Repository navigation
Conversation
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Greptile SummaryAdds a per-session prompt-policy manager that synchronously derives, verifies, parses, and atomically exposes a complete Cedar PolicySet while invalidating prior authority when a newer prompt fails.
Confidence Score: 4/5The PR appears safe to merge, with non-blocking lifecycle and parent-refresh races worth resolving before the manager is integrated into policy evaluation. The manager correctly fails closed on derivation failures, but EndSession can split one key across two session objects and activation does not revalidate a parent that may change during derivation. Files Needing Attention: internal/sessionpolicy/manager.go Important Files Changed
Reviews (1): Last reviewed commit: "feat(policy): activate prompt policy set..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| func (m *Manager) EndSession(key SessionKey) { | ||
| m.mu.Lock() | ||
| delete(m.sessions, key) | ||
| m.mu.Unlock() | ||
| } |
There was a problem hiding this comment.
If EndSession overlaps an in-flight BeginPrompt and the key is reused, the old operation continues on a detached session while sessionFor creates a replacement whose sequence restarts at zero, producing duplicate prompt sequences and a returned policy that SnapshotFor no longer represents.
| if err := m.verifier.Verify(bundle, promptpolicy.ExpectedAudience{ | ||
| InstallationID: m.installationID, AuthorizationSessionID: authorizationSessionID, | ||
| PromptSequence: sequence, ParentDeploymentIdentity: parent.DeploymentIdentity, | ||
| }); err != nil { | ||
| state.snapshot.Failure = err | ||
| return state.snapshot, err | ||
| } | ||
| if _, err := cedareval.New(bundle.PolicySet.Source); err != nil { | ||
| state.snapshot.Failure = fmt.Errorf("parse effective prompt policy set: %w", err) | ||
| return state.snapshot, state.snapshot.Failure | ||
| } | ||
| deployment := deploymentFromBundle(bundle) | ||
| state.snapshot = Snapshot{Required: true, Ready: true, PromptSequence: sequence, Deployment: &deployment} |
There was a problem hiding this comment.
If the parent deployment refreshes or expires while Deriver.Put is running, BeginPrompt verifies and activates the response against the previously captured identity without confirming it remains current, leaving the session ready with a policy derived from obsolete parent authority.
Knowledge Base Used: Guard runtime decision engine
f12befe to
8867b94
Compare
a5516fa to
7390811
Compare
8867b94 to
03a75ff
Compare
7390811 to
a3cfb57
Compare
1 participant
ENG-624 CLI stack 3/6; stacked on #467.
Adds the small session policy manager. For each prompt it synchronously derives, validates, parses, and atomically activates one complete PolicySet. Prompt sequence is ordering only; a failed newer prompt makes the older set ineligible rather than falling back to broader authority.
Policy generation happens once per prompt, never once per tool call.