@axtary/policy 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,5 +1,9 @@
-import { DEFAULT_EXPIRES_IN_SECONDS, NormalizedActionSchema, } from "@axtary/actionpass";
+import { analyzePostgresSelect, DEFAULT_EXPIRES_IN_SECONDS, explainDecision, NormalizedActionSchema, } from "@axtary/actionpass";
 import { z } from "zod";
+// The deterministic reason→prose explanation now lives in @axtary/actionpass so
+// the SDK facade and the policy/CLI surfaces share one source of truth. Re-export
+// it under the historical name for existing importers.
+export { explainDecision as explainPolicyDecision } from "@axtary/actionpass";
 export const POLICY_SCHEMA_VERSION = "axtary.policy.v0";
 const DEFAULT_GITHUB_PULL_REQUEST_POLICY = {
     enabled: true,
@@ -48,8 +52,98 @@ const DEFAULT_DOCS_POLICY = {
     maxSearchResults: 10,
     maxReadBytes: 20_000,
 };
+const DEFAULT_POSTGRES_READ_POLICY = {
+    enabled: true,
+    allowedDatabases: [],
+    allowedTables: [],
+    allowedFunctions: [],
+    maxRows: 100,
+    requirePredicate: true,
+};
+const DEFAULT_DRIVE_READ_POLICY = {
+    enabled: true,
+    allowedFileIds: [],
+    maxReadBytes: 100_000,
+};
+export const PROVENANCE_COVERAGE = {
+    "github.pull_requests.create": ["title", "body"],
+    "github.contents.write": ["content", "message"],
+    "github.pull_request_review_comments.create": ["body"],
+    "github.check_runs.create": ["output"],
+    "github.issue_comments.create": ["body"],
+    "slack.chat.postMessage": ["message", "text"],
+    "linear.comments.create": ["body"],
+    "linear.issues.update": ["title", "description", "status"],
+    "jira.comments.create": ["body"],
+    "jira.issues.update": ["title", "description", "status"],
+    "mcp.tool.call": ["arguments"],
+};
+const DEFAULT_PROVENANCE_POLICY = {
+    enabled: false,
+    unknownDecision: "deny",
+    untrustedDecision: "step_up",
+};
+// Behavioral novelty/sequence step-up (M5.6, risk-graph v0). Opt-in and
+// escalate-only: these signals may raise an `allow` to `step_up`, and may never
+// produce an `allow` or weaken a `deny`/`step_up` (PRD §4 non-goals fence).
+const DEFAULT_BEHAVIOR_POLICY = {
+    enabled: false,
+    firstSeen: true,
+    abnormalSequence: true,
+};
+const StringMatcherSchema = z.union([
+    z.string().min(1),
+    z.array(z.string().min(1)).min(1),
+]);
+export const PolicyRuleSchema = z.object({
+    id: z.string().min(1),
+    description: z.string().min(1).optional(),
+    enabled: z.boolean().default(true),
+    match: z
+        .object({
+        tools: StringMatcherSchema.optional(),
+        resources: StringMatcherSchema.optional(),
+        actors: z
+            .object({
+            agentIds: StringMatcherSchema.optional(),
+            humanOwners: StringMatcherSchema.optional(),
+            runtimes: StringMatcherSchema.optional(),
+            tenants: StringMatcherSchema.optional(),
+        })
+            .optional(),
+    })
+        .default({}),
+    effect: z.enum(["allow", "deny", "step_up"]),
+    reason: z.string().min(1).optional(),
+    obligations: z
+        .object({
+        expiresInSeconds: z.number().int().positive().optional(),
+        requiredApproverRoles: z.array(z.string().min(1)).default([]),
+        blockedPathPrefixes: z.array(z.string().min(1)).default([]),
+        timeWindow: z
+            .object({
+            startHourUtc: z.number().int().min(0).max(23),
+            endHourUtc: z.number().int().min(0).max(23),
+            daysOfWeek: z.array(z.number().int().min(0).max(6)).default([]),
+        })
+            .optional(),
+        rateLimit: z
+            .object({
+            maxActions: z.number().int().positive(),
+            windowSeconds: z.number().int().positive(),
+            scope: z.enum(["actor", "tool", "resource", "tenant"]).default("actor"),
+        })
+            .optional(),
+    })
+        .default({
+        requiredApproverRoles: [],
+        blockedPathPrefixes: [],
+    }),
+});
 export const PolicyConfigSchema = z.object({
     version: z.string().min(1).default("2026-05-30"),
+    defaultDecision: z.literal("deny").default("deny"),
+    rules: z.array(PolicyRuleSchema).default([]),
     github: z
         .object({
         pullRequests: z
@@ -181,6 +275,54 @@ export const PolicyConfigSchema = z.object({
         .default({
         documents: DEFAULT_DOCS_POLICY,
     }),
+    postgres: z
+        .object({
+        reads: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedDatabases: z.array(z.string().min(1)).default([]),
+            allowedTables: z.array(z.string().min(1)).default([]),
+            allowedFunctions: z.array(z.string().min(1)).default([]),
+            maxRows: z.number().int().positive().max(10_000).default(100),
+            requirePredicate: z.boolean().default(true),
+        })
+            .default(DEFAULT_POSTGRES_READ_POLICY),
+    })
+        .default({
+        reads: DEFAULT_POSTGRES_READ_POLICY,
+    }),
+    drive: z
+        .object({
+        reads: z
+            .object({
+            enabled: z.boolean().default(true),
+            allowedFileIds: z.array(z.string().min(1)).default([]),
+            maxReadBytes: z
+                .number()
+                .int()
+                .positive()
+                .max(10_000_000)
+                .default(100_000),
+        })
+            .default(DEFAULT_DRIVE_READ_POLICY),
+    })
+        .default({
+        reads: DEFAULT_DRIVE_READ_POLICY,
