rbac typed grant (§6) + OGAR DO-arm provider (Türsteher) + Rung↔elevation calibration#600
Conversation
Three of the five autoattended bricks, all lance-graph-side: contract::rbac (§6 keystone) — the typed `granted` value-tenant: OpMask (verb bitmask), ClassGrant (target_classid:u16, op_mask:u8), grants_permit. The first-class, palette-native replacement for project_role.permissions: text (I-K0 registry axiom: decisions key on classid, not on text). Keys on the shared-concept low u16 so a grant survives any app render-skin. Re-exported from lance-graph-rbac. 6 tests. lance-graph-ogar::OgarActionProvider — the OGAR DO-arm provider: per-class ActionDef manifests keyed by classid, with RBAC HARDCODED into the class (the Türsteher). auth_store (0x0B01) carries required_role on every mutating action as a compile-time const; auth_zitadel (0x0B02) inherits it via effective_actions and overrides issue_token onto the Elixir low-code exec path without widening the grant. Containment by structure: cognition above cannot widen a class's DO surface. Decoupled from ogar-vocab git (literal canon ids) so the module is contract-only; verified 4/4 against the contract (the lib's own test run is blocked by a PRE-EXISTING OGAR-main↔mirror codebook lag — main lacks the 2026-06-23 auth mint the in-repo mirror has). planner elevation — ElevationLevel::from_rung(RungLevel): the Rung-1-9 Flughöhe ↔ elevation L0-L5 calibration, monotone non-decreasing (a cost floor of ambition). Csíkszentmihályi's Flow channel (already in code as FlowState + flow_state_from + elevation::homeostasis) tunes the spend around that floor: Boredom deepens, Anxiety caps. 1 test (monotonicity + endpoints). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EYvNjD8M8LMNYbRy3gq2FP
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
More reviews will be available in 20 minutes and 23 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds typed RBAC grant primitives ( ChangesTyped RBAC Grant Primitives
OGAR Action Provider
ElevationLevel::from_rung Mapping
Sequence Diagram(s)sequenceDiagram
rect rgba(100, 149, 237, 0.5)
Note over Caller,OpMask: RBAC Grant Check
Caller->>grants_permit: grants_permit(granted_slice, class, op)
grants_permit->>ClassGrant: permits(class, op)
ClassGrant->>ClassGrant: match low-u16 of ClassId vs target_classid
ClassGrant->>OpMask: permits(op)
OpMask-->>ClassGrant: verb bit match
ClassGrant-->>grants_permit: bool
grants_permit-->>Caller: any true → permit, else deny
end
sequenceDiagram
rect rgba(144, 238, 144, 0.5)
Note over Client,effective_actions_fn: OGAR Effective Actions Resolution
Client->>OgarActionProvider: effective_actions(classid)
OgarActionProvider->>parent_of: parent_of(classid)
parent_of-->>OgarActionProvider: Some(AUTH_STORE) or None
OgarActionProvider->>effective_actions_fn: (parent_actions, own_actions)
effective_actions_fn-->>OgarActionProvider: merged Vec<ActionDef> with overrides
OgarActionProvider-->>Client: Vec<ActionDef>
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/lance-graph-ogar/src/actions.rs`:
- Around line 167-170: The effective_actions method returns inherited ActionDef
instances from parent classes with their object_class field unchanged (pointing
to the parent class). When these inherited actions are used for a child class,
the object_class mismatch causes ActionInvocation::commit to reject them before
RBAC is applied. Modify the effective_actions function to rebind the
object_class field of all returned ActionDef instances to match the requested
classid parameter, ensuring that inherited actions from parent classes are
properly tagged with the child class's identifier. This change should be applied
consistently both in the main effective_actions method (line 167-170) and
wherever else it is called (lines 215-235).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9d7dc3e4-f7b5-40ab-aa28-162babf35a04
📒 Files selected for processing (5)
crates/lance-graph-contract/src/rbac.rscrates/lance-graph-ogar/src/actions.rscrates/lance-graph-ogar/src/lib.rscrates/lance-graph-planner/src/elevation/mod.rscrates/lance-graph-rbac/src/lib.rs
…assid CodeRabbit (PR #600) caught a real correctness bug: effective_actions returned inherited parent ActionDefs with object_class unchanged (AUTH_STORE_CID). contract::action::ActionInvocation::commit def-matches on def.object_class == inv.object_class BEFORE RBAC, so an inherited revoke_token/rotate_secret advertised on auth_zitadel could never commit for a Zitadel instance (def.object_class=0x0B01 vs inv.object_class=0x0B02 → Failed). Rebind every effective action to the requested child classid (idempotent for the child's own actions). Test now asserts all effective actions carry the child classid. Verified 4/4 against the contract in isolation (lib build still blocked by the pre-existing OGAR-main↔mirror codebook lag, unrelated). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EYvNjD8M8LMNYbRy3gq2FP
2 participants
Three of the five autoattended "Türsteher" bricks, all lance-graph-side.
1.
contract::rbac— the typedgrantedvalue-tenant (keystone §6)OpMask(verb bitmask) +ClassGrant { target_classid: u16, op_mask: u8 }+grants_permit. The first-class, palette-native replacement forproject_role.permissions: text(I-K0 registry axiom: decisions key onclassid, not on text). Keys on the shared-concept low u16, so a grant
survives any app render-skin (hi u16). Re-exported from
lance-graph-rbac.The richer
PermissionSpec(depth/predicate/action-name) is the finer stageabove the verb gate. 6 tests.
2.
lance-graph-ogar::OgarActionProvider— the OGAR DO-arm providerPer-class
ActionDefmanifests keyed by classid, with RBAC hardcoded into theclass (the Türsteher):
auth_store(0x0B01) carriesrequired_roleon everymutating action as a compile-time
const;auth_zitadel(0x0B02) inherits viaeffective_actionsand overridesissue_tokenonto theElixirlow-code execpath without widening the grant. Containment by structure — cognition above
cannot widen a class's DO surface.
3. planner elevation —
ElevationLevel::from_rung(RungLevel)The Rung-1-9 Flughöhe ↔ elevation L0-L5 calibration, monotone
non-decreasing (a cost floor of ambition). Csíkszentmihályi's Flow channel
(already in code:
FlowState+flow_state_from+elevation::homeostasis)tunes the spend around that floor —
Boredomdeepens,Anxietycaps. 1 test(monotonicity + endpoints).
All new tests green; clippy/fmt clean on the touched crates (pre-existing
workspace warnings unchanged).
🤖 Generated with Claude Code
Generated by Claude Code
Summary by CodeRabbit
Release Notes