Repository navigation
core: record handler and provider provenance in plans and results - #342
Conversation
Plans, execution results and plan exports record which module (and
version) provided each step handler and each provider.
- Plan: Steps[].Source / OnFailureSteps[].Source (planning-time view),
ProviderSources (alias -> source).
- Execution result: Steps[].Source / OnFailure.Steps[].Source for the
handler that actually ran ($null if the handler did not run),
ProviderSources.
- Plan export: steps[].source and plan.providers; schemaVersion 1.1.
- Source = @{ Module; Version }; Module/Version are $null for handlers
or providers without a module and for handlers not resolvable at
planning time. Planning never fails because of provenance; registry
validation stays at execution time.
- Providers are Providers entries exposing GetCapabilities(); their
module is the module defining that method.
- FirstParty is intentionally not recorded: it is no integrity proof,
and first-party detection is only needed for enforcement (#322).
Also make two tests locale-independent (assert exception type/ErrorId
instead of localized PowerShell messages).
Closes #323
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Verdict: PASS Provenance is recorded without breaking planning, the execution and export contracts are consistent, and tests and docs cover the change. No CRITICAL, MAJOR or MINOR findings. |
Code Coverage Report
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 903e4e16f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return $sources | ||
| } | ||
|
|
||
| $entries = @{} |
There was a problem hiding this comment.
If a host supplies a case-sensitive IDictionary with aliases that differ only by case, this @{} scratch map (and the ordered map above) merges them because PowerShell hashtable literals are case-insensitive (PowerShell case-sensitivity docs). ProviderSources can then omit an alias or report the wrong provider's module and version, making the audit provenance diverge from the providers available at execution; preserve keys in a case-sensitive representation throughout.
Useful? React with 👍 / 👎.
Summary
Plans, execution results and plan exports now record which module and version provided each step handler and each provider.
Motivation
#323: For IAM audits ("which code disabled this account?") and troubleshooting, plans and results had no information about which code ran. This matters more now that extension step packs (#292) and providers are mixed with first-party modules.
Type of Change
Changes
Source = @{ Module; Version }.ModuleandVersionare$nullfor host functions and provider objects without a module, and for handlers that cannot be resolved at planning time.Steps[].SourceandOnFailureSteps[].Source: the handler expected at planning time.ProviderSources: map from provider alias to source.StepRegistryvalidation stays at execution time, as before.Steps[].SourceandOnFailure.Steps[].Source: the handler that actually ran.Sourceis$nullfor steps whose handler did not run (NotApplicable,Blocked,PreconditionSkipped).ProviderSources.Providersentries that exposeGetCapabilities()are listed. A provider's module is the module that defines that method.steps[].sourceandplan.providers[].schemaVersiongoes from 1.0 to 1.1. The spec classifies additive changes as MINOR.FirstPartyintentionally not recorded (deviation from the issue):IdLE.for first-party, require{Owner}.IdLE.*for extensions #322.Testing
New file
tests/Core/Provenance.Tests.ps1(7 tests) covers:The expected export fixture is updated.
Local full suite: 904 passed, 0 failed. PSScriptAnalyzer: 0 errors; the 17 warnings are the same as on
main. The step reference is unchanged.How to test & review
pwsh -NoProfile -File ./tools/Invoke-IdlePesterTests.ps1source.versionchanges exports on every release. The spec deliberately omitsengine.versionfor stable exports, but Record handler and provider provenance in plans and execution results #323 asks for exactly this information for audits.Checklist
Related Issues
Related: #322 (needs its own first-party detection, for example using the same logic as the mixed-version guard in
IdLE.Init.ps1).Closes #323
🤖 Generated with Claude Code