Repository navigation
docs: describe controls as closed by server-side evaluation decisions - #469
Conversation
A decision is now recorded by evaluating a published policy on the server with `kosli evaluate policy --control`, and the server refuses a decision from an inline policy. The tutorial still taught `kosli attest decision`, attaching evidence by hand, and requiring decisions through flow templates, all of which lead to trail compliance, the direction we are moving away from. The page now covers publishing a policy and recording a decision from it, states that a decision must be complete to close a control, and notes that multi-level evaluations are not supported yet. The decision screenshots are retaken from a decision recorded by evaluation. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
|
Claude finished @ToreMerkely's task in 2m 34s —— View job Follow-up review (commits 0285005..8b27b64)
Scope: only Result: the ergo No new bugs or regressions found in the changed lines. Full details posted as a summary comment. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
mbevc1
left a comment
mbevc1
left a comment
There was a problem hiding this comment.
Thanks, only minor comment about the screenshots, when zoomed in they are a bit blurry. Not a blocker
The screenshots were captured at 1x and blurred when zoomed in, so all four are retaken at 2x from the same 1920x1000 viewport while logged in. "Only a published policy can record a decision" read as if `kosli attest decision` no longer records decisions, which it still does. The rule applies to evaluations, so the sentence now says so. The page also lost its only pointer to Rego authoring, so it now links the Rego policy reference and says the trail input schema gives the same input as `kosli evaluate trail`. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up review (commits 28afb5d..47c2d1c)Scope: only the lines touched by the newest commit in
New inline comments: 0 — no bugs, security issues, or regressions found in the changed lines themselves. |
The reference described only `kosli evaluate trail` and `kosli evaluate trails`, which evaluate a policy in the CLI. Decisions against controls now come from policies published with `kosli publish rego-policy` and evaluated on the server with `kosli evaluate policy`, and that route has a different contract: any package name with an `allow` rule, outputs chosen by entrypoint annotations, multi-file bundles, a params schema checked at evaluation, a trail moment as input with `evaluation.time` as the only clock, and nondeterministic built-ins refused. The page now documents that contract first and keeps the CLI commands in a local evaluation section, with a table of how their input differs. The controls tutorial no longer claims the two inputs are the same, and the OPA tutorial links to the local sections it describes. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up review (commits 47c2d1c..82e7fb4)Scope:
New regression (blocks CI): the rewritten examples at lines 142, 282, and 319 now declare packages other than No other bugs, broken anchors, or regressions found in the changed lines — the updated |
The repo's example test reads every Rego block with a package as a file to create and requires `package policy` and an `allow` rule. The server accepts any package name, but `package policy` is valid on both routes, so the examples now declare it and also run with `kosli evaluate trail`. The params schema snippet becomes a complete policy for the same reason. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The safety rules and the example helper spoke of a trail being compliant, which reads as checking flow-template compliance, the direction we are moving away from. They now talk about a policy's requirements, the helper is renamed `requirements_met`, and the `is_compliant` field notes that a policy should check the attestations it requires instead. The params schema snippet no longer reads an attestation path that does not exist. See kosli-dev/server#7656 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add a policy step to the tutorial: an Ergo policy with a plain Rego alternative, tested with kosli evaluate policy --path, then published - Show control creation as Kosli app, CLI and API tabs - Explain evaluating several trails with repeated --context - Explain why only published policies record decisions (no pipeline tampering) - Put environment policies before asserting, move listing and archiving to a catalog section at the end, and hide the Coverage tab - Make the pipeline diagram readable in dark mode - Introduce Ergo and testing before publishing in the Rego reference Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Introduce controls, evidence, policies, decisions and environment policies before the sections that use them - Pin the Ergo download to rego-v0.2.0 and declare ergo_spec v0.2 - Replace the reference examples with one simple multi-trail check in Ergo and Rego, and drop the Snyk example - Say Ergo is open source, and that controls and policies are versioned separately - Open each tab with a sentence Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up review status (commits c0ca137..0285005)
No other regressions found in the lines touched by 1 new inline comment, blocking CI. |
Follow-up review (commits 0285005..8b27b64)Scope: only the lines changed by the newest commit,
New inline comments: 0 bugs/regressions found in the changed lines — it is a single, correct version bump and CI confirms it fixes the prior failure. |
Rewrite the Working with controls tutorial so a control's decision is recorded by evaluating a published policy on the server, not with
kosli attest decisionor flow templates. It states that a decision must be complete, notes that multi-level evaluations are not supported yet, and refreshes the decision screenshots.See https://github.com/kosli-dev/server/issues/7656
🤖 Generated with Claude Code