feat: account-management wave — account_group, role, user (admin-gated, green) - #90
Merged
Conversation
… green account_group, role and user: ingested, curated, recorded live under an admin-scoped token, and green through the full acceptance lifecycle -- which runs only under TFPFGEN_ACC_ADMIN and skips cleanly without it, proven by the ungated sweep. What the live rounds established, all recorded in the blueprints: - A permission-less role create answers 500 -- a genuine ThousandEyes API bug -- so permissions is effectively required and the fixtures carry real permission ids. The response echoes permissions as expanded objects, never the id list, so the attribute is write-only with state carrying the configuration; user role assignments get the same request-shaped modelling (accountGroupRoles in, expanded allAccountGroupRoles out, the latter dropped as a drift-prone echo). - Users need a login account group and at least one role, and emails are globally unique -- the operator's own address was already taken by their real account, which the first record round discovered as "already exists" on every create. Fixtures use a plus-tagged variant; deletion frees the email immediately, so sequential probe creates and repeated acceptance runs both work. all_account_group_role_ids is a curated omission: live role ids, duplicating the assignment the fixtures already exercise. - account_group updates answered 403 under this token on the first round's maximal; the second round's rehearsal ran clean. Two toolkit fixes the wave forced: - The sweeper resolves phantom intents by proven absence. A create the API refused after the intent was written -- the 500-ing roles -- left a ledger no pass could clear: no id for the ledger pass, no object for the prefix pass. When a complete collection read does not contain the stamped name, the intent resolves as never-created instead of holding every future record hostage to phantom debris. - Verify compares facts even when the replay reproduces a recorded stopping error. The account_group snapshot legitimately contains a delete the API refused; replay reproducing that error is replay working, and what verify asserts is fact purity -- the error is part of the transcript. Gates: root and pilot suites green, all snapshots replay-verify, every merge -check green, static facts match the pinned SDK, interop re-baselined, ungated sweep green with the admin trio skipping, gated trio green under TFPFGEN_ACC_ADMIN. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The emitted code was already clean -- these were appended by hand and never went through the formatter the emitted files are held to. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Generation was not finished when emit returned: five waves changed schema descriptions and CI, not emit, noticed docs/ was stale -- the "terraform validate" job failed before validate ever ran, at its docs-drift first step. The battery now runs by default after every write: - go build ./... -- nothing else matters if the module does not compile - go generate . -- tfplugindocs, when the module declares the directive; stale registry docs were this battery's founding failure - terraform fmt -recursive -- advisory-fixing but still failing, because the emitter aligns its own output and a formatter rewrite means the alignment drifted; the diff is the bug report terraform validate stays a CI job: it needs the provider compiled into a dev-override, which is workflow plumbing rather than emission. -skip-postcheck exists for tight inner loops, and nothing before a commit should use it. Also: merge -check treats an empty facts document as trivially reflected. A rehearse-only recording whose bodies were refused legitimately commits one -- the transcript and its notes are the evidence -- and the CI gate was failing over that honesty. The stale docs/ from the last three waves regenerate here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A test's temp dir and an -only inspection have no module to compile or docs to regenerate; the battery gates real provider roots, which carry go.mod. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stage 5 of the Phase 6e program:
thousandeyes_account_group,thousandeyes_role,thousandeyes_user— recorded live under an admin-scoped token, green through the full acceptance lifecycle underTFPFGEN_ACC_ADMIN, skipping cleanly without it (proven by the ungated sweep).Live findings, curated with evidence
permissionsis modelled write-only (ids in, expanded objects echoed out).all_account_group_role_idsis a curated omission (live ids, duplicatingaccount_group_roles); the expandedallAccountGroupRolesecho is dropped as drift-prone.aid→idconvention, sweep override, create returns its ownCreatedAccountGrouptype.Toolkit fixes the wave forced
Gates
Root + pilot suites green · all snapshots replay-verify · every
merge -checkgreen · static facts match the pinned SDK · interop re-baselined · ungated sweep green (admin trio skips) · gated trio green underTFPFGEN_ACC_ADMIN.🤖 Generated with Claude Code