the spelling
[policy.module.<key>]. The landed spelling is[policy.component.<id>], keyed on[[modules]].id. Do not propagate the wrong one.Done when
An operator can upgrade without discovering a refusal at boot.