Repository navigation
Deploy previews under a preview rule with enforcement on (D7) - #4055
Draft
nick-potts wants to merge 6 commits into
Draft
nick-potts wants to merge 6 commits into
nick-potts wants to merge 6 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
…hecks a preview against
A preview build's grant and a preview's Container changes carry the preview rule, the image token and, for a reviewed build, the review. The Machine checks each against what it holds: the derived Namespace, the trusted account or the review, the head it reads, the inherited Sealed values, and the template. Setup Commands run only in a preview's first Hook Container here.
…rules A PR Environment under a preview rule takes the Namespace every Server derives from the rule and its branch, generated domains holding it, Own Copy Volumes named for their parent's, and the parent's Sealed values naming the parent. A preview rule's plan rehearses opening one and undoes it, so the template a Device signs is what every preview lowers to.
ployz github preview approve rehearses a preview of the environment, prints what every preview runs, reads and shares from it, refuses shared mounts without --share-mounts, and signs the rule with the device key. end signs the rule's last generation. The user docs describe previews on servers that enforce device approval.
A preview's GitHub build follows its push's run and checks in and asks its grant under the preview rule the Store finds for the PR Environment's Deployment. The runner hands each Server a PreviewProof with every EnsureContainer. A preview build's Actions cache scope names the rule, so no preview build writes layers a production build reads.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft. Slice D7 of the 0.4 security program, "Previews under a rule" (checkpoint C3). Work in progress; this body is rewritten before it leaves draft.
The first commit records the program root's preview template decisions (d-plan.md gap 10), taken on 2026-11-10 under the operator's autopilot grant after D7's prototype stopped at its gate.