+    }),
+    provenance: z
+        .object({
+        enabled: z.boolean().default(false),
+        unknownDecision: z.literal("deny").default("deny"),
+        untrustedDecision: z.enum(["deny", "step_up"]).default("step_up"),
+    })
+        .default(DEFAULT_PROVENANCE_POLICY),
+    behavior: z
+        .object({
+        enabled: z.boolean().default(false),
+        firstSeen: z.boolean().default(true),
+        abnormalSequence: z.boolean().default(true),
+    })
+        .default(DEFAULT_BEHAVIOR_POLICY),
 });
 export const PolicyFixtureInputSchema = z.object({
     id: z.string().min(1).optional(),
@@ -196,20 +338,101 @@ export const DEFAULT_POLICY_FIXTURE_SOURCE = {
     label: "package defaults from @axtary/policy",
     path: null,
 };
+const TEMPLATE_ACTOR = {
+    agentId: "agent:codex-prod",
+    humanOwner: "user:asrar@company.com",
+    runtime: "codex-cli",
+    tenant: "org:company",
+};
+function templateAction(taskId, declaredGoal, tool, resource, payload) {
+    return NormalizedActionSchema.parse({
+        schemaVersion: "axtary.action.v0",
+        actor: TEMPLATE_ACTOR,
+        intent: { taskId, declaredGoal },
+        capability: { tool, resource, payload },
+    });
+}
+const DISABLE_NON_REPO_POLICY = {
+    slack: { messages: { enabled: false } },
+    issueTrackers: {
+        linear: { enabled: false },
+        jira: { enabled: false },
+    },
+    cloud: {
+        aws: { enabled: false },
+        gcp: { enabled: false },
+    },
+    docs: { documents: { enabled: false } },
+    postgres: { reads: { enabled: false } },
+    drive: { reads: { enabled: false } },
+    mcp: { enabled: false },
+};
+const DISABLE_NON_CLOUD_POLICY = {
+    github: {
+        pullRequests: { enabled: false },
+        contents: { enabled: false },
+    },
+    slack: { messages: { enabled: false } },
+    issueTrackers: {
+        linear: { enabled: false },
+        jira: { enabled: false },
+    },
+    docs: { documents: { enabled: false } },
+    postgres: { reads: { enabled: false } },
+    drive: { reads: { enabled: false } },
+    mcp: { enabled: false },
+};
+const DISABLE_NON_TICKET_POLICY = {
+    github: {
+        pullRequests: { enabled: false },
+        contents: { enabled: false },
+    },
+    slack: { messages: { enabled: false } },
+    cloud: {
+        aws: { enabled: false },
+        gcp: { enabled: false },
+    },
+    docs: { documents: { enabled: false } },
+    postgres: { reads: { enabled: false } },
+    drive: { reads: { enabled: false } },
+    mcp: { enabled: false },
+};
+const DISABLE_NON_DOCS_POLICY = {
+    github: {
+        pullRequests: { enabled: false },
+        contents: { enabled: false },
+    },
+    slack: { messages: { enabled: false } },
+    issueTrackers: {
+        linear: { enabled: false },
+        jira: { enabled: false },
+    },
+    cloud: {
+        aws: { enabled: false },
+        gcp: { enabled: false },
+    },
+    postgres: { reads: { enabled: false } },
+    drive: { reads: { enabled: false } },
+    mcp: { enabled: false },
+};
 export const POLICY_TEMPLATES = [
     {
-        id: "coding-agent-repo-guardrails",
-        name: "Coding agent repo guardrails",
+        id: "repo-only-coding",
+        name: "Repo-only coding",
         category: "coding_agent",
-        summary: "Allow routine PR work while denying secret reads and stepping up auth, billing, and production paths.",
+        summary: "Allow routine repository work while denying secret reads and stepping up auth, billing, and production paths.",
         tools: [
             "github.pull_requests.create",
             "github.branches.create",
             "github.contents.read",
             "github.contents.write",
+            "github.pull_request_review_comments.create",
+            "github.check_runs.create",
+            "github.issue_comments.create",
         ],
         decisionModel: "step_up",
         config: {
+            ...DISABLE_NON_REPO_POLICY,
             github: {
                 pullRequests: {
                     requiredBaseBranch: "main",
@@ -228,12 +451,48 @@ export const POLICY_TEMPLATES = [
             "Matches the current coding-agent wedge.",
             "Protected path changes require exact approval evidence before execution.",
         ],
+        fixtures: [
+            PolicyFixtureInputSchema.parse({
+                id: "repo-only-coding-allow-pr",
+                name: "allow a routine PR inside repo coding scope",
+                expectedDecision: "allow",
+                expectedReasons: ["github_pr_inside_policy"],
+                action: templateAction("AXT-TEMPLATE-1", "Open a routine source PR", "github.pull_requests.create", "repo:company/web-app", {
+                    baseBranch: "main",
+                    filesChanged: ["src/app/page.tsx"],
+                    testsPassed: true,
+                    touchesProduction: false,
+                }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "repo-only-coding-deny-secret-read",
+                name: "deny a repository secret read",
+                expectedDecision: "deny",
+                expectedReasons: ["content_read_denied_path"],
+                action: templateAction("AXT-TEMPLATE-2", "Read files for a coding task", "github.contents.read", "repo:company/web-app", { path: ".env.production" }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "repo-only-coding-step-up-prod",
