Task: Close the official report loopholes
Table of Contents
This page documents a task in the Add sandboxes and virtual books story. It captures the goal, current status, acceptance, and any notes or results.
1. Goal
Leave no path by which an official report reads sandbox data.
2. Status
| Field | Value |
|---|---|
| State | DONE |
| Parent story | Add sandboxes and virtual books |
| Now | Nothing. |
| Waiting on | Nothing. |
| Next | Nothing. |
| Last touched | 2026-10-03 |
3. Acceptance
- A risk report configuration whose scope holds sandbox inputs cannot belong to an official definition.
- The books an official report resolves exclude every book reached through a sandbox portfolio.
- The pgTAP test covers the sandbox portfolio path and checks its fixture.
4. Plan
The review of PR 2561 found two paths around the official report rules, and the PR was merged on green with them taken here.
- A risk report configuration could move from a definition that is not official to an official one with sandbox data in its scope. The configuration's insert trigger now refuses that, through a new helper that answers whether one configuration's scope holds sandbox inputs; the definition check reuses it.
- The resolver filtered virtual books but not other books reached through a sandbox portfolio. Its portfolio path now skips sandbox portfolios for an official report.
- The test asserts its fixture and covers scoping a sandbox portfolio.
5. Measurements
Every number this task claims about a tree, with the command that produced it
and the commit it was measured at. A number without both is not a measurement,
because a clean-up record describes a tree and trunk moves under a branch: a
consumer count, a gate's component count and a suite's size all change with no
code changing, and the reader of a bare number cannot tell which tree it came
from. Where the raw output matters, put it in an evidence/ file beside the
task and name that file in the Command column.
| What | Value | Command | Commit |
|---|---|---|---|
6. Notes
7. Test Scenarios
Manual QA scenarios (scaffolded via compass add test_scenario)
that verify this task. Link
new ones here as they're created; the scenario doc itself links back
via its "Verifies task" field.
| Scenario | State | Notes |
|---|---|---|
8. PRs
| PR | Title |
|---|---|
| #2563 | [reporting] Close the official report loopholes |
9. Review
| # | Comment summary | File | Decision | Notes |
|---|---|---|---|---|
| 1 | (PR 2561) Moving a config under an official definition skips the check | risk_report_config | Fix | The config trigger refuses it. |
| 2 | (PR 2561) Resolver misses non-virtual books under a sandbox portfolio | resolver | Fix | The portfolio path skips sandbox portfolios for an official report. |
| 3 | (PR 2561) Fragile test fixture | pgTAP | Fix | The test asserts it found a seeded configuration. |
| 4 | (PR 2561) Blank line before the next comment | SQL | Keep | Cosmetic. |
| 5 | (PR 2561) Sandbox portfolio path untested | pgTAP | Fix | A report that is not official scopes a sandbox portfolio; becoming official is then refused. |
10. Result
- A configuration with sandbox scope cannot belong to an official definition, whether it is created there or moves there (23514).
- The resolver skips sandbox portfolios on its portfolio path for an official report.
- pgTAP:
reporting_official_reports_test11 of 11 andrefdata_sandbox_test24 of 24 pass against a recreated database.- Build unchanged (no C++ changed); ctest 89 of 89 on a recreated database.