Repository navigation
fix: bind installation consent to reviewed authority state - #27
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
antoinetoussaint-byte
added a commit
that referenced
this pull request
Oct 26, 2026
On the 0.2 installation model Install returns while the installation is pending its acknowledgement steps. The blocking-install check carried over from #27 refused that early return, which is not part of the consent binding; restore the 0.2 polling and say why in the README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ent-binding # Conflicts: # libraries/conformance/go/go.mod
… stranded A pending attempt whose solution was redelivered refused its own operation (generation changed) and every fresh one (operation conflict), so it stayed pending for good. A fresh approval, held by checkConsent to the current generation, digest and pending revision, now replaces the attempt's receipt and moves its revision; the superseded operation can neither resume nor acknowledge it. Closes B1 of the #27 review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Install previously resolved current state without carrying what the administrator reviewed, so a saved request could outlive its intended authority offer. This fix adds ConsentApproval and Review to the installation contract, and requires the reviewed target, generation, revision, authority-offer digest and operation UUID. Unchanged retries reuse their receipt; changed input or state refuses with a named reason. Acknowledgement rechecks consent and current administrator authority before activating the installation.
Reuses the existing authority-core Store transaction, lifecycle revision, pending install step and immutable module principal. No second resolver or store is introduced. The shared conformance caller reads the published Review contract, sends explicit consent, and checks missing/mismatched approval and replay after revocation. Local wire regression coverage uses the Codefly-generated Connect client. Protobuf and all three client languages were regenerated with Codefly; reviewed generated-file digests were refreshed.
Validation:
Branched from main after #25 merged (583cb19). Accounts validation and its dependency repin are follow-up work on module-saas-starter #1217. That branch still implements the pre-#25 installation interface, so this PR does not claim Accounts parity before its solution-role interface migration is resolved.
Follow-up validation: all 15 GitHub checks are green. A local Accounts repin to this PR head was tested. After deleting the removed UnexposedTeam fixture argument, the shared suite fails because the host still lacks ListRoleGrants and AuthorityManifestV1.owner_aware and returns the pre-#25 installation-principal shape. The copied-interface digest test also remains red. No Accounts pin was pushed and no parity claim is made; its solution-principal interface adoption must precede completion of that host's consent integration.