feat(kits): add neutral network.tier vocab (strict/balanced/open) to hybrid/v1 (#300) - #313
Merged
Merged
Conversation
…hybrid/v1 (#300) First implementation of the neutral-network-tiers epic (#303; design in ADR 0002 / PR #299). Adds a `tier` sibling to the existing `caps.network` block in schemas/kit-hybrid-v1.schema.json (draft-2020-12 enum): strict | balanced | open, schema default `balanced`. - ALL tiers are deny-by-default; the tier only sizes the baseline allowlist. strict = kit `allow` only; balanced = curated shared baseline ∪ kit `allow` (the default when unspecified, per the 2026-08-07 maintainer decision — backend- consistent with the sbx baseline + quickstart msb-balanced-egress default); open = unrestricted (testing only, never GFE). Effective allowlist = tier baseline ∪ kit allow ∪ per-sandbox additions. - Coexists with the existing `caps.network.allow` (unchanged). - validate-kits.py: schema enum already rejects bad values; added a kit-scoped field-level message for a clearer error. Default is DOCUMENTED, not mutated — consistent with the validator's existing non-mutating, validation-only posture. - INDEX/CATALOG generators don't read the network block, so nothing to update there. Tests: schema (absent-valid, all 3 tiers, coexists-with-allow, bad-value + wrong-type + typo-key rejected) + validator (valid/absent pass, bad-tier message). 322 tests pass; make validate green; ruff clean. Unblocks #301 (balanced baseline data file) + quickstart #294 (adapter mapping). Closes #300. AI-assisted (OpenCode); consensus-reviewed (3/3 on the tier design). Requires human review. Co-authored-by: OpenCode Agent <william.zujkowski@gsa.gov>
mogul
approved these changes
Aug 12, 2026
Contributor
|
Approved, but needs the link check result addressed before merging. |
This was referenced Aug 12, 2026
mogul
pushed a commit
that referenced
this pull request
Aug 12, 2026
…se-positives (#316) (#317) * fix(ci): authenticate Link Check to github.com to stop rate-limit false-positives (#316) The Link Check job (tcort/github-action-markdown-link-check, unauthenticated) intermittently reported LIVE github.com URLs as dead (Status 0/503) when a run checked many links at once and hit GitHub's ~60/hr anonymous rate limit — seen blocking approved PRs #313/#315 on consecutive runs, every flagged link 200 in a browser. retryOn429 never engaged because GitHub sheds anonymous load with 503, not 429. Fix (no new secret, read-only token only): - httpHeaders: send Authorization: Bearer <token> for github.com / api.github.com / raw.githubusercontent.com, so those links are checked AUTHENTICATED (5000/hr). A CI step renders the read-only workflow GITHUB_TOKEN into the placeholder via envsubst (whitelisted to only) → a git-ignored .markdown-link-check.ci.json; locally the placeholder stays inert ('Bearer '), so github still answers anonymously and the committed config carries no token. - aliveStatusCodes: add 429 + 503 so a throttled probe of a live host defers instead of being reported dead (belt-and-suspenders alongside the token). - retryCount 3 -> 5. Real dead links still fail (a genuine 404 is not in aliveStatusCodes). Job stays continue-on-error. Verified: config renders to valid JSON with + without a token; make validate + 354 tests pass. Closes #316. AI-assisted (OpenCode). Requires human review. Co-authored-by: OpenCode Agent <william.zujkowski@gsa.gov> * fix(ci): ignore nvd.nist.gov in Link Check (bot-hostile to HEAD probe) Follow-up within #316: with github.com now authenticated, the only remaining Link Check false-positive was nvd.nist.gov -> Status 0. NVD is bot-hostile to the checker's unauthenticated HEAD probe (same behavior as asciinema.org) but is a live, stable gov site referenced from the dependency-analysis skill. Ignore it, matching the asciinema treatment. Real dead links still fail. Co-authored-by: OpenCode Agent <william.zujkowski@gsa.gov>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First implementation of the neutral-network-tiers epic (#303; design in ADR 0002 / PR #299). Adds a
tierfield to the existingcaps.networkblock inschemas/kit-hybrid-v1.schema.json— enum strict | balanced | open, schema default balanced.strict= kitallowonly;balanced= curated shared baseline ∪ kitallow(the default when unspecified, per the 2026-08-07 maintainer decision — backend-consistent with the sbx baseline + the merged quickstart msb-balanced-egress default);open= unrestricted (testing only, never GFE). Effective allowlist = tier baseline ∪ kitallow∪ per-sandbox additions.caps.network.allow(unchanged).Verification
make validategreen; ruff clean.Rollback
Revert. Additive optional schema field + one validator message + tests; existing kits unaffected (none set
tier).Unblocks #301 (balanced baseline data file) + quickstart #294 (adapter mapping). Closes #300.
AI-assisted (OpenCode); consensus-reviewed. Requires human review.