)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c6ed9fb93c93adb93c83c8cd26534e643cfe4985","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"f6908e1c_8506d103","updated":"2026-06-26 08:05:36.000000000","message":"look good, One improvement about using versionutils to specify depreaction release name to keep consist.\n```\ncyborg/policies/base.py:    deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/base.py:        deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/device_profiles.py:    deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/device_profiles.py:    deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/device_profiles.py:    deprecated_since\u003dversionutils.deprecated.WALLABY,\ncyborg/policies/device_profiles.py:    deprecated_since\u003dversionutils.deprecated.WALLABY,\n\n```","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"d324b62d22c5c0513691f759607e0eedba7f0956","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"b0c6ad2d_081614c8","updated":"2026-06-22 23:45:37.000000000","message":"teim-ci: auto","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"9994aceebc1e9242179a7288d694b93dc43aab98","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"c44ec0e4_83a8e07b","updated":"2026-06-22 08:35:08.000000000","message":"teim-ci: auto","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c3ae33ea60cf88a5bcd4c1b210439119ca8f0d23","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"c2f957ae_d7603dd1","in_reply_to":"f6908e1c_8506d103","updated":"2026-06-29 10:07:11.000000000","message":"Tempest results from cyborg-tempest-srbac https://review.opendev.org/c/openstack/cyborg/+/992332 \nhttps://5126e99bb555fcd10074-f8d3aa66ce3962c6e3c5c35044bdfdd4.ssl.cf1.rackcdn.com/openstack/21ccea317c924406b12ce9ab3cc22cc5/job-output.txt\n```\n  SRBAC tests proving new arq policies work:\n  - test_service_create_and_delete_arq — ok (service satisfies project_member_or_service)\n  - test_service_cannot_list_arqs — ok (service lacks reader role)\n  - test_admin_can_read_arqs — ok (admin via implied reader) \n  - test_admin_can_write_arqs — ok (admin via implied member)\n  - test_reader_can_list_arqs — ok (reader satisfies project_reader_or_admin)\n  - test_reader_cannot_create_arq — ok (reader lacks member)\n  - test_reader_cannot_delete_arq — ok (reader lacks member)\n```","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"change_message_id":"5b03025cec0eb06550169ca236ce0e7225db3f85","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"26eef2a7_a3d9556e","updated":"2026-07-01 11:03:57.000000000","message":"lgtm","commit_id":"2819fa5cc5b2de8a4b1fed30070c37164e636313"},{"author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"change_message_id":"efc2656f28182c0370a640ecbe7a79b3546a903b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"dbe216a7_4d4ee1a2","updated":"2026-07-21 09:35:15.000000000","message":"looks good, with extensive testing coverage","commit_id":"c5198427e0d4be881bb31caf86e580c7e40f5a8b"}],"cyborg/common/policy.py":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c6ed9fb93c93adb93c83c8cd26534e643cfe4985","unresolved":false,"context_lines":[{"line_number":26,"context_line":"#       All of these may be overridden by configuration, but we can"},{"line_number":27,"context_line":"#       depend on their existence throughout the code."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"accelerator_request_policies \u003d ["},{"line_number":30,"context_line":"    policy.RuleDefault("},{"line_number":31,"context_line":"        \u0027cyborg:arq:get_all\u0027,"},{"line_number":32,"context_line":"        \u0027rule:default\u0027,"},{"line_number":33,"context_line":"        description\u003d\u0027Retrieve accelerator request records.\u0027,"},{"line_number":34,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":35,"context_line":"    ),"},{"line_number":36,"context_line":"    policy.RuleDefault("},{"line_number":37,"context_line":"        \u0027cyborg:arq:get_one\u0027,"},{"line_number":38,"context_line":"        \u0027rule:default\u0027,"},{"line_number":39,"context_line":"        description\u003d\u0027Get an accelerator request record.\u0027,"},{"line_number":40,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":41,"context_line":"    ),"},{"line_number":42,"context_line":"    policy.RuleDefault("},{"line_number":43,"context_line":"        \u0027cyborg:arq:create\u0027,"},{"line_number":44,"context_line":"        \u0027rule:project_member_or_admin\u0027,"},{"line_number":45,"context_line":"        description\u003d\u0027Create accelerator request records.