sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests Projects Releases 758 Packages Wiki Activity

docs: record the two tiers of attribution, and close two done boxes #2030

Merged
sean merged 1 commit from docs/attribution-and-stale-claims into trunk 2026-08-11 09:16:10 +00:00
Conversation 0 Commits 1 Files changed 6 +74 -27
sean commented 2026-08-11 09:15:41 +00:00
Owner
Copy link

docs/MCP.md said the dashboard, pipectl, and MCP "write through the same release API". pipectl does not — it creates the CRs with kubectl (bin/pipectl:153, 274, 365, 409, 459).

That mattered because of what it hid. pipectl takes requestedBy from $USER (bin/pipectl:107, 273, 364, 405, 458) and nothing checks it, while the release API requires a Hydra-verified email (releaseapi/server.go:163-170). The control plane has two tiers of attribution, no document said so, and two claimed the opposite (CONFIG-SCHEMA.md:155, DOMAIN-MODEL.md:321).

MCP.md now carries the full account, including the matching fact that the release API rate limit cannot bind pipectl either — only the operator's version claim binds all three surfaces.

Two ENTERPRISE-HARDENING.md boxes were still open and are done: a denial is terminal (submitters.go:1695-1699, bin/pipectl:346-352), and a superseded run records phase: Superseded (submitters.go:2252-2259). DOMAIN-MODEL.md:312 restated the second and is corrected.

Also: pipectl is 654 lines, not 584. /api/ship is gone, and releaseapi/server_test.go:192 asserts it answers 404.

Docs only — no code change. Guards: 129/129 with PIPELINE_GUARDS_STRICT=1.

`docs/MCP.md` said the dashboard, pipectl, and MCP "write through the same release API". pipectl does not — it creates the CRs with kubectl (`bin/pipectl:153, 274, 365, 409, 459`). That mattered because of what it hid. pipectl takes `requestedBy` from `$USER` (`bin/pipectl:107, 273, 364, 405, 458`) and nothing checks it, while the release API requires a Hydra-verified email (`releaseapi/server.go:163-170`). The control plane has **two tiers of attribution**, no document said so, and two claimed the opposite (`CONFIG-SCHEMA.md:155`, `DOMAIN-MODEL.md:321`). `MCP.md` now carries the full account, including the matching fact that the release API rate limit cannot bind pipectl either — only the operator's version claim binds all three surfaces. Two `ENTERPRISE-HARDENING.md` boxes were still open and are done: a denial is terminal (`submitters.go:1695-1699`, `bin/pipectl:346-352`), and a superseded run records `phase: Superseded` (`submitters.go:2252-2259`). `DOMAIN-MODEL.md:312` restated the second and is corrected. Also: pipectl is 654 lines, not 584. `/api/ship` is gone, and `releaseapi/server_test.go:192` asserts it answers 404. Docs only — no code change. Guards: 129/129 with `PIPELINE_GUARDS_STRICT=1`.
docs: record the two tiers of attribution, and close two done boxes
All checks were successful
pipeline/ci CI green @ 94b17d298689
Details
94b17d2986
 
docs/MCP.md said the dashboard, pipectl, and MCP "write through the same
release API". pipectl does not. It creates the CRs with kubectl
(bin/pipectl:153, 274, 365, 409, 459) and never calls the release API.

That mattered because of what it hid. pipectl takes requestedBy from the
$USER environment variable (bin/pipectl:107, 273, 364, 405, 458) and
nothing checks it, while the release API requires a Hydra-verified email
(releaseapi/server.go:163-170). So the control plane has two tiers of
attribution. No document said so, and two claimed the opposite:
CONFIG-SCHEMA.md called requestedBy an "authenticated identity", and
DOMAIN-MODEL.md called approval actors "authenticated". Both are now
qualified by surface, and MCP.md carries the full account, including the
matching fact that the release API rate limit cannot bind pipectl either.

Two ENTERPRISE-HARDENING boxes were still open and are done. A denial is
terminal (submitters.go:1695-1699, bin/pipectl:346-352), and a superseded
run records phase: Superseded (submitters.go:2252-2259). DOMAIN-MODEL.md
restated the second one and is corrected. An unchecked box that is
already done sends the next reader at work nobody needs.

Also: pipectl is 654 lines, not 584. /api/ship is gone, and
releaseapi/server_test.go:192 asserts it answers 404.

Guards: 129/129 pass with PIPELINE_GUARDS_STRICT=1.
sean merged commit 94b17d2986 into trunk 2026-08-11 09:16:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/pipelines!2030
No description provided.