fix(policy): treat unreadable security level as unknown - #5
Merged
Conversation
Parse the Jira security field three-valued (SecurityLevel: Absent / Present / Unreadable) instead of Option<String>, so a security object without a readable name no longer matches has_security_level = false. Unreadable is Unknown independent of the project being known and denies when consulted (I4, DESIGN.md visibility semantics). Tightens behavior on deployments returning nameless security objects (I9 direction).
plusky
added
security
plusky
enabled auto-merge (rebase)
August 8, 2026 19:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
IssueMeta::from_jira_issuecollapsed "no security level" and "security level present but unreadable" into oneNone, andhas_security_levelthen treated both as absence — so an embargoed issue whosesecurityobject arrived without a readablenamecould satisfyhas_security_level = falseand be allowed. That is the fail-open hazard DESIGN.md's visibility section exists to prevent, and it contradicts I4's rule that unreadable metadata never yields more access than readable metadata would.The parsed security level is now three-state — absent / present(name) / unreadable. Absent still means "no level set"; unreadable is Unknown to the matcher, which denies whenever the rule is consulted (I4). The unknown branch no longer depends on
projectbeing unknown. DESIGN.md's visibility section records the three-way distinction.Invariants: I4, DESIGN.md visibility semantics; strictly tightening (I9-compatible).
Tests: matcher unit tests pin all three states, including the allow-rule-denies-unreadable case; confirmed to fail against the unfixed code.
Process: AI-assisted — implemented and independently adversarially reviewed against
docs/DESIGN.md(verdict: approve, with an empirical pre-fix-failure check). Full verification suite green at the commit.