\u0027,"},{"line_number":46,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":47,"context_line":"    ),"},{"line_number":48,"context_line":"    policy.RuleDefault("},{"line_number":49,"context_line":"        \u0027cyborg:arq:delete\u0027,"},{"line_number":50,"context_line":"        \u0027rule:default\u0027,"},{"line_number":51,"context_line":"        description\u003d\u0027Delete accelerator request records.\u0027,"},{"line_number":52,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":53,"context_line":"    ),"},{"line_number":54,"context_line":"    policy.RuleDefault("},{"line_number":55,"context_line":"        \u0027cyborg:arq:update\u0027,"},{"line_number":56,"context_line":"        \u0027rule:default\u0027,"},{"line_number":57,"context_line":"        description\u003d\u0027Update accelerator request records.\u0027,"},{"line_number":58,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":59,"context_line":"    ),"},{"line_number":60,"context_line":"]"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"device_policies \u003d ["},{"line_number":63,"context_line":"    policy.RuleDefault("}],"source_content_type":"text/x-python","patch_set":4,"id":"72c315a3_ff7dafb3","side":"PARENT","line":60,"range":{"start_line":29,"start_character":0,"end_line":60,"end_character":1},"updated":"2026-06-26 08:05:36.000000000","message":"All these 5 rules are added in DeprecatedRule in cyborg/policies/arqs.py file and new rules are added based on DocumentDefaultRule.","commit_id":"44aeac64279753a95ca7a40ec70ac0f030ea3ffa"}],"cyborg/policies/arqs.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"9a89017f5bb968480667424640b3f481838dddd2","unresolved":false,"context_lines":[{"line_number":24,"context_line":"        \u0027project_reader_or_admin to grant readers explicit \u0027"},{"line_number":25,"context_line":"        \u0027read-only access to their own ARQs\u0027"},{"line_number":26,"context_line":"    ),"},{"line_number":27,"context_line":"    deprecated_since\u003d\u00272026.2\u0027,"},{"line_number":28,"context_line":")"},{"line_number":29,"context_line":"deprecated_get_one \u003d policy.DeprecatedRule("},{"line_number":30,"context_line":"    name\u003d\u0027cyborg:arq:get_one\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"97a7184d_74722e47","line":27,"updated":"2026-06-23 00:14:48.000000000","message":"DeprecatedRule entries use a bare string deprecated_since\u003d2026.2 instead of oslo_log.versionutils.deprecated enum, unlike the existing device_profiles.py and base.py policies which use versionutils.deprecated.WALLABY.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Inconsistency with the established pattern in cyborg/policies/device_profiles.py and base.py. While oslo.policy accepts strings for deprecated_since, using versionutils enums is the oslo convention and enables programmatic deprecation tracking.\n\n**Suggestion**:\nUse versionutils.deprecated for consistency, e.g. add a versionutils.deprecated release constant or at minimum follow the same style as the existing device_profiles.py DeprecatedRule definitions. If 2026.2 has no versionutils enum yet, document why a string is used.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c55f9500195671ed67189a714dc7d7caa1d8cbb3","unresolved":true,"context_lines":[{"line_number":24,"context_line":"        \u0027project_reader_or_admin to grant readers explicit \u0027"},{"line_number":25,"context_line":"        \u0027read-only access to their own ARQs\u0027"},{"line_number":26,"context_line":"    ),"},{"line_number":27,"context_line":"    deprecated_since\u003d\u00272026.2\u0027,"},{"line_number":28,"context_line":")"},{"line_number":29,"context_line":"deprecated_get_one \u003d policy.DeprecatedRule("},{"line_number":30,"context_line":"    name\u003d\u0027cyborg:arq:get_one\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"e08f1af4_3b885305","line":27,"in_reply_to":"78334970_43c14238","updated":"2026-06-26 11:33:09.000000000","message":"so i didnt do thtat to avoid bumping the min verion of oslo log to 8.1.0 form 5.0.0\nhttps://github.com/openstack/cyborg/blob/master/requirements.txt#L10\n\nas that needs https://github.com/openstack/oslo.log/commit/d0f0bf3ee5d5676b99b4ad7656089808c2aeb35b\nwhich was released in febuary https://github.com/openstack/oslo.log/releases/tag/8.1.0\n\nbut since Takashi added them i guess i can.