+                name: "step up protected production paths",
+                expectedDecision: "step_up",
+                expectedReasons: [
+                    "payload_touches_step_up_path",
+                    "payload_declares_production_impact",
+                ],
+                action: templateAction("AXT-TEMPLATE-3", "Touch production infrastructure", "github.pull_requests.create", "repo:company/web-app", {
+                    baseBranch: "main",
+                    filesChanged: ["infra/prod/main.tf"],
+                    testsPassed: true,
+                    touchesProduction: true,
+                }),
+            }),
+        ],
     },
     {
-        id: "staging-cloud-read-only",
-        name: "Staging cloud read-only",
+        id: "staging-reads",
+        name: "Staging reads",
         category: "cloud_read",
-        summary: "Permit bounded AWS/GCP inventory and object listing only after account, project, region, and bucket scopes are pinned.",
+        summary: "Permit bounded AWS/GCP staging inventory and object listing only for pinned accounts, projects, regions, and buckets.",
         tools: [
             "aws.identity.get",
             "aws.s3.objects.list",
@@ -242,97 +501,202 @@ export const POLICY_TEMPLATES = [
         ],
         decisionModel: "deny_until_scoped",
         config: {
+            ...DISABLE_NON_CLOUD_POLICY,
             cloud: {
                 aws: {
                     enabled: true,
-                    allowedAccountIds: [],
+                    allowedAccountIds: ["111122223333"],
                     allowedRegions: ["us-east-1"],
-                    allowedS3Buckets: [],
+                    allowedS3Buckets: ["axtary-staging-logs"],
                     denyObjectKeyPrefixes: ["secrets/", ".env"],
                 },
                 gcp: {
                     enabled: true,
-                    allowedProjectIds: [],
-                    allowedStorageBuckets: [],
+                    allowedProjectIds: ["axtary-staging"],
+                    allowedStorageBuckets: ["axtary-staging-logs"],
                     denyObjectNamePrefixes: ["secrets/", ".env"],
                 },
             },
         },
         evidence: ["accountId", "region", "projectId", "bucket", "prefix"],
         notes: [
-            "Empty allowlists intentionally fail closed until customer scopes are configured.",
+            "The scaffold uses sample staging scopes so policy tests pass locally; replace them with your own staging account, project, and bucket identifiers before real mode.",
             "Smoke checks stay read/auth-only.",
         ],
+        fixtures: [
+            PolicyFixtureInputSchema.parse({
+                id: "staging-reads-allow-aws-s3",
+                name: "allow a scoped staging S3 list",
+                expectedDecision: "allow",
+                expectedReasons: ["aws_s3_read_inside_policy"],
+                action: templateAction("AXT-TEMPLATE-4", "Inspect staging logs", "aws.s3.objects.list", "aws:s3:::axtary-staging-logs", {
+                    accountId: "111122223333",
+                    region: "us-east-1",
+                    bucket: "axtary-staging-logs",
+                    prefix: "logs/",
+                }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "staging-reads-deny-secret-prefix",
+                name: "deny a secret prefix in staging storage",
+                expectedDecision: "deny",
+                expectedReasons: ["aws_s3_prefix_denied"],
+                action: templateAction("AXT-TEMPLATE-5", "Inspect staging secrets", "aws.s3.objects.list", "aws:s3:::axtary-staging-logs", {
+                    accountId: "111122223333",
+                    region: "us-east-1",
+                    bucket: "axtary-staging-logs",
+                    prefix: "secrets/",
+                }),
+            }),
+        ],
     },
     {
-        id: "production-impact-step-up",
-        name: "Production impact step-up",
-        category: "production_change",
-        summary: "Route production-impact declarations and protected infrastructure paths through approval.",
-        tools: ["github.pull_requests.create", "github.contents.write"],
-        decisionModel: "step_up",
+        id: "incident-investigation",
+        name: "Incident investigation",
+        category: "docs_read",
+        summary: "Allow read-only investigation across repository content, tickets, and local docs while denying secret paths.",
+        tools: [
+            "github.contents.read",
+            "linear.issues.read",
+            "jira.issues.read",
+            "docs.documents.search",
+            "docs.documents.read",
+        ],
+        decisionModel: "deny_until_scoped",
         config: {
+            slack: { messages: { enabled: false } },
+            cloud: {
+                aws: { enabled: false },
+                gcp: { enabled: false },
+            },
+            postgres: { reads: { enabled: false } },
+            drive: { reads: { enabled: false } },
+            mcp: { enabled: false },
             github: {
                 pullRequests: {
-                    stepUpPathPrefixes: ["infra/prod/", "deploy/", "auth/", "billing/"],
-                    requiresTests: true,
+                    enabled: false,
+                },
+                contents: {
+                    enabled: true,
+                    denyReadPathPrefixes: [".env", "secrets/", "infra/prod/"],
