Skip to content

HYPERFLEET-1232 - docs: move detailed sentinel docs from architecture repo#222

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift-hyperfleet:mainfrom
rafabene:HYPERFLEET-1232-move-sentinel-docs
Jul 10, 2026
Merged

HYPERFLEET-1232 - docs: move detailed sentinel docs from architecture repo#222
openshift-merge-bot[bot] merged 1 commit into
openshift-hyperfleet:mainfrom
rafabene:HYPERFLEET-1232-move-sentinel-docs

Conversation

@rafabene

@rafabene rafabene commented Jul 9, 2026

Copy link
Copy Markdown
Member

Summary

  • Add docs/decision-engine.md with all detailed content moved from the architecture repo's sentinel.md: CEL function reference, status tracking semantics, adapter status update contract, service components, and decision engine test scenarios (Tests 1-12)
  • Fix outdated property name hyperfleet_api.endpointclients.hyperfleet_api.base_url in docs/sentinel-operator-guide.md (4 locations: YAML config block, Required Fields table, Deployment Checklist, Troubleshooting table) — reported by Martin Liptak during Ignition Day
  • Add cross-references between existing docs and the new decision-engine.md

Companion PR for the architecture repo will trim sentinel.md to keep only the high-level design document (What/Why, How, Trade-offs, Alternatives Considered).

Test plan

  • Verify all internal links in decision-engine.md resolve correctly
  • Verify docs/config.md cross-reference to decision-engine.md works
  • Verify docs/sentinel-operator-guide.md cross-reference in Additional Resources works
  • Confirm no content loss — all moved content matches the architecture repo's original
  • Verify the property name clients.hyperfleet_api.base_url matches the actual config struct

@openshift-ci openshift-ci Bot requested review from tirthct and vkareh July 9, 2026 18:57
@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Adds a Decision Engine reference covering CEL evaluation, status semantics, adapter update contracts, Sentinel components, publishing behavior, and test scenarios. Updates operator and configuration documentation to use clients.hyperfleet_api.base_url and clients.hyperfleet_api.timeout, and links to the new reference. No CWE/CVE IDs apply to these documentation-only changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output ✅ Passed PASS: PR touches docs only; repo-wide scan found no non-test slog/logr/zap/fmt.Print* call containing token/password/credential/secret (CWE-532 not introduced).
No Hardcoded Secrets ✅ Passed Strict scan of added lines in the changed docs found no hardcoded creds, embedded-credential URLs, private keys, or long base64 strings (CWE-798/CWE-321).
No Weak Cryptography ✅ Passed Only docs changed; searched those files and found no md5/des/rc4/sha1/ECB/ConstantTimeCompare/hmac.Equal or custom crypto code.
No Injection Vectors ✅ Passed Docs-only PR; touched files contain no exec.Command, template.HTML, yaml.Unmarshal, or SQL/query concatenation patterns. No CWE-78/79/89/502 injection vectors introduced.
No Privileged Containers ✅ Passed Only docs changed; no Kubernetes/OpenShift manifests, Helm templates, or Dockerfiles, and no privileged fields/USER root patterns were present.
No Pii Or Sensitive Data In Logs ✅ Passed Docs-only diff; no new slog/log/fmt.Print* statements or examples leaking PII, session IDs, or credentials. CWE-532/CWE-200 not implicated.
Title check ✅ Passed The title matches the main change: moving detailed Sentinel docs into this repo.
Description check ✅ Passed The description directly describes the documentation migration and config rename changes in this PR.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
✨ Simplify code
  • Create PR with simplified code

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.


Comment @coderabbitai help to get the list of available commands.

@rafabene

rafabene commented Jul 9, 2026

Copy link
Copy Markdown
Member Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown
✅ Action performed

Full review finished.

@hyperfleet-ci-bot

hyperfleet-ci-bot Bot commented Jul 9, 2026

Copy link
Copy Markdown

Risk Score: 2 — risk/medium

Signal Detail Points
PR size 636 lines (>500) +2
Sensitive paths none +0

Computed by hyperfleet-risk-scorer

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
docs/sentinel-operator-guide.md (1)

682-699: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Finish the config-path rename in the troubleshooting table.