\n\n\n`deprecated_since\u003dversionutils.deprecated.WALLABY`\nwould be incorrect\n\nit would be \n`deprecated_since\u003dversionutils.deprecated.GAZPACHO`","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c6ed9fb93c93adb93c83c8cd26534e643cfe4985","unresolved":true,"context_lines":[{"line_number":24,"context_line":"        \u0027project_reader_or_admin to grant readers explicit \u0027"},{"line_number":25,"context_line":"        \u0027read-only access to their own ARQs\u0027"},{"line_number":26,"context_line":"    ),"},{"line_number":27,"context_line":"    deprecated_since\u003d\u00272026.2\u0027,"},{"line_number":28,"context_line":")"},{"line_number":29,"context_line":"deprecated_get_one \u003d policy.DeprecatedRule("},{"line_number":30,"context_line":"    name\u003d\u0027cyborg:arq:get_one\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"78334970_43c14238","line":27,"in_reply_to":"97a7184d_74722e47","updated":"2026-06-26 08:05:36.000000000","message":"\u003e DeprecatedRule entries use a bare string deprecated_since\u003d2026.2 instead of oslo_log.versionutils.deprecated enum, unlike the existing device_profiles.py and base.py policies which use versionutils.deprecated.WALLABY.\n\u003e \n\u003e **Severity**: WARNING | **Confidence**: 0.8\n\u003e \n\u003e **Impact**: Inconsistency with the established pattern in cyborg/policies/device_profiles.py and base.py. While oslo.policy accepts strings for deprecated_since, using versionutils enums is the oslo convention and enables programmatic deprecation tracking.\n\u003e \n\u003e **Suggestion**:\n\u003e Use versionutils.deprecated for consistency, e.g. add a versionutils.deprecated release constant or at minimum follow the same style as the existing device_profiles.py DeprecatedRule definitions. If 2026.2 has no versionutils enum yet, document why a string is used.\n\n+1 to this suggestion,\n\nwe need to import \n```\nfrom oslo_log import versionutils\n# and then replace 2026.2 with \n\ndeprecated_since\u003dversionutils.deprecated.WALLABY\n```\nGood to update for consistency.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"55ab441815e61cf5a6abb7fbc3a5315bd1deb1de","unresolved":false,"context_lines":[{"line_number":24,"context_line":"        \u0027project_reader_or_admin to grant readers explicit \u0027"},{"line_number":25,"context_line":"        \u0027read-only access to their own ARQs\u0027"},{"line_number":26,"context_line":"    ),"},{"line_number":27,"context_line":"    deprecated_since\u003d\u00272026.2\u0027,"},{"line_number":28,"context_line":")"},{"line_number":29,"context_line":"deprecated_get_one \u003d policy.DeprecatedRule("},{"line_number":30,"context_line":"    name\u003d\u0027cyborg:arq:get_one\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f03c768_5cfa76bb","line":27,"in_reply_to":"e08f1af4_3b885305","updated":"2026-06-30 11:10:12.000000000","message":"Done","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"9a89017f5bb968480667424640b3f481838dddd2","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    ),"},{"line_number":37,"context_line":"    deprecated_since\u003d\u00272026.2\u0027,"},{"line_number":38,"context_line":")"},{"line_number":39,"context_line":"deprecated_create \u003d policy.DeprecatedRule("},{"line_number":40,"context_line":"    name\u003d\u0027cyborg:arq:create\u0027,"},{"line_number":41,"context_line":"    check_str\u003d\u0027rule:project_member_or_admin\u0027,"},{"line_number":42,"context_line":"    deprecated_reason\u003d("}],"source_content_type":"text/x-python","patch_set":4,"id":"79d63183_c2b6f35d","line":39,"updated":"2026-06-23 00:14:48.000000000","message":"The deprecated_create bridge uses a different check_str (rule:project_member_or_admin) than the other four bridges which use base.deprecated_default (rule:admin_or_owner). This is correct but the inconsistency is subtle.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: An inline comment explaining why create diverges from the other operations would prevent a future developer from accidentally normalizing all five bridges to the same check_str.\n\n**Recommendation**:\nAdd a one-line comment above deprecated_create noting that the prior policy for create was already project_member_or_admin (not rule:default), so the bridge preserves that specific prior behavior rather than the admin_or_owner default used by other operations.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"}],"cyborg/tests/unit/policies/test_arqs.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"9a89017f5bb968480667424640b3f481838dddd2","unresolved":false,"context_lines":[{"line_number":60,"context_line":"            set(self.all_contexts) - set(self.read_authorized_contexts)"},{"line_number":61,"context_line":"        )"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        # Same reasoning applies to write operations."