fix(policy): undo Condition.operator deprecation

[alkalescent]

Summary

Removes the deprecated = true annotation from Condition.operator in service/policy/objects.proto and restores its original doc comment, then regenerates protocol/go and the policy docs.

Why

Condition.operator was deprecated in #3580 in favor of the decomposed comparison + quantifier (+ case_insensitive) fields. The decomposed evaluator was never wired up on main — EvaluateCondition (service/internal/subjectmappingbuiltin/subject_mapping_builtin.go) still switches entirely on operator, nothing reads the new fields, and there is no normalization shim. So the deprecation marker currently only produces staticcheck SA1019 failures in every consumer of GetOperator() (in-repo: subject_mapping_builtin.go, otdfctl/migrations/namespacedpolicy/canonical.go; plus downstream importers of protocol/go) with no migration target to move to.

Undoing the deprecation unblocks those consumers. Once the decomposed evaluation path actually lands, the field can be re-deprecated alongside a working replacement.

Scope

• Drops deprecated = true only. The field stays optional via (buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE, so request validation is unchanged and this is not a breaking change (buf breaking passes). required = true is intentionally not restored.
• Regenerated protocol/go/policy/objects.pb.go via remote-pinned plugins (reproducible across buf CLI versions).
• Surgically updated the operator field entry in docs/openapi/policy/objects.openapi.yaml and docs/grpc/index.html to drop the deprecated marker. Full doc regeneration was avoided because the local doc plugins produce unrelated churn; CI stages docs before its drift check, so the enforced generated files (*.pb.go, connect wrappers, enums.gen.go) are what matter and those match.

Verification

• buf lint service — 0
• buf breaking service --against origin/main — 0
• golangci-lint run --enable-only staticcheck on subject_mapping_builtin and otdfctl/.../namespacedpolicy — 0 issues
• go build + go test ./internal/subjectmappingbuiltin/... — pass

Summary by CodeRabbit

• Documentation
  • Updated the description of the operator field in policy condition docs to reflect its current role.
  • Removed outdated deprecation language from API documentation and schema references.
  • Clarified that operator is the evaluation operator for a relation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: abd99660-eebb-46a0-afc5-57cf50b811d7

📥 Commits

Reviewing files that changed from the base of the PR and between 41cee41 and e92a21b.

⛔ Files ignored due to path filters (1)

• protocol/go/policy/objects.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (3)

• docs/grpc/index.html
• docs/openapi/policy/objects.openapi.yaml
• service/policy/objects.proto

---

📝 Walkthrough

Walkthrough

The policy.Condition.operator field is reworded across proto, OpenAPI, and gRPC docs to remove deprecated guidance and describe it as the evaluation operator of relation.

Changes

Policy condition operator documentation

Layer / File(s)	Summary
Operator contract and docs service/policy/objects.proto, docs/openapi/policy/objects.openapi.yaml, docs/grpc/index.html	policy.Condition.operator removes deprecated/backward-compatibility text and deprecated: true, and its description is updated to the new operator wording.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

A bunny hopped through docs so bright,
and trimmed old warnings out of sight.
The operator now speaks clear and true,
in proto, OpenAPI, and gRPC view.
Hoppity! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: removing the deprecation from Condition.operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/undo-condition-operator-deprecation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request reverts the deprecation of the Condition.operator field. The previous deprecation was premature as the replacement evaluation logic is not yet fully implemented, causing unnecessary build warnings across the codebase. This change restores the field to its previous state to unblock consumers while maintaining compatibility with existing validation rules.

Highlights

• Reverting Deprecation: Removed the deprecated = true annotation from Condition.operator in service/policy/objects.proto to resolve staticcheck warnings.
• Documentation Update: Restored the original documentation comment for Condition.operator and updated the generated gRPC documentation.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: docs/openapi/**/* (1)
  • docs/openapi/policy/objects.openapi.yaml
• Ignored by pattern: protocol/**/* (1)
  • protocol/go/policy/objects.pb.go

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

The field was marked as old and gray, / But logic wasn't ready for the day. / We bring it back to clear the noise, / And let the build return to poise.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request removes the deprecation status of the operator field in the Condition message within service/policy/objects.proto and updates its documentation in docs/grpc/index.html. The reviewer noted that the operator field remains listed in the 'Fields with deprecated option' table in docs/grpc/index.html and should be removed to ensure consistency.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	240.163784ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	110.463674ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	644.159126ms
Throughput	155.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.128845708s
Average Latency	449.69745ms
Throughput	110.79 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@pull-3668-v0.9.0
✅ go@main-main
✅ go@pull-3668-pull-3668
✅ go@main-v0.9.0
✅ go@main-pull-3668
✅ go@pull-3668-main
✅ java@main-pull-3668
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-v0.9.0
✅ js@main-main
✅ js@main-pull-3668
cukes-report
opentdfplatformUZU5QX.dockerbuild
govulncheck-failure-2
govulncheck-failure-8
govulncheck-failure-0
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-5