Remove Python from host-service and CEL guards #607

Merged

binjovi-bot merged 1 commit from perf/seanfarm-host-cel-guards into trunk

2026-09-10 22:47:19 +00:00

sean commented

2026-09-10 22:38:07 +00:00

Owner

Both guards pass with Python denied. CEL covers 70 expressions across five policies, plus nine broken and twelve valid fixture expressions. Shellcheck, syntax and diff checks pass. This preserves lexical validation; it does not claim to compile or type-check CEL.

Replace the ARM host-service relation helper with Bash/jq and the CEL lexical-balance helper with jq. Preserve exact architecture selectors, equivalent container commands and existing host-route behavioral tests. Both guards pass with Python denied. CEL covers 70 expressions across five policies, plus nine broken and twelve valid fixture expressions. Shellcheck, syntax and diff checks pass. This preserves lexical validation; it does not claim to compile or type-check CEL.

sean added 1 commit

2026-09-10 22:38:07 +00:00