feat(identity): policy-bundle endpoint so contract travels with ChittyID#197
feat(identity): policy-bundle endpoint so contract travels with ChittyID#197chitcommit wants to merge 1 commit into
Conversation
Closes the cross-channel enforcement gap. Local hooks at ~/.claude/hooks/ only fire on the VM — Desktop, Mobile, web, ChatGPT have no local hook layer, so the System-Wide Sensitive Intent Contract is structurally invisible to them today. New: GET /api/v1/identity/:chittyId/policy-bundle (and /check) returns the vendored canon bundle (contract, policy, conformance, integration map, drift framework) with ETag/304 support. Public read — bundle is non-secret governance and must be reachable by any channel binding to a ChittyID on session start. - policy-bundle/v1/: vendored canon (.md, .json, .yaml) + compiled bundle.json with sha256 of file contents - scripts/build-policy-bundle.mjs: regenerates bundle.json from canon - src/api/routes/identity.js: ChittyID-validated route (P/L/T/E/A) - src/api/middleware/auth.js: path-specific public bypass for the policy-bundle GET endpoints - 6 real tests (no mocks): hit the Hono router with the real bundle Follow-up (out of scope for this PR): - entity-specific policy overlays keyed by ChittyID - desktop/mobile/web client wiring to fetch on session start - gateway-level enforcement middleware for thin clients Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
chittyconnect | f044774 | May 22 2026, 03:51 PM |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| @@ -0,0 +1,35 @@ | |||
| #!/usr/bin/env node | |||
| // Build policy-bundle/v1/bundle.json from vendored canon files. | |||
| import { readFileSync, writeFileSync, readdirSync } from "node:fs"; | |||
📝 WalkthroughWalkthroughThis PR introduces a complete policy bundle delivery system for managing sensitive-intent governance across product surfaces. It includes versioned contract documents, JSON policy configurations, conformance test specifications, integration maps defining enforcement points, and a build/delivery pipeline comprising a CLI bundle builder, npm wiring, API routes, public authentication handling, and comprehensive tests. ChangesPolicy Bundle Delivery System
Sequence DiagramsequenceDiagram
participant Client
participant Router
participant AuthMiddleware
participant IdentityRoutes
participant Cache
Client->>Router: GET /api/v1/identity/:chittyId/policy-bundle
Router->>AuthMiddleware: Check isPolicyBundlePath
AuthMiddleware->>AuthMiddleware: Set public apiKey context
AuthMiddleware->>IdentityRoutes: next()
IdentityRoutes->>IdentityRoutes: Validate chittyId against regex
IdentityRoutes->>Cache: Check If-None-Match vs ETag
alt ETag matches
IdentityRoutes->>Client: 304 Not Modified
else No ETag match
IdentityRoutes->>Client: 200 with bundle payload + ETag
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
policy-bundle/v1/system-wide-integration-map-v1.yaml (1)
3-6: ⚡ Quick winReplace machine-specific absolute artifact paths with portable identifiers.
Lines 3-6 hardcode
/home/ubuntu/..., which makes the integration map host-dependent and less channel-agnostic. Use bundle-relative names (or a neutral URI scheme) so clients across environments can consume it consistently.Suggested diff
contract: - policy_doc: /home/ubuntu/.ch1tty/canon/system-wide-sensitive-intent-contract-v1.md - policy_json: /home/ubuntu/.ch1tty/canon/system-wide-sensitive-intent-policy-v1.json - conformance: /home/ubuntu/.ch1tty/canon/system-wide-conformance-tests-v1.md - drift_remediation: /home/ubuntu/.ch1tty/canon/system-wide-drift-remediation-framework-v1.md + policy_doc: system-wide-sensitive-intent-contract-v1.md + policy_json: system-wide-sensitive-intent-policy-v1.json + conformance: system-wide-conformance-tests-v1.md + drift_remediation: system-wide-drift-remediation-framework-v1.md🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@policy-bundle/v1/system-wide-integration-map-v1.yaml` around lines 3 - 6, The policy integration map currently uses machine-specific absolute paths for keys policy_doc, policy_json, conformance, and drift_remediation; change these values to portable bundle-relative identifiers or a neutral URI scheme (e.g., ./canon/system-wide-sensitive-intent-contract-v1.md or bundle://canon/system-wide-sensitive-intent-policy-v1.json) so the map is host-agnostic and consumable across environments—update the four entries (policy_doc, policy_json, conformance, drift_remediation) accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@policy-bundle/v1/system-wide-integration-map-v1.yaml`:
- Around line 3-6: The policy integration map currently uses machine-specific
absolute paths for keys policy_doc, policy_json, conformance, and
drift_remediation; change these values to portable bundle-relative identifiers
or a neutral URI scheme (e.g.,
./canon/system-wide-sensitive-intent-contract-v1.md or
bundle://canon/system-wide-sensitive-intent-policy-v1.json) so the map is
host-agnostic and consumable across environments—update the four entries
(policy_doc, policy_json, conformance, drift_remediation) accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f68aeaf3-7ce6-4e0e-a6c8-62d95cf9b581
📒 Files selected for processing (12)
package.jsonpolicy-bundle/v1/bundle.jsonpolicy-bundle/v1/system-wide-conformance-tests-v1.mdpolicy-bundle/v1/system-wide-drift-remediation-framework-v1.mdpolicy-bundle/v1/system-wide-integration-map-v1.yamlpolicy-bundle/v1/system-wide-sensitive-intent-contract-v1.mdpolicy-bundle/v1/system-wide-sensitive-intent-policy-v1.jsonscripts/build-policy-bundle.mjssrc/api/middleware/auth.jssrc/api/router.jssrc/api/routes/identity.jstests/api/identity-routes.test.js
There was a problem hiding this comment.
