Let the NetGuard plugin reach review and reality - #53
Merged
Conversation
The reality snapshots and the review that compares them against compiled intent have been finished and REST-reachable since they landed. The NetGuard plugin could not use either: a plugin speaks only lattice.plugin.call, so an interface the core does not register is unreachable no matter what the REST surface offers. That is why there is no drift panel despite the backend for one being done. Both methods now register on latticenet.netguard/firewall and route into the same handlers the REST routes use, through a query-shaped sibling of invokePluginOperation — the read handlers take their input from the URL, and duplicating their rules to accept a body is exactly how two implementations of one operation start to disagree. Authorization, node scoping, and audit are the handlers' own and unchanged. Tested: reality lists a node that has never reported a snapshot (the state that most needs to be visible) and narrows to detail by node id; review reports the conflict for an unbound node and compiles once a binding exists; both are denied for a principal holding netguard:admin but not netguard:read, so a manifest mistake cannot widen the read surface. Full internal/server suite green.
lr00rl
force-pushed
the
feat/netguard-review-rpc
branch
from
August 18, 2026 13:51
6370b6d to
712f77e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
D3a server half: registers review + reality on latticenet.netguard/firewall, routed into the existing REST handlers via a query-shaped invokePluginOperation sibling, so authorization/scoping/audit stay single-implementation. Unblocks the reality/drift panel in the plugin UI. New contract tests cover list/detail/conflict/denial; full suite green.