From a60d65c9a20b8845abccd781a5e69b15cdeaca50 Mon Sep 17 00:00:00 2001 From: Brian Grant Date: Wed, 9 Sep 2026 15:29:49 -0700 Subject: [PATCH] Fix "an ValidationError" left by the rename The ApplyGates -> ValidationErrors substitution rewrote the noun and left the article: "An ApplyGate attaches" became "An ValidationError attaches", and "an ApplyWarning" became "an ValidationWarning". Nineteen files, in help text, SKILL.md prose, READMEs, a demo transcript, and one user-facing string in promoter's publish refusal. Only the article changed. managerkit and eks-manager still build, and promoter/app still builds. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Ge1C6Wm1qR3WUCxEZKPboc --- autoscale-manager/skills/autoscale-edit/SKILL.md | 2 +- configboard/demo/TRANSCRIPT.md | 2 +- configboard/demo/manifest.tsv | 2 +- cost-management-app/AI_START_HERE.md | 2 +- eks-manager/README.md | 4 ++-- eks-manager/internal/cli/guardrails.go | 2 +- managerkit/guardrails/annotate.go | 2 +- managerkit/guardrails/query.go | 2 +- namespace-manager/skills/namespace-backfill/SKILL.md | 2 +- namespace-manager/skills/namespace-enforce/SKILL.md | 2 +- network-policy-manager/skills/netpol-fix/SKILL.md | 2 +- network-policy-manager/skills/netpol-guardrails/SKILL.md | 2 +- .../skills/observability-instrument/SKILL.md | 2 +- promoter/AI_START_HERE.md | 2 +- promoter/README.md | 2 +- promoter/app/src/data/promote.ts | 2 +- scheduling-manager/skills/scheduling-place/SKILL.md | 2 +- workload-manager/skills/workload-fleet/SKILL.md | 2 +- workload-manager/skills/workload-harden/SKILL.md | 2 +- 19 files changed, 20 insertions(+), 20 deletions(-) diff --git a/autoscale-manager/skills/autoscale-edit/SKILL.md b/autoscale-manager/skills/autoscale-edit/SKILL.md index 36449a2..85b09d2 100644 --- a/autoscale-manager/skills/autoscale-edit/SKILL.md +++ b/autoscale-manager/skills/autoscale-edit/SKILL.md @@ -60,7 +60,7 @@ All **edit Units but do not publish them** — rolling out is a separate `cub re ## Stop conditions -- An ValidationError attaches (a validating Trigger failed). **Do not bypass** — fix the data (or the rule), via **triggers-and-applygates**. +- A ValidationError attaches (a validating Trigger failed). **Do not bypass** — fix the data (or the rule), via **triggers-and-applygates**. - The user wants the change deployed — hand off to `release-publish`. ## Tool boundary diff --git a/configboard/demo/TRANSCRIPT.md b/configboard/demo/TRANSCRIPT.md index 9cb94cd..73e7721 100644 --- a/configboard/demo/TRANSCRIPT.md +++ b/configboard/demo/TRANSCRIPT.md @@ -14,7 +14,7 @@ were edited after the fact. **0:00 · Fleet Overview** > configboard — BI-style dashboards over ConfigHub configuration data. Fleet Overview: -> 85 Units under management, 25% applied and current, nothing blocked by an validation error. +> 85 Units under management, 25% applied and current, nothing blocked by a validation error. configboard is a small React app that treats ConfigHub as a BI backend. Selection, projection, and joins happen on the server through the same `where` clauses the CLI diff --git a/configboard/demo/manifest.tsv b/configboard/demo/manifest.tsv index d141759..7fc8ddf 100644 --- a/configboard/demo/manifest.tsv +++ b/configboard/demo/manifest.tsv @@ -1,4 +1,4 @@ -frame-01-fleet-overview.png 6.0 configboard — BI-style dashboards over ConfigHub configuration data.\nFleet Overview: 85 Units under management, 25% applied and current, nothing blocked by an validation error. +frame-01-fleet-overview.png 6.0 configboard — BI-style dashboards over ConfigHub configuration data.\nFleet Overview: 85 Units under management, 25% applied and current, nothing blocked by a validation error. frame-02-show-the-query.png 6.0 Every panel can show its query. The code icon reveals the equivalent cub command —\nhere `cub space list`, which uses the one server-side rollup ConfigHub offers. frame-03-cross-filter.png 5.5 Clicking a bar cross-filters the whole dashboard. A chip records the scope, and Clear all removes it. frame-04-compliance-findings.png 6.5 Compliance: 36 open findings across 17 Units. These come from the guardrail Triggers the fleet\nmanagers already install — configboard reads recorded findings rather than running its own