docs(#1820): document test attestation input contract in AGENTS.md - #1821
docs(#1820): document test attestation input contract in AGENTS.md#1821fullsend-ai-coder[bot] wants to merge 1 commit into
Conversation
Add a subsection to the Architecture section documenting the Konflux test attestation input contract. Specifically: - All test-result attestations include predicate.configuration[0].name and predicate.timestamp (RFC 3339, nanosecond precision). - test_attestation.rego relies on these fields for deduplication (group by name, keep latest timestamp). Attestations without a valid timestamp are excluded by design, not a fail-open path. - A separate enforcement story provides a safety net if the attestation format changes. This helps review agents calibrate severity: missing-field edge cases in test_attestation are low-severity theoretical concerns, not high-severity vulnerabilities. Closes #1820
|
🤖 Finished Review · ✅ Success · Started 3:21 PM UTC · Completed 3:32 PM UTC Commit: |
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
ReviewFindingsMedium
Low
Labels: PR is a documentation-only change to AGENTS.md |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| architectural constraints that aren't derivable from the code. Check there before reverse-engineering | ||
| a subsystem. | ||
|
|
||
| **Test attestation input contract:** Konflux test-result attestations (evaluated by |
There was a problem hiding this comment.
[low] paragraph length / information density
The new 'Test attestation input contract' paragraph is approximately 10 lines, roughly 2x longer than the longest existing paragraph in the Architecture section (Collections at 5 lines). The surrounding paragraphs each convey a single concise architectural fact, while this one mixes the input contract description with deduplication behavior, threat-model rationale, and a reference to a separate enforcement story.
Suggested fix: Consider splitting into two paragraphs: one describing the input contract and deduplication behavior, and a second shorter note on severity calibration and the enforcement safety net.
fullsend-ai-review
Bot
added
requires-manual-review
1 participant
What:
Add a subsection to the Architecture section of AGENTS.md documenting the Konflux test attestation input contract — the field guarantees that
test_attestation.regodepends on for deduplication.Why:
The review agent rated a fail-open concern at high severity on PR #1817 because it had no way to know that Konflux test attestation predicates always include
configuration[0].nameand a validtimestamp. This documents the input contract so review agents can calibrate severity: missing-field edge cases in thetest_attestationpackage are low-severity theoretical concerns, not high-severity fail-open paths.The documentation covers three points:
predicate.configuration[0].name(test name) andpredicate.timestamp(RFC 3339 with nanosecond precision).test_attestationpackage relies on these fields for deduplication (grouping by name, selecting latest timestamp). Attestations without a valid timestamp are excluded by design.Complementary to PR #1773 (for #1772), which documents the dual test-result architecture and file-level change patterns.
Tickets:
Closes #1820
Post-script verification
agent/1820-doc-test-attestation-contract)ebd3fbd270297c15f590f4023360465ffb41d4fe..HEAD)