Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[Bug] gem4gov-cli: the compliance regime has no effect on the engine's feature posture — FedRAMP High, IL4 and IL5 print the same list and apply the same engine_features.yaml

クローズ
  • 何か問題がありますか？
#190 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
静か
技術スタック
python
領域
cli, security

調査の方向性

gem4gov app update-compliance とオンボーディングフローから始め、configure_gemini_enterprise_for_fedramp_high、configure_gemini_enterprise_for_il4、configure_gemini_enterprise_for_il5、engine_features.yaml を調べます。FEDRAMP_HIGH と IL5 のコマンドを再現し、返された feature map を比較します。適用された feature posture と regime 固有のメッセージが一致していれば完了です。各 regime に異なるセットが割り当てられる場合でも、1 つの共有セットが明示的に記述される場合でも構いません。

索引モデルが issue の本文から書いたものです。

説明

Bug Gemini - Government Level of Effort - Medium Priority - High

Bug Description

gem4gov app update-compliance and the onboarding flow both branch on the compliance regime, announce a regime-specific set of features that "are not yet authorized for <regime> and must be disabled", and then configure the engine identically.

Two things are the same across all three branches:

  • The message. The 13 printed bullets are byte-identical for FEDRAMP_HIGH, IL4 and IL5; only the regime name in the lead sentence changes.
  • What is applied. configure_gemini_enterprise_for_fedramp_high (:1526), configure_gemini_enterprise_for_il4 (:1642) and configure_gemini_enterprise_for_il5 (:1754) each load the same file and send its map unchanged:
yaml_path = os.path.join(script_dir, 'engine_features.yaml')
with open(yaml_path, 'r') as f:
    engine_features = yaml.safe_load(f)
...
engine_patch_body = { "features": engine_features.get('features'), ... }

There is one engine_features.yaml in the package, and it carries no regime dimension. So the engine's feature posture — including the four disable-* keys — is identical whichever regime the operator picks.

The assistant PATCH in the same functions does diverge by regime (FedRAMP High's updateMask includes customerPolicy; IL5's does not), which shows per-regime behavior is intended somewhere. That is what makes the identical engine feature set look unintended rather than deliberate.

Environment and Deployment Context

  • Stellar Engine Version/Commit: v3.0.0 (f64ce6cd).
  • Deployment Type:
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Medium
    • FedRAMP High
    • FedRAMP Moderate
    • DoD IL4
    • DoD IL5
    • Stand-alone / Custom
  • **FAST Stage (if applicable):
    • Stage 0 (Bootstrap)
    • Stage 1 (Resource Management)
    • Stage 2 (Networking)
    • Stage 3 (Security)

Steps to Reproduce

  1. Run gem4gov app update-compliance --project-id <project> --engine-id <engine-a> --compliance-regime FEDRAMP_HIGH.
  2. Run the same command against a second engine with --compliance-regime IL5.
  3. GET both engines and diff their features maps.

Expected Behavior

Either each regime applies the feature set its own on-screen list describes, or — if the three regimes genuinely share one engine feature set — the tool says so once instead of naming a regime it did not act on.

Actual Behavior

The features maps are identical. Three regime choices produce one posture, announced three different ways.

Relevant Logs and Errors

None. Both runs report success.

Additional Context

The practical impact is that an operator deploying at IL5 is told a specific set of features is being disabled for IL5, and has no way to tell from the tool that the set applied is the FedRAMP High one.

If the sets should differ, this is a missing per-regime capability. If they should not, the messaging asserts a determination the code never makes. Either way the tool's output and its behavior disagree, and an auditor reading the transcript would conclude something the deployment cannot evidence.

主要言語
HCL
スター
51
フォーク
21
平均マージ
1日 16時間
マージ済み PR（30日）
30

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

google/stellar-engine のほかの issue

google/stellar-engine の issue をすべて見る

似ている issue

CLI の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。