You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
template-mgr-client: take in the template lookup scope protocol from rpc-auth - #1691
This moves the template lookup scope protocol from pplx-space-rpc-auth to pplx-space-template-mgr-client, as pplx_space_template_mgr_client::lookup_scope. The protocol is the x-space-template-lookup-scope request header, its -received response receipt, and the auth.template_lookup.compatibility counter in lookup_scope::metrics.
It isn't authentication. Its own doc says receipts confirm protocol support, not authorization, and it reached rpc-auth only because common-svc was split up. All four callers already depend on the client crate: the internal-api, node-api, sbx-mgr and template-mgr servers.
It can't go to an l20_domain protocol crate, where crates/l40_api/AGENTS.md puts wire schemas shared by a server and its client. Its counter goes through pplx-space-metrics-emit, which requires pplx-space-observability, and [rules.layers.domain_fences] keeps l20_domain off that package. The client crate already carries template-manager's shared proto, which the server re-exports.
Unchanged: the type, header strings, receipt behaviour, error messages, and the metric's name, tags and values.
Same log target: the missing-receipt warning still logs under pplx_space_rpc_auth::template_lookup, so log filters that name that target still match.
rpc-auth: keeps no re-export, and its crate doc no longer mentions lookup scope.
Dependencies: sbx-mgr used rpc-auth only for this module, so it drops that dependency. The client gains tracing and pplx-space-metrics-emit, which the layers rule allows for a client.
Downstream: pplx_space_rpc_auth::template_lookup::{TemplateLookupScope, metrics::template_lookup_compatibility} moves to pplx_space_template_mgr_client::lookup_scope::…. No package, crate directory or feature is added, removed or renamed.
Validation
cargo fmt and cargo check --workspace --all-targets pass.
Feature builds pass for rpc-auth (k8s, and no default features), the client (otel,datadog), node-api-server (k8s), api (kubernetes) and internal-api-server (all features).
ci/scripts/run-rust-checks.sh clippy and isolated-crates pass. cargo arch against the base reports no required findings.
cargo nextest for rpc-auth, the client and the four callers, without the privileged group: 2667 passed.
run-rust-checks.sh tests-unprivileged: 12,414 passed and 41 failed. Every failure is a guest-process or node-mgr test that needs process-spawn permission or a privileged path the host lacked. None of those crates depends on anything this change touches.
Every string literal on removed lines reappears on added lines. The only new literal is the pinned log target.
Not validated: the privileged test group and Kind.
Severity and risk
Severity: does not apply (a code move).
Risk: low. No wire, metric or log text changes. Code that imports pplx_space_rpc_auth::template_lookup stops compiling until it uses the new path. Roll back by reverting.
AI assistance: Claude Code drafted the code change and this description.
…rpc-auth
`pplx_space_rpc_auth::template_lookup` is not authentication: its receipts
confirm protocol support, not authorization. It is the template-manager
lookup-scope protocol (the `x-space-template-lookup-scope` request header,
its `-received` response receipt and the
`auth.template_lookup.compatibility` counter), and it landed in rpc-auth
only when common-svc was split up. It moves unchanged to
`pplx_space_template_mgr_client::lookup_scope`, with its metrics at
`lookup_scope::metrics`; every caller already depends on the client.
The header strings, receipt behaviour, error messages, metric name, tags
and values are unchanged. The missing-receipt warning keeps its old event
target, `pplx_space_rpc_auth::template_lookup`, so log filters that name it
still match. rpc-auth keeps no re-export. sbx-mgr used rpc-auth only for
this module and drops the dependency; the client gains `tracing` and
`pplx-space-metrics-emit`.
No actionable comments were generated in the recent review.
Walkthrough
Template lookup scope and compatibility metrics are now exposed through the template manager client. Callers in the internal API, node API, sandbox manager, and template manager use the new module path. The RPC auth crate no longer declares the template lookup module, and the sandbox manager removes its RPC auth dependency. Scope selection, fallback, receipt matching, and error behavior remain unchanged.
Possibly related PRs
perplexityai/SPACE#1516: Creates the RPC auth module and call-site paths that this PR moves to the template manager client.
perplexityai/SPACE#1515: Places the compatibility metric in RPC auth before this PR moves it to the template manager client.
perplexityai/SPACE#1582: Changes delta-base verification and tests that use the lookup scope type moved by this PR.
Merge Risk: Minimal · up to 7da4c
The lookup-scope API moves without an evidenced behavior change. Normal checks should pass before merging.
Security architecture risk: Low · up to 7da4c
This is a low-risk ownership change. The lookup protocol and inspected authorization controls are preserved; consumers must adopt the new Rust import path. Deployed authentication configuration and consumers outside the inspected code were not verified.
