Repository navigation
fix(flow): bind an API step to the complete definition of the steps it replaces - #1372
Merged
Merged
Conversation
…t replaces Review of #1269: folded_checks_digest hashed only the folded steps' on-screen checks, so changing what a replaced step does (its action, value, parameter, target or identity, a guard, the save itself) left the admitted API step running in its place. The digest now covers every replaced step's complete definition, the save included, minus only the save's own API binding. Any change keeps the API step on the GUI with the reason until it is proposed and admitted again. Bindings proposed before this need proposing again (they fail closed). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ed-step digest After merging main (#1361): the run authorization's admitted_api_step compared folded_checks_digest over the steps before the save, while #1372 now digests every replaced step including the save. It uses the same range as the replayer and the proposal. Tests that edit the save re-propose its digest first, as openadapt-flow api propose does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixth of six fixes from an external review of #1269. Stacked on #1371 (then #1370, #1369, #1368).
Bug
folded_checks_digesthashed only the folded steps' on-screen checks (expect). Changing what a replaced step does left the admitted API step running in its place. That covers its action, its typed value or parameter, its target or identity evidence, a guard, and the save step itself.Fix
The digest now covers the complete definition (
model_dump) of every replaced step, the save included, minus only the save's own API binding, which carries the digest. Any change keeps the API step on the GUI. The reason reads "the steps the API step replaces changed after it was proposed ... (openadapt-flow api propose)", and the step stays off until it is proposed and admitted again.Bindings proposed before this PR need proposing again. Their digest no longer matches, so they fail closed onto the GUI. The field keeps its name (
folded_checks_digest) so no bundle schema changes; its description inir.pyandAPI_TIER.mdare updated.Tests
tests/test_api_step_replaced_steps_digest.py(new, 9 tests): the admitted steps still run as the API step, and each of these changes keeps them on the GUI:8 of the 9 fail on
main; the unchanged case passes on both. 89 pass with the other API-tier and review-fix suites.🤖 Generated with Claude Code