scan. diff --git a/cost-management-app/AI_START_HERE.md b/cost-management-app/AI_START_HERE.md index 2719d2f..f74502a 100644 --- a/cost-management-app/AI_START_HERE.md +++ b/cost-management-app/AI_START_HERE.md @@ -10,7 +10,7 @@ zero-dependency CLI sibling and no `setup.sh` — the early stages run on a cold clone with no install and no ConfigHub account. The neighbouring [`../cost-estimator`](../cost-estimator) is the enforcement -plane of the same problem: a price book and an validation error that block +plane of the same problem: a price book and a validation error that block over-budget changes before they ship. This example is the reduction plane: it finds money already leaking and claws it back through governed mutations. The two are complementary, not competing. diff --git a/eks-manager/README.md b/eks-manager/README.md index 17d804d..3ec9d4a 100644 --- a/eks-manager/README.md +++ b/eks-manager/README.md @@ -93,7 +93,7 @@ its Units *describe* a cluster rather than deploy to one. A cluster is a **Space** (`eks--`), labelled `Cluster`, `Region`, `Environment`, `Provider=aws`. Inside it, **one managed resource per Unit** — so -a nodegroup scale never shares a revision, a diff, or an ValidationError with the +a nodegroup scale never shares a revision, a diff, or a ValidationError with the control plane. The Space's Target is the **Crossplane management cluster**: ConfigHub publishes @@ -209,7 +209,7 @@ Spaces cloned from it is variant promotion, which lives in `cub` and the `guardrails install` creates validating Triggers in a policy Space and wires them to every cluster Space, skipping any Space that already has its own Trigger configuration rather than clobbering it. Rules ship **advisory** (`Warn=true`, -so failures attach an ValidationWarning); promote one to blocking with `cub trigger +so failures attach a ValidationWarning); promote one to blocking with `cub trigger update --space common --unwarn`. Gate-versus-warning lives on the Trigger, not the rule, so the same pack can advise in dev and block in prod. diff --git a/eks-manager/internal/cli/guardrails.go b/eks-manager/internal/cli/guardrails.go index 3ae1b45..bbde77d 100644 --- a/eks-manager/internal/cli/guardrails.go +++ b/eks-manager/internal/cli/guardrails.go @@ -85,7 +85,7 @@ selecting them, and wires that Filter to every Space holding an EKS cluster in scope. The Triggers are created with Warn=true, so a failing rule attaches a -non-blocking ValidationWarning rather than an ValidationError. Promote a rule to blocking +non-blocking ValidationWarning rather than a ValidationError. Promote a rule to blocking with: cub trigger update --space --unwarn diff --git a/managerkit/guardrails/annotate.go b/managerkit/guardrails/annotate.go index 2cf8775..232b5d8 100644 --- a/managerkit/guardrails/annotate.go +++ b/managerkit/guardrails/annotate.go @@ -4,7 +4,7 @@ package guardrails // The annotate command: the producing half of annotate-then-validate. A manager -// cannot attach an ValidationWarning itself -- only a failed Trigger can -- so a +// cannot attach a ValidationWarning itself -- only a failed Trigger can -- so a // finding that no single resource expresses is written onto the Unit as an // annotation, and a rule in the pack warns for as long as it is there. // diff --git a/managerkit/guardrails/query.go b/managerkit/guardrails/query.go index 5edd4bb..edf09d1 100644 --- a/managerkit/guardrails/query.go +++ b/managerkit/guardrails/query.go @@ -11,7 +11,7 @@ import ( api "github.com/confighub/sdk/core/function/api" ) -// StatusRow is one Unit carrying an ValidationWarning or an ValidationError. +// StatusRow is one Unit carrying a ValidationWarning or a ValidationError. type StatusRow struct { Space string `json:"space"` Unit string `json:"unit"` diff --git a/namespace-manager/skills/namespace-backfill/SKILL.md b/namespace-manager/skills/namespace-backfill/SKILL.md index e29d153..b486131 100644 --- a/namespace-manager/skills/namespace-backfill/SKILL.md +++ b/namespace-manager/skills/namespace-backfill/SKILL.md @@ -58,7 +58,7 @@ A runtime tenancy controller injects policy objects into live namespaces; correc ## Stop conditions -- An ValidationError attaches (a validating Trigger failed). **Do not