feat(connectorapi): add ServedPolicyEnvelope to GetConnectorConfigResponse#1028
feat(connectorapi): add ServedPolicyEnvelope to GetConnectorConfigResponse#1028jugonzalez12 wants to merge 2 commits into
Conversation
…ponse Define the server-computed policy envelope delivered on the connector-config response: a capabilities section carrying the recorded capability manifest verbatim (with its record-time digest), and an egress section carrying the per-instance allowed-hosts list computed at serve from revision-sealed derivation rules, plus the https_only scheme gate input. The envelope is optional on the response; runtimes that require one treat absence, an unsupported version, a missing section, or any binding mismatch (revision id, integrity-root digest, config version) as deny-all, and a bad section poisons the whole envelope. Digest fields are lowercase hex with the algorithm bound to the enclosing version (v1 = sha256), so a hash migration is a version bump rather than in-band negotiation. GetConnectorConfigResponse gains an optional config_version (explicit presence distinguishes a server that does not stamp versions from one that stamped an empty handle); when the envelope is present it must be non-empty and equal to the envelope's config_version.
General PR Review: feat(connectorapi): add ServedPolicyEnvelope to GetConnectorConfigResponseBlocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe new commit (Remove the CapabilitySection) drops the CapabilitySection message and its capabilities field from ServedPolicyEnvelope, renumbers egress from field 6 to field 5, and regenerates the matching pb.go / pb.validate.go output. Because servedpolicy.proto is introduced in this same PR and does not exist on the base branch, this renumbering is safe: there are no released consumers or serialized messages bound to the old field numbers. I scanned the full PR diff (including the generated servedpolicy.pb.go / servedpolicy_protoopaque.pb.go paths dropped from the incremental artifact) for security and correctness: the additive config_version (field 3, optional) and served_policy_envelope (field 4) fields on GetConnectorConfigResponse do not collide with existing field numbers, generated code is consistent with the proto source, and no Go code references the removed CapabilitySection. No new issues found. Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| // Canonical recorded bytes of the capability manifest, embedded unmodified | ||
| // after the serving layer re-verified them against the revision's recorded | ||
| // digest. Empty means no capability manifest is recorded for this revision: | ||
| // capability enforcement is not yet active and transport dispatch is | ||
| // governed by the egress section alone. Non-empty bytes that fail to | ||
| // parse, carry an unsupported inner version, or mismatch the recorded | ||
| // digest invalidate the whole envelope. | ||
| bytes manifest_bytes = 1; | ||
|
|
||
| // Record-time digest (lowercase hex; algorithm bound by envelope_version, | ||
| // v1 = sha256) over manifest_bytes, copied from the sealed revision record — | ||
| // never recomputed from the fetched bytes. Empty exactly when | ||
| // manifest_bytes is empty. | ||
| string recorded_manifest_digest = 2; |
There was a problem hiding this comment.
I would like to remove the capabilities. It looks like the capabilities part is not finalized yet. cc @gontzess
That is still WIP, so let's not add it just yet.
2 participants
Define the server-computed policy envelope delivered on the connector-config response: a capabilities section carrying the recorded capability manifest verbatim (with its record-time digest), and an egress section carrying the per-instance allowed-hosts list computed at serve from revision-sealed derivation rules, plus the https_only scheme gate input.
The envelope is optional on the response; runtimes that require one treat absence, an unsupported version, a missing section, or any binding mismatch (revision id, integrity-root digest, config version) as deny-all, and a bad section poisons the whole envelope. Digest fields are lowercase hex with the algorithm bound to the enclosing version (v1 = sha256), so a hash migration is a version bump rather than in-band negotiation.
GetConnectorConfigResponse gains an optional config_version (explicit presence distinguishes a server that does not stamp versions from one that stamped an empty handle); when the envelope is present it must be non-empty and equal to the envelope's config_version.