fix: [NPM] policy translation correctness and limits - #4859

Open

Isaiah Raya (rayaisaiah) wants to merge 28 commits into

isaiahraya/npm-translation-hardening

Commits on Sep 11, 2026

fix: [NPM] compile multi-value namespaceSelector NotIn as a single conjunction

Isaiah Raya (rayaisaiah)
and
Copilot
committed
4639811
fix: [NPM] scope negation-only namespaceSelector matches to cluster namespaces

Isaiah Raya (rayaisaiah)
and
Copilot
committed
1cb58e8
fix: [NPM] bound namespaceSelector flattening

Isaiah Raya (rayaisaiah)
and
Copilot
committed
f691b00
fix: [NPM] canonicalize ipBlock CIDRs and stop reporting failed translation as success

Isaiah Raya (rayaisaiah)
and
Copilot
committed
68b9c34
chore: [NPM] address lint findings in the changed files

Isaiah Raya (rayaisaiah)
and
Copilot
committed
affea42
test: [NPM] cover every negation-only namespaceSelector operator and its rendered rule

Isaiah Raya (rayaisaiah)
and
Copilot
committed
a41a3e1
fix: [NPM] bound generated rules per policy and keep CIDR canonicalization on the Linux path

Isaiah Raya (rayaisaiah)
and
Copilot
committed
eae6cc9
fix: [NPM] keep the rule budget off the direct-rule path and make two tests meaningful

Isaiah Raya (rayaisaiah)
and
Copilot
committed
caa37b3
fix: [NPM] check the rule budget per port and record translation errors once

Isaiah Raya (rayaisaiah)
and
Copilot
committed
4390359
chore: [NPM] address lint findings in the changed files

Isaiah Raya (rayaisaiah)
and
Copilot
committed
d33f5b8
fix: [NPM] make the rule ceiling exact and refuse an except NPM cannot program

Isaiah Raya (rayaisaiah)
and
Copilot
committed
92249a8
fix: [NPM] bound a rule that lists ports and no peers

Isaiah Raya (rayaisaiah)
and
Copilot
committed
5817c7a
chore: [NPM] keep the new error messages bounded and conventional

Isaiah Raya (rayaisaiah)
and
Copilot
committed
2bb7202
fix: [NPM] let a policy land exactly on the rule ceiling

Isaiah Raya (rayaisaiah)
and
Copilot
committed
54c7fb0
fix: [NPM] bound the matches a namespaceSelector expands into

Isaiah Raya (rayaisaiah)
and
Copilot
committed
10cb1a7
fix: [NPM] bound a selector that carries only matchLabels

Isaiah Raya (rayaisaiah)
and
Copilot
committed
e26f3d0
fix: [NPM] bound a selector across its branches and keep the rule ceiling exact

Isaiah Raya (rayaisaiah)
and
Copilot
committed
63cd697
fix: [NPM] account for default drops at the ACL boundary

Isaiah Raya (rayaisaiah)
and
Copilot
committed
5388807
fix: [NPM] distinguish aggregate namespace membership

Isaiah Raya (rayaisaiah)
and
Copilot
committed
cf44fd5

Commits on Sep 14, 2026

fix: [NPM] retain CIDR error details during translation

Isaiah Raya (rayaisaiah)
and
Copilot
committed
0344b13
fix: [NPM] classify policy errors and namespace debug matches

Isaiah Raya (rayaisaiah)
and
Copilot
committed
4ab92bb
fix: [NPM] retain combined peer conditions in v2 diagnostics

Isaiah Raya (rayaisaiah)
and
Copilot
committed
bc1278f
fix: [NPM] evaluate all v2 namespace conditions consistently

Isaiah Raya (rayaisaiah)
and
Copilot
committed
0ebf283

Commits on Sep 15, 2026

fix: [NPM] use explicit version mode in peer diagnostics

Isaiah Raya (rayaisaiah)
and
Copilot
committed
3a70439
fix: [NPM] reject invalid exclusions before set programming

Isaiah Raya (rayaisaiah)
and
Copilot
committed
10ec9b6
test: [NPM] share diagnostic label constants

Isaiah Raya (rayaisaiah)
and
Copilot
committed
103ef3e
fix: [NPM] preserve invalid-exclusion error classification

Isaiah Raya (rayaisaiah)
and
Copilot
committed
c645df8
fix: [NPM] preserve alternative branches in v2 diagnostics

Isaiah Raya (rayaisaiah)
and
Copilot
committed
c180e45