bypass** — diagnose and fix the data (or the Trigger), via **triggers-and-applygates**. +- A ValidationError attaches (a validating Trigger failed). **Do not bypass** — diagnose and fix the data (or the Trigger), via **triggers-and-applygates**. - `backfill` reports "nothing missing" — the envelope is already complete; nothing to do. - The user wants the change deployed — hand off to `release-publish`. diff --git a/namespace-manager/skills/namespace-enforce/SKILL.md b/namespace-manager/skills/namespace-enforce/SKILL.md index edeea11..6c1e43b 100644 --- a/namespace-manager/skills/namespace-enforce/SKILL.md +++ b/namespace-manager/skills/namespace-enforce/SKILL.md @@ -7,7 +7,7 @@ allowed-tools: Bash(cub-namespace --help) Bash(cub-namespace * --help) Bash(cub # namespace-enforce -Make namespace-envelope findings **enforced**, not advisory. Installs a pack of validation policies (defined once in a policy Space, enforced fleet-wide via a shared Filter) and the annotate-then-validate loop that turns a set-aware envelope finding into an ValidationWarning. +Make namespace-envelope findings **enforced**, not advisory. Installs a pack of validation policies (defined once in a policy Space, enforced fleet-wide via a shared Filter) and the annotate-then-validate loop that turns a set-aware envelope finding into a ValidationWarning. ## Why this matters diff --git a/network-policy-manager/skills/netpol-fix/SKILL.md b/network-policy-manager/skills/netpol-fix/SKILL.md index 77005f2..54e0ac2 100644 --- a/network-policy-manager/skills/netpol-fix/SKILL.md +++ b/network-policy-manager/skills/netpol-fix/SKILL.md @@ -63,7 +63,7 @@ A per-resource validator can only *report* a gap; fixing it means editing the cl ## Stop conditions - The user asks to publish/roll out — hand off to **release-publish**, don't publish here. -- A commit hits an ValidationError or permission error — report it; fix the data or route to **triggers-and-applygates**; never bypass a gate. +- A commit hits a ValidationError or permission error — report it; fix the data or route to **triggers-and-applygates**; never bypass a gate. - Whole-fleet remediation requested — hand off to **netpol-fleet**. ## Tool boundary diff --git a/network-policy-manager/skills/netpol-guardrails/SKILL.md b/network-policy-manager/skills/netpol-guardrails/SKILL.md index 8a95d64..8deb854 100644 --- a/network-policy-manager/skills/netpol-guardrails/SKILL.md +++ b/network-policy-manager/skills/netpol-guardrails/SKILL.md @@ -7,7 +7,7 @@ allowed-tools: Bash(cub-netpol --help) Bash(cub-netpol * --help) Bash(cub auth s # netpol-guardrails -Make NetworkPolicy findings **enforced**, not advisory. Installs a pack of validation policies (defined once in a policy Space, enforced fleet-wide via a shared Filter) and the annotate-then-validate loop that turns a coverage finding into an ValidationWarning. +Make NetworkPolicy findings **enforced**, not advisory. Installs a pack of validation policies (defined once in a policy Space, enforced fleet-wide via a shared Filter) and the annotate-then-validate loop that turns a coverage finding into a ValidationWarning. ## Why this matters diff --git a/observability-manager/skills/observability-instrument/SKILL.md b/observability-manager/skills/observability-instrument/SKILL.md index 311426b..4e9639c 100644 --- a/observability-manager/skills/observability-instrument/SKILL.md +++ b/observability-manager/skills/observability-instrument/SKILL.md @@ -53,7 +53,7 @@ ServiceMonitor coverage is a cross-Unit property, and a sidecar must be find-or- ## Stop conditions - `ensure-servicemonitor` refuses (Service has no labels, or no metrics port and no `--port`) — supply `--port`, or fix the Service. -- An ValidationError attaches. **Do not bypass** — fix via **triggers-and-applygates**. +- A ValidationError attaches. **Do not bypass** — fix via **triggers-and-applygates**. - The user wants the change deployed — hand off to `release-publish`. ## Tool boundary diff --git a/promoter/AI_START_HERE.md b/promoter/AI_START_HERE.md index e8ad283..a85b81f 100644 --- a/promoter/AI_START_HERE.md +++ b/promoter/AI_START_HERE.md @@ -63,7 +63,7 @@ proxy). `VITE_CONFIGHUB_BASE_URL` defaults to `https://hub.confighub.com`. ``` 6. **See publishing refuse.