feat(validators): central registry + sync to Paramify#15
Open
21tmccauley wants to merge 1 commit into
Open
Conversation
Revamp how validators are stored, and add the path to push them to Paramify and associate them to evidence sets. Storage: validators are now first-class, deduplicated objects in a central validators/<category>/<key>.yaml registry (validator_schema.json), each owning its fetcher link via an evidence_sets list of reference_ids — a validator shared across fetchers is one file, never a copy. The dead, unused inline `validators` block is removed from fetcher_schema.json. Sync: uploaders/paramify_validators/ + `paramify validators sync` and `paramify upload --with-validators` (framework/api facade). Create-or-skip by default — a customer's tuned validator is never PATCHed unless --update; associates on create only; --dry-run previews with no writes. Per-instance Paramify ids live in a gitignored lock, not the shared registry. Seeded validators/aws/alb_encryption_in_transit.yaml as the first entry. 231 tests pass; ruff + mypy clean on new code. Incorporates fixes from a 3-agent review (duplicate-create-on-list-failure, association isolation, schema strictness, combined exit/JSON ok, crash guards). Importer (Paramify export -> registry files) is deferred to a separate PR. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Collaborator
Author
|
Need to test in a stage environment with real data before we merge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Revamps how validators are stored and builds the sync that pushes them to Paramify and wires them to evidence sets — the second half of the "when a user adds fetchers to their manifest, they can upload and associate these validators" story.
Storage model
validators/<category>/<key>.yamlregistry, validated by the newframework/schemas/validator_schema.json.evidence_sets: [<reference_id>, …]), mirroring Paramify's own model — a validator shared across fetchers is one file with multiple entries, never a copy.validatorsblock was removed fromfetcher_schema.json(no code parsed it; 0 fetchers used it).Sync (repo → Paramify)
uploaders/paramify_validators/syncer.py: client (POST/PATCH /validators,POST /evidence/{id}/associate) + reconcile engine.paramify validators sync [--manifest] [--update] [--dry-run]andparamify upload --with-validators.--update(these ship as ~80% templates customers tune). Associate on create only.--dry-runmakes no writes..paramify/lock — never in the shared registry.Not in this PR
Testing
test_validators_registry.py,test_validator_sync.py,test_validator_api.py); ruff + mypy clean on all new/changed files.GET /validatorsfailure (now fails closed), association-failure isolation, four schema-permissiveness gaps, combinedok/exit-code, and crash guards.tests/test_executor.pyandtests/test_redaction.pycarry pre-existing ruffI001warnings unrelated to this PR (untouched here).One behavior to confirm in review
upload --with-validatorsruns the sync even after a partially-failed upload (scoped to the sets the run produced). Documented indocs/validators_design.md— kept for now, with the conservative/precise alternatives noted.Full model + v0.6.0 API mapping:
docs/validators_design.md.🤖 Generated with Claude Code