cloudsec(sdk): keep resolver_ready through the chunked resolve merge#323
Merged
Conversation
…hunked resolve merge
_resolve_chunked rebuilt the response as {resolved, unresolved}, discarding
resolver_ready — and, once legion_graph #94 lands, verdicts_available. Those
flags are how an SDK caller distinguishes a real negative from an unevaluated
one: a resolved asset with no 'exposed' key means UNKNOWN, not safe. Without
them the SDK hands back silence.
Merge them instead: resolver_ready is pessimistic (one not-ready chunk makes the
batch not-ready), verdicts_available is true if any chunk carried a verdict, and
a flag no chunk reported (older backend) stays absent rather than invented.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132oQ8tTsLG5qGvX1c4TiJu
lcbill
previously approved these changes
Jul 25, 2026
_resolve_chunked rebuilt the response as {resolved, unresolved}, discarding
resolver_ready — the flag that says whether the resolver is provisioned in that
datacenter at all. Without it a caller cannot tell 'no sensor runs on a cloud
asset' from 'nothing resolved because redis-cloudsec is not there'.
Merge it instead, pessimistically: one not-ready chunk makes the whole batch
not-ready. A backend that never sent the flag still gets no flag — absent, not
a fabricated False.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132oQ8tTsLG5qGvX1c4TiJu
lcbill
previously approved these changes
Jul 25, 2026
maximelb
changed the title
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0132oQ8tTsLG5qGvX1c4TiJu
lcbill
approved these changes
Jul 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
CloudSec._resolve_chunked(limacharlie/sdk/cloudsec.py) rebuilds the merged response from scratch:dropping
resolver_ready— the flag that says whether the sensor↔cloud resolver (redis-cloudsec) is provisioned in that datacenter at all. Without it an SDK caller cannot tell "no sensor runs on a cloud asset" from "nothing resolved because the resolver isn't running here". The server added that flag precisely so the two are distinguishable; the SDK threw it away.This matters more now that refractionPOINT/legion_graph#94 makes the same endpoint report posture verdicts only where they were actually computed — the whole surface is being made to say "unknown" out loud rather than imply a negative.
The fix
Merge it rather than drop it, pessimistically: one not-ready chunk makes the whole merged answer not-ready (a batch split across chunks is only as trustworthy as its weakest chunk). A backend that never sent the flag still gets no flag — absent, not a fabricated
False.Tests
Three new cases in
tests/unit/test_sdk_cloudsec.py::TestResolution, verified failing-first on master withKeyError: 'resolver_ready':resolver_ready is False;Verified
python3 -m pytest tests/unit— 3676 passed, 6 skipped.limacharlie/commands/cloudsec.py)_outputs whatever this returns, so the flag now reaches CLI users too; no CLI change needed.Not verified
Related: refractionPOINT/legion_graph#94.