fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test/docs(cli): §3 M3 per-env approval journey; Tier 1 complete

Browse Source 
`tests/env_approval.rs`: a `[project.environments]` gating `production` →
`pic apply --env production` refused (names --approve); `--yes` alone does not
bypass; `--approve production` applies; an un-gated `staging` applies freely.
Design doc §3 records M3 shipped and the §6/§3 group-tree Tier 1 (M1 create ·
M2 divergence/reparent · M3 per-env approval) COMPLETE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-07-07 20:28:28 +02:00
parent 62710b5d81
commit e2bfe633a7
3 changed files with 103 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/design/groups-and-project-tool.md
View File

@@ -824,8 +824,19 @@ reshapes the tree): `Refuse` → `ApplyError::StructuralDivergence` (422, naming
divergence (`divergence_preview` → a `structure` row: `diverged`, server + manifest parents). CLI:
`--force-local-structure` / `--adopt-server-structure` (mutually exclusive) → the `structure_mode` wire field; the
422 surfaces verbatim. A concurrent `pic groups reparent` between plan and apply still trips `StateMoved` (the tree
token folds `structure_version`). Pinned by `tests/structural_divergence.rs`. **Still deferred:** per-env approval
gating (`[project.environments]`).
token folds `structure_version`). Pinned by `tests/structural_divergence.rs`.
**§3 M3 shipped — per-env approval gating (`[project.environments]`).** A `[project.environments]` block on the
root `[project]` maps an env name to `{ confirm = bool }` (`ManifestProject.environments`, `#[serde(skip_serializing)]`
— purely CLI-side). `pic apply --env <e>` is REFUSED (client-side, before any request) when `<e>` is confirm-required
unless it is explicitly `--approve <e>`d; a blanket `--yes` does NOT cover a gated env (§4.2 "CI must opt in per
environment"); an unlisted / `confirm = false` env applies freely. `require_env_approval` gates both the single
(`run`) and tree (`run_tree`) apply paths; `--approve <env>` is a repeatable flag. Value overlays
(`picloud.<env>.toml`) already merge client-side, so this milestone is the confirm-policy gate only. Pinned by
`tests/env_approval.rs`. **Deferred (documented, not built):** server-side audited approval-override capability
(§4.2 → `authz::can`); env-as-app mapping + declarative server-side `@E` config scoping.
**§6/§3 group-tree Tier 1 (M1 create · M2 divergence/reparent · M3 per-env approval) is COMPLETE.**
---