Strategic naming cleanup. Earlier doc-comments + commit messages framed Rank
4 / Rank 5 / Rank 7 work as 'Rank N of the 2026-05-03 Infisical deep-research
deliverable' — the 'Infisical' qualifier was a holdover from the original
deep-research framing where Infisical (a competing secrets-management
platform) was the comparator. Keeping the comparator's name in our source
adds noise without value; an external reader sees 'Infisical' and assumes a
dependency or shared lineage rather than reading it as the competitive
context it was.
Mechanical sed across 34 files (32 source / docs + 2 follow-up Python passes
to collapse 'deep-research deep-research' duplicates that emerged where the
original phrase wrapped across lines):
s|Infisical deep-research|deep-research|g
s|infisical-deep-research-results|deep-research-results-2026-05-03|g
s|infisical-deep-research-prompt|deep-research-prompt-2026-05-03|g
s|infisical-deep-research|deep-research|g
s|Infisical|deep-research|g
s|deep-research deep-research|deep-research|g # collapse-pass
Net diff: 63 insertions / 64 deletions across cmd/, docs/, internal/,
migrations/. Pure text substitution; zero behavior change. Code path
unchanged — go vet clean, tests for TestApproval pass on both
internal/service and internal/api/handler packages.
Workspace docs (cowork/) carry the same references and will be swept
separately — they're not under certctl/ git control. The two filename
references (cowork/infisical-deep-research-results.md +
cowork/infisical-deep-research-prompt.md) get renamed alongside that sweep
to deep-research-results-2026-05-03.md /
deep-research-prompt-2026-05-03.md so cross-references in the certctl
repo doc-comments resolve cleanly.
Rank 7 of the 2026-05-03 Infisical deep-research deliverable, commit 2 of 4
(cowork/rank-7-approval-workflow-primitive-prompt.md). Builds on the
foundation in commit 2025275 — wires the service layer that drives the
approval workflow. Still no handler / integration wiring; commits 3-4
land that.
Files added:
internal/service/approval.go - ApprovalService struct + 6
methods: RequestApproval,
Approve, Reject, ListPending,
List, Get, ExpireStale.
Same-actor RBAC check
(ErrApproveBySameActor) at
both Approve and Reject; the
load-bearing two-person
integrity gate. Bypass mode
short-circuits via
approveInternal(outcome=
"bypassed", actorType=System).
Audit + metric emission per
decision via shared
recordAudit helper. Tolerates
nil AuditService for tests.
Service depends on a narrow
JobStatusUpdater interface
(single-method) rather than
the full repository.JobRepository
— production wiring satisfies
it implicitly via postgres'
existing UpdateStatus.
internal/service/approval_metrics.go - ApprovalMetrics: thread-safe
counter table (decisions
counter dimensioned by
outcome × profile_id) + a
custom durationHistogram for
pending-age (le buckets:
60, 300, 1800, 3600, 21600,
86400, +Inf — 1m, 5m, 30m,
1h, 6h, 24h, beyond).
Snapshot* methods return the
Prometheus exposer's input
shapes. Mirrors the
ExpiryAlertMetrics +
VaultRenewalMetrics pattern
from prior ranks.
internal/service/approval_test.go - 8 table-driven tests with
tight in-package fakes
(fakeApprovalRepo +
fakeJobStateRepo):
TestApproval_RequestCreatesPendingRow_BypassDisabled
TestApproval_BypassMode_AutoApprovesWithSystemBypassActor
TestApproval_Approve_TransitionsJobFromAwaitingApprovalToPending
TestApproval_Reject_TransitionsJobFromAwaitingApprovalToCancelled
TestApproval_Approve_RejectsSameActor
↑ THE LOAD-BEARING TWO-PERSON
INTEGRITY TEST. PCI-DSS 6.4.5
/ NIST 800-53 SA-15 / SOC 2
CC6.1 compliance auditors
pattern-match against this.
Pins same-actor rejection on
both Approve and Reject paths;
pins success when a different
actor approves.
TestApproval_Approve_RejectsAlreadyDecided
TestApproval_ExpireStale_TransitionsPendingToExpired_AndCancelsJob
TestApproval_MetricCounterIncrements
Verified:
gofmt: clean.
go vet ./internal/service/...: exit 0.
go test -short -count=1 -run TestApproval ./internal/service/...:
ok 0.005s — all 8 tests green.
Out of scope for this commit (lands in commits 3-4):
- api/handler/approval.go (5 endpoints + handler-side RBAC).
- api/openapi.yaml extensions.
- Integration into CertificateService.TriggerRenewal +
RenewalService.CheckExpiringCertificates + Scheduler.ReapTimedOutJobs.
- cmd/server/main.go wiring of ApprovalService + ApprovalMetrics.
- Config.Approval.BypassEnabled + CERTCTL_APPROVAL_BYPASS env var.
- docs/connectors.md row + docs/approval-workflow.md runbook.
Reference: cowork/rank-7-approval-workflow-primitive-prompt.md.
shankar0123