Retained concerns
No architecture-level concerns identified.
Security review details
Security Blast Radius
inferred — The inspected impact follows the existing template lookup chain across internal API, node API, sandbox manager, and template manager. The protocol relocation does not expand caller authority or organization access in those paths; deployment-wide exposure remains unverified.
Trust Boundaries and Controls
observed — Catalog handlers derive read scope from authenticated caller identity and registered node information independently of lookup-scope metadata. Both tag and hash lookups pass organization and derived scope into storage queries that apply organization and node placement/grant predicates before returning storage locations. Receipt handling does not replace these controls.
Resilience and Maintainability Implications
observed — The create-path changes are confined to the relocated type and metric paths. Existing requested-ID checks, reuse and cleanup-state handling, lifecycle locking, persistence handoff, and response publication are not modified. This establishes an unchanged transition path, not a complete proof of every pre-existing interruption or recovery case.
Pre-merge checks: 6
Check name
Status
Explanation
Title check
The title uses the prefix "template-mgr-client:" followed by a lowercase summary, which matches the required area-prefix format. It accurately describes the main change: the template lookup scope prot…
Description Follows The Pr Template
The description contains all four required items: Summary, Validation with results, Severity and risk, and an AI assistance line naming the tool and its contribution.
Bug Fixes Name A Regression Test
This is not an application bug fix. The diff moves the lookup-scope protocol and updates its callers without changing lookup behavior.
Weakened Safeguards Are Justified
The diff does not weaken a test, assertion, lint, CI check, or repository guard. It does not change review guidance.
Agent Tooling Runs No New Commands
The diff changes Rust source and Cargo files. It does not change agent manifests, skills, guidelines, or manifest-referenced command files.
Public-Safe Content
The diff, title, and description contain no content prohibited by this check. The moved protocol files contain no sensitive values.
Full details: Title check
Explanation
The title uses the prefix "template-mgr-client:" followed by a lowercase summary, which matches the required area-prefix format. It accurately describes the main change: the template lookup scope protocol moves from pplx-space-rpc-auth into pplx-space-template-mgr-client under lookup_scope. The title is 77 characters, and the title requirement does not set a length limit.
Recent review info
Automatic approval policy
Commit: 7da4c6321b4a.
Setting
Effective value
Source
Automatic approvals
Enabled
Global configuration
Merge risk
Moderate
Global configuration
Security risk
Not set
Global configuration
No overrides matched. The global limits apply.
Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
This moves the template lookup scope protocol from
pplx-space-rpc-authtopplx-space-template-mgr-client, aspplx_space_template_mgr_client::lookup_scope. The protocol is thex-space-template-lookup-scoperequest header, its-receivedresponse receipt, and theauth.template_lookup.compatibilitycounter inlookup_scope::metrics.It isn't authentication. Its own doc says receipts confirm protocol support, not authorization, and it reached rpc-auth only because common-svc was split up. All four callers already depend on the client crate: the internal-api, node-api, sbx-mgr and template-mgr servers.
It can't go to an l20_domain protocol crate, where
crates/l40_api/AGENTS.mdputs wire schemas shared by a server and its client. Its counter goes throughpplx-space-metrics-emit, which requirespplx-space-observability, and[rules.layers.domain_fences]keeps l20_domain off that package. The client crate already carries template-manager's shared proto, which the server re-exports.pplx_space_rpc_auth::template_lookup, so log filters that name that target still match.tracingandpplx-space-metrics-emit, which thelayersrule allows for a client.Downstream:
pplx_space_rpc_auth::template_lookup::{TemplateLookupScope, metrics::template_lookup_compatibility}moves topplx_space_template_mgr_client::lookup_scope::…. No package, crate directory or feature is added, removed or renamed.Validation
cargo fmtandcargo check --workspace --all-targetspass.k8s, and no default features), the client (otel,datadog), node-api-server (k8s), api (kubernetes) and internal-api-server (all features).ci/scripts/run-rust-checks.sh clippyandisolated-cratespass.cargo archagainst the base reports no required findings.cargo nextestfor rpc-auth, the client and the four callers, without the privileged group: 2667 passed.run-rust-checks.sh tests-unprivileged: 12,414 passed and 41 failed. Every failure is a guest-process or node-mgr test that needs process-spawn permission or a privileged path the host lacked. None of those crates depends on anything this change touches.Severity and risk
Severity: does not apply (a code move).
Risk: low. No wire, metric or log text changes. Code that imports
pplx_space_rpc_auth::template_lookupstops compiling until it uses the new path. Roll back by reverting.AI assistance: Claude Code drafted the code change and this description.