VARASYS/ZDDC
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ZDDC/zddc/internal/zddc
History
ZDDC 6d132572d3 chore(server): drop the federal reference Rego (bring-your-own-policy) 
Decision: external OPA is a bring-your-own-policy escape hatch, not a
supported turnkey mode — so stop shipping access_federal.rego. A verb-blind
read-ACL policy under NIST AC-6 branding is a liability to hand a federal
evaluator, and (like access.rego before the fail-close) it over-granted writes
and ignored WORM. The HTTPDecider + Decider interface stay: operators who want
an AC-6 ancestor-deny-absolute posture write their own Rego.

- Delete rego/access_federal.rego, FederalRego, --print-rego=federal, and
  federal_parity_test.go; trim the federal cases from rego_failclosed_test.go.
- Reframe every doc reference (rego.go, main.go, file.go, ARCHITECTURE.md,
  README.md) to "operators write their own Rego"; rewrite the README
  "Reference Rego policy" section to describe the single fail-closed read-ACL
  skeleton accurately (it also still carried the now-removed "mirrors exactly"
  parity claim).

Out of scope (flagged): the broader federal-readiness narrative
(FedRAMP/FIPS/IdP) and the separate website page federal.html still discuss
federal posture — the OPA bring-your-own-Rego path stays valid, but a
deliberate review with the federal go-to-market in mind is warranted.

go vet + full go test ./... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-10 08:45:21 -05:00
..
defaults feat(server): cascade-resolved display: labels for the canonical project peers 2026-06-05 17:48:46 -05:00
acl.go refactor(audit): pre-release cleanup pass 2026-05-18 16:28:07 -05:00
acl_test.go refactor(audit): pre-release cleanup pass 2026-05-18 16:28:07 -05:00
admin.go feat(policy): config-edit is a standing permission, not elevation-gated 2026-06-05 17:00:54 -05:00
admin_test.go refactor(audit): pre-release cleanup pass 2026-05-18 16:28:07 -05:00
cascade.go feat(zddc): operator .zddc.zip mountable at any cascade level (migration phase 5) 2026-06-05 11:29:12 -05:00
cascade_test.go refactor(audit): pre-release cleanup pass 2026-05-18 16:28:07 -05:00
cascade_zip_test.go feat(zddc): operator .zddc.zip mountable at any cascade level (migration phase 5) 2026-06-05 11:29:12 -05:00
defaults.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
defaults_test.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
embedded_neutral_test.go fix(server): fail-close the reference Rego; stop claiming internal-decider parity 2026-06-09 19:30:09 -05:00
ensure.go docs: fix stale "fenced/private home" claims — default homes are shared 2026-06-09 19:57:13 -05:00
ensure_test.go test(zddc): update internal/zddc suite for flat-peer layout 2026-06-03 11:47:04 -05:00
field_codes.go fix(records): validate folder_fields at load time + cache field-code patterns 2026-05-21 15:28:35 -05:00
field_codes_test.go fix(records): validate folder_fields at load time + cache field-code patterns 2026-05-21 15:28:35 -05:00
file.go chore(server): drop the federal reference Rego (bring-your-own-policy) 2026-06-10 08:45:21 -05:00
file_test.go feat(server): local-only tool-HTML override; remove apps URL/version fetching 2026-06-04 08:59:28 -05:00
folder.go feat(zddc): MD→{docx,html,pdf} server-side conversion via stock pandoc + chromium containers 2026-05-13 10:33:56 -05:00
folder_test.go feat(zddc): add ParseTransmittalFolder + IsTrnOrSubTracking helpers 2026-05-07 09:14:19 -05:00
history_policy_test.go feat(server): edit-history versioning for working-folder markdown 2026-05-28 12:37:51 -05:00
inherit_test.go refactor(audit): pre-release cleanup pass 2026-05-18 16:28:07 -05:00
lookups.go feat(server): cascade-resolved display: labels for the canonical project peers 2026-06-05 17:48:46 -05:00
lookups_test.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
roles.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
roles_test.go feat: show effective permissions + roles per location in the browse hovercard 2026-06-01 11:12:39 -05:00
scan.go feat: lockstep release infra + cascade/.archive fixes + profile perf + page redesign 2026-05-01 20:11:38 -05:00
scan_test.go refactor(history): store under .zddc.d/history/; drop .history carve-out + dead .devshell 2026-06-02 13:48:41 -05:00
schema.go feat(zddc): .zddc JSON Schema (machine grammar) with structure/option tiers 2026-06-05 14:54:07 -05:00
schema_test.go feat(zddc): .zddc JSON Schema (machine grammar) with structure/option tiers 2026-06-05 14:54:07 -05:00
slots.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
special.go docs: fix stale "fenced/private home" claims — default homes are shared 2026-06-09 19:57:13 -05:00
special_test.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
standardroles_test.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
validate.go feat(server): add declarative views: cascade key + ViewAt resolver (schema) 2026-06-04 09:53:53 -05:00
validate_test.go feat(server): local-only tool-HTML override; remove apps URL/version fetching 2026-06-04 08:59:28 -05:00
virtualreceived.go refactor: nest lifecycle slots per-party + add virtual top-level aggregators 2026-05-21 07:57:45 -05:00
virtualviews.go feat(browse,tables): flat-peer clients + dual-mode cross-party aggregate 2026-06-03 12:35:31 -05:00
virtualviews_test.go feat(browse,tables): flat-peer clients + dual-mode cross-party aggregate 2026-06-03 12:35:31 -05:00
walker.go feat(server): route no-slash directory URLs through views.dir (cascade spine) 2026-06-04 10:01:31 -05:00
walker_test.go feat(zddc): Phase 2 — paths: walker, recursive cascade 2026-05-11 14:55:12 -05:00
worm.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
worm_test.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00
writer.go feat: form-data system v0 (sixth tool + zddc-server endpoints) 2026-05-02 20:12:16 -05:00
writer_test.go refactor(audit): pre-release cleanup pass 2026-05-18 16:28:07 -05:00
zddc.schema.json feat(zddc): .zddc JSON Schema (machine grammar) with structure/option tiers 2026-06-05 14:54:07 -05:00
zippolicy.go feat(zddc): embed default tree + assemble into cascade (migration phases 3-4) 2026-06-05 11:22:59 -05:00
zippolicy_test.go feat(zddc): retire defaults.zddc.yaml; .zddc.zip is the policy carrier (phase 6) 2026-06-05 11:35:21 -05:00