Documentation
¶
Overview ¶
Package action gates proposed remediations against the autonomy-ladder policy (config.actions: off | suggest | approve | auto). The gate is server-authoritative: reversibility and blast radius are derived from the operation (deriveSafety), not trusted from model-authored fields, and executable targets are checked against a namespace allowlist with a built-in protected-namespace deny. suggest surfaces proposals only; approve executes after an authenticated human approval; auto executes reversible, in-envelope actions unattended (rate-limited, kill-switchable, audited). The gate is the load-bearing safety logic for every rung above read-only.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoPending = errors.New("no pending action")
ErrNoPending is returned when an approval id is unknown, already consumed, or expired.
Functions ¶
Types ¶
type Approvals ¶
type Approvals struct {
// contains filtered or unexported fields
}
Approvals queues actions proposed under "approve" mode until a human approves (then it executes via the Executor) or rejects them. In-memory, held on the leader; entries expire after a TTL.
func NewApprovals ¶
NewApprovals builds an approval queue. A nil auditor falls back to a no-op.
func (*Approvals) Approve ¶
Approve executes the pending action after re-checking the envelope. The entry is CLAIMED (removed) under the same lock that reads it, so two concurrent approvals of the same id cannot both execute (TOCTOU double-execute). actor identifies the approver for the audit trail. Errors if the id is unknown/expired, the action is now out of policy, or execution fails.
type Auto ¶
type Auto struct {
// contains filtered or unexported fields
}
Auto executes remediations without human approval (mode "auto"), under layered safety controls: it only ever runs REVERSIBLE actions, requires a minimum investigation confidence, is rate-limited, can be paused instantly (kill-switch), supports dry-run, and audits every decision. Anything failing a gate is surfaced (annotated), never executed.
func NewAuto ¶
func NewAuto(exec Executor, p config.AutoPolicy, policy *Policy, aud audit.Auditor, log *slog.Logger) *Auto
NewAuto builds the auto executor from the policy (window defaults to 1h). policy is the action envelope, re-checked at the exec boundary (defense in depth). A nil auditor falls back to a no-op. The returned Auto starts with the kill-switch ENGAGED (paused) — fail closed by construction, so a process/leader restart can never resume unattended execution on its own; an operator must Resume() it.
func (*Auto) Pause ¶
func (a *Auto) Pause()
Pause engages the kill-switch: all auto-execution halts until Resume.
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy evaluates proposed actions against the configured envelope.
func (*Policy) Mode ¶
func (p *Policy) Mode() config.ActionMode
Mode returns the configured action mode.
Source Files