the v11 examples run as a runtime-e2e leg (replace the D5 skip-runtime-e2e hatch) #260

Activity

1. saurabhjain1592 commented on Sep 13, 2026

   

   saurabhjain1592

   on Sep 13, 2026

   MemberAuthor

   More actions

   D4 wording (W3-Q, Java D4 R3 round 1; ruled by master)

   Measured on sdk-python main 537423270.

   1. "Which ships with the v11 series." axonflow/client.py:2927 and :8774 name a typed simulate on /api/v1/typed-policies that ships with the v11 series; no such route exists on enterprise main (6edf47aaf). Drop the clause and point at the typed policy methods.
   2. What the deprecated simulation methods answer on v11. No "keep working" text was found here. Where the notes describe it, the wording ruled for all four SDKs is: "keeps answering until v11.1; on a v11.0.0 platform its result comes from the legacy engine, which no longer decides, so it does not predict what the platform enforces." Evidence: enterprise platform/orchestrator/policy_simulation_handler.go (~:140-175 at 6edf47aaf) calls h.engine.EvaluateDynamicPolicies, and PRD v11 §1 items 2 and 10 (technical-docs/product/PRD_V11_POLICY_DECISION_PLANE.md:14 and :22) say the old verdict engines author no verdict in v11 and the legacy simulate endpoints are removed.

   Route deprecation is recorded per id, not per route (measured)

   _warn_if_route_deprecated keys the record on f"{method} {path.split('?', 1)[0]}" with the concrete path (axonflow/client.py:371), so a stamped route with a path parameter is reported once per id. The Java SDK's D4 keys on the route template (each id-bearing call tags its request with the template; a test with two ids asserts one report).

   The Community-credentials paragraph (measured: not carried here)

   The Java D5 review found a paragraph copied from Go ("Decide names the client id as the caller's organization... on Community leave both unset") that is wrong for Java, whose Decide sends the request as built. This repository's examples do not carry it: examples/pep_handshake.py:23/:80 and examples/typed_policies.py:13 default AXONFLOW_CLIENT_ID to community. Nothing to change for this item.

   Refs getaxonflow/axonflow-enterprise#3746
2. saurabhjain1592 commented on Sep 13, 2026

   

   saurabhjain1592

   on Sep 13, 2026

   Last edited by saurabhjain1592

   MemberAuthor

   More actions

   Docs row for this follow-up, ruled on getaxonflow/axonflow-enterprise#3746: from platform v11.0.0, a Community deployment CAN refuse a declaring caller, and two sentences here say it cannot.

   • axonflow/pep_handshake.py:13-14 at 537423270: "A Community deployment records the declaration and does not deny on it."
   • runtime-e2e/pep_handshake_planes/README.md:23 at 537423270: "On Community, the declaration is recorded and does not deny."

   What the platform does (enterprise 857455033):

   • decide passes the admitted declaration's profile into the enforcing seam (platform/agent/decision_handler.go:1304).
   • The seam refuses with unsupported_obligation when that profile cannot discharge a mandatory obligation (platform/agent/decision_enforcing_seam.go:1042-1046).
   • The Community build passes that refusal through unchanged (platform/agent/pep_handshake_anchored_community.go:10-16).
   • Only the capability refusal on an allow, where an allow carrying a mandatory obligation outside the declared set becomes a deny, is Enterprise-only.

   Measured live: the Rust SDK's runtime-e2e/pep_handshake_planes leg, refusal phase, on a Community stack running on the app database role, built from enterprise 857455033 (agent image sha256:0b9e3c407e4713191965de236a3ce39f9624b93b0351c52884e85b99ff82d266), SDK commit 992ef8edd. An organization pii=redact detection override was recorded for local-dev-org. Under it, a decide from a client declaring ONLY field_mask@1 was answered verdict: deny, reasons: ["unsupported_obligation"] (decision a74f7483-772c-4187-9165-665aa048f4d7). A client declaring nothing got the same (fd4986ef-005e-43fe-bd65-c23240ea1207), and a client declaring field_redact@1 was allowed with redact_pii (ce23fee9-a370-4351-a58e-ec9bd2b43b38).

   Suggested wording (the Rust SDK's, from getaxonflow/axonflow-sdk-rust#99): "From platform v11.0.0, on every edition, decide refuses with unsupported_obligation a mandatory obligation the enforcement point cannot discharge, judged against the declared capabilities: an organization's redact override is the shipped case. On Enterprise, in addition, any allow carrying a mandatory obligation outside the declared set becomes a deny."

   Correction (2026-09-13): the refusal measured above is the engine's own, not the seam's: composeSet (platform/decision/contract/obligation.go:1148 at 857455033, no build tag, unchanged on main d61b876df) refuses any mandatory obligation the admitted profile cannot discharge (if !in.PEP.Supports(o), :1237) with the bare code unsupported_obligation, which is what decision a74f7483-772c-4187-9165-665aa048f4d7 carried; the validator path (attachValidatorRedactions, cited above) refuses the same way but writes "unsupported_obligation: <detail>". What is Enterprise-only is three handler-level refusals: applyPEPCapabilityRefusal, applyAnchoredCapabilityRefusal and applyMCPRedactionRefusal. So the sentence to carry is "on every edition the engine refuses a caller whose declaration cannot discharge a mandatory obligation", not that the seam or the validator path refuses.
3. saurabhjain1592

   closed this as completedin #264on Sep 14, 2026