Pull request overview
Adds a public, identity-bound “policy bundle” API so clients across channels can fetch a canonical System-Wide Sensitive Intent governance bundle (with ETag/sha) keyed by ChittyID.
Changes:
- Adds
GET /api/v1/identity/:chittyId/policy-bundleand/checkroutes with ChittyID validation and ETag-based caching. - Vendors the v1 governance bundle source files + committed
bundle.json, plus a build script (npm run policy-bundle:build) to regenerate it. - Introduces an auth-middleware bypass for the new public endpoints and adds route-level tests.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/api/identity-routes.test.js | Adds Vitest coverage for the identity policy-bundle routes (status, ETag/304, validation, check endpoint). |
| src/api/routes/identity.js | Implements the new identity policy-bundle endpoints with regex validation and cache headers/ETag handling. |
| src/api/router.js | Mounts the new identity routes under /api/v1/identity. |
| src/api/middleware/auth.js | Adds a path-based public bypass for the new policy-bundle endpoints. |
| scripts/build-policy-bundle.mjs | Adds a bundle builder that compiles vendored canon files into policy-bundle/v1/bundle.json and computes sha256. |
| policy-bundle/v1/system-wide-sensitive-intent-policy-v1.json | Adds the v1 sensitive intent policy JSON. |
| policy-bundle/v1/system-wide-sensitive-intent-contract-v1.md | Adds the v1 sensitive intent contract document. |
| policy-bundle/v1/system-wide-integration-map-v1.yaml | Adds the v1 integration surface map. |
| policy-bundle/v1/system-wide-drift-remediation-framework-v1.md | Adds the v1 drift remediation framework document. |
| policy-bundle/v1/system-wide-conformance-tests-v1.md | Adds the v1 conformance test definitions. |
| policy-bundle/v1/bundle.json | Adds the generated v1 bundle artifact including file contents and sha256. |
| package.json | Adds policy-bundle:build script. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| version: bundle.version, | ||
| scope: bundle.scope, | ||
| sha256: bundle.sha256, | ||
| generated_at: bundle.generated_at, | ||
| bundle: bundle.files, |
| if (isPolicyBundlePath(c)) { | ||
| c.set("apiKey", { type: "public", service: "policy-bundle", status: "active" }); | ||
| await next(); | ||
| return; | ||
| } |
| @@ -0,0 +1,35 @@ | |||
| #!/usr/bin/env node | |||
| // Build policy-bundle/v1/bundle.json from vendored canon files. | |||
| import { readFileSync, writeFileSync, readdirSync } from "node:fs"; | |||
| policy_doc: /home/ubuntu/.ch1tty/canon/system-wide-sensitive-intent-contract-v1.md | ||
| policy_json: /home/ubuntu/.ch1tty/canon/system-wide-sensitive-intent-policy-v1.json | ||
| conformance: /home/ubuntu/.ch1tty/canon/system-wide-conformance-tests-v1.md | ||
| drift_remediation: /home/ubuntu/.ch1tty/canon/system-wide-drift-remediation-framework-v1.md |
| api.route("/api/v1/tenants/migration", migrationRoutes); | ||
| api.route("/api/v1/tenants", tenantRoutes); | ||
| api.route("/api/v1/sessions", sessionRoutes); | ||
| api.route("/api/v1/identity", identityRoutes); |
| api.route("/api/v1/tenants/migration", migrationRoutes); | ||
| api.route("/api/v1/tenants", tenantRoutes); | ||
| api.route("/api/v1/sessions", sessionRoutes); | ||
| api.route("/api/v1/identity", identityRoutes); |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f044774a99
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const identityRoutes = new Hono(); | ||
|
|
||
| // ChittyID format: VV-G-LLL-SSSS-T-YM-C-X where T ∈ {P,L,T,E,A} | ||
| const CHITTYID_RE = /^\d{2}-\d-[A-Z]{3}-\d{4}-[PLTEA]-\d{4}-\d-\d{1,3}$/; |
There was a problem hiding this comment.
The new CHITTYID_RE rejects canonical IDs that contain letters in the SSSS or final X segments (it requires \d{4} and \d{1,3}), so /api/v1/identity/:chittyId/policy-bundle* returns 400 INVALID_CHITTYID for valid identities such as those produced by generateLocalChittyId() (src/intelligence/experience-anchor.js, which emits base36/alpha characters and is tested by tests/intelligence/experience-anchor.test.js). This makes the policy-bundle endpoint unusable for a non-trivial portion of real ChittyIDs.
Useful? React with 👍 / 👎.
| */ | ||
|
|
||
| import { Hono } from "hono"; | ||
| import bundle from "../../../policy-bundle/v1/bundle.json"; |
There was a problem hiding this comment.
identityRoutes now has a hard runtime import of ../../../policy-bundle/v1/bundle.json, but package.json still uses a restrictive files allowlist that does not include policy-bundle/** (confirmed by npm pack --dry-run, which omits that directory). In npm-installed environments this causes module resolution failure when the router is loaded, so the service can fail to start before handling any request.
Useful? React with 👍 / 👎.
Summary
Closes the cross-channel enforcement gap for the System-Wide Sensitive Intent Contract. Local hooks (~/.claude/hooks/) only fire on this VM — Desktop, Mobile, web, ChatGPT have no local hook layer.
New endpoint binds policy to the entity, not the channel:
Public read (no auth) — bundle is non-secret governance and must be reachable by any channel on session start. ChittyID is validated against the canonical P/L/T/E/A regex.
Implementation
Test plan
Follow-ups (deliberately not in scope)
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores