openstack/cyborg — Week of 2026-07-25

Secure RBAC overhaul. The dominant work this week was a top-to-bottom migration of Cyborg's policy layer toward Secure RBAC. New SRBAC base rules landed alongside an enforce_new_defaults override (992292), followed by conversions of the ARQ, device, deployable, and attribute policies to DocumentedRuleDefault. Supporting changes switched enforcement to use the request context as the policy target and removed no-op deprecated policy bridges. Concept documentation for SRBAC was added to explain the new model, and a cyborg-tempest-srbac Zuul job was introduced to exercise the new defaults in CI. Together this accounts for roughly 2,300 lines of churn across the policy subsystem.

Tooling. Bashate was wired into pre-commit and existing shell-script violations were cleaned up in the same pass, a ~640-line sweep across the tree.