+                },
+            },
+            issueTrackers: {
+                linear: {
+                    enabled: true,
+                    allowedProjectKeys: ["AXT", "INC"],
+                    stepUpStatuses: ["Done", "Closed"],
+                },
+                jira: {
+                    enabled: true,
+                    allowedProjectKeys: ["AXT", "INC"],
+                    stepUpStatuses: ["Done", "Closed"],
+                },
+            },
+            docs: {
+                documents: {
+                    enabled: true,
+                    allowedWorkspaces: ["local"],
+                    allowedPathPrefixes: ["README.md", "docs/", "product/"],
+                    denyPathPrefixes: [".env", "secrets/", "private/"],
+                    maxSearchResults: 10,
+                    maxReadBytes: 20_000,
                 },
             },
         },
-        evidence: ["touchesProduction", "filesChanged", "diff", "payloadHash"],
+        evidence: ["issueKey", "projectKey", "path", "query", "payloadHash"],
         notes: [
-            "The native evaluator already steps up PR payloads with touchesProduction=true.",
-            "Future cloud write tools should attach the same production-impact evidence before execution.",
+            "Investigation scope is read-oriented; ticket completion and production changes use separate templates.",
+            "Repository and docs secret paths remain deny-only.",
         ],
-    },
-    {
-        id: "iam-mutation-deny",
-        name: "IAM mutation deny",
-        category: "identity_mutation",
-        summary: "Keep identity and credential mutations denied until a scoped connector and reviewer workflow exist.",
-        tools: [
-            "aws.iam.roles.update",
-            "aws.iam.policies.attach",
-            "gcp.iam.bindings.set",
-            "gcp.serviceAccounts.keys.create",
-        ],
-        decisionModel: "deny",
-        config: {},
-        evidence: ["resource", "role", "principal", "payloadHash"],
-        notes: [
-            "These tools are not registered executable handlers yet; unsupported tools fail closed.",
-            "When added, they should require reviewer permissions and short-lived/federated credentials.",
+        fixtures: [
+            PolicyFixtureInputSchema.parse({
+                id: "incident-investigation-allow-ticket-read",
+                name: "allow an incident ticket read",
+                expectedDecision: "allow",
+                expectedReasons: ["jira_issue_inside_policy"],
+                action: templateAction("AXT-TEMPLATE-6", "Read the incident ticket", "jira.issues.read", "jira:site/company", { issueKey: "INC-104", projectKey: "INC" }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "incident-investigation-deny-secret-read",
+                name: "deny secret repository content during investigation",
+                expectedDecision: "deny",
+                expectedReasons: ["content_read_denied_path"],
+                action: templateAction("AXT-TEMPLATE-7", "Read incident environment details", "github.contents.read", "repo:company/web-app", { path: "secrets/prod.env" }),
+            }),
         ],
     },
     {
-        id: "external-slack-step-up",
-        name: "External Slack step-up",
+        id: "ticket-updates",
+        name: "Ticket updates",
         category: "external_communication",
-        summary: "Allow approved internal channels and require approval when a message reaches external recipients.",
-        tools: ["slack.chat.postMessage"],
+        summary: "Allow scoped ticket reads and comments while denying out-of-project updates and stepping up terminal status changes.",
+        tools: [
+            "linear.issues.read",
+            "linear.comments.create",
+            "linear.issues.update",
+            "jira.issues.read",
+            "jira.comments.create",
+            "jira.issues.update",
+        ],
         decisionModel: "step_up",
         config: {
-            slack: {
-                messages: {
-                    allowedChannels: ["#axtary-dev"],
-                    stepUpExternalRecipients: true,
+            ...DISABLE_NON_TICKET_POLICY,
+            issueTrackers: {
+                linear: {
+                    enabled: true,
+                    allowedProjectKeys: ["AXT"],
+                    stepUpStatuses: ["Done", "Closed"],
+                },
+                jira: {
+                    enabled: true,
+                    allowedProjectKeys: ["AXT"],
+                    stepUpStatuses: ["Done", "Closed"],
                 },
             },
         },
-        evidence: ["channel", "message", "externalRecipients", "payloadHash"],
+        evidence: ["issueKey", "projectKey", "status", "body", "payloadHash"],
         notes: [
-            "Exact message payload is approval evidence.",
-            "Unapproved channels are denied rather than stepped up.",
+            "Comments and non-terminal edits inside the configured project are allowed.",
+            "Terminal statuses require reviewer approval; other projects are denied.",
+        ],
+        fixtures: [
+            PolicyFixtureInputSchema.parse({
+                id: "ticket-updates-allow-comment",
+                name: "allow a scoped Linear comment",
+                expectedDecision: "allow",
+                expectedReasons: ["linear_issue_inside_policy"],
