mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-22 03:04:03 +00:00
rcourtman
2dca000416
Operators about to approve a Pulse-driven action need to know what the command actually touches before saying yes. Until now the preflight shown at approval time was the same generic boilerplate for every action: "approval is scoped, hash must match, etc." — useful safety posture but no operational specifics. The dry-run summary said the same thing for 99% of actions. Adds classifyApprovalCommand and approvalCommandClassPreflightAdditions in tools_control.go that bucket common Pulse remediation actions and return hand-authored safety + verification additions per class: - service-restart (systemctl restart, service restart) - service-stop (systemctl stop, service stop) - service-start (systemctl start, service start) - service-reload (systemctl reload) - container-restart (docker / podman restart) - container-stop (docker / podman stop) - k8s-rollout-restart (kubectl rollout restart) The additions name concrete operational facts the operator needs: - For service-restart: "Service will be briefly unavailable; no other unit dependencies altered" plus verification "Read back systemctl is-active <unit>" and "tail journal for crash patterns". - For container-restart: "Container will be briefly unavailable; image and volume mounts unchanged" plus "Read back via docker inspect" verification. - For k8s-rollout-restart: "Pods rolled in waves per deployment strategy; PodDisruptionBudget continues to apply" plus "watch kubectl rollout status" verification. approvalPreflight now appends class-specific safety and verification content onto the existing default content rather than replacing it, so the broker's structural safety posture (org scope, hash match, single-use approval) remains visible alongside the operational copy. Unknown command classes return nil/nil — no fabricated padding for commands the bucket does not recognize. The default preflight stands on its own, matching the no-fabrication rule that runs through the rest of the trust-record arc. Tests cover: each known class returns non-empty additions with the expected operational tokens; unknown commands return nil; the end-to-end approvalPreflight merge surfaces both default and class-specific safety/verification entries. ai-runtime contract pinned with the per-class enrichment rule and the no-fabrication boundary for unknown classes.