Repository navigation
docs: describe controls as closed by server-side evaluation decisions - #469
ToreMerkely wants to merge 5 commits into
Conversation
A decision is now recorded by evaluating a published policy on the server with `kosli evaluate policy --control`, and the server refuses a decision from an inline policy. The tutorial still taught `kosli attest decision`, attaching evidence by hand, and requiring decisions through flow templates, all of which lead to trail compliance, the direction we are moving away from. The page now covers publishing a policy and recording a decision from it, states that a decision must be complete to close a control, and notes that multi-level evaluations are not supported yet. The decision screenshots are retaken from a decision recorded by evaluation. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
|
Claude finished @ToreMerkely's task in 1m 30s —— View job Follow-up review (commits 26e8d83..54bf416)Scope:
New inline comments: 0. The rename ( No bugs, broken links, or regressions found in the changed lines. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
mbevc1
left a comment
mbevc1
left a comment
There was a problem hiding this comment.
Thanks, only minor comment about the screenshots, when zoomed in they are a bit blurry. Not a blocker
The screenshots were captured at 1x and blurred when zoomed in, so all four are retaken at 2x from the same 1920x1000 viewport while logged in. "Only a published policy can record a decision" read as if `kosli attest decision` no longer records decisions, which it still does. The rule applies to evaluations, so the sentence now says so. The page also lost its only pointer to Rego authoring, so it now links the Rego policy reference and says the trail input schema gives the same input as `kosli evaluate trail`. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up review (commits 28afb5d..47c2d1c)Scope: only the lines touched by the newest commit in
New inline comments: 0 — no bugs, security issues, or regressions found in the changed lines themselves. |
The reference described only `kosli evaluate trail` and `kosli evaluate trails`, which evaluate a policy in the CLI. Decisions against controls now come from policies published with `kosli publish rego-policy` and evaluated on the server with `kosli evaluate policy`, and that route has a different contract: any package name with an `allow` rule, outputs chosen by entrypoint annotations, multi-file bundles, a params schema checked at evaluation, a trail moment as input with `evaluation.time` as the only clock, and nondeterministic built-ins refused. The page now documents that contract first and keeps the CLI commands in a local evaluation section, with a table of how their input differs. The controls tutorial no longer claims the two inputs are the same, and the OPA tutorial links to the local sections it describes. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up review (commits 47c2d1c..82e7fb4)Scope:
New regression (blocks CI): the rewritten examples at lines 142, 282, and 319 now declare packages other than No other bugs, broken anchors, or regressions found in the changed lines — the updated |
The repo's example test reads every Rego block with a package as a file to create and requires `package policy` and an `allow` rule. The server accepts any package name, but `package policy` is valid on both routes, so the examples now declare it and also run with `kosli evaluate trail`. The params schema snippet becomes a complete policy for the same reason. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The safety rules and the example helper spoke of a trail being compliant, which reads as checking flow-template compliance, the direction we are moving away from. They now talk about a policy's requirements, the helper is renamed `requirements_met`, and the `is_compliant` field notes that a policy should check the attestations it requires instead. The params schema snippet no longer reads an attestation path that does not exist. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rewrite the Working with controls tutorial so a control's decision is recorded by evaluating a published policy on the server, not with
kosli attest decisionor flow templates. It states that a decision must be complete, notes that multi-level evaluations are not supported yet, and refreshes the decision screenshots.See https://github.com/kosli-dev/server/issues/7656
🤖 Generated with Claude Code