Repository navigation
Enforce the installed workspace policy on launch - #1260
Open
billiam-wang wants to merge 4 commits into
Open
billiam-wang wants to merge 4 commits into
billiam-wang wants to merge 4 commits into
Conversation
Launches read the policy installed at /etc/unitygateway/managed-settings.json, refuse a selection for another workspace, and refresh at most every five minutes using user-owned stamps in ~/.ucode/refresh_ts.json. Non-root launches never install or remove the policy. The per-user cache remains only for Windows, UG_SKIP_OS_SETTINGS, and --user. Configure restores the saved workspace on a denied install, and other agents refuse early on a machine managed elsewhere. Also adds ug export, dry-run workspace adoption, and the CUJ recorder and harness reading the installed policy. Co-authored-by: Isaac <no-reply@databricks.com>
billiam-wang
added this pull request to stack #1261
October 23, 2026 02:21
# Conflicts: # docs/managed-workspace-policy.md # src/ucode/managed_config.py # tests/test_managed_config.py
Collaborator
Author
|
/ug-review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
- The --agent refusal says the selection stays on the installed workspace and to rerun configure from a terminal with sudo access. - The launch refusal tells skip-mode users to switch without UG_SKIP_OS_SETTINGS, which is the only way the policy can change. - _launch_workspace_state resolves the target workspace once. - The configure integration test checks the policy folder is root-owned. Co-authored-by: Isaac <no-reply@databricks.com>
Polly AI ReviewBlocking issues
Security vulnerabilitiesNo confirmed new vulnerability found in the reviewed changes. Installed-policy precedence under Non-blocking notes
No added or modified source comments warrant a conciseness finding. ApproachSeparating protected policy from user-owned refresh metadata is sound when an installed policy exists. The first-launch storage/throttling conflict needs resolution rather than another fallback branch. The repeated refresh-result construction and overlapping token/fetch handling in SummaryDiff size (computed): 20 files; +1829 / -537 lines (2366 changed text lines); 0 binary files.
Shares use additions + deletions, including generated text and lockfiles. Binary files have no line count. Tests include fixtures/helpers under test paths and colocated test/spec files; categories are path-based, not coverage measurements. ChangesThe PR makes installed machine policy authoritative for launch workspace selection, separates freshness metadata into a user-owned sidecar, and restores the installed workspace after denied configure writes. It also migrates integration/CUJ evidence sources and updates documentation. Most of the size follows the persistence migration and state-transition coverage. No dependency or lockfile changes are included. Sharing refresh plumbing could reduce duplication without changing the design. TestsTest-by-test assessmentThe frozen diff’s checksum was verified and both trusted policy files were read. Tests were not executed; the PR’s reported green results were not independently verified. The supplied base/head Git objects were unavailable locally, so unchanged context came from the supplied trusted checkout rather than the exact target tree. The tables account for changed cases, removed cases, and support edits. Existing callers are identified where a changed helper alters their evidence source. Parameterized inputs with the same purpose share a row. Shared support, documentation, and CUJ adapters
Integration cases
CLI cases
Persistence and TTL cases
Machine-policy refresh cases
Per-user fallback and workspace resolution
Removed installation cases These rows refer to the removed
Revert and recorder adaptations
The concrete missing regressions are failed authoritative reads during workspace switching and repeated non-root first-launch reads. Existing unit/component scenarios are the smallest suitable place to add them; new live suites are unnecessary. Removed installation assertions should be transferred as noted rather than restoring a separate integration journey. After those changes, run the focused suites in a prepared environment: uv run --offline pytest tests/test_managed_config.py tests/test_cli.py tests/test_tui_request_recorder.pyOn a disposable machine, also verify that configuring B while its policy read fails leaves A selected, and that two ordinary-user launches within five minutes follow the resolved first-launch throttling contract. ScopeNo clearly unrelated changes were found. Policy persistence, workspace enforcement, configure recovery, harness migration, and documentation support the stated outcome. The first-launch TTL inconsistency is a contract problem within that scope, not a separate feature. Automated review by Polly · workflow run |
billiam-wang
marked this pull request as ready for review
October 23, 2026 04:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🥞 Stacked PR
Use this link to review incremental changes.
Worktree: unity-gateway | Branch: mdm-policy-read
What did you change, and why?
Second of two stacked PRs replacing #1228. It's based on #1259, which installs the policy file. Launches now read the installed policy instead of the per-user cache on Linux and macOS:
ug,ug claudeandug codexrefuse any other workspace. Onlyug configurecan switch it.~/.ucode/refresh_ts.json.Windows,
UG_SKIP_OS_SETTINGSand--userkeep the per-user cache unchanged.How do you know it works?
Unit tests cover enforcement, refresh and fallback. The CUJ and integration harnesses read the installed policy. Lint and ty are clean.
This pull request and its description were written by Isaac.