TAN-827: preserve global memory sharing across department changes #182
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Enforcement Model Drift | |
| on: | |
| pull_request: | |
| paths: | |
| - "guide/src/content/docs/policy-and-enforcement-model.md" | |
| - ".github/workflows/enforcement-model-drift.yml" | |
| - ".github/workflows/engine-ci.yml" | |
| - ".github/governance-audit-critical-tests.txt" | |
| - "crates/tandem-enterprise-contract/src/policy_predicates.rs" | |
| - "crates/tandem-tools/src/tool_dispatcher.rs" | |
| - "crates/tandem-automation/src/orchestration.rs" | |
| - "crates/tandem-automation/src/types_tests.rs" | |
| - "crates/tandem-server/src/agent_teams_parts/**" | |
| - "crates/tandem-server/src/app/state/app_state_impl_parts/part01.rs" | |
| - "crates/tandem-server/src/app/state/automation_v2_wait_nodes.rs" | |
| - "crates/tandem-server/src/app/state/governance_action_gate.rs" | |
| - "crates/tandem-server/src/app/state/mod.rs" | |
| - "crates/tandem-server/src/app/state/tests/**" | |
| - "crates/tandem-server/src/app/state/tool_dispatch_outbox.rs" | |
| - "crates/tandem-server/src/benchmarking/mod.rs" | |
| - "crates/tandem-server/src/http/coder_parts/part05.rs" | |
| - "crates/tandem-server/src/http/pack_builder.rs" | |
| - "crates/tandem-server/src/http/governance.rs" | |
| - "crates/tandem-server/src/http/mcp.rs" | |
| - "crates/tandem-server/src/http/mcp/**" | |
| - "crates/tandem-server/src/http/mcp_run_as.rs" | |
| - "crates/tandem-server/src/http/tests/governance_parts/**" | |
| - "crates/tandem-server/src/http/tests/approval_gate_matrix.rs" | |
| - "crates/tandem-server/src/http/tests/governance.rs" | |
| - "crates/tandem-server/src/incident_monitor_*.rs" | |
| - "crates/tandem-server/src/incident_monitor/**" | |
| - "crates/tandem-server/src/pack_builder.rs" | |
| - "crates/tandem-server/src/pack_builder_parts/**" | |
| - "crates/tandem-runtime/src/mcp_parts/part01.rs" | |
| - "scripts/check_enforcement_model_drift.py" | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| env: | |
| SCCACHE_GHA_ENABLED: "true" | |
| RUSTC_WRAPPER: sccache | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Load trusted drift checker | |
| id: checker | |
| shell: bash | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| set -euo pipefail | |
| checker="$RUNNER_TEMP/check_enforcement_model_drift.py" | |
| if git cat-file -e "$BASE_SHA:scripts/check_enforcement_model_drift.py" 2>/dev/null; then | |
| git show "$BASE_SHA:scripts/check_enforcement_model_drift.py" > "$checker" | |
| echo "source=trusted-base" >> "$GITHUB_OUTPUT" | |
| else | |
| cp scripts/check_enforcement_model_drift.py "$checker" | |
| echo "source=bootstrap-candidate" >> "$GITHUB_OUTPUT" | |
| fi | |
| echo "path=$checker" >> "$GITHUB_OUTPUT" | |
| - name: Run trusted drift checker | |
| run: >- | |
| python '${{ steps.checker.outputs.path }}' | |
| --base-ref '${{ github.event.pull_request.base.sha }}' | |
| - name: Install trusted Rust toolchain | |
| uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable | |
| with: | |
| toolchain: 1.98.0 | |
| - name: Install trusted compiler cache | |
| uses: mozilla-actions/sccache-action@1583d6b38d7be47f593cb472781bbb21cab4321e # v0.0.10 | |
| - name: Restore trusted Cargo cache | |
| uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2 | |
| with: | |
| shared-key: ${{ runner.os }}-workspace-browser-premium | |
| workspaces: ". -> target" | |
| - name: Execute premium governance audit manifest | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cargo test -p tandem-server --features premium-governance \ | |
| --lib --no-run --message-format=json > "$RUNNER_TEMP/premium-test-messages.json" | |
