[juliusmarminge]

Kiro is a built-in provider, but the managed policy's list of known providers left it out. So the policy didn't cover it at all:

• With maxRuntimeMode set, users and agents could still set Kiro's binary path to a wrapper script, or add variables such as NODE_OPTIONS to its environment. The admin guide says a permission cap makes those the admin's.
• Admins couldn't allow or pin Kiro either: t3 policy check refused "kiro" in allowedDrivers or instances as an unknown provider.

Fix

• Add Kiro's client definition to the policy's known providers. Its binary path and environment now follow the same pin, lock and permission-cap rules as every other provider.
• Add kiro to the provider IDs listed in the admin guide.
• Extend the existing provider-limits test so a policy allowing every built-in driver must load. It fails on main with "kiro" in allowedDrivers is not a known provider, and it will fail the same way for the next provider added without policy support.

Verification

vp run check:changed passes, and the extended test fails on main.

One of several PRs closing gaps where the managed policy wasn't truthful.

Built with Claude Opus 5.5 in Claude Code, inside T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 9647f07

Macroscope's review found this PR approvable — Kiro now participates in the existing managed-provider policy controls, including administrator allowlists and pinned settings. The change reuses established enforcement without changing unmanaged defaults or persisting policy overlays to user settings.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	−16 B (−0.3%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−16 B (−1.3%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.5 KiB	−41 B (−0.2%)	24.4 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 61c3794 · PR result: 9647f07 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The managed-policy provider registry now includes Kiro. A test checks that policy summaries preserve all built-in driver IDs, and the guide lists fx and kiro as allowed driver IDs.

Changes: Managed-policy provider registry

Layer / File(s)	Summary
Register and verify managed-policy drivers apps/server/src/policy/managedProviders.ts, apps/server/src/policy/ManagedPolicy.test.ts, docs/user/managed-policy.md	The packaged provider registry includes kiroClient. A policy test checks that the summary preserves the full built-in driver list. The guide adds fx and kiro to the documented allowed driver IDs.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Possibly related PRs

• pingdotgg/t3code#27197: Adds the managed-policy framework and provider allowlists extended by this change.
• pingdotgg/t3code#14693: Adds the Kiro provider client used in the managed-policy registry.
• pingdotgg/t3code#29862: Adds managed-policy templates that use the known-driver registry.

Suggested labels: size:XS

Suggested reviewers: macroscopeapp

Merge Risk: Minimal · up to 9647f

The managed-policy Kiro support is internally consistent and presents no identified merge-blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title is concise, conventional, and accurately identifies the primary change: adding Kiro coverage to the managed policy.
Description check		The description clearly explains the problem, the fix, and focused verification results. It does not include a separate Scope and approval section, but the change is narrowly scoped and the descriptio…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the problem, the fix, and focused verification results. It does not include a separate Scope and approval section, but the change is narrowly scoped and the description provides sufficient context for this focused bug fix.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

ast-grep (0.51.1)

ast-grep could not parse rule config: /ast-grep-rules/ast-grep-essentials/rules/kotlin/security/shared-preferences-world-readable-kotlin.yml

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: t3/policy-kiro
• File: .coderabbit.config.ts
• Commit: 9647f07
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: 2961bc4e-ea31-4008-bc33-ae44f321fd37

Commits

Reviewing files that changed from the base of the PR and between 61c3794 and 9647f07.

Files selected for processing: 3

• apps/server/src/policy/ManagedPolicy.test.ts
• apps/server/src/policy/managedProviders.ts
• docs/user/managed-policy.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.