Name: [FIX] ai17: Vietnamese catalogues, the locale regressions they caused, and the defects that surfaced

State: Succeed finished in 179m

PR State: merged

PR Author: David Tran

PR Author Email:

PR: #103

Committer: David Tran

Committer Email: davidtran.hp@gmail.com

Commit: f163aebe69ddaa808ef68f8b4e9fba1ee8c0bf70

Description:

                                            [FIX] viin_ai_ops: an unprovable proposal gets the strictest outcome, not the default

Acceptance rejected the previous fix on six High-tier scenarios, and it was
right. That fix moved the unknown-model case from auto-executed to pending, and
stopped there. But an administrator's model-scoped block yields rejected for a
proposal that names its model, while the same proposal with the field empty
yielded pending - which one approver can wave through, after which it executes.
Omitting impacted_model still downgraded a hard block into an approvable request.
Two code reviews read that as defensible; the rule requires monotone OVERSIGHT,
and rank 1 is not rank 2.

The scan no longer aborts at the first policy it cannot rule out. It runs to
completion and takes the maximum over the oversight lattice of every outcome
still reachable: each policy that agrees on all the proposal's OTHER axes and is
scoped to a model that cannot be excluded, plus the first unscoped policy reached
(nothing behind it is reachable for any model), or the unmatched fallback when no
catch-all is reached. Taking the first rather than the max is exactly what made
the earlier attempt wrong.

Nothing is recorded as the matching policy. The status stays "model
unidentified" and policy is None, because the resolved action is a statement
about the policy SET - nothing configured here permits less than this - not an
attribution to one rule. Naming the strictest candidate would assert that a rule
scoped to a model the proposal may never have touched governed it, which is a
false statement in an auditable subsystem, and it would break the workflow
bridge that reads this status to tell "no orchestration configured" from "the
governing policy could not be determined".

The sudo gate generalises the same way: allow_runs_as_sudo is now the AND over
candidates, since an opt-in must not be borrowed from a rule that may not govern.
An unranked action falls back to maximum oversight rather than raising.

Both directions are held. The over-correction set - a permissive rule legitimately
in front of a block, a block filtered out by risk or scope, another company's
policy - passes at HEAD AND after the fix, which is what proves the change is not
a blanket block. Reverting the model file reds 14 tests and errors 2 more; the
S9 discriminator names the twins and the strictest outcome in its failure message.

Two consequences stated rather than buried. A single model-scoped block now
blocks every proposal recording no impacted_model, not only those that might have
hit that model - a real widening, and what the rule's wording forces. And two
legacy assertions changed, because they encoded the earlier partial fix.

96 tests green on two databases, plus the bridge, approval, approval_account and
workflow suites.

Test setup now archives pre-existing policies inside its own rolled-back
transaction. A shared test database carried leftover fixtures that reddened 13
tests before any of this; the suite should not depend on which rows a previous
run forgot.
                                            

Branch: 17.0

Instance ID: 0

Age:

Up-time:

Delete Date: