feat: persist scoped project warning acceptances

crates/registry-bregctl/src/check.rs

@@ -189,6 +189,10 @@ pub(super) fn run(
     if outcome.files > 0 {
         outcome.report.set_files_checked(outcome.files);
     }
+    if let Some(project) = request.project {
+        registry_platform_config::apply_check_acceptances(project, &mut outcome.report);
+        outcome.files = outcome.report.files_checked().unwrap_or(outcome.files);
+    }
     let denied = request.deny_warnings && outcome.report.warning_count() > 0;
     let exit = if outcome.unavailable {
         OPERATIONAL_FAILURE_EXIT
@@ -819,10 +823,12 @@ pub(super) fn compile_for_inspection(
         )
     })?;
     let mut outcome = Outcome::default();
+    let compiled = compile_project_with_documents(&selected, profile, &mut outcome);
+    registry_platform_config::apply_check_acceptances(&selected, &mut outcome.report);
     // A production compile can succeed while `check --production` still
     // refuses the project, as for a deployment identity a package must not
     // carry, so an error in the report refuses inspection too.
-    match compile_project_with_documents(&selected, profile, &mut outcome) {
+    match compiled {
         Some((compiled, documents)) if !outcome.report.has_errors() => {
             let authoring = documents.model_authoring(&compiled);
             Ok((compiled, outcome.report.into_diagnostics(), authoring))

crates/registry-bregctl/src/file_check.rs

@@ -36,6 +36,7 @@ pub(crate) struct Request<'a> {
 }
 
 /// Why a check produced no findings.
+#[derive(Debug)]
 pub(crate) enum Failure {
     /// The shared reader refused the document.
     Refused(Report),
@@ -86,7 +87,18 @@ type Check = fn(&Input<'_>) -> Result<Vec<Diagnostic>, Failure>;
 /// it is refused with, when the file is read as written (CFG-SEC-2); and its
 /// check. A file a command writes holds text it copied, which is never
 /// substituted, so it has no remedy.
-const CHECKS: [(FormatSpec<'static>, Option<&str>, Check); 15] = [
+const CHECKS: [(FormatSpec<'static>, Option<&str>, Check); 16] = [
+    (
+        registry_platform_yaml::CHECK_ACCEPTANCES_FORMAT,
+        Some(WRITE_THE_VALUE),
+        |input| {
+            registry_platform_config::read_project_check_acceptances(
+                &input.file.display().to_string(),
+                input.bytes,
+            )?;
+            Ok(Vec::new())
+        },
+    ),
     (fixtures::JOURNEYS_FORMAT, Some(WRITE_THE_VALUE), journeys),
     (
         fixtures::SCHEMA_TEST_RECEIPT_FORMAT,
@@ -517,6 +529,26 @@ fn nearest_written_pointer<'a>(document: &Document, pointer: &'a str) -> &'a str
 mod tests {
     use super::*;
 
+    #[test]
+    fn shared_check_acceptances_are_a_supported_tool_file() {
+        let temporary = tempfile::tempdir().unwrap();
+        let file = temporary
+            .path()
+            .canonicalize()
+            .unwrap()
+            .join("check-acceptances.yaml");
+        std::fs::write(
+            &file,
+            "apiVersion: id.registrystack.org/formats/platform/check-acceptances/v1alpha1\nkind: PlatformCheckAcceptances\nacceptances: []\n",
+        )
+        .unwrap();
+
+        let report = check(&file, &file.display().to_string(), &Against::Nothing)
+            .expect("the shared acceptance format is a supported tool file");
+        assert!(!report.has_errors());
+        assert!(report.diagnostics().is_empty());
+    }
+
     #[test]
     fn a_descriptor_location_is_the_last_five_path_components() {
         assert_eq!(

