coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind trusted task approval to exact producer facts and lifetime
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Failing after 1m10s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 17:27:30 +02:00
parent 4f6946bbb3
commit 2b064eee51
31 changed files with 2170 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

19
internal/policy/package.go
View file

@ -1,6 +1,7 @@
package policy
import (
"bytes"
"context"
"encoding/json"
"fmt"
@ -375,7 +376,25 @@ func (p *Package) runFixtures(ctx context.Context) []FixtureResult {
}
func (p *Package) evaluateDecision(ctx context.Context, request api.CheckRequest) (api.DecisionExpectation, error) {
return p.evaluateDecisionProfile(ctx, request, false)
}
// EvaluatePreservingNumbers feeds the same evaluator the task profile's exact
// numeric values. Ordinary evaluation behavior and canonical contracts stay put.
func (p *Package) EvaluatePreservingNumbers(ctx context.Context, request api.CheckRequest) (api.DecisionExpectation, error) {
return p.evaluateDecisionProfile(ctx, request, true)
}
func (p *Package) evaluateDecisionProfile(ctx context.Context, request api.CheckRequest, preserve bool) (api.DecisionExpectation, error) {
input, err := toRegoInput(request)
if preserve {
raw, e := json.Marshal(request)
if e != nil {
return api.DecisionExpectation{}, e
}
decoder := json.NewDecoder(bytes.NewReader(raw))
decoder.UseNumber()
err = decoder.Decode(&input)
}
if err != nil {
return api.DecisionExpectation{}, err
}