Uh oh!
There was an error while loading. Please reload this page.
perf(crafter): de-duplicate AccessChk security descriptors in the policy projection - #3364
Merged
Merged
Conversation
…icy projection The SYSINTERNALS_ACCESSCHK material is projected to JSON client-side for policy evaluation. AccessChk evidence for a registry hive or service database applies a small number of distinct security descriptors to hundreds of thousands of objects through inheritance, and the flat projection repeats each descriptor inline on every object. The policy engine materializes every copy in memory, so a large material drives the CLI to very high peak memory and can OOM-kill the CI runner during evaluation. Project the material to a de-duplicated shape instead: the distinct security descriptors are emitted once in a descriptors table, and each object references one by index. Descriptors are shared only when byte-for-byte identical, so no object, name, or ACE is dropped and policy findings are unchanged. For a large registry material this collapses hundreds of thousands of inline descriptors to a few hundred table entries and brings evaluation peak memory down by an order of magnitude. Policies read a descriptor via input.descriptors[obj.descriptor]. Closes PFM-6922. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: bcafbeb2-90ea-4ff6-89b5-b896e6c68b2f
Contributor
AI Session Checks — |
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | pr-description-required | - |
| ✅ Passed | pr-user-story-linked | - |
⏭️ 3 scans not applied
| Scan | Reason |
|---|---|
vulnerability-scan | no manifest/lockfile changed |
github-actions-scan | no workflow files changed |
iac-scan | no IaC files changed |
Powered by Chainloop and Chainloop Trace
There was a problem hiding this comment.
All reported issues were addressed across 3 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Uh oh!
There was an error while loading. Please reload this page.
Add a test that marshals the projection and verifies the serialized contract the policy engine consumes: the descriptors table, objects referencing a descriptor index (with no inline DACL), the retained/omitted raw_lines fallback, and the top-level raw field. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: bcafbeb2-90ea-4ff6-89b5-b896e6c68b2f
jiparis
reviewed
Aug 25, 2026
Uh oh!
There was an error while loading. Please reload this page.
jiparis
approved these changes
Aug 25, 2026
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
SYSINTERNALS_ACCESSCHKmaterial is projected to JSON client-side for policy evaluation. AccessChk evidence for a registry hive or service database applies a small number of distinct security descriptors to hundreds of thousands of objects through inheritance, and the flat projection repeats each descriptor inline on every object. The policy engine materializes every copy in memory, so a large material drives the CLI to very high peak memory and can OOM-kill the CI runner during evaluation.This projects the material to a de-duplicated shape: the distinct security descriptors are emitted once in a
descriptorstable, and each object references one by index (descriptor). For a large registry material this reduces the projection by roughly 20x (hundreds of thousands of objects collapse to a few hundred distinct descriptors) and brings evaluation peak memory down by an order of magnitude. No object, name, or ACE is dropped — descriptors are shared only when byte-for-byte identical — so recorded evidence and policy findings are unchanged.Policies read a descriptor via
input.descriptors[obj.descriptor].Closes PFM-6922.
AI assistance
This change was produced with the assistance of Claude Code.