crates/registry-bregctl/tests/cli.rs

@@ -105,6 +105,78 @@ fn duplicate_profile_display_warns_once_and_deny_warnings_refuses_it() {
     ]);
     assert_eq!(denied.status.code(), Some(1));
     assert_eq!(json_stdout(&denied)["diagnostics"], report["diagnostics"]);
+
+    fs::write(
+        project.path().join("check-acceptances.yaml"),
+        r#"apiVersion: id.registrystack.org/formats/platform/check-acceptances/v1alpha1
+kind: PlatformCheckAcceptances
+acceptances:
+  - code: breg.access-profile.duplicate-label
+    scope:
+      file: registry.yaml
+      path: /accessProfiles/@id=directory-observer/display/label
+    reason: These profiles intentionally share a label in this reviewed project.
+"#,
+    )
+    .unwrap();
+    let accepted = bregctl(&[
+        "--format",
+        "json",
+        "check",
+        path(project.path()),
+        "--deny-warnings",
+    ]);
+    assert!(accepted.status.success(), "{accepted:?}");
+    let accepted_report = json_stdout(&accepted);
+    assert_eq!(accepted_report["diagnostics"].as_array().unwrap().len(), 1);
+    let accepted_warning = &accepted_report["diagnostics"][0];
+    assert_eq!(accepted_warning["severity"], "warning");
+    assert_eq!(
+        accepted_warning["scope"],
+        json!({
+            "file": "registry.yaml",
+            "path": "/accessProfiles/@id=directory-observer/display/label"
+        })
+    );
+    assert_eq!(
+        accepted_warning["acceptedReason"],
+        "These profiles intentionally share a label in this reviewed project."
+    );
+    assert_eq!(accepted_warning["rank"], "hygiene");
+
+    let explained = bregctl(&[
+        "--format",
+        "json",
+        "explain",
+        "access",
+        path(project.path()),
+    ]);
+    assert!(explained.status.success(), "{explained:?}");
+    let explained_report = json_stdout(&explained);
+    let explained_warning = explained_report["findings"]
+        .as_array()
+        .and_then(|findings| {
+            findings
+                .iter()
+                .find(|finding| finding["code"] == "breg.access-profile.duplicate-label")
+        })
+        .unwrap_or_else(|| panic!("accepted warning remains visible: {explained_report}"));
+    assert_eq!(
+        explained_warning["acceptedReason"],
+        "These profiles intentionally share a label in this reviewed project."
+    );
+    assert_eq!(
+        explained_warning["scope"],
+        json!({
+            "file": "registry.yaml",
+            "path": "/accessProfiles/@id=directory-observer/display/label"
+        })
+    );
+
+    let accepted_human = bregctl(&["check", path(project.path()), "--deny-warnings"]);
+    assert!(accepted_human.status.success(), "{accepted_human:?}");
+    assert!(String::from_utf8_lossy(&accepted_human.stdout)
+        .ends_with("0 errors, 0 warnings, 1 accepted warning in 2 files\n"));
 }
 
 #[test]
@@ -1908,6 +1980,8 @@ fn assert_check_diagnostic(diagnostic: &Value, artifact: Option<&str>) {
                 "source",
                 "related",
                 "rank",
+                "scope",
+                "acceptedReason",
             ]
             .contains(&key.as_str()),
             "{key} in {diagnostic}"
@@ -2159,7 +2233,7 @@ fn facility_starter_checks_clean_with_warnings_denied() {
     ]);
     assert!(initialized.status.success(), "{initialized:?}");
 
-    let registry = registry_platform_yaml::Reader::new("registry.yaml")
+    let mut registry = registry_platform_yaml::Reader::new("registry.yaml")
         .scan(&fs::read(destination.join("registry.yaml")).unwrap())
         .unwrap()
         .unwrap()
@@ -2199,6 +2273,75 @@ fn facility_starter_checks_clean_with_warnings_denied() {
         .as_array()
         .unwrap()
         .is_empty());
+
+    let registrar = registry["accessProfiles"]
+        .as_array_mut()
+        .unwrap()
+        .iter_mut()
+        .find(|profile| profile["id"] == "facility-registrar")
+        .unwrap();
+    let facility_target = registrar["permissions"]["actions"]
+        .as_array_mut()
+        .unwrap()
+        .iter_mut()
+        .find(|permission| permission["action"] == "register-facility")
+        .unwrap()["targets"]
+        .as_array_mut()
+        .unwrap()
+        .iter_mut()
+        .find(|target| target["recordType"] == "facility")
+        .unwrap();
+    facility_target["rowBoundaries"] = json!("unrestricted");
+    fs::write(
+        destination.join("registry.yaml"),
+        serde_norway::to_string(&registry).unwrap(),
+    )
+    .unwrap();
+
+    let refused = bregctl(&[
+        "--format",
+        "json",
+        "check",
+        path(&destination),
+        "--deny-warnings",
+    ]);
+    assert_eq!(refused.status.code(), Some(1), "{refused:?}");
+    let refused_report = json_stdout(&refused);
+    let findings = refused_report["diagnostics"].as_array().unwrap();
+    assert_eq!(findings.len(), 1, "{refused_report}");
+    let warning = &findings[0];
+    assert_eq!(warning["code"], "breg.access.target-unrestricted-rows");
+    assert_eq!(warning["severity"], "warning");
+    assert_eq!(warning["rank"], "widens-access");
+
+    fs::write(
+        destination.join("check-acceptances.yaml"),
+        serde_json::to_vec_pretty(&json!({
+            "apiVersion": registry_platform_yaml::CHECK_ACCEPTANCES_API_VERSION,
+            "kind": registry_platform_yaml::CHECK_ACCEPTANCES_KIND,
+            "acceptances": [{
+                "code": warning["code"],
+                "scope": warning["scope"],
+                "reason": "The facility registrar intentionally has registry-wide create authority."
+            }]
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+    let accepted = bregctl(&[
+        "--format",
+        "json",
+        "check",
+        path(&destination),
+        "--deny-warnings",
+    ]);
+    assert!(accepted.status.success(), "{accepted:?}");
+    let accepted_report = json_stdout(&accepted);
+    assert_eq!(accepted_report["diagnostics"].as_array().unwrap().len(), 1);
+    assert_eq!(
+        accepted_report["diagnostics"][0]["acceptedReason"],
+        "The facility registrar intentionally has registry-wide create authority."
+    );
 }
 