+                action: templateAction("AXT-TEMPLATE-8", "Comment on the source ticket", "linear.comments.create", "linear:workspace/company", {
+                    issueKey: "AXT-418",
+                    projectKey: "AXT",
+                    body: "Investigation complete; PR is linked.",
+                }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "ticket-updates-deny-other-project",
+                name: "deny a ticket update outside the configured project",
+                expectedDecision: "deny",
+                expectedReasons: ["jira_project_not_allowed"],
+                action: templateAction("AXT-TEMPLATE-9", "Update an unrelated ticket", "jira.issues.update", "jira:site/company", { issueKey: "SEC-9", projectKey: "SEC", status: "In Progress" }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "ticket-updates-step-up-done",
+                name: "step up terminal ticket status changes",
+                expectedDecision: "step_up",
+                expectedReasons: ["linear_status_requires_step_up"],
+                action: templateAction("AXT-TEMPLATE-10", "Mark the source ticket done", "linear.issues.update", "linear:workspace/company", { issueKey: "AXT-418", projectKey: "AXT", status: "Done" }),
+            }),
         ],
     },
     {
-        id: "local-docs-read-scoped",
-        name: "Local docs read scoped",
+        id: "doc-search",
+        name: "Doc search",
         category: "docs_read",
-        summary: "Permit local docs search and read actions only inside configured workspaces, paths, result caps, and byte limits.",
+        summary: "Permit local documentation search and bounded reads only inside configured workspaces and paths.",
         tools: ["docs.documents.search", "docs.documents.read"],
         decisionModel: "deny_until_scoped",
         config: {
+            ...DISABLE_NON_DOCS_POLICY,
             docs: {
                 documents: {
                     enabled: true,
@@ -349,8 +713,101 @@ export const POLICY_TEMPLATES = [
             "Local document roots are configured adapter-side, while policy controls normalized action scope.",
             "Returned content should be bounded and redacted by the connector before the agent sees it.",
         ],
+        fixtures: [
+            PolicyFixtureInputSchema.parse({
+                id: "doc-search-allow-query",
+                name: "allow a bounded docs search",
+                expectedDecision: "allow",
+                expectedReasons: ["docs_search_inside_policy"],
+                action: templateAction("AXT-TEMPLATE-11", "Search product docs", "docs.documents.search", "docs:local", { workspace: "local", query: "ActionPass ledger", maxResults: 5 }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "doc-search-deny-private-read",
+                name: "deny a private docs path read",
+                expectedDecision: "deny",
+                expectedReasons: ["docs_path_denied"],
+                action: templateAction("AXT-TEMPLATE-12", "Read private planning notes", "docs.documents.read", "docs:local", { workspace: "local", path: "private/roadmap.md", maxBytes: 1000 }),
+            }),
+        ],
+    },
+    {
+        id: "guarded-prod",
+        name: "Guarded production changes",
+        category: "production_change",
+        summary: "Allow routine repository changes, deny secret paths, and require approval for production-impact changes.",
+        tools: ["github.pull_requests.create", "github.contents.write", "github.contents.read"],
+        decisionModel: "step_up",
+        config: {
+            ...DISABLE_NON_REPO_POLICY,
+            github: {
+                pullRequests: {
+                    requiredBaseBranch: "main",
+                    maxFilesChanged: 8,
+                    denyPathPrefixes: [".env", "secrets/"],
+                    stepUpPathPrefixes: ["infra/prod/", "deploy/", "auth/", "billing/"],
+                    requiresTests: true,
+                },
+                contents: {
+                    denyReadPathPrefixes: [".env", "secrets/", "infra/prod/"],
+                },
+            },
+        },
+        evidence: ["touchesProduction", "filesChanged", "diff", "payloadHash"],
+        notes: [
+            "The native evaluator steps up PR payloads with touchesProduction=true.",
+            "Approval binds the exact production-impact payload before execution.",
+        ],
+        fixtures: [
+            PolicyFixtureInputSchema.parse({
+                id: "guarded-prod-allow-app-pr",
+                name: "allow a tested non-production PR",
+                expectedDecision: "allow",
+                expectedReasons: ["github_pr_inside_policy"],
+                action: templateAction("AXT-TEMPLATE-13", "Ship an application fix", "github.pull_requests.create", "repo:company/web-app", {
+                    baseBranch: "main",
+                    filesChanged: ["src/lib/cache.ts"],
+                    testsPassed: true,
+                    touchesProduction: false,
+                }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "guarded-prod-deny-secret-write",
+                name: "deny a secret file write",
+                expectedDecision: "deny",
+                expectedReasons: ["payload_touches_denied_path"],
+                action: templateAction("AXT-TEMPLATE-14", "Write a production secret", "github.contents.write", "repo:company/web-app", {
