datatug / backend / 41850177585
100%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 416
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 99.995%. Remained the same
41850177585

push

github

web-flow 
feat(watch): dormant Service admission for Cloud Watch runners (#150)

Plan Task 7 of the DataTug unified data access MVP: Service admission for Cloud Watch runners. It covers standing Service read intent, `watch_service_admission`, `watch_service_read`, and the security doc `docs/security/watch-service-read.md`.

**Off by default.** Production activation stays OFF: nothing in this module sets `ServiceReadAccess` or `ServiceReadMappings`. With no control plane, behaviour is unchanged (das-7).

**Protected sources fail closed.** The Service subject carries `Grants: []` and gets authority only from Standing entries for that subject. Identity and mode are re-checked inside the transaction, and old workers can't get a protected bundle.

**Review fixes added on takeover:**
- Runners enrolled before source manifests existed (2026-10-24 to 10-29) keep working; a missing manifest is classified from the grant's source IDs and stays fail-closed for protected sources.
- A test that the owner's run-rights gate covers protected bundles.
- A test that the bundle is never nil without ServiceRead.

The original work was written by the Codex data-access lane, which is offline until 2026-11-09, and taken over by Claude. Independent review and re-review approve head 31df79d.

Tests: `go test ./facade4datatug ./api4datatug -cover`, both packages at 100%; vet and golangci-lint 2.15.0 clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Source commits:

- 0be8794a750b feat(watch): fence dormant protected runner incarnations
- 4795585c2da0 test(watch): fix explicit nil-context lint finding
- 205507e787f6 test(watch): preserve definition gate rollback through runner factory
- 47765aa21de6 fix(watch): classify only selected enrollment sources
- a5f46439432e feat(watch): resolve bounded standing Service read intent
- 43e5e3259744 fix(watch): keep pre-manifest runner enrollments working
  Enrollments made before source manifests existed (2026-10-24..29) have ... (continued)

55394 of 55397 relevant lines covered (99.99%)

1.0 hits per line

Jobs
ID Job ID Ran Files Coverage
1 41850177585.1 416
99.99
GitHub Action Run
Source Files on build 41850177585