feat(factory): author provider-backed pipeline nodes (PBF-GOV Wave 1) - #9
Merged
Merged
Conversation
Re-vendors the governed pipeline schema from afi-config@faa6a8a (the merged PBF-GOV config), which adds the OPTIONAL, non-secret node providerInstanceRef. Factory authors/validates/hashes/packages/inspects it across all five surfaces and NEVER resolves a credential. - re-vendor src/governed-schema/pipeline.schema.json (byte-identical); bump MANIFEST.afiConfigCommit + sha256, drift-test PINNED_COMMIT, and CI ref - regenerate src/generated/pipeline.ts (codegen; Node.providerInstanceRef?) - graph.ts: semantic rule — providerInstanceRef is admissible only on the five analysis-category nodes, never on merge/scorer (category compatibility) - inspect.ts: surface the non-secret provider identity in the node table - tests: authoring technical + news provider-backed nodes; reject ref on scorer/merge; reject a ref missing its version pin or carrying a credential/secret field; hash materiality + determinism; froggy baseline hash byte-stable; packaging + inspection carry the ref and NO secret-named field (denylist scan); five-surface parity (still 14 ops, opaque envelopes, no per-field wiring, no secret in catalog/tools/MCP output) 201 tests pass (incl. governed-schema byte-compare vs config@faa6a8a and codegen freshness); typecheck clean. Factory reads no provider env; the ref is identity+version only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends afi-factory so a category node can carry an optional, non-secret
providerInstanceRef(identity + version). Factory authors / validates / hashes / packages / inspects it across all five surfaces and never resolves a credential.Re-vendors the governed pipeline schema from afi-config@faa6a8a (the merged PBF-GOV config commit), which introduced the field.
Changes
src/governed-schema/pipeline.schema.json(byte-identical); bumpMANIFEST.afiConfigCommit+ sha256, drift-testPINNED_COMMIT, and CIreftofaa6a8a.src/generated/pipeline.ts(Node.providerInstanceRef?) — regenerated, not hand-edited (freshness test enforces).graph.ts):providerInstanceRefis admissible only on the five analysis-category nodes — never onmerge/scorer(category compatibility). Centralized → inherited by all five surfaces.inspect.ts): surfaces the non-secret provider identity in the node table.Proofs (new tests)
scorer/merge; reject a ref missing its version pin; reject a ref carrying a credential/secret field (apiKey,credentialRef,token).Verification
201tests pass — incl. the governed-schema byte-compare vs afi-config@faa6a8a (run locally withAFI_CONFIG_DIR) and codegen freshness.Depends on: afi-config PBF-GOV (merged, PR #28).
🤖 Generated with Claude Code