dave/personaEngine2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement Stage A: rule engine, validation, audit, and safety gates

Browse Source 
Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).

  354 offline Pester tests      PASS
  Engine purity (Principle IV)  PASS
  Sanitization (SC-013)         PASS  (156 files)
  Graph module loaded in tests  none  (SC-008 holds)

What landed
  - Four-layer configuration validation with stable finding codes, covering
    every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
  - Run loop, audit records (NDJSON through a single sink), summaries,
    reconciliation, and exit codes 0-6
  - Persistence behind a single write-body builder whose result always has
    exactly one key
  - Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
  - Six docs, two pipelines, traceability matrix, V-5a and sanitization records

Three deviations from tasks.md, each recorded in its status block

  T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
  state and the rule engine is pure; a counter there would break Principle IV.
  It lives in New-PersonaRunCounter and is applied in the run loop.

  A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
  imports the manifest, which requires Microsoft.Graph.Authentication, so a
  loop living only inside it could not run on a machine without the Graph SDK
  and SC-004 could not be proven at all. The entry script is now a thin
  wrapper and what ships is what is tested.

  The invalid-config corpus is generated by a committed script, with the
  generated fixtures committed too, so a reviewer sees the fixture in the diff.

Defects found by running the code, not by reading it

  Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
  around a comma-returned array collapsed every membership list into one
  bogus space-joined entry. That is a silent false non-match, exactly what
  FR-013 exists to prevent.

  A 403 whose status appears only in the exception message parsed as $null,
  which the retry policy treats as a transport error - five requests per
  account against a tenant already refusing. Status extraction now falls back
  to the message text, bounded to 400-599.

  The sanitization scan walked tracked files only, so it covered 34 of 156
  files and none of this phase's code. It now scans untracked non-ignored
  files too, and a negative control confirms it catches a planted leak.

  Test-Json reports one error per violating location, not first-failure-only
  as the V-5a draft claimed. Record and pin corrected.

Enforcement remains blocked on the V-4 security sign-off.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Dave
2026-08-20 21:48:19 -04:00
parent c59c85dd55
commit cdc6bb33d3
124 changed files with 16638 additions and 199 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/TestData/Users/users.json
+162
View File
@@ -0,0 +1,162 @@
{
"_comment": "Synthetic fixtures. Every value is fictional and every identifier is a placeholder-shaped GUID. These must never be replaced with real directory data (SC-013).",
"users": [
{
"fixtureId": "enabled-employee",
"accountObjectId": "00000000-0000-0000-0000-000000000101",
"userPrincipalName": "alex.employee@example.invalid",
"displayName": "Alex Employee",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "Finance",
"JobTitle": "Analyst"
},
"storedPersona": "Employee"
},
{
"fixtureId": "disabled-employee",
"accountObjectId": "00000000-0000-0000-0000-000000000102",
"userPrincipalName": "blair.disabled@example.invalid",
"displayName": "Blair Disabled",
"userType": "Member",
"accountEnabled": false,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "Operations",
"JobTitle": "Coordinator"
},
"storedPersona": "Employee"
},
{
"fixtureId": "guest",
"accountObjectId": "00000000-0000-0000-0000-000000000103",
"userPrincipalName": "casey.guest@example.invalid",
"displayName": "Casey Guest",
"userType": "Guest",
"accountEnabled": true,
"properties": {
"CompanyName": "<PARTNER-ORGANIZATION>",
"Department": null
},
"storedPersona": null
},
{
"fixtureId": "null-properties",
"accountObjectId": "00000000-0000-0000-0000-000000000104",
"userPrincipalName": "drew.sparse@example.invalid",
"displayName": "Drew Sparse",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": null,
"Department": null,
"JobTitle": null
},
"storedPersona": null
},
{
"fixtureId": "missing-properties",
"accountObjectId": "00000000-0000-0000-0000-000000000105",
"userPrincipalName": "ellis.minimal@example.invalid",
"displayName": "Ellis Minimal",
"userType": "Member",
"accountEnabled": true,
"properties": {},
"storedPersona": null
},
{
"fixtureId": "service-account",
"accountObjectId": "00000000-0000-0000-0000-000000000106",
"userPrincipalName": "svc-billing@example.invalid",
"displayName": "Billing Service",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "IT"
},
"storedPersona": "Employee"
},
{
"fixtureId": "contractor",
"accountObjectId": "00000000-0000-0000-0000-000000000107",
"userPrincipalName": "flynn.external@example.invalid",
"displayName": "Flynn External",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<PARTNER-ORGANIZATION>",
"Department": "Engineering"
},
"storedPersona": null
},
{
"fixtureId": "breakglass",
"accountObjectId": "00000000-0000-0000-0000-000000000001",
"userPrincipalName": "emergency-access-01@example.invalid",
"displayName": "Emergency Access 01",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "IT"
},
"storedPersona": "BreakGlass-Admin"
},
{
"fixtureId": "mixed-case-properties",
"accountObjectId": "00000000-0000-0000-0000-000000000108",
"userPrincipalName": "GRAY.MixedCase@example.invalid",
"displayName": "Gray MixedCase",
"userType": "MEMBER",
"accountEnabled": true,
"properties": {
"CompanyName": "<organization-name>",
"Department": "FINANCE"
},
"storedPersona": "employee"
},
{
"fixtureId": "tier0-admin",
"accountObjectId": "00000000-0000-0000-0000-000000000109",
"userPrincipalName": "harper.admin@example.invalid",
"displayName": "Harper Admin",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "IT",
"JobTitle": "Directory Administrator"
},
"storedPersona": "Employee"
},
{
"fixtureId": "transitive-failed",
"accountObjectId": "00000000-0000-0000-0000-000000000110",
"userPrincipalName": "indigo.partial@example.invalid",
"displayName": "Indigo Partial",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "Operations"
},
"storedPersona": "Tier0-Admin"
},
{
"fixtureId": "all-failed",
"accountObjectId": "00000000-0000-0000-0000-000000000111",
"userPrincipalName": "jordan.unknown@example.invalid",
"displayName": "Jordan Unknown",
"userType": "Member",
"accountEnabled": true,
"properties": {
"CompanyName": "<ORGANIZATION-NAME>",
"Department": "Finance"
},
"storedPersona": "Tier0-Admin"
}
]
}