ahmido/TenantAtlas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity
9374260ae1
TenantAtlas/specs/431-exchange-powershell-invocation-operation-registration-gate/checklists/requirements.md
ahmido 9374260ae1 feat: add Exchange PowerShell invocation gate (#498) 
## Summary
- Adds the Spec 431 Exchange PowerShell invocation gate and operation registration slice.
- Introduces trusted provider operation start handling and read-only Exchange PowerShell runner abstractions.
- Updates provider capability/readiness evaluation and coverage for Exchange PowerShell invocation safety.

## Verification
- `cd apps/platform && ./vendor/bin/sail artisan test tests/Feature/Providers/ProviderCapabilityEvaluationTest.php tests/Feature/Providers/ProviderOperationCapabilityGateTest.php tests/Feature/TenantConfiguration/Spec431ExchangePowerShellInvocationGateTest.php tests/Unit/Providers/ProviderCapabilityRegistryTest.php tests/Unit/Providers/ProviderOperationStartGateTest.php tests/Unit/Support/TenantConfiguration/Spec430ExchangePowerShellCommandAllowlistTest.php tests/Unit/Support/TenantConfiguration/Spec431ExchangePowerShellOperationRegistrationTest.php tests/Unit/Verification/ManagedEnvironmentPermissionCapabilityMappingTest.php`
- Result: 80 passed, 685 assertions.

## Product Surface / Ops
- Rendered UI surface changed: N/A.
- Filament/Livewire surface changed: N/A.
- Deployment impact: config/runtime service changes only; no migrations, queues, or assets added.

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #498
2026-07-07 15:23:29 +00:00

