eric/audita
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Document verified prototype overlay behavior

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-24 00:24:19 +00:00
parent 7b809878d6
commit 590604bf38
5 changed files with 64 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
docs/roadmap/library-boundary-findings.md
View File

@@ -102,7 +102,7 @@ Selected for the prototype and recommended for production:
Repeated modules retain their existing ordered meaning.
- The original prototype disabled ConfigKit imports, selected configuration layers
(then called configuration profiles), and secret-directory bootstrap. Selected
overlays are now planned under the linked overlay decision; the other two
overlays are now verified under the linked overlay decision; the other two
features remain disabled. PromptKit execution profiles retain their meaning.
Configuration validation/inspection must assemble and inspect both selected profiles
@@ -369,3 +369,53 @@ and rebuild/relink materials needed for Audita's Go binary/container distributio
This unit does not publish binaries or claim that release compliance is complete.
No upstream relicensing request or library implementation change is required for
this prototype.
## Selected-Overlay Extension: 2026-09-24
The isolated prototype now pins published ConfigKit v0.4.0. ConfigKit loads
`overlays/testing.yml` relative to the selected main file; the overlay selects
complete PromptKit execution profiles from the separate `profiles/` directory.
The original v0.3.1 observations above are historical and do not prove this
extension. No production Audita behavior changed.
With Go 1.26.8 on linux/amd64, from `examples/library-adoption/`, these offline
checks passed with `GOTOOLCHAIN=local GOWORK=off GOPROXY=off GOSUMDB=off`:
```sh
go test ./...
go test -race ./...
go vet ./...
go run .
go run . --overlay testing
go run . --overlay testing --proposal-profile proposal
```
Each demonstration reported one accepted correction, four attempts, zero
transient retries, and two structural repairs. The base run selected
`synthetic-grammar`/`synthetic-review`; testing selected
`synthetic-grammar-testing`/`synthetic-review-testing`; the explicit proposal
override restored only `synthetic-grammar`. These are synthetic routing IDs,
not price, latency, quality, or provider-compatibility measurements.
| Requirement | Consumer evidence |
| --- | --- |
| Base, empty/default, testing selection, role overrides, final inheritance, and relative profile resolution | `TestSelectedOverlayConfiguration` loads temporary on-disk layouts and assembles both roles. |
| Actual base/testing/override HTTP models and repairs | `TestDemonstrationSelectsOutboundModels` captures every request body and matches model IDs to the reported selections and domain outcome. |
| Missing/invalid selection, version/directive rejection, and ordinary backend-setting validation | `TestOverlayFailuresAndApplicationValidation` checks ConfigKit diagnostic codes and effective backend limits. |
| Surviving credential resolution, absent/empty failures, null unauthenticated use, and profile-only switching | `TestOverlayCredentialResolutionAndInspection` controls synthetic environment values and observes HTTP Authorization. |
| Redacted effective output, explanation and metadata origin, profile inspection, and observations | `TestOverlayCredentialResolutionAndInspection` and `TestOverlaySelectionProvenance` inspect safe output and overlay/CLI origins. |
| Existing retry, repair, domain, capacity, and concurrent-observation behavior | The unchanged nested suite passes, including under `-race`. |
Changing a profile does not remove a backend credential reference from the
effective configuration. ConfigKit validates a surviving reference when only
profile selection changes. Replacing the reference in an
overlay resolves only the replacement; explicit null allows unauthenticated use.
This distinction is part of the selected configuration boundary, not an
application fallback. Imports and secret-directory bootstrap remain disabled.
The tests use a controlled built-in HTTP transport and synthetic credentials;
there were no live provider calls. The prototype still covers one representative
proposal/assessment pair, not all production modules, prompts, CLI paths, or
diagnostic artifacts. Root `go test ./...` does not run this nested module. No
upstream API gap appeared in this extension. The production migration handoff is
the remaining work for this unit.