},{"line_number":64,"context_line":"        self.write_authorized_contexts \u003d self.read_authorized_contexts"},{"line_number":65,"context_line":"        self.write_unauthorized_contexts \u003d self.read_unauthorized_contexts"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"d13f9599_7ec212fd","line":63,"updated":"2026-06-23 00:14:48.000000000","message":"The ARQPolicyTest class docstring is thorough but the read and write authorized context lists are identical, which may obscure intent for future maintainers.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Explicitly listing separate read and write context lists (even if currently identical) makes the test structure self-documenting and simplifies future updates when read/write personas diverge.\n\n**Recommendation**:\nConsider keeping the lists separate (not aliased via self.write \u003d self.read) with a comment that they are intentionally identical due to the deprecated bridge accepting all project-scoped contexts. This documents the current state and makes divergence intentional.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"9a89017f5bb968480667424640b3f481838dddd2","unresolved":false,"context_lines":[{"line_number":64,"context_line":"        self.write_authorized_contexts \u003d self.read_authorized_contexts"},{"line_number":65,"context_line":"        self.write_unauthorized_contexts \u003d self.read_unauthorized_contexts"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    @mock.patch(\u0027cyborg.objects.ExtARQ.list\u0027, autospec\u003dTrue)"},{"line_number":68,"context_line":"    def test_get_all_arqs_success(self, mock_list):"},{"line_number":69,"context_line":"        mock_list.return_value \u003d [self.fake_extarq_obj]"},{"line_number":70,"context_line":"        for context in self.read_authorized_contexts:"}],"source_content_type":"text/x-python","patch_set":4,"id":"b69267e3_2b3d9410","line":67,"updated":"2026-06-23 00:14:48.000000000","message":"Only get_all (read) and create (write) policies are tested. The get_one, delete, and update policies have no direct API-level tests despite being distinct policy names with distinct check strings.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: A misnamed or incorrectly scoped policy for get_one, delete, or update would not be caught by the test suite. For example, if the delete check_str were accidentally set to PROJECT_READER_OR_ADMIN instead of PROJECT_MEMBER_OR_SERVICE, the test suite would pass silently.\n\n**Suggestion**:\nAdd test methods for get_one (GET /accelerator_requests/{uuid}), delete (DELETE), and update (PATCH) operations covering both authorized and unauthorized contexts in both test classes. These can reuse the existing authorized/unauthorized context lists.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"9a89017f5bb968480667424640b3f481838dddd2","unresolved":false,"context_lines":[{"line_number":158,"context_line":"    def setUp(self):"},{"line_number":159,"context_line":"        super().setUp()"},{"line_number":160,"context_line":"        self.flags(enforce_new_defaults\u003dTrue, group\u003d\u0027oslo_policy\u0027)"},{"line_number":161,"context_line":"        cyborg_policy._ENFORCER \u003d None"},{"line_number":162,"context_line":"        cyborg_policy.init_enforcer(suppress_deprecation_warnings\u003dTrue)"},{"line_number":163,"context_line":"        self.fake_dp_obj \u003d fake_device_profile.get_obj_devprofs()[1]"},{"line_number":164,"context_line":"        self.fake_extarq_obj \u003d fake_extarq.get_fake_extarq_objs()[0]"}],"source_content_type":"text/x-python","patch_set":4,"id":"8ea956d4_edf05d49","line":161,"updated":"2026-06-23 00:14:48.000000000","message":"The ARQPolicyNewDefaultsTest.setUp reaches into the private cyborg_policy._ENFORCER attribute to reset the cached enforcer before reinitializing.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A helper method or public API for enforcer reset would make the test less fragile against internal refactoring of authorize_wsgi.py and document the intent more clearly.\n\n**Recommendation**:\nConsider adding a class-level or fixture-level helper (e.g. in BasePolicyTest) that encapsulates the _ENFORCER\u003dNone + init_enforcer pattern, with a comment explaining why the singleton must be reset when toggling enforce_new_defaults.