+                    path: ".env.production",
+                    branch: "main",
+                    content: "SECRET=value",
+                    message: "update production env",
+                }),
+            }),
+            PolicyFixtureInputSchema.parse({
+                id: "guarded-prod-step-up-prod-pr",
+                name: "step up production-impact PRs",
+                expectedDecision: "step_up",
+                expectedReasons: [
+                    "payload_touches_step_up_path",
+                    "payload_declares_production_impact",
+                ],
+                action: templateAction("AXT-TEMPLATE-15", "Change production deployment config", "github.pull_requests.create", "repo:company/web-app", {
+                    baseBranch: "main",
+                    filesChanged: ["deploy/prod.yml"],
+                    testsPassed: true,
+                    touchesProduction: true,
+                }),
+            }),
+        ],
     },
 ];
+const POLICY_TEMPLATE_ALIASES = {
+    "coding-agent-repo-guardrails": "repo-only-coding",
+    "staging-cloud-read-only": "staging-reads",
+    "production-impact-step-up": "guarded-prod",
+    "iam-mutation-deny": "guarded-prod",
+    "external-slack-step-up": "ticket-updates",
+    "local-docs-read-scoped": "doc-search",
+};
 export const DEFAULT_POLICY_REVIEW_FIXTURES = [
     PolicyFixtureInputSchema.parse({
         id: "allow-github-pr",
@@ -440,7 +897,8 @@ export function getPolicyTemplates() {
     return POLICY_TEMPLATES;
 }
 export function getPolicyTemplate(id) {
-    return POLICY_TEMPLATES.find((template) => template.id === id) ?? null;
+    const resolvedId = POLICY_TEMPLATE_ALIASES[id] ?? id;
+    return POLICY_TEMPLATES.find((template) => template.id === resolvedId) ?? null;
 }
 export function mergePolicyConfig(baseInput = {}, patchInput = {}) {
     const base = PolicyConfigSchema.parse(baseInput);
@@ -454,27 +912,6 @@ export function applyPolicyTemplate(baseInput, templateId) {
     }
     return mergePolicyConfig(baseInput, template.config);
 }
-export function explainPolicyDecision(decisionInput) {
-    const reviewerAction = decisionInput.decision === "allow"
-        ? "none"
-        : decisionInput.decision === "step_up"
-            ? "approval_required"
-            : "block";
-    const label = decisionInput.decision === "allow"
-        ? "Allowed"
-        : decisionInput.decision === "step_up"
-            ? "Step-up required"
-            : "Denied";
-    return {
-        label,
-        reviewerAction,
-        summary: decisionSummary(decisionInput),
-        reasonDetails: decisionInput.reasons.map((reason) => ({
-            reason,
-            detail: reasonDetail(reason),
-        })),
-    };
-}
 export function runPolicyFixtures(configInput = {}, fixtureInputs = DEFAULT_POLICY_REVIEW_FIXTURES) {
     const config = PolicyConfigSchema.parse(configInput);
     return fixtureInputs.map((fixtureInput, index) => {
@@ -495,7 +932,7 @@ export function runPolicyFixtures(configInput = {}, fixtureInputs = DEFAULT_POLI
             sourcePath: fixture.sourcePath ?? null,
             passed: decisionResult.decision === fixture.expectedDecision && reasonsPassed,
             decision: decisionResult,
-            explanation: explainPolicyDecision(decisionResult),
+            explanation: explainDecision(decisionResult),
             cedar: toCedarRequest(action),
             opa: toOpaInput(action),
         };
@@ -563,9 +1000,38 @@ export function previewPolicyTemplates(configInput = {}, templates = getPolicyTe
         };
     });
 }
-export function evaluatePolicy(actionInput, configInput = {}) {
+export function evaluatePolicy(actionInput, configInput = {}, context = {}) {
     const action = NormalizedActionSchema.parse(actionInput);
     const config = PolicyConfigSchema.parse(configInput);
+    const baseDecision = config.rules.length > 0
+        ? evaluateRulePolicy(action, config, context).decision
+        : evaluateBuiltinPolicy(action, config);
+    return applyBehaviorPolicy(config, context, applyProvenancePolicy(action, config, baseDecision));
+}
+export function simulatePolicy(actionInput, configInput = {}, context = {}) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    const config = PolicyConfigSchema.parse(configInput);
+    if (config.rules.length === 0) {
+        return {
+            schemaVersion: POLICY_SCHEMA_VERSION,
+            action,
+            mode: "builtin_preset",
+            defaultDecision: "deny",
+            decision: applyProvenancePolicy(action, config, evaluateBuiltinPolicy(action, config)),
+            rules: [],
+        };
+    }
+    const evaluated = evaluateRulePolicy(action, config, context);
+    return {
+        schemaVersion: POLICY_SCHEMA_VERSION,
+        action,
+        mode: "rules",
+        defaultDecision: "deny",
+        decision: applyBehaviorPolicy(config, context, applyProvenancePolicy(action, config, evaluated.decision)),
+        rules: evaluated.traces,
+    };
+}
+function evaluateBuiltinPolicy(action, config) {
     switch (action.capability.tool) {
         case "github.pull_requests.create":
             return evaluateGitHubPullRequest(action, config);
@@ -575,6 +1041,12 @@ export function evaluatePolicy(actionInput, configInput = {}) {
             return evaluateGitHubContentWrite(action, config);
         case "github.branches.create":
             return evaluateGitHubBranchCreate(action, config);