The 401 Unauthorized row still refers to hyperfleet_api, so this section now mixes the old flat schema with the new nested clients.hyperfleet_api.* schema. Update that row too to keep the operator guide consistent.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/sentinel-operator-guide.md` around lines 682 - 699, The troubleshooting
table still uses the old flat `hyperfleet_api` config path in the 401
Unauthorized row, so update that entry to the new nested
`clients.hyperfleet_api.*` schema. Make the change in the operator guide’s
troubleshooting section and keep the wording aligned with the rest of the
config-path renames in that table.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/decision-engine.md`:
- Around line 346-349: The cross-reference in the Message Data Composition
section points to an outdated config.md anchor, so update the link target to the
current generated heading for the Message Data section. Locate the markdown text
in the decision-engine documentation near the “Message Data Composition (CEL
Expressions)” block and change the reference from the old anchor to the current
`#message-data-cel-expressions` anchor so the link resolves correctly.
- Around line 502-518: The note in the Test 7 example should be tightened to
reflect the actual default-config behavior: when the Reconciled condition is
missing, `has_ref_time` in the decision logic prevents `timestamp(ref_time)`
from evaluating a zero-value condition, so `not_reconciled_and_debounced` is not
the reason this publishes. Update the explanation around
`condition("Reconciled")`, `has_ref_time`, `not_reconciled_and_debounced`, and
`is_new_resource` to state that the decision is PUBLISH solely because
`is_new_resource` is true.
- Around line 481-498: Update the Test 6 note in decision-engine.md to reflect
that `message_decision` evaluates `generation_mismatch` directly via
`resource.generation > condition("Reconciled").observed_generation`, not only
through `not_reconciled_and_debounced`. Adjust the explanation around the
`Decision: PUBLISH` case to mention the `generation_mismatch` path and keep the
rest of the test data intact so the description matches the actual default rule
behavior.

---

Outside diff comments:
In `@docs/sentinel-operator-guide.md`:
- Around line 682-699: The troubleshooting table still uses the old flat
`hyperfleet_api` config path in the 401 Unauthorized row, so update that entry
to the new nested `clients.hyperfleet_api.*` schema. Make the change in the
operator guide’s troubleshooting section and keep the wording aligned with the
rest of the config-path renames in that table.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 498839a2-4416-4c7c-9079-b1549ff35542

📥 Commits

Reviewing files that changed from the base of the PR and between c919524 and c44c863.

📒 Files selected for processing (3)
  • docs/config.md
  • docs/decision-engine.md
  • docs/sentinel-operator-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)

Comment thread docs/decision-engine.md
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch from c44c863 to 6c38af3 Compare July 9, 2026 19:08

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/decision-engine.md`:
- Around line 267-280: The broker config source description is incorrect and
points operators to the wrong input path. Update the references around the
LoadBrokerConfig flow to state that broker configuration is loaded from
broker.yaml or the BROKER_CONFIG_FILE environment variable, not from Sentinel
YAML or a ConfigMap, and keep the wording aligned with the hyperfleet-broker
library contract. Also revise any related mentions in the same section so
BuildLabelSelector/Load(configPath) documentation clearly separates Sentinel
config from broker config.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 81c7e7db-7f76-49c5-a799-3d11496b3e1b

📥 Commits

Reviewing files that changed from the base of the PR and between c44c863 and 6c38af3.

📒 Files selected for processing (3)
  • docs/config.md
  • docs/decision-engine.md
  • docs/sentinel-operator-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
✅ Files skipped from review due to trivial changes (1)
  • docs/config.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/sentinel-operator-guide.md

Comment thread docs/decision-engine.md Outdated
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch from 6c38af3 to 42d027d Compare July 9, 2026 19:18

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/decision-engine.md`:
- Around line 181-184: The generation-flow description is inconsistent with the
documented default decision logic in message_decision, which already checks
generation_mismatch. Update the wording in the “How Generation Changes Flow
Through the System” section to say the Sentinel relies on the default rules’
generation_mismatch evaluation (along with Reconciled) rather than implying no
separate generation check exists. Keep the explanation aligned with the result
expression and reference message_decision and generation_mismatch when revising
the text.
- Around line 403-446: The skip examples in the decision-engine docs are
incomplete because they omit the observed_generation check, which affects
whether the default decision stays false. Update the Test 1 and Test 3 scenarios
in the decision logic section to use condition("Reconciled").observed_generation
equal to resource.generation, and keep the existing refs to ref_time,
is_reconciled, is_new_resource, reconciled_and_stale, and
not_reconciled_and_debounced so the outcomes remain SKIP as described.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: aeddaf1e-5211-43b4-8614-d834ab050e74

📥 Commits

Reviewing files that changed from the base of the PR and between 6c38af3 and 42d027d.

📒 Files selected for processing (3)
  • docs/config.md
  • docs/decision-engine.md
  • docs/sentinel-operator-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
✅ Files skipped from review due to trivial changes (2)
  • docs/config.md
  • docs/sentinel-operator-guide.md

Comment thread docs/decision-engine.md
Comment thread docs/decision-engine.md
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch from 42d027d to 749ddbd Compare July 9, 2026 19:22

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/decision-engine.md`:
- Around line 419-432: Complete the decision breakdowns in the decision-engine
examples by adding the missing generation_mismatch term to the evaluated params
and result expression in the test cases. In the Test 2 and Test 5 sections of
decision-engine.md, update the breakdowns around the message decision logic so
they explicitly show generation_mismatch alongside ref_time, is_reconciled,
is_new_resource, reconciled_and_stale, and not_reconciled_and_debounced. Also
correct Test 5’s value so it reflects that when Reconciled is absent,
observed_generation defaults to 0 and generation_mismatch evaluates to true.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 30a36c1d-5901-4350-bf32-fef49ee9d818

📥 Commits

Reviewing files that changed from the base of the PR and between 42d027d and 749ddbd.