** Publishing is disabled with a reason when the Space has no `ReleaseTargetID`, when that Target is not an `OCI` provider, - when no Unit is assigned to it, or when a bundled Unit has an Validation Error — + when no Unit is assigned to it, or when a bundled Unit has a Validation Error — the app never clears a gate as a side effect. 7. **See the promote gate refuse.** Pick a variant that is *not* a downstream clone of the previous stage's variant — Promote reports exactly why it can't diff --git a/promoter/README.md b/promoter/README.md index 977e1ee..36f0ab5 100644 --- a/promoter/README.md +++ b/promoter/README.md @@ -78,7 +78,7 @@ quietly widening the first approval into the second: Anything in the second set that was not in the first is listed by name before the Publish button is offered. Publishing is disabled with a reason when the Space has no Release Target, when that Target is not an OCI provider, when no -Unit is assigned to it, or when any bundled Unit has an Validation Error set — the +Unit is assigned to it, or when any bundled Unit has a Validation Error set — the server refuses a gated Release, and the app does not clear gates as a side effect. diff --git a/promoter/app/src/data/promote.ts b/promoter/app/src/data/promote.ts index 0fd55bb..9f9f1bc 100644 --- a/promoter/app/src/data/promote.ts +++ b/promoter/app/src/data/promote.ts @@ -284,7 +284,7 @@ export function usePromotion(): Promotion { if (gated.length > 0) { return { publishable: false, - reason: `${gated.length} of ${members.length} Unit(s) have an Validation Error set; publishing is refused until they are cleared.`, + reason: `${gated.length} of ${members.length} Unit(s) have a Validation Error set; publishing is refused until they are cleared.`, targetId, targetSlug, providerType, diff --git a/scheduling-manager/skills/scheduling-place/SKILL.md b/scheduling-manager/skills/scheduling-place/SKILL.md index 0c75c08..29e5684 100644 --- a/scheduling-manager/skills/scheduling-place/SKILL.md +++ b/scheduling-manager/skills/scheduling-place/SKILL.md @@ -61,7 +61,7 @@ A toleration only *permits* scheduling onto a tainted node — pair it with a no ## Stop conditions -- An ValidationError attaches (a validating Trigger failed). **Do not bypass** — fix the data (or the rule), via **triggers-and-applygates**. +- A ValidationError attaches (a validating Trigger failed). **Do not bypass** — fix the data (or the rule), via **triggers-and-applygates**. - The user wants the change deployed — hand off to `release-publish`. ## Tool boundary diff --git a/workload-manager/skills/workload-fleet/SKILL.md b/workload-manager/skills/workload-fleet/SKILL.md index 743cd18..2e52c4d 100644 --- a/workload-manager/skills/workload-fleet/SKILL.md +++ b/workload-manager/skills/workload-fleet/SKILL.md @@ -59,7 +59,7 @@ All **edit/create Units but do not publish them**. ## Stop conditions - The selector is broader than intended (dry-run count surprises you) — narrow `--where` / shorthands before committing. -- An ValidationError attaches on a Unit. **Do not bypass** — fix via **triggers-and-applygates**. +- A ValidationError attaches on a Unit. **Do not bypass** — fix via **triggers-and-applygates**. - A single workload is the real target — hand off to **workload-harden**. - Variant propagation requested — hand off to **promote-release**. - The user wants the change deployed — hand off to `release-publish`. diff --git a/workload-manager/skills/workload-harden/SKILL.md b/workload-manager/skills/workload-harden/SKILL.md index 6273a1f..a98c330 100644 --- a/workload-manager/skills/workload-harden/SKILL.md +++ b/workload-manager/skills/workload-harden/SKILL.md @@ -69,7 +69,7 @@ Per-object validators return pass/fail and a human then `kubectl edit`s the clus ## Stop conditions -- An ValidationError attaches (a validating Trigger failed). **Do not bypass** — diagnose and fix the data (or the Trigger), via **triggers-and-applygates**. +- A ValidationError attaches (a validating Trigger failed). **Do not bypass** — diagnose and fix the data (or the Trigger), via **triggers-and-applygates**. - The fix would apply to many workloads — hand off to **workload-fleet**. - The user wants the change deployed — hand off to `release-publish`.