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"b74b9d3d20bd09a51083b73e3a0586718a2581a3","unresolved":false,"context_lines":[{"line_number":42,"context_line":"        self.fake_dp_obj \u003d fake_device_profile.get_obj_devprofs()[1]"},{"line_number":43,"context_line":"        self.fake_extarq_obj \u003d fake_extarq.get_fake_extarq_objs()[0]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"        # With enforce_new_defaults\u003dFalse the deprecated bridge accepts"},{"line_number":46,"context_line":"        # any project-scoped context. All project-scoped contexts are"},{"line_number":47,"context_line":"        # authorized; only system-scoped contexts are rejected."},{"line_number":48,"context_line":"        self.read_authorized_contexts \u003d ["},{"line_number":49,"context_line":"            self.legacy_admin_context,"},{"line_number":50,"context_line":"            self.project_admin_context,"},{"line_number":51,"context_line":"            self.legacy_owner_context,"},{"line_number":52,"context_line":"            self.project_member_context,"},{"line_number":53,"context_line":"            self.project_reader_context,"},{"line_number":54,"context_line":"            self.other_project_member_context,"},{"line_number":55,"context_line":"            self.project_foo_context,"},{"line_number":56,"context_line":"            self.project_manager_context,"},{"line_number":57,"context_line":"            self.project_service_context,"},{"line_number":58,"context_line":"        ]"},{"line_number":59,"context_line":"        self.read_unauthorized_contexts \u003d list("},{"line_number":60,"context_line":"            set(self.all_contexts) - set(self.read_authorized_contexts)"},{"line_number":61,"context_line":"        )"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        # Same reasoning applies to write operations."},{"line_number":64,"context_line":"        self.write_authorized_contexts \u003d self.read_authorized_contexts"},{"line_number":65,"context_line":"        self.write_unauthorized_contexts \u003d self.read_unauthorized_contexts"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    @mock.patch(\u0027cyborg.objects.ExtARQ.list\u0027, autospec\u003dTrue)"},{"line_number":68,"context_line":"    def test_get_all_arqs_success(self, mock_list):"}],"source_content_type":"text/x-python","patch_set":5,"id":"69170eee_6a7edeef","line":65,"range":{"start_line":45,"start_character":2,"end_line":65,"end_character":74},"updated":"2026-07-06 22:46:19.000000000","message":"this is not quite true in general, it is but there is a nuance\n\n`rule:admin_or_owner` is the default rule so at the policy level it scorrect that usign the old defaults any token with the admin role or that is issue for the relevent project will be accpated for read or write.\n\nthe api behavior is actully slight difefnt because for the cve fix i also did addtional non policy related enfoceemnt\n\nso to delete a bound arq or to bind it in the first place im requiring the call be made wiht an addtional service token if the admin role is not present on the user token. that however happens after the policy layer so that wont be apprent in these tests.\n\nself.other_project_member_context is also interesting.\n\nit shoudl be able ot see its own arqs but not the arqs form the normal project_id.\ntaht filtering however also happens at the object/db layer so that woudl not be apprent form testing at this level\n\nso form a pure unit test perspective fo the api policy this is correct\n\nif we were to write the same tests as functional tests or gabbi test we woudl ahve to split this up diffenrtly to mic to full db/object behvior.","commit_id":"2819fa5cc5b2de8a4b1fed30070c37164e636313"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"7c56614fabe585f3cbcfac48deba9c2714a9768f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"678eac2b_3b77fb4b","line":249,"updated":"2026-06-30 11:57:08.000000000","message":"Test coverage gap: both test classes exercise only get_all and create. get_one, delete, and update have no tests in either class, leaving three of five migrated operations - including the write ops whose check strings widened to accept role:service - untested at the policy layer.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: The delete/update service-role widening ships untested. A future change that narrows those ops back to a reader-or-admin string, or breaks their deprecated bridges, would not be caught; the create tests cannot cover them since they resolve to a different check string.\n\n**Priority**: Before merge\n**Why This Matters**: This patch\u0027s core deliverable is a verified access-control contract for five endpoints; leaving 60% of the operations (including the service-role widening the release note advertises) untested undermines the migration\u0027s safety guarantee and the stated coverage-completeness goal.