[Debt] Decompose effective View resolution and provenance evaluation #1

New Issue

2026-07-29T13:25:59+02:00

zemion commented

2026-07-29 13:25:59 +02:00

Problem

resolve_effective_view remains E/37 and combines assignment precedence, scope inheritance, reusable definitions, restrictions, active selection, surface filtering, provenance, and lockout protection. This is difficult to reason about as user/group assignments and workflow-driven view switching expand.

Acceptance criteria

Candidate collection, precedence, policy restriction, surface resolution, provenance, and lockout fallback are separate testable stages.
A deterministic precedence table covers system, tenant, group, user, and workflow inputs.
Missing optional modules/surfaces degrade without hiding required recovery/admin controls.
Resolution is bounded and suitable for request-time caching with explicit invalidation inputs.
Views passes the configured Xenon threshold.

## Problem `resolve_effective_view` remains E/37 and combines assignment precedence, scope inheritance, reusable definitions, restrictions, active selection, surface filtering, provenance, and lockout protection. This is difficult to reason about as user/group assignments and workflow-driven view switching expand. ## Acceptance criteria - Candidate collection, precedence, policy restriction, surface resolution, provenance, and lockout fallback are separate testable stages. - A deterministic precedence table covers system, tenant, group, user, and workflow inputs. - Missing optional modules/surfaces degrade without hiding required recovery/admin controls. - Resolution is bounded and suitable for request-time caching with explicit invalidation inputs. - Views passes the configured Xenon threshold.

zemion added the module/policy module/views

type

debt

area/api area/governance source/security-audit codex/ready

labels 2026-07-29 13:25:59 +02:00

zemion commented

2026-07-29 14:24:42 +02:00

Codex State: reviewed

Reviewed after published Views c24d1f2. Searchable assignment targets are complete, but this debt remains open: fresh Xenon still reports resolve_effective_view at rank E. Inheritance/ceiling selection, surface evaluation, and provenance assembly still need independent decision layers.

## Codex State: reviewed Reviewed after published Views `c24d1f2`. Searchable assignment targets are complete, but this debt remains open: fresh Xenon still reports `resolve_effective_view` at rank E. Inheritance/ceiling selection, surface evaluation, and provenance assembly still need independent decision layers.

zemion commented

2026-07-29 19:09:27 +02:00

Implemented and pushed in govoplan-views@d5b13de with the public optional workflow input announced by govoplan-core@4bde049.

Resolution now has separate bounded candidate collection, batch revision resolution, option precedence, selection/provenance, surface evaluation, lockout fallback, and response assembly stages. Exact applicable scopes are queried with a 1,000-assignment/500-group safety bound. Tested precedence is required > workflow > user > default, with default specificity user > group > tenant > system. Workflow selections must already be available to the account. Missing surfaces and safety-limit failures show the full authorized interface with diagnostics. An invalidation token captures assignments/revisions, preference, workflow input, and surface catalogue for future request caching.

Verification: 21 Views tests, 117 Core module-system tests, Ruff, Xenon C/B/A, and diff checks pass.

Implemented and pushed in `govoplan-views@d5b13de` with the public optional workflow input announced by `govoplan-core@4bde049`. Resolution now has separate bounded candidate collection, batch revision resolution, option precedence, selection/provenance, surface evaluation, lockout fallback, and response assembly stages. Exact applicable scopes are queried with a 1,000-assignment/500-group safety bound. Tested precedence is required > workflow > user > default, with default specificity user > group > tenant > system. Workflow selections must already be available to the account. Missing surfaces and safety-limit failures show the full authorized interface with diagnostics. An invalidation token captures assignments/revisions, preference, workflow input, and surface catalogue for future request caching. Verification: 21 Views tests, 117 Core module-system tests, Ruff, Xenon C/B/A, and diff checks pass.

zemion removed the

status

ready

codex/ready labels 2026-07-29 19:09:28 +02:00

zemion closed this issue

2026-07-29 19:09:28 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-views#1