+        case "github.pull_request_review_comments.create":
+            return evaluateGitHubReviewComment(action, config);
+        case "github.check_runs.create":
+            return evaluateGitHubCheckRun(action, config);
+        case "github.issue_comments.create":
+            return evaluateGitHubIssueComment(action, config);
         case "slack.chat.postMessage":
             return evaluateSlackMessage(action, config);
         case "linear.issues.read":
@@ -596,6 +1068,10 @@ export function evaluatePolicy(actionInput, configInput = {}) {
             return evaluateDocsDocument(action, config);
         case "mcp.tool.call":
             return evaluateMcpToolCall(action, config);
+        case "postgres.query.select":
+            return evaluatePostgresSelect(action, config);
+        case "drive.files.read":
+            return evaluateDriveFileRead(action, config);
         default:
             return decision("deny", [`unsupported_tool:${action.capability.tool}`], config, {
                 maxFilesChanged: 0,
@@ -603,6 +1079,280 @@ export function evaluatePolicy(actionInput, configInput = {}) {
             });
     }
 }
+function evaluateDriveFileRead(action, config) {
+    const policy = config.drive.reads;
+    const fileId = getString(action.capability.payload.fileId);
+    const maxBytes = getPositiveInteger(action.capability.payload.maxBytes);
+    if (!policy.enabled) {
+        return decision("deny", ["drive_reads_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!fileId || !maxBytes) {
+        return decision("deny", ["drive_read_payload_invalid"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (action.capability.resource !== `drive:file:${fileId}`) {
+        return decision("deny", ["drive_file_resource_mismatch"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!policy.allowedFileIds.includes(fileId)) {
+        return decision("deny", ["drive_file_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (maxBytes > policy.maxReadBytes) {
+        return decision("deny", ["drive_read_byte_limit_exceeded"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["drive_file_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [],
+    });
+}
+function evaluatePostgresSelect(action, config) {
+    const policy = config.postgres.reads;
+    const payload = action.capability.payload;
+    const statement = getString(payload.statement);
+    const parameters = Array.isArray(payload.parameters) ? payload.parameters : null;
+    const maxRows = getPositiveInteger(payload.maxRows);
+    if (!policy.enabled) {
+        return decision("deny", ["postgres_reads_disabled"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!policy.allowedDatabases.includes(action.capability.resource)) {
+        return decision("deny", ["postgres_database_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (!statement || !parameters || !maxRows) {
+        return decision("deny", ["postgres_query_payload_invalid"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    const analyzed = analyzePostgresSelect(statement);
+    if (!analyzed.ok) {
+        return decision("deny", [analyzed.reason], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    const { analysis } = analyzed;
+    if (analysis.parameterCount !== parameters.length) {
+        return decision("deny", ["postgres_parameter_count_mismatch"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (analysis.tables.some((table) => !policy.allowedTables.includes(table))) {
+        return decision("deny", ["postgres_table_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: analysis.tables,
+        });
+    }
+    if (analysis.tables.some((table) => !table.includes("."))) {
+        return decision("deny", ["postgres_table_must_be_schema_qualified"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: analysis.tables,
+        });
+    }
+    if (analysis.functions.some((functionName) => !policy.allowedFunctions.includes(functionName))) {
+        return decision("deny", ["postgres_function_not_allowed"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: analysis.functions,
+        });
+    }
+    if (maxRows > policy.maxRows) {
+        return decision("deny", ["postgres_row_limit_exceeded"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (policy.requirePredicate && !analysis.hasPredicate) {
+        return decision("step_up", ["postgres_unpredicated_scan_step_up"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["postgres_select_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: analysis.tables,
+    });
+}
+function applyProvenancePolicy(action, config, baseDecision) {
+    if (baseDecision.decision === "deny")
+        return baseDecision;
+    const guard = evaluateProvenanceGuard(action, config);
+    if (!guard)
+        return baseDecision;
+    if (guard.decision === "deny") {
+        return { ...baseDecision, decision: "deny", reasons: [guard.reason] };
+    }
+    return {
+        ...baseDecision,
+        decision: "step_up",
+        reasons: [...new Set([...baseDecision.reasons, guard.reason])],
+    };
+}
+/**
+ * Escalate-only behavior guard (M5.6). Maps the proxy-supplied novelty/sequence
+ * signals to `step_up` reason codes. It may ONLY raise an `allow` to `step_up`;
+ * it never returns `allow` and never weakens a `deny`/`step_up`. This is the
+ * code-level enforcement of the PRD §4 fence: a signal can escalate, never
+ * authorize.
