feat(acms): add scoped backend view filtering #193

Closed
opened 2026-02-22 23:40:00 +00:00 by freemo · 1 comment
Owner

Metadata

  • Commit Message: feat(acms): add scoped backend view filtering
  • Branch: feature/m6-acms-scoped-view

Background

ScopedBackendView filters text, vector, and graph queries to project resources. Enforcement hooks are integrated into context retrieval services and StrategyCoordinator. Allowlist/denylist resolution uses project resource links and aliases.

Acceptance Criteria

  • Implement ScopedBackendView that filters text/vector/graph queries to project resources.
  • Add enforcement hooks in context retrieval services and StrategyCoordinator.
  • Add allowlist/denylist resolution for resource scopes using project resource links and aliases.
  • Log and reject context requests that reference resources outside scope (security guard).
  • Add unit helper to resolve alias -> resource_id mapping and validate uniqueness.

Definition of Done

This issue is complete when:

  • All subtasks below are completed and checked off.
  • A Git commit is created where the first line of the commit message matches
    the Commit Message in Metadata exactly, followed by a blank line, then
    additional lines providing relevant details about the implementation. The
    commit body should be appropriate in size for a commit message and relatively
    complete in describing what was done.
  • The commit is pushed to the remote on the branch matching the Branch in
    Metadata exactly.
  • The commit is submitted as a pull request to master, reviewed, and
    merged before this issue is marked done.

Subtasks

  • Implement ScopedBackendView that filters text/vector/graph queries to project resources.
  • Add enforcement hooks in context retrieval services and StrategyCoordinator.
  • Add allowlist/denylist resolution for resource scopes using project resource links and aliases.
  • Log and reject context requests that reference resources outside scope (security guard).
  • Add unit helper to resolve alias -> resource_id mapping and validate uniqueness.
  • Add guard for mixed project scopes (explicit error when request spans unlinked projects).
  • Add docs/reference/scoped_backend_view.md with security guarantees.
  • Add examples of allowlist/denylist configurations.
  • Tests (Behave): Add features/scoped_view.feature for cross-project isolation.
  • Tests (Robot): Add robot/scoped_view.robot smoke tests.
  • Tests (ASV): Add benchmarks/scoped_view_bench.py for filter overhead.
  • Verify coverage >=97% via nox -s coverage_report. If coverage is <97% then review the current unit test coverage report at build/coverage.xml and use it to write new Behave based unit tests to improve coverage on whichever file has the most uncovered lines by writing tests that will target the uncovered lines in the report. Once that is done rerun nox -s coverage_report to verify all tests pass and coverage is above >=97%. Only mark this as complete once coverage is >=97%, if not repeat this task as many times as is needed until coverage reaches >=97%.
  • Run nox (all default sessions, including benchmark), fix any errors if needed ensuring nox passes across entire code base, do not ignore any failure even if it seems unrelated to this commit, fix it.

Section: #### M5: ACMS v1 + Context Scaling (Day 26)
Status: Open

## Metadata - **Commit Message**: `feat(acms): add scoped backend view filtering` - **Branch**: `feature/m6-acms-scoped-view` ## Background ScopedBackendView filters text, vector, and graph queries to project resources. Enforcement hooks are integrated into context retrieval services and StrategyCoordinator. Allowlist/denylist resolution uses project resource links and aliases. ## Acceptance Criteria - [x] Implement ScopedBackendView that filters text/vector/graph queries to project resources. - [x] Add enforcement hooks in context retrieval services and StrategyCoordinator. - [x] Add allowlist/denylist resolution for resource scopes using project resource links and aliases. - [x] Log and reject context requests that reference resources outside scope (security guard). - [x] Add unit helper to resolve alias -> resource_id mapping and validate uniqueness. ## Definition of Done This issue is complete when: - All subtasks below are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. The commit body should be appropriate in size for a commit message and relatively complete in describing what was done. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. ## Subtasks - [x] Implement ScopedBackendView that filters text/vector/graph queries to project resources. - [x] Add enforcement hooks in context retrieval services and StrategyCoordinator. - [x] Add allowlist/denylist resolution for resource scopes using project resource links and aliases. - [x] Log and reject context requests that reference resources outside scope (security guard). - [x] Add unit helper to resolve alias -> resource_id mapping and validate uniqueness. - [x] Add guard for mixed project scopes (explicit error when request spans unlinked projects). - [x] Add `docs/reference/scoped_backend_view.md` with security guarantees. - [x] Add examples of allowlist/denylist configurations. - [x] Tests (Behave): Add `features/scoped_view.feature` for cross-project isolation. - [x] Tests (Robot): Add `robot/scoped_view.robot` smoke tests. - [x] Tests (ASV): Add `benchmarks/scoped_view_bench.py` for filter overhead. - [ ] Verify coverage >=97% via `nox -s coverage_report`. If coverage is <97% then review the current unit test coverage report at `build/coverage.xml` and use it to write new Behave based unit tests to improve coverage on whichever file has the most uncovered lines by writing tests that will target the uncovered lines in the report. Once that is done rerun `nox -s coverage_report` to verify all tests pass and coverage is above >=97%. Only mark this as complete once coverage is >=97%, if not repeat this task as many times as is needed until coverage reaches >=97%. - [ ] Run `nox` (all default sessions, including benchmark), fix any errors if needed ensuring nox passes across **entire** code base, do not ignore any failure even if it seems unrelated to this commit, fix it. **Section**: #### M5: ACMS v1 + Context Scaling (Day 26) **Status**: Open
freemo added this to the v3.4.0 milestone 2026-02-22 23:40:00 +00:00
Author
Owner

Expected completion updated (Day 15 rebaseline): Day 35 / 2026-03-15 (previously Day 31 / 2026-03-11)

**Expected completion updated (Day 15 rebaseline):** Day 35 / 2026-03-15 (previously Day 31 / 2026-03-11)
freemo added the due date 2026-03-08 2026-02-23 18:41:39 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

2026-03-08

Blocks
#396 Epic: ACMS Context Pipeline
cleveragents/cleveragents-core
Depends on
Reference
cleveragents/cleveragents-core#193
No description provided.