docs(cpex-ocsf-audit): record Fred's changes-requested review on PR #84 in the in-tree plan - #526
Merged
Merged
Conversation
… in the in-tree plan Five findings on 2026-09-09; two touch the sink seam this crate consumes. Audit records are emitted before apply_assertions and route-resolution denials emit nothing, so a sink can record allow for a request the caller saw denied; the fix is the order AID-EMIT-1 assumes and changes nothing here. Sinks receive the unfiltered Extensions; this crate reads only the typed fields, so a filtered view costs nothing unless it lands as a new type, in which case the ppe build follows the new handle signature. The other three sit behind on_effect, which this crate does not implement. Teryl's next push moves the head: re-pin and re-run the bar before gate 3 is called met. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019XNHGsnzrXrncvFnSSCZTF
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Fred requested changes on praxis-proxy/policy PR #84 on 2026-09-09 with five findings. The in-tree port plan is gated on that PR merging, so the plan should say which findings touch the seam this crate consumes and what the next push means for the gates.
What
PRAXIS-INTREE-PLAN.md, a status note under the gates:emit_auditruns insideexecuteandapply_assertionsruns on its result, so a sink can record allow for a request an assertion then denies, and a route-resolution failure returns a denial with no record. The fix is the order AID-EMIT-1 already assumes; nothing in this crate changes. Route denials gaining a record keeps the decision stream dense.Extensions.emit_auditand the effect sink pass the unfiltered extensions, transport and effect slot included. This crate reads only the typed fields (request,mcp,security,agent,completion,delegation), so a filtered view costs nothing, unless it lands as a new type rather than&Extensionswith the slots detached, in which caseAuditHandler::handlechanges shape and theppebuild follows.on_effect, which this crate does not implement.CHANGELOG entry under Unreleased / Changed.
Verification
Docs only. Added lines checked for non-ASCII: zero.
🤖 Generated with Claude Code
https://claude.ai/code/session_019XNHGsnzrXrncvFnSSCZTF
Generated by Claude Code