Repository navigation
fix(retired): boolean retired, stub tolerance, schema 20260925 - #42
Merged
Merged
Conversation
tmx is about to export `retired` as a JSON boolean on all five entity
sections, and the released dataset will keep retired ids as
{"retired": true} stubs. Both reach tmxcaliber before anything else:
- The OverWatch publish gate diffs a new export against the JSON in each
customer's GitHub repo, where threats, control objectives and controls
hold "false" and feature classes and actions have no key. Without a
scoped comparator every delivery would block on "false" vs false.
compare_retired reads absent as live and reports a real flip as the
lowercase strings the change log always showed. diff_threatmodels drops
stubs on both sides, so a stub reads the same as a dropped id.
- ThreatModelData is how the internal SDK readers load released-dataset
documents, so its single load path now drops stubs, coerces string
flags to bool, and reads class_relationship with .get.
- validate_permissions skips a retired threat in either form, and the CLI
feature-class listing skips stubs.
- Schema 20260925 (20240423 unchanged) declares retired boolean on every
section and each entity as full record or retiredStub via oneOf, with
properties kept inline so the E136 api_details pointer still resolves.
It is picked up as the latest by filename date.
Version 0.4.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rBiJvwvpEVjgvsvWTYx7X
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
tmx is about to export
retiredas a JSON boolean on all five entity sections (feature_classes,threats,control_objectives,controls,actions), and the released dataset will keep retired ids as{"retired": true}stubs. Both reach tmxcaliber first:"false"and feature classes and actions have no key. Without a scoped comparator, every delivery would block on"false"vsfalse, with nothing to file.ThreatModelDatais how internal SDK readers (ccr_factory intake,sweep_uncaptured_drift.py) load released-dataset documents, and it indexes fields a stub does not have.What
compare_retiredinCOMPARATORSfor all five sections: absent,"false"andfalseread the same; a real flip is reported as the lowercase strings the change log always showed._values_differis untouched.rolled_out_keysneeds nothing.diff_threatmodelsdrops stubs on both sides, so a retirement reads as a removal exactly as before.upgrade_to_latest_template_versiondrops stubs, coerces string flags to bool, and readsclass_relationshipwith.get.validate_permissionsand the CLI feature-class listing accept both forms and skip stubs.20260925.json(20240423.jsonunchanged):retiredis boolean on every section, and each entity is a full record or aretiredStubviaoneOf, keepingpropertiesinline so the E136api_detailspointer still resolves. It becomes the latest by filename date.Verification
uv run pytest: 304 passed (104 new). ruff format/check and mypy clean.uv buildincludes the new schema in wheel and sdist. A stubbed fixture export from the tmx branch loads throughThreatModelDatawithout error.Merge order
Merge this before tmx
1c61a27is pushed: tmx installs tmxcaliber unpinned, and this comparator must be live before any boolean export reaches the gate. Tolerant of today's string output, so it is safe to merge now.🤖 Generated with Claude Code
https://claude.ai/code/session_015rBiJvwvpEVjgvsvWTYx7X