| TEST_MESSAGES="$RUNNER_TEMP/premium-test-messages.json" python - <<'PY' | |
| import json | |
| import os | |
| import pathlib | |
| import subprocess | |
| messages = pathlib.Path(os.environ["TEST_MESSAGES"]) | |
| executable = None | |
| for line in messages.read_text(encoding="utf-8").splitlines(): | |
| try: | |
| message = json.loads(line) | |
| except json.JSONDecodeError: | |
| continue | |
| if ( | |
| message.get("reason") == "compiler-artifact" | |
| and message.get("profile", {}).get("test") | |
| and message.get("target", {}).get("name") == "tandem_server" | |
| and message.get("executable") | |
| ): | |
| executable = message["executable"] | |
| if not executable: | |
| raise SystemExit("premium tandem_server test binary was not produced") | |
| listing = subprocess.check_output( | |
| [executable, "--list", "--format", "terse"], text=True | |
| ) | |
| discovered = { | |
| line.removesuffix(": test") | |
| for line in listing.splitlines() | |
| if line.endswith(": test") | |
| } | |
| manifest = [ | |
| line.strip() | |
| for line in pathlib.Path( | |
| ".github/governance-audit-critical-tests.txt" | |
| ).read_text(encoding="utf-8").splitlines() | |
| if line.strip() and not line.lstrip().startswith("#") | |
| ] | |
| for requested in manifest: | |
| matches = sorted( | |
| name | |
| for name in discovered | |
| if name == requested or name.endswith(f"::{requested}") | |
| ) | |
| if len(matches) != 1: | |
| raise SystemExit( | |
| f"audit test must resolve exactly once: {requested}; matches={matches}" | |
| ) | |
| subprocess.run( | |
| [executable, matches[0], "--exact", "--nocapture"], check=True | |
| ) | |
| PY | |
| - name: Execute local fail-closed governance route test | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cargo test -p tandem-server --features browser \ | |
| --lib --no-run --message-format=json > "$RUNNER_TEMP/local-test-messages.json" | |
| TEST_MESSAGES="$RUNNER_TEMP/local-test-messages.json" python - <<'PY' | |
| import json | |
| import os | |
| import pathlib | |
| import subprocess | |
| messages = pathlib.Path(os.environ["TEST_MESSAGES"]) | |
| executable = None | |
| for line in messages.read_text(encoding="utf-8").splitlines(): | |
| try: | |
| message = json.loads(line) | |
| except json.JSONDecodeError: | |
| continue | |
| if ( | |
| message.get("reason") == "compiler-artifact" | |
| and message.get("profile", {}).get("test") | |
| and message.get("target", {}).get("name") == "tandem_server" | |
| and message.get("executable") | |
| ): | |
| executable = message["executable"] | |
| if not executable: | |
| raise SystemExit("local tandem_server test binary was not produced") | |
| requested = "governance_routes_fail_closed_without_premium_governance" | |
| listing = subprocess.check_output( | |
| [executable, "--list", "--format", "terse"], text=True | |
| ) | |
| matches = sorted( | |
| line.removesuffix(": test") | |
| for line in listing.splitlines() | |
| if line.endswith(f"::{requested}: test") or line == f"{requested}: test" | |
| ) | |
| if len(matches) != 1: | |
| raise SystemExit( | |
| f"local guard test must resolve exactly once: {requested}; matches={matches}" | |
| ) | |
| subprocess.run( | |
| [executable, matches[0], "--exact", "--nocapture"], check=True | |
| ) | |
| PY | |
| candidate-checker: | |
| needs: check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Validate candidate drift checker for the next trusted base | |
| run: | | |
| python -m py_compile scripts/check_enforcement_model_drift.py | |
| python scripts/check_enforcement_model_drift.py \ | |
| --base-ref '${{ github.event.pull_request.base.sha }}' |