#246: mode enforced — reject profile-violating configuration writes #295

fable-5 · 2026-07-31T19:48:52+02:00

fable-5 commented

2026-07-31 19:48:52 +02:00

Last issue of M32, chained on #294 (already merged) — base is current main.

In mode enforced, settings writes that would set a catalog-violating value are rejected in the one write path every caller uses (InstanceSettingsService.set) with the stable error code vs_nfd_profile_violation (403; i18n de+en for the UI). The check is scope-generic over the catalog — pond-level entries would be enforced the same way, and their deliberate absence is the recorded ADR 0027 decision. Existing violating values are reported at startup (log line; tolerant of database-less boots) and on the admin profile card, and are never auto-changed. The UI renders as in hidden (#245 already keys on hidden|enforced). The hardening guide now names enforced as the recommended mode for VS-NfD reference operation.

Tests: violating write rejected with the stable code and nothing stored; compliant writes pass; the same violating write passes in marked and hidden (separate app boots); pre-existing violation reported and untouched (off behaviour is pinned by every existing settings-write test). Full api suite green: 100 files / 555 tests against a fresh DB.

Issue #246 will be closed manually after green CI + merge — which completes M32.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

Last issue of M32, chained on #294 (already merged) — base is current main. In mode `enforced`, settings writes that would set a catalog-violating value are rejected in the one write path every caller uses (`InstanceSettingsService.set`) with the stable error code `vs_nfd_profile_violation` (403; i18n de+en for the UI). The check is scope-generic over the catalog — pond-level entries would be enforced the same way, and their deliberate absence is the recorded ADR 0027 decision. Existing violating values are reported at startup (log line; tolerant of database-less boots) and on the admin profile card, and are never auto-changed. The UI renders as in `hidden` (#245 already keys on `hidden|enforced`). The hardening guide now names `enforced` as the recommended mode for VS-NfD reference operation. Tests: violating write rejected with the stable code and nothing stored; compliant writes pass; the same violating write passes in `marked` and `hidden` (separate app boots); pre-existing violation reported and untouched (`off` behaviour is pinned by every existing settings-write test). Full api suite green: 100 files / 555 tests against a fresh DB. Issue #246 will be closed manually after green CI + merge — which completes M32. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 added 1 commit 2026-07-31 19:48:52 +02:00

#246 : mode enforced — reject profile-violating configuration writes

CI / Lint, typecheck, test (pull_request) Successful in 6m18s

Details

CI / Build container images (pull_request) Successful in 4m3s

Details

CI / Auth e2e pack (pull_request) Successful in 8m43s

Details

CI / Import/export fidelity gate (pull_request) Successful in 1m0s

Details

CD / Build and push images (push) Successful in 23s

Details

CD / Smoke tests against Test (push) Successful in 1m22s

Details

CD / Deploy to Test (push) Successful in 12s

Details

CD / Promote to Int (push) Successful in 13s

Details

CI / Lint, typecheck, test (push) Successful in 6m27s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 8m24s

Details

CI / Import/export fidelity gate (push) Successful in 58s

Details

4d9f913845

In enforced mode the ONE settings write path every caller uses rejects
catalog-violating values with the stable code vs_nfd_profile_violation
(403 — the request is well-formed, the policy says no). Existing
violating values are reported at startup (log line, database-less boots
must not fail) and on the admin card, never auto-changed. The UI
renders as in hidden (#245 already keys on hidden|enforced). The
hardening guide now names enforced as the recommended mode for VS-NfD
reference operation. Tests: violating write rejected with the stable
code and nothing stored; compliant writes pass; the same violating
write passes in marked and hidden (own app boots); pre-existing
violation reported and untouched. Full api suite 100 files / 555 green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 merged commit 4d9f913845 into main

2026-07-31 20:05:34 +02:00

fable-5 referenced this pull request

2026-07-31 20:08:37 +02:00

[VS-NfD] Mode "enforced": reject profile-violating configuration writes server-side #246

Sign in to join this conversation.

No reviewers