You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "hanahmily (via GitHub)" <gi...@apache.org> on 2026/08/26 03:13:44 UTC

[I] [BanyanDB][RBAC][Sub-TDD B9] Authorize SchemaBarrier key waits for every group [skywalking]

hanahmily opened a new issue, #14033:
URL: https://github.com/apache/skywalking/issues/14033

   Root tracking issue: #13994
   Workflow PR issue: #14015
   Sub-TDD ID: `B9`
   Cycle gate: #14032 must be GREEN on workflow #14015's branch; it is not merged independently.
   
   > [!IMPORTANT]
   > **No independent PR.** This issue tracks one strict RED→GREEN cycle inside
   > workflow #14015. Implement it on that workflow branch, record the evidence
   > in the parent PR checklist, and close it only when the parent PR merges.
   
   ## Size audit
   
   Classification: sub-TDD tracking leaf inside workflow #14015; not an independently mergeable PR leaf
   
   Boundary: typed repeated-key extractor activates `AwaitSchemaApplied` and `AwaitSchemaDeleted`; a `kind=group` key uses `SchemaKey.Name`, while other keys use `SchemaKey.Group`.
   
   Production activation: typed repeated-key extractor activates `AwaitSchemaApplied` and `AwaitSchemaDeleted`; a `kind=group` key uses `SchemaKey.Name`, while other keys use `SchemaKey.Group`.
   
   RED test: `TestRBACSchemaBarrierKeyWaitsRequireEveryScope`.
   
   End to end: alpha reader may await alpha, is denied alpha+beta, and a wildcard reader may await both; both methods are table-covered.
   
   Format/lifecycle scope: only the lifecycle and caller family named above; no protobuf or persisted-format change
   
   Fixtures and oracle: literal actors, groups, status codes, and visible/absent side effects stated in the integration scenario; expectations are not derived from the implementation
   
   Focused suites: the named RED test plus the focused real-liaison integration scenario in workflow #14015
   
   Dependencies present on `main`: the workflow-level prerequisites are recorded above; intra-workflow cycle gates become GREEN on the same branch
   
   Decision: one bounded RED→GREEN cycle, but deliberately no independent PR; workflow #14015 owns the cumulative production activation, E2E, and merge
   
   ## Boundary
   
   typed repeated-key extractor activates `AwaitSchemaApplied` and `AwaitSchemaDeleted`; a `kind=group` key uses `SchemaKey.Name`, while other keys use `SchemaKey.Group`.
   
   The production caller activated in this cycle is: typed repeated-key extractor activates `AwaitSchemaApplied` and `AwaitSchemaDeleted`; a `kind=group` key uses `SchemaKey.Name`, while other keys use `SchemaKey.Group`. Later child
   behavior remains fail-closed or unchanged. Do not add a parallel authorizer,
   generic protobuf field search, or a fourth PR.
   
   ## RED
   
   `TestRBACSchemaBarrierKeyWaitsRequireEveryScope`.
   
   Add and run the named test, then record its observable failure before production
   code for this cycle. The failure must come from the missing production behavior,
   not a source-text assertion or a fixture generated by the implementation.
   
   ## GREEN
   
   Implement the minimum production change that activates only the boundary above.
   Make the named RED test pass, then keep all later workflow executors fail-closed.
   Refactor only after the RED and GREEN evidence is recorded in workflow #14015's PR.
   
   ## Focused integration proof
   
   alpha reader may await alpha, is denied alpha+beta, and a wildcard reader may await both; both methods are table-covered.
   
   This proof uses the real public liaison path and is added to the cumulative
   integration suite in workflow #14015; it is not deferred to another PR.
   
   ## Requirements
   
   R1. deduplicate scopes.
   R2. require all scopes.
   R3. handle group-kind keys.
   R4. deny before cache polling or cluster fan-out.
   
   ## Acceptance criteria
   
   - The named RED test is recorded failing for the stated reason before GREEN.
   - The minimum production activation and focused real-liaison integration proof pass.
   - Expected allow/deny/status/side-effect values come from this issue's literal oracle, not production-derived fixtures.
   - Only the named method/extractor/lifecycle boundary is activated; later cycles remain fail-closed.
   - The parent PR checklist links this cycle's RED, GREEN, refactor, integration, and test evidence.
   - No independent PR is opened; this issue closes only when workflow #14015's single PR merges.
   
   ## Scope
   
   Production/tests: BanyanDB public liaison authorization and focused tests named by this cycle.
   
   Cycle entry from the reviewed catalog: B8 GREEN in W-PR2.
   
   Out of scope: every later sub-TDD boundary, OAP E2E, Canopy E2E, and any PR separate from workflow #14015.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [BanyanDB][RBAC][Sub-TDD B9] Authorize SchemaBarrier key waits for every group [skywalking]

Posted by "hanahmily (via GitHub)" <gi...@apache.org>.
hanahmily closed issue #14033: [BanyanDB][RBAC][Sub-TDD B9] Authorize SchemaBarrier key waits for every group
URL: https://github.com/apache/skywalking/issues/14033


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [BanyanDB][RBAC][Sub-TDD B9] Authorize SchemaBarrier key waits for every group [skywalking]

Posted by "hanahmily (via GitHub)" <gi...@apache.org>.
hanahmily commented on issue #14033:
URL: https://github.com/apache/skywalking/issues/14033#issuecomment-5426004675

   This tracking issue is withdrawn. Its TDD round remains an internal checklist item in workflow #14015; only the three workflow issues #14014, #14015, and #14016 are sub-issues of #13994, and no round owns an issue or PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org