📒 Files selected for processing (3)
  • docs/config.md
  • docs/decision-engine.md
  • docs/sentinel-operator-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
✅ Files skipped from review due to trivial changes (1)
  • docs/config.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/sentinel-operator-guide.md

Comment thread docs/decision-engine.md Outdated
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch from 749ddbd to eaa6b02 Compare July 9, 2026 19:39
Comment thread docs/decision-engine.md
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md Outdated
Comment thread docs/decision-engine.md Outdated
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch 2 times, most recently from 99adcf9 to daec9d5 Compare July 10, 2026 12:44
rafabene added a commit to rafabene/hyperfleet-architecture that referenced this pull request Jul 10, 2026
Move detailed operational/reference content to the sentinel repo
(openshift-hyperfleet/hyperfleet-sentinel#222) and keep only the
high-level design document per the component doc standard.

Removed sections (now in sentinel repo docs/decision-engine.md):
- Message Decision details, CEL Function Reference
- Adapter Status Update Contract, Status Tracking
- Service Components, Decision Engine Test Scenarios
- Configuration YAML examples, Resource Filtering examples

Retained sections: What & Why, Architecture (diagrams), Decision
Logic (conceptual), Trade-offs, Alternatives Considered, Post-MVP.

Also updates cross-references in condition-mapping-design.md,
glossary.md, and v0.2.0-to-v1.0.0-upgrade-guide.md to point to
the sentinel repo for detailed content.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/decision-engine.md`:
- Around line 121-126: Clarify the Test 12 missing-condition note: explain that
when the Applied condition is absent, is_applied short-circuits before
timestamp(ref_time) is evaluated, so this example skips publishing rather than
converting a missing timestamp.
- Around line 350-353: Update the “Implementation Requirements” list in
decision-engine.md to describe GCP Pub/Sub support through the hyperfleet-broker
abstraction rather than directly using cloud.google.com/go/pubsub, matching the
existing RabbitMQ requirement’s framing.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 47531230-4fc6-41a4-ba5f-8e9ecf170dc1

📥 Commits

Reviewing files that changed from the base of the PR and between eaa6b02 and 99adcf9.

📒 Files selected for processing (3)
  • docs/config.md
  • docs/decision-engine.md
  • docs/sentinel-operator-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
✅ Files skipped from review due to trivial changes (2)
  • docs/config.md
  • docs/sentinel-operator-guide.md

Comment thread docs/decision-engine.md
Comment thread docs/decision-engine.md Outdated
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch from daec9d5 to d85bcfb Compare July 10, 2026 12:52
… repo

Move operational/reference content from the architecture repo's
sentinel.md to the sentinel repo's docs/ directory. The architecture
repo now retains only the high-level design document.

New file:
- docs/decision-engine.md: CEL function reference, status tracking,
  adapter status contract, service components, test scenarios (1-12)

Updated files:
- docs/sentinel-operator-guide.md: fix outdated property name
  hyperfleet_api.endpoint -> clients.hyperfleet_api.base_url
- docs/config.md: add cross-reference to decision-engine.md
@rafabene rafabene force-pushed the HYPERFLEET-1232-move-sentinel-docs branch from d85bcfb to f16a757 Compare July 10, 2026 12:56
rafabene added a commit to rafabene/hyperfleet-architecture that referenced this pull request Jul 10, 2026
Move detailed operational/reference content to the sentinel repo
(openshift-hyperfleet/hyperfleet-sentinel#222) and keep only the
high-level design document per the component doc standard.

Removed sections (now in sentinel repo docs/decision-engine.md):
- Message Decision details, CEL Function Reference
- Adapter Status Update Contract, Status Tracking
- Service Components, Decision Engine Test Scenarios
- Configuration YAML examples, Resource Filtering examples

Retained sections: What & Why, Architecture (diagrams), Decision
Logic (conceptual), Trade-offs, Alternatives Considered, Post-MVP.

Also updates cross-references in condition-mapping-design.md,
glossary.md, and v0.2.0-to-v1.0.0-upgrade-guide.md to point to
the sentinel repo for detailed content.
@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tirthct

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot Bot merged commit a7c4cae into openshift-hyperfleet:main Jul 10, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants