Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 73 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Web Console: Versioned policy editing, validation, simulation, approval, and rollback (Phase 3) #647

New Issue
Open
opened 2026-07-10 14:41:39 -05:00 by jcwalker3 · 0 comments
jcwalker3 commented 2026-07-10 14:41:39 -05:00
Owner
Copy Link
Copy Source

Problem statement

After policy visibility (#646), controllers need versioned policy editing with validation, simulation, approval, and rollback — without live-editing production profiles unsafely or bypassing code review norms.

User and operational impact

Policy changes are error-prone; no simulation before apply; hard rollback.

Scope

  • Versioned policy store for console-managed overlays (not raw secret-bearing profile files).
  • Validate schema; simulate impact (which gates change); require approval role; rollback to prior version.
  • Prefer PR-based apply for code-owned policies; allow overlay for operational toggles if explicitly designed.
  • Full audit trail.

Explicit non-goals

  • Do not allow arbitrary shell or unrestricted profile secret edits from browser.
  • Do not disable hard safety rails (self-merge ban, branches-only) via overlay.

Required implementation investigation

#646, #633, #434, profile model, docs/gitea-execution-profiles.md, #631.

Proposed architecture or implementation direction

Policy bundle versions in CP-DB or git; simulate using dry-run evaluators; dual-control approve for high-risk changes.

Security and workflow-safety requirements

RBAC; dual-control for high risk; audit; fail closed; never store secrets in policy JSON.

Acceptance criteria

  1. Create version → validate → simulate → approve → apply → rollback path.
  2. High-risk policies blocked from single-actor apply if dual-control configured.
  3. Tests cover invalid policy reject and rollback.
  4. Docs define which policies are overlay vs code-owned.

Required tests

Validation/simulation/rollback unit tests; authz tests.

Observability and audit requirements

Every version transition audited.

Dependencies and linkage

Canonical issue state

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Implement versioned policy change workflow after visibility
NEXT_PROMPT: Author policy versioning; PR; stop

Required final evidence

PR with versioning, tests, docs.

Required final response and handoff expectations

Brief PR → reviewer/controller.

## Problem statement After policy visibility (#646), controllers need **versioned policy editing** with validation, simulation, approval, and rollback — without live-editing production profiles unsafely or bypassing code review norms. ## User and operational impact Policy changes are error-prone; no simulation before apply; hard rollback. ## Scope * Versioned policy store for console-managed overlays (not raw secret-bearing profile files). * Validate schema; simulate impact (which gates change); require approval role; rollback to prior version. * Prefer PR-based apply for code-owned policies; allow overlay for operational toggles if explicitly designed. * Full audit trail. ## Explicit non-goals * Do not allow arbitrary shell or unrestricted profile secret edits from browser. * Do not disable hard safety rails (self-merge ban, branches-only) via overlay. ## Required implementation investigation #646, #633, #434, profile model, docs/gitea-execution-profiles.md, #631. ## Proposed architecture or implementation direction Policy bundle versions in CP-DB or git; simulate using dry-run evaluators; dual-control approve for high-risk changes. ## Security and workflow-safety requirements RBAC; dual-control for high risk; audit; fail closed; never store secrets in policy JSON. ## Acceptance criteria 1. Create version → validate → simulate → approve → apply → rollback path. 2. High-risk policies blocked from single-actor apply if dual-control configured. 3. Tests cover invalid policy reject and rollback. 4. Docs define which policies are overlay vs code-owned. ## Required tests Validation/simulation/rollback unit tests; authz tests. ## Observability and audit requirements Every version transition audited. ## Dependencies and linkage * Parent: #631 · Depends: #646, #633 · Related: #434 ## Canonical issue state ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Implement versioned policy change workflow after visibility NEXT_PROMPT: Author policy versioning; PR; stop ``` ## Required final evidence PR with versioning, tests, docs. ## Required final response and handoff expectations Brief PR → reviewer/controller.
jcwalker3 added the type:featurestatus:readyworkflow-hardeningdashboardsafety labels 2026-07-10 14:41:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels dashboard safety status:ready type:feature workflow-hardening
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#647