Skip to content

feat: enforce per-method effect/network policy on the Solution contract (#289)#294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antoinetoussaint-byte merged 6 commits into from
Aug 16, 2026
Merged

feat: enforce per-method effect/network policy on the Solution contract (#289) #294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1b3757b
feat: enforce per-method effect/network policy on the Solution contra…
antoinetoussaint-byte Aug 16, 2026
a3b7fd2
fix: give the solution ceiling a provenance chokepoint (#289)
antoinetoussaint-byte Aug 16, 2026
5f7f0f3
refactor: unexport ceilingFrom, now dead external surface (#289)
antoinetoussaint-byte Aug 16, 2026
3345819
test: assert the no-ceiling denial names its remedy (#289)
antoinetoussaint-byte Aug 16, 2026
32e482e
fix: address remaining solution-policy review items (#289)
antoinetoussaint-byte Aug 16, 2026
85699fe
fix: annotate Render as a registry read, not offline (#289)
antoinetoussaint-byte Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions agents/manager/loader.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -28,6 +28,7 @@ import (
"github.com/codefly-dev/core/resources"
runnersbase "github.com/codefly-dev/core/runners/base"
"github.com/codefly-dev/core/runners/sandbox"
"github.com/codefly-dev/core/solution"
coretoolbox "github.com/codefly-dev/core/toolbox"
"github.com/codefly-dev/core/wool"

Expand DownExpand Up@@ -1028,6 +1029,11 @@ func Load(ctx context.Context, p *resources.Agent, opts ...LoadOption) (*AgentCo
grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
grpc.WithPerRPCCredentials(bearerCreds{token: authToken}),
// Host-side dispatch gate for the Solution contract: refuses to send a
// Solution RPC whose declared effect/network policy exceeds the ceiling
// stamped on the call context (solution.WithCeiling). No-ops for every
// other service, so it is safe on every agent connection.
grpc.WithChainUnaryInterceptor(solution.EnforcingClientInterceptor()),
grpcconfig.TypedMessageClientDialOption(),
)
if err != nil {
Expand Down
Loading
Loading