182 lines
5.7 KiB
Markdown
Raw Blame History

# Requirements Checklist: Exchange PowerShell Invocation Operation Registration and Execution Gate
**Purpose**: Validate Spec 431 preparation and later implementation against operation registration, invocation safety, no-promotion, and no-surface requirements.
**Created**: 2026-07-05
**Feature**: `specs/431-exchange-powershell-invocation-operation-registration-gate/spec.md`
## Applicability And Low-Impact Gate
- [x] CHK001 The change explicitly says no rendered UI surface is affected.
- [x] CHK002 The spec, plan, and tasks carry the same no-UI/no-product-surface decision.
- [x] CHK029 The spec includes exactly one coherent UI Surface Impact decision: `No UI surface impact`.
- [x] CHK037 Browser proof is `N/A - no rendered UI surface changed`.
- [x] CHK038 Human Product Sanity is N/A because no product surface changes.
- [x] CHK040 Completed historical specs were not rewritten or stripped of implementation history.
## Spec Package
- [x] `spec.md` exists.
- [x] `plan.md` exists.
- [x] `tasks.md` exists.
- [x] `checklists/requirements.md` exists.
- [x] `implementation-report.md` exists and records implementation validation.
## Scope
- [x] Only `transportRule`.
- [x] Only `remoteDomain`.
- [x] Only `inboundConnector`.
- [x] Only `Get-TransportRule`.
- [x] Only `Get-RemoteDomain`.
- [x] Only `Get-InboundConnector`.
- [x] No Teams.
- [x] No Exchange Admin API.
- [x] No live provider execution.
- [x] No evidence.
- [x] No compare/render.
- [x] No certification.
- [x] No restore.
- [x] No customer claim.
- [x] No UI.
- [x] No migration.
## Proportionality
- [x] New operation type justified.
- [x] New catalog entry justified.
- [x] New provider operation justified.
- [x] New capability justified.
- [x] New runner interface justified.
- [x] No mini-platform planned.
- [x] No new persisted status framework planned.
## Operation Registration
- [x] OperationRunType registered.
- [x] OperationCatalog registered.
- [x] ProviderOperationRegistry registered.
- [x] ProviderCapabilityRegistry registered.
- [x] OperationRunCapabilityResolver mapping exists.
- [x] Tests prove all mappings.
## Summary Counts
- [x] Existing allowed keys reused or new keys explicitly added.
- [x] SummaryCountsNormalizer preserves emitted keys.
- [x] Unknown keys remain dropped.
- [x] No raw output in summary counts.
- [x] No secrets in summary counts.
## Failure Sanitization
- [x] Invocation blocker reasons sanitized.
- [x] Invocation failure reasons sanitized.
- [x] Unknown failures sanitized.
- [x] Secret-like values redacted.
- [x] Raw stderr/stdout not persisted.
## Invocation Gate
- [x] Verified contract required.
- [x] Allowlisted command required.
- [x] OperationRun required before fake runner execution.
- [x] Provider scope required.
- [x] Capability required.
- [x] Actor capability is `Capabilities::PROVIDER_RUN` or a spec amendment documents a narrower dedicated capability.
- [x] Feature gate `tenantpilot.features.exchange_powershell_invocation` required and default disabled.
- [x] Provider identity/credential reference required or fake-runner-only mode documented.
- [x] Bypass calls rejected.
## Runner Safety
- [x] Structured runner interface.
- [x] Fake runner.
- [x] Production runner disabled/inert.
- [x] Raw command strings rejected.
- [x] Mutation commands rejected.
- [x] Unknown parameters rejected.
- [x] No shell execution in unit tests.
- [x] No Microsoft service calls in tests.
## OperationRun Safety
- [x] OperationRun created before fake invocation.
- [x] Status transitions owned by `OperationRunService`.
- [x] Numeric/safe summary counts only.
- [x] Safe failure category only.
- [x] `provider_connection_id` only in safe context.
- [x] No `provider_connection_id` migration.
- [x] No raw stdout/stderr.
- [x] No raw provider payload.
- [x] No secrets.
## Credential / Provider Scope
- [x] Provider connection scoped to workspace/environment.
- [x] Credential reference source is existing `ProviderIdentityResolver` / `ProviderConnection::credential` / `ProviderCredential` truth, not a new persistence path.
- [x] Missing credential reference blocks.
- [x] Unsupported credential kind blocks.
- [x] Missing permission evidence blocks or stays unvalidated.
- [x] Username/password blocked.
- [x] No plaintext secret fields.
- [x] Capability checks enforced.
## Shape Validation
- [x] Structured collection accepted.
- [x] Empty collection distinguished from permission failure.
- [x] Malformed result blocks.
- [x] Missing identity fields block or fail safe.
- [x] Text/scalar output fails safe.
## No Promotion
- [x] No evidence rows.
- [x] No raw evidence payload.
- [x] No normalized evidence payload.
- [x] No content-backed state.
- [x] No comparable state.
- [x] No renderable state.
- [x] No certified state.
- [x] No restore-ready state.
- [x] No customer-ready state.
## Product Surface
- [x] No routes planned.
- [x] No Filament pages planned.
- [x] No Livewire components planned.
- [x] No navigation planned.
- [x] No global search changes planned.
- [x] No asset changes planned.
- [x] Browser N/A.
## Architecture
- [x] Uses OperationRun architecture.
- [x] Uses provider operation/capability architecture.
- [x] Uses Coverage v2 source contract architecture.
- [x] No `tenant_id`.
- [x] No Exchange mini-platform.
- [x] No legacy shim.
- [x] No fallback reader.
## Validation
- [x] Focused unit tests pass.
- [x] Focused feature tests pass.
- [x] Regressions pass.
- [x] Pint passes.
- [x] `git diff --check` passes.
- [x] `git status --short` documented.
## Review Outcome
- [x] Review outcome class: implementation gate passed for backend-only slice.
- [x] Workflow outcome: keep.
- [x] Final note location: `implementation-report.md`.
## Final Candidate Gate
PASS for implementation. Runtime checklist items are checked against the implementation report and validation runs.
Reference in New Issue View Git Blame Copy Permalink