\n\n**Recommendation**:\nAdd get_one, delete, and update tests mirroring the existing get_all/create pattern in both classes: a success loop over the authorized contexts, a forbidden loop over the complement, and a system-scope-forbidden check. For delete/update assert project_service_context is authorized in ARQPolicyNewDefaultsTest (proves the service-role widening) and unauthorized in the read path. For get_one, a GET to /accelerator_requests/{uuid} with a mocked ExtARQ.get covers it.","commit_id":"2819fa5cc5b2de8a4b1fed30070c37164e636313"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"c0cf0caf7510aadf8d04a0bca124b5d926850fc9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"a635dd60_f4554d19","line":249,"in_reply_to":"175b2f4d_c73a7276","updated":"2026-07-20 21:41:55.000000000","message":"Done","commit_id":"2819fa5cc5b2de8a4b1fed30070c37164e636313"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"b74b9d3d20bd09a51083b73e3a0586718a2581a3","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"175b2f4d_c73a7276","line":249,"in_reply_to":"678eac2b_3b77fb4b","updated":"2026-07-06 22:46:19.000000000","message":"this is valid and i shoudl correct this before proceeding.","commit_id":"2819fa5cc5b2de8a4b1fed30070c37164e636313"}],"releasenotes/notes/srbac-persona-migration-5d1a48ee7c479629.yaml":[{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c6ed9fb93c93adb93c83c8cd26534e643cfe4985","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    the OpenStack TC\u0027s Consistent and Secure RBAC community goal."},{"line_number":15,"context_line":"    New personas for ARQ endpoints:"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    * **reader** -- read-only access to ARQs within the caller\u0027s"},{"line_number":18,"context_line":"      project."},{"line_number":19,"context_line":"    * **member** and **service** -- ARQ write operations (create,"},{"line_number":20,"context_line":"      delete, update), supporting both Nova\u0027s current"},{"line_number":21,"context_line":"      token-forwarding and future service-credential presentation."},{"line_number":22,"context_line":"    * **admin** -- full access to all ARQ operations via implied"},{"line_number":23,"context_line":"      roles."},{"line_number":24,"context_line":"upgrade:"},{"line_number":25,"context_line":"  - |"},{"line_number":26,"context_line":"    Cyborg now overrides ``enforce_new_defaults`` to ``False`` in its"},{"line_number":27,"context_line":"    default configuration. During the transition window, both legacy"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"bbf586f3_7dbf4d13","line":24,"range":{"start_line":17,"start_character":3,"end_line":24,"end_character":8},"updated":"2026-06-26 08:05:36.000000000","message":"+1 for adding it to the releasenotes.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"9a89017f5bb968480667424640b3f481838dddd2","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    * **2027.2** -- the deprecated legacy rules and bridges will be"},{"line_number":40,"context_line":"      removed."},{"line_number":41,"context_line":"  - |"},{"line_number":42,"context_line":"    The ``manager`` and ``service`` roles must exist in Keystone"},{"line_number":43,"context_line":"    (both standard since Yoga). The ``service`` role must be"},{"line_number":44,"context_line":"    assigned to Nova\u0027s service account for the service-token gate"},{"line_number":45,"context_line":"    to function."}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1fc1c2b6_0e8fe3b6","line":42,"updated":"2026-06-23 00:14:48.000000000","message":"The release note upgrade section states the manager and service roles must exist in Keystone, but ARQ policies do not directly use role:manager in any check string. The manager role is only covered transitively via implied roles.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Operators reading the release note may believe the manager role is a direct requirement for ARQ access when it is not. The project_manager_or_admin rule exists in base.py but is not referenced by any ARQ policy check string.\n\n**Suggestion**:\nClarify the release note to state that the service role is required for ARQ service-token operations, and the manager role is used by other cyborg resources but not ARQ policies directly. Alternatively, if manager access to ARQs is intended, document the implied-role chain.","commit_id":"024b06d6e6047beffe2536c7f2b6c1bebeb6d979"}]}