Repository navigation
feat: simplify product API calls with saved connections - #2437
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd40deedb1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Use one bounded regular-file reader for raw API file arguments and saved connection documents, rejecting FIFOs without blocking on Unix. Preserve explicit stdin bodies, regular-file symlinks, missing stores, and the stricter saved-secret resolver. Add process regressions and Messaging security traceability. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f2db871b74
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Summary
Add shared
rstack <product> api PATHcommands and saved product connections for BReg, Evidence, Casework, Messaging, Scheduling, Coordinator and Discovery. Operators can reuse local development clients or named remote connections while keeping request-specific grants, revisions, idempotency and disclosure choices explicit.The tooling-only transport shares project discovery, private CA trust, credential references, OAuth private-key JWT handling, raw responses and exit statuses. Connection mutations are serialized across processes. Strict schemas, structured offline diagnostics, CLI references and maintained tutorials cover the same interface.
Direct raw-API files and saved-connection documents use a bounded regular-file reader. Unix FIFO inputs fail promptly; regular-file symlinks and explicit stdin bodies remain supported. All seven product owners now record their credential selection and destination boundaries. The shared security contract distinguishes raw opaque bearers from legacy typed credential commands and the separate saved-secret resolver. Messaging's invariant traceability maps the concrete checks.
Evidence
After feedback fixes: all seven BReg API process tests, 23 shared API/schema tests and 26 Messaging contract tests passed. FIFO regressions reproduced the original hangs before the fix and passed afterwards, including explicit connection-check and implicit saved-store paths. Strict Clippy, formatting, locked metadata, dependency policy and secret scanning passed. FIFO behavior was tested locally on macOS; the non-Unix fallback was not exercised locally.
The reviewed candidate passed 23 shared API tests, strict Clippy and formatting, CLI catalog tests (24 unit and three snapshots), identifier tests (25 unit and 367 hash-binding/reference checks), and 179 configuration/classifier tests. Secret scanning passed.
The explicit-header contract is also pinned by all 11 HTTP transport tests: an anonymous connection may carry one deliberate raw Authorization header through any of the three supported header forms, while automatic credentials remain protected. Anonymous denotes the absence of an automatic provider, not access to public routes only.
The prior source PR also passed its full protected CI on its final head. This replacement must pass fresh protected CI and merge-queue checks before landing. Local tests do not replace the full workspace, PostgreSQL, native-client or tutorial matrix. A complete local identifier regeneration was not completed; CI supplies that reproduction check.
Notes
Supersedes #2407, retaining the reviewed feature and fixes on a linear branch based on main. The final tree was checked against the independently simulated combination of main and the reviewed source PR. The original branch remains intact.
The review fixes align the editor modeline contract and make the transport's source-path test compare canonical paths on macOS. No third-party dependency versions are changed by this feature.
DCO
Signed-off-bytrailer.