 #[test]
@@ -3322,6 +3465,73 @@ fn check_says_so_when_an_expression_stops_it() {
     }
 }
 
+#[test]
+fn project_acceptance_applies_after_the_runtime_warning_is_collected() {
+    let scratch = TestProject::asset_fixture();
+    let project = scratch.path().join("runtime-warning-project");
+    let initialized = bregctl(&["init", path(&project)]);
+    assert!(initialized.status.success(), "{initialized:?}");
+    let runtime = project.join("runtime.example.yaml");
+    let source = fs::read_to_string(&runtime).unwrap();
+    let edited = source.replacen(
+        "allowedAlgorithm: EdDSA",
+        "allowedAlgorithm: ${BREG_CHECK_TEST_ALGORITHM}",
+        1,
+    );
+    assert_ne!(edited, source);
+    fs::write(&runtime, edited).unwrap();
+
+    let arguments = [
+        "--format",
+        "json",
+        "check",
+        path(&project),
+        "--runtime-config",
+        path(&runtime),
+    ];
+    let warned = bregctl(&arguments);
+    assert!(warned.status.success(), "{warned:?}");
+    let report = json_stdout(&warned);
+    let warning = report["diagnostics"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|diagnostic| diagnostic["code"] == "platform.runtime-config.check-incomplete")
+        .unwrap_or_else(|| panic!("the runtime warning is reported: {report}"));
+    assert_eq!(
+        warning["scope"],
+        json!({
+            "file": "runtime.example.yaml",
+            "path": "/authentication/oidc/allowedAlgorithm"
+        })
+    );
+
+    fs::write(
+        project.join("check-acceptances.yaml"),
+        serde_json::to_vec_pretty(&json!({
+            "apiVersion": registry_platform_yaml::CHECK_ACCEPTANCES_API_VERSION,
+            "kind": registry_platform_yaml::CHECK_ACCEPTANCES_KIND,
+            "acceptances": [{
+                "code": warning["code"],
+                "scope": warning["scope"],
+                "reason": "This deployment supplies the reviewed algorithm through its environment."
+            }]
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+    let mut strict_arguments = arguments.to_vec();
+    strict_arguments.push("--deny-warnings");
+    let accepted = bregctl(&strict_arguments);
+    assert!(accepted.status.success(), "{accepted:?}");
+    let report = json_stdout(&accepted);
+    assert_eq!(report["diagnostics"].as_array().unwrap().len(), 1);
+    assert_eq!(
+        report["diagnostics"][0]["acceptedReason"],
+        "This deployment supplies the reviewed algorithm through its environment."
+    );
+}
+
 /// One numbered step, read back out of the rendering: the ordinal line and the
 /// continuation lines hanging under it, checked for the column the renderer
 /// folds them into and rejoined into the sentence the step states.

crates/registry-bregctl/tests/cli/file_check.rs

@@ -146,6 +146,37 @@ fn every_registered_tool_example_checks_without_a_diagnostic() {
     assert_eq!(report["diagnostics"], json!([]), "{report}");
 }
 
+#[test]
+fn check_acceptance_reason_refuses_an_authored_expression() {
+    let scratch = scratch();
+    let file = scratch
+        .path()
+        .canonicalize()
+        .unwrap()
+        .join("check-acceptances.yaml");
+    fs::write(
+        &file,
+        r#"apiVersion: id.registrystack.org/formats/platform/check-acceptances/v1alpha1
+kind: PlatformCheckAcceptances
+acceptances:
+  - code: breg.access.target-unrestricted-rows
+    scope: {file: registry.yaml, path: /accessProfiles/@id=reader}
+    reason: ${CHECK_ACCEPTANCE_REASON_CANARY}
+"#,
+    )
+    .unwrap();
+
+    let output = check_file(&file, &["--format", "json"]);
+    assert_eq!(output.status.code(), Some(1));
+    let report = json_report(&output);
+    assert_eq!(
+        report["diagnostics"][0]["code"],
+        "config.substitution-not-allowed"
+    );
+    assert_eq!(report["diagnostics"][0]["path"], "/acceptances/0/reason");
+    assert!(!String::from_utf8_lossy(&output.stdout).contains("CHECK_ACCEPTANCE_REASON_CANARY"));
+}
+
 #[test]
 fn model_selection_effective_ids_refuse_separator_collisions_at_authored_sources() {
     let scratch = scratch();