OSEP-0004/0005/0014: mark implemented and add tenant namespace startup validation - #1389
Conversation
github-actions
Bot
added
documentation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 138141ce99
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2178f376d9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Enforce the OSEP-0014 fail-fast requirement that all tenant namespaces exist and are accessible at startup. Adds validate_tenant_namespaces() and wires it into the lifespan startup path after the tenant provider starts, aggregating all failing namespaces into a single fatal error. Addresses Codex review feedback on PR #1389.
github-actions
Bot
added
component/server
size/L
Pangjiping
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95a15c4fe0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
- Grant the Helm ClusterRole get/list access to namespaces so CoreV1Api.read_namespace works under the default deployment (fixes crash-loop on 403 during tenant startup validation). - Add supports_enumeration to TenantProvider: file provider enumerates its config at startup, HTTP provider cannot. - validate_tenant_namespaces_on_startup() skips validation with an explicit warning for non-enumerable providers instead of validating an empty set and reporting success. - Document the HTTP provider skip in docs/guides/multi-tenancy.md.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7ffbab018
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…ol marker - Split namespaces into its own ClusterRole rule with get/list only; the startup guard only calls read_namespace, so the full write verbs on namespaces are not needed (addresses Codex P1). - Declare supports_enumeration as a protocol attribute instead of a property stub to satisfy the static-analysis no-effect check.
💡 Codex Review Keep OSEP-0014 non-implemented until opt-in matches
For operators following the newly AGENTS.md reference: AGENTS.md:L44-L44 ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59e78e4f02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| last-updated: 2026-05-07 | ||
| status: draft | ||
| last-updated: 2026-07-27 | ||
| status: implemented |
There was a problem hiding this comment.
For file-backed tenants, this implemented status advertises the requirement at line 74 that API-key authentication use constant-time comparison, but FileTenantProvider.lookup() still authenticates with self._lookup.get(api_key) (server/opensandbox_server/tenants/file_provider.py:110-112), and the tenant authentication path contains no compare_digest call. Retain an in-progress status or implement and test constant-time tenant-key matching before declaring the proposal fully implemented.
AGENTS.md reference: AGENTS.md:L44-L44
Useful? React with 👍 / 👎.
| last-updated: 2026-05-07 | ||
| status: draft | ||
| last-updated: 2026-07-27 | ||
| status: implemented |
There was a problem hiding this comment.
When an operator follows OSEP-0014 and mounts tenants.toml without adding [tenants] to server.toml, _build_tenant_provider() returns None solely because config.tenants is absent (server/opensandbox_server/main.py:66-68), leaving the server in legacy single-tenant authentication despite line 71 requiring file existence to be the sole trigger. The operations guide instead documents [tenants] as mandatory, so update the proposal's requirement/design to match that shipped contract or keep the proposal in progress rather than marking the contradictory contract fully implemented.
AGENTS.md reference: AGENTS.md:L44-L44
Useful? React with 👍 / 👎.
3 participants
Summary
Mark three OSEPs as
implementedand close the one implementation gap that blocked OSEP-0014 from that status.OSEP status updates
Reflect current implementation state across all proposal indexes (frontmatter,
oseps/README.md,docs/community/oseps.md,ROADMAP.md):implementing→implementedimplementing→implementeddraft→implementedlast-updatedbumped to 2026-07-27 for each.Tenant namespace startup validation (OSEP-0014)
OSEP-0014 requires (line 75) that startup MUST validate all tenant namespaces exist and are accessible (fail-fast). This was previously missing —
validate_tenant_config()only checked runtime type and legacy API key, so the server could start with an invalid tenant namespace and fail only at request time.validate_tenant_namespaces()inserver/opensandbox_server/tenants/__init__.py: reads each tenant namespace viaCoreV1Api, dedupes shared namespaces, and aggregates all missing/inaccessible namespaces into a single fatal error.server/opensandbox_server/main.py, after the tenant provider starts and before serving traffic; failures exit the process.server/tests/test_tenants.py(ok / dedup / 404 missing / 403 forbidden / aggregated failures).Verification
uv run ruff check— cleanuv run pyright(tenants) — 0 errorsuv run pytest tests/test_tenants.py— 36 passedNotes
Addresses Codex review feedback on this PR (index sync + OSEP-0014 fail-fast guard).