Skip to content

fix(supervisor-network): bound OPA policy load diagnostics #3369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johntmyers merged 2 commits into from
Sep 17, 2026
+820 −96
Merged

fix(supervisor-network): bound OPA policy load diagnostics #3369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e5f606f
fix(supervisor-network): bound OPA policy load diagnostics
shiju-nv Sep 16, 2026
33bd9c9
chore(supervisor-network): reconcile bounded diagnostics with main
shiju-nv Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions architecture/security-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,9 +89,7 @@ proxy.
| `foo.**.example.com` | No | — | Recursive wildcard outside the first label is not allowed. |
| `foo**.example.com` | No | — | Recursive `**` mixed inside a label; allowed only as the entire first label. |

Validation rejects the disallowed patterns at policy load time with a message
that names the offending host. Exact hosts and IP addresses do not use this
path.
Validation rejects the disallowed patterns at policy load time. OPA load errors omit the supplied hostname. Exact hosts and IP addresses do not use this wildcard-validation path.

## TLS and L7 Inspection

Expand Down Expand Up @@ -201,6 +199,14 @@ configure the separately isolated supervisor. When a supervisor override is
combined with injected provider credentials, the supervisor emits a
high-severity detection finding at startup naming the inactive controls.

## Policy Load Diagnostics

`OpaEngine` bounds the error messages returned when loading or reloading policy from files, strings, or protobuf. Each message contains at most eight error items and 512 UTF-8 bytes, including its heading, separators, and any `additional violations omitted` marker. The loader reports complete, fixed categories and discards authored names, values, paths, source snippets, and nested error chains.

Typed validation categories distinguish process identity, filesystem paths and limits, Landlock compatibility, endpoint hosts and ports, credential signing and rewriting, MCP configuration, and middleware configuration. Opaque L7 errors identify the protocol-configuration or policy-validation stage; endpoint conflicts report ambiguous selectors. YAML errors retain a fixed parser category and numeric line and column when available. File I/O, Rego loading, and internal policy-data errors use fixed messages.

A candidate rejected during validation does not replace the active engine or advance its generation. The supervisor separately applies `policy_validation_failure_mode` and may publish a quarantine generation as described below. The diagnostic bounds cover returned OPA load errors; accepted-policy warnings, runtime request diagnostics, and gateway-authored policy parser messages have separate reporting contracts.

## Live Updates

The gateway stores sandbox-authored policy revisions separately from derived
Expand Down
Loading
Loading