docs(#1811): add enforcement-delegation parity check to review checklist - #1812
Open
fullsend-ai-coder[bot] wants to merge 1 commit into
Open
docs(#1811): add enforcement-delegation parity check to review checklist#1812fullsend-ai-coder[bot] wants to merge 1 commit into
fullsend-ai-coder[bot] wants to merge 1 commit into
Conversation
Add a fourth item to the Review Checklist for New Policy Rules in AGENTS.md covering enforcement-delegation collection parity. When a deny rule conditionally bypasses to another package, reviewers must now verify that the destination package's rules cover all collections declared by the bypassed rule. This addresses the gap identified in PR #1805 where four test_attestation rules lacked redhat_security collection membership, creating an enforcement gap. Closes #1811
|
🤖 Finished Review · ✅ Success · Started 3:26 PM UTC · Completed 3:37 PM UTC Commit: |
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
ReviewFindingsMedium
Low
Labels: PR exclusively modifies AGENTS.md documentation |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| the pattern. | ||
| - **Test coverage:** Every new rule needs tests in a corresponding `_test.rego` file. CI enforces | ||
| 100% coverage. | ||
| - **Enforcement delegation parity.** When a deny rule conditionally skips its |
There was a problem hiding this comment.
[low] formatting consistency
The new checklist item uses a period after the bold label (Enforcement delegation parity.) while all three existing checklist items in this section use a colon (Label:). This breaks the established Label: Description pattern.
Suggested fix: Change Enforcement delegation parity. to Enforcement delegation parity:.
fullsend-ai-review
Bot
added
requires-manual-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What:
Add enforcement-delegation collection-parity check as a fourth item to the "Review Checklist for New Policy Rules" section in AGENTS.md.
Why:
On PR #1805, a deny rule bypass was added that delegated enforcement to the
test_attestationpackage. The inline comment claimed equivalent collection membership, but four destination rules lackedredhat_securitycollection membership — creating an enforcement gap. The review agent ran three times and approved each time because no checklist criterion prompted comparison of collection annotations between bypassed and destination rules. This new checklist item gives the agent a mechanical instruction: read the bypassed rule'scollections:, read every destination rule'scollections:, and flag any collection present in the former but absent from the latter.Tickets:
Closes #1811
Post-script verification
agent/1811-add-delegation-parity-check)57634e656f21e6224543b54bc767fc8ec1497779..HEAD)