sixfold-space/madtea

SHA256

guard: the raw API passthrough keeps every limit #668

New issue

Closed

opened 2026-09-29 19:05:28 +00:00 by hexajon · 1 comment

hexajon commented

2026-09-29 19:05:28 +00:00

Owner

ADR 0046 says that a passthrough call goes through the same guard as every other write, with the effects of its endpoint. A write to a path that is in no vendored spec is refused, because its effect is unknown. A GET passes.

Today madt_api_call and madtea api send any method to any path.

Scope:

The passthrough looks up the method and path in the vendored specs (docs/api-specs/) and takes the effects that #654 declares for that endpoint.
It calls the guard (#653) with those effects before it sends.
A write to a path that is in no vendored spec is refused. A GET passes.

Acceptance:

Against the live forge and a test repo, each of these is refused with the guard's refusal text: a label delete, a write to the default branch, and a content write to a populated repo outside the session's scope.
A GET passes, and a POST to a path in no vendored spec is refused.

Depends on #653, #654, and #660. Decision record: ADR 0046.

ADR 0046 says that a passthrough call goes through the same guard as every other write, with the effects of its endpoint. A write to a path that is in no vendored spec is refused, because its effect is unknown. A GET passes. Today `madt_api_call` and `madtea api` send any method to any path. Scope: - The passthrough looks up the method and path in the vendored specs (`docs/api-specs/`) and takes the effects that #654 declares for that endpoint. - It calls the guard (#653) with those effects before it sends. - A write to a path that is in no vendored spec is refused. A GET passes. Acceptance: - Against the live forge and a test repo, each of these is refused with the guard's refusal text: a label delete, a write to the default branch, and a content write to a populated repo outside the session's scope. - A GET passes, and a POST to a path in no vendored spec is refused. Depends on #653, #654, and #660. Decision record: ADR 0046.

hexajon added a new dependency

2026-09-29 19:05:51 +00:00

#653 guard: add the guard package with its three effects

hexajon added a new dependency

2026-09-29 19:05:51 +00:00

#654 guard: declare the effects of every operation and every spec endpoint

hexajon added a new dependency

2026-09-29 19:05:52 +00:00

#660 guard: the forge client send functions call the guard

hexajon referenced this issue

2026-09-29 19:06:46 +00:00

epic: one guard enforces the recorded limits on every surface #670

hexajon added a new dependency

2026-09-29 19:06:52 +00:00

#670 epic: one guard enforces the recorded limits on every surface

hexajon added a new dependency

2026-09-29 19:36:05 +00:00

#674 epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy

hexajon referenced this issue

2026-10-05 18:43:27 +00:00

feat(repo-scope)!: one repo= target on every tool, resolved in one place #685

hexajon referenced this issue

2026-10-15 20:24:12 +00:00

guard: allowlist the pure-toggle DELETE endpoints the raw passthrough may pass #774

hexajon referenced this issue

2026-10-16 02:41:35 +00:00

feat(guard): enforce the ADR 0046 write guard on every forge write surface #790

hexajon commented

2026-10-18 05:23:10 +00:00

Author

Owner

The v0.20.0 breaking set is complete and green on main. The code landed across the v0.20.0 branches, the full local gate passes, and the forge suite is green on both forges at both pinned versions on current main (31693766). Closing as done.

The v0.20.0 breaking set is complete and green on main. The code landed across the v0.20.0 branches, the full local gate passes, and the forge suite is green on both forges at both pinned versions on current main (31693766). Closing as done.

hexajon removed a dependency

2026-10-18 05:24:44 +00:00

#674 epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy

hexajon closed this issue

2026-10-18 05:25:31 +00:00

Sign in to join this conversation.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks

#670 epic: one guard enforces the recorded limits on every surface

sixfold-space/madtea

Depends on

#653 guard: add the guard package with its three effects

sixfold-space/madtea

#654 guard: declare the effects of every operation and every spec endpoint

sixfold-space/madtea

#660 guard: the forge client send functions call the guard

sixfold-space/madtea

Reference

sixfold-space/madtea#668

No description provided.