Phase 1: Revocation strategy interface #69

Merged

erikinkinen merged 4 commits from 1-revocation-strategy-interface into main

2026-03-05 12:43:51 +01:00

erikinkinen commented

2026-03-05 12:17:44 +01:00

Owner

Closes #29

Summary

This PR introduces a swappable revocation strategy interface for Phase 1 while preserving existing direct-edge revocation semantics.

It adds:

a new IRevoker strategy seam in core,
runtime strategy selection (direct, snapshot_direct),
CLI/config plumbing for strategy selection,
determinism parity tests to ensure both built-ins produce identical behavior.

No event-log schema/version changes are introduced in this PR.

Included

New core revoker API:
- RevokerKind (Direct, SnapshotDirect)
- IRevoker
- direct_revoker(), snapshot_direct_revoker(), revoker_for_kind(...)
apply_event(...) overload accepting const IRevoker&
RevokeCap path routed through selected revoker
Parity guard: revoker-resolved targets must equal normalized selector or fail with InvariantViolation
Engine strategy field:
- Engine::revoker_kind (default Direct)
Config/CLI strategy selection:
- RunParams.revoker_kind (default Direct)
- aes simulate --revoker <direct|snapshot_direct>
Docs update in docs/phase1.md
New tests:
- aes_revocation_strategy_tests (selector parity, error parity, engine equivalence, repeat determinism)
- extended CLI/workload param coverage for --revoker and default config

Explicitly Excluded

Behavior-divergent revocation strategies
Transitive/provenance revocation semantics
Event-log version/schema updates
Revocation policy changes outside direct-edge Phase 1 semantics

API / Interface Changes

Added: core/include/aes/core/revoker.hpp
Added: core/src/revoker.cpp
Added overload:
- ApplyEventResult apply_event(..., const IRevoker &revoker);
Existing apply_event(..., const Event&) remains and defaults to direct_revoker()
Added config surface:
- workload::RunParams::revoker_kind
- CLI --revoker

Compatibility

Default behavior remains unchanged (direct).
Existing revoke error taxonomy is preserved (InvalidArgument, NotFound, InvariantViolation).
Replay/event-log behavior remains compatible; no schema migration required.

Verification

cmake --build _build --target aes_apply_event_tests aes_engine_tests aes_workload_params_tests aes_cli_simulate_tests aes_revocation_strategy_tests aes_invalid_event_determinism_tests
ctest --test-dir _build --output-on-failure -R "aes_apply_event_tests|aes_engine_tests|aes_workload_params_tests|aes_cli_simulate_tests|aes_revocation_strategy_tests"
ctest --test-dir _build --output-on-failure -R "aes_event_log_reader_tests|aes_event_log_replay_tests|aes_revocation_oracle_tests|aes_invalid_event_determinism_tests"

Review Focus

Revoker contract and deterministic target resolution
Selector parity enforcement in RevokeCap path
Strategy selection plumbing (RunParams, Engine, CLI)
Determinism equivalence between direct and snapshot_direct

Closes #29 --- ## Summary This PR introduces a swappable revocation strategy interface for Phase 1 while preserving existing direct-edge revocation semantics. It adds: - a new `IRevoker` strategy seam in `core`, - runtime strategy selection (`direct`, `snapshot_direct`), - CLI/config plumbing for strategy selection, - determinism parity tests to ensure both built-ins produce identical behavior. No event-log schema/version changes are introduced in this PR. --- ## Included - New `core` revoker API: - `RevokerKind` (`Direct`, `SnapshotDirect`) - `IRevoker` - `direct_revoker()`, `snapshot_direct_revoker()`, `revoker_for_kind(...)` - `apply_event(...)` overload accepting `const IRevoker&` - `RevokeCap` path routed through selected revoker - Parity guard: revoker-resolved targets must equal normalized selector or fail with `InvariantViolation` - Engine strategy field: - `Engine::revoker_kind` (default `Direct`) - Config/CLI strategy selection: - `RunParams.revoker_kind` (default `Direct`) - `aes simulate --revoker <direct|snapshot_direct>` - Docs update in `docs/phase1.md` - New tests: - `aes_revocation_strategy_tests` (selector parity, error parity, engine equivalence, repeat determinism) - extended CLI/workload param coverage for `--revoker` and default config --- ## Explicitly Excluded - Behavior-divergent revocation strategies - Transitive/provenance revocation semantics - Event-log version/schema updates - Revocation policy changes outside direct-edge Phase 1 semantics --- ## API / Interface Changes - Added: `core/include/aes/core/revoker.hpp` - Added: `core/src/revoker.cpp` - Added overload: - `ApplyEventResult apply_event(..., const IRevoker &revoker);` - Existing `apply_event(..., const Event&)` remains and defaults to `direct_revoker()` - Added config surface: - `workload::RunParams::revoker_kind` - CLI `--revoker` --- ## Compatibility - Default behavior remains unchanged (`direct`). - Existing revoke error taxonomy is preserved (`InvalidArgument`, `NotFound`, `InvariantViolation`). - Replay/event-log behavior remains compatible; no schema migration required. --- ## Verification - [x] `cmake --build _build --target aes_apply_event_tests aes_engine_tests aes_workload_params_tests aes_cli_simulate_tests aes_revocation_strategy_tests aes_invalid_event_determinism_tests` - [x] `ctest --test-dir _build --output-on-failure -R "aes_apply_event_tests|aes_engine_tests|aes_workload_params_tests|aes_cli_simulate_tests|aes_revocation_strategy_tests"` - [x] `ctest --test-dir _build --output-on-failure -R "aes_event_log_reader_tests|aes_event_log_replay_tests|aes_revocation_oracle_tests|aes_invalid_event_determinism_tests"` --- ## Review Focus - Revoker contract and deterministic target resolution - Selector parity enforcement in `RevokeCap` path - Strategy selection plumbing (`RunParams`, `Engine`, CLI) - Determinism equivalence between `direct` and `snapshot_direct`