+ */
+function applyBehaviorPolicy(config, context, decision) {
+    if (decision.decision !== "allow")
+        return decision;
+    const reasons = behaviorStepUpReasons(config, context.behaviorSignals);
+    if (reasons.length === 0)
+        return decision;
+    return {
+        ...decision,
+        decision: "step_up",
+        reasons: [...new Set([...decision.reasons, ...reasons])],
+    };
+}
+function behaviorStepUpReasons(config, signals) {
+    if (!config.behavior.enabled || !signals)
+        return [];
+    const reasons = [];
+    if (config.behavior.firstSeen && signals.firstSeenCombo) {
+        reasons.push("behavior_first_seen");
+    }
+    if (config.behavior.abnormalSequence && signals.abnormalSequence) {
+        reasons.push("behavior_abnormal_sequence");
+    }
+    return reasons;
+}
+/**
+ * The step-up reason codes the behavior guard would emit for the given signals
+ * and config. Read-only; used by the proxy/tests to inspect the guard without
+ * a full policy evaluation.
+ */
+export function evaluateBehaviorGuard(configInput = {}, signals = undefined) {
+    const config = PolicyConfigSchema.parse(configInput);
+    return behaviorStepUpReasons(config, signals);
+}
+export function evaluateProvenanceGuard(actionInput, configInput = {}) {
+    const action = NormalizedActionSchema.parse(actionInput);
+    const config = PolicyConfigSchema.parse(configInput);
+    if (!config.provenance.enabled)
+        return null;
+    const fields = PROVENANCE_COVERAGE[action.capability.tool];
+    if (!fields)
+        return null;
+    const presentFields = fields.filter((field) => action.capability.payload[field] !== undefined);
+    if (presentFields.length === 0)
+        return null;
+    const provenance = action.provenance;
+    if (!provenance) {
+        return { decision: "deny", reason: "provenance_unknown_egress" };
+    }
+    const sourcesById = new Map(provenance.sources.map((source) => [source.id, source]));
+    let untrusted = false;
+    for (const field of presentFields) {
+        const path = `/capability/payload/${field}`;
+        const binding = provenance.bindings.find((entry) => entry.path === path);
+        if (!binding) {
+            return { decision: "deny", reason: "provenance_unknown_egress" };
+        }
+        const sources = binding.sourceIds.map((id) => sourcesById.get(id));
+        if (sources.some((source) => !source || source.integrity === "unknown")) {
+            return { decision: "deny", reason: "provenance_unknown_egress" };
+        }
+        if (sources.some((source) => source?.integrity === "untrusted")) {
+            untrusted = true;
+        }
+    }
+    if (!untrusted)
+        return null;
+    return {
+        decision: config.provenance.untrustedDecision,
+        reason: "provenance_untrusted_egress",
+    };
+}
+function evaluateRulePolicy(action, config, context) {
+    const traces = config.rules.map((rule) => traceRule(rule, action));
+    const matching = config.rules.filter((rule, index) => rule.enabled && traces[index]?.matched);
+    if (matching.length === 0) {
+        return {
+            decision: decision(config.defaultDecision, ["policy_default_deny"], config, { maxFilesChanged: 0, blockedPaths: [] }, { ruleId: "default_deny", matchedRuleIds: [] }),
+            traces,
+        };
+    }
+    const selectedEffect = matching.some((rule) => rule.effect === "deny")
+        ? "deny"
+        : matching.some((rule) => rule.effect === "step_up")
+            ? "step_up"
+            : matching.some((rule) => rule.effect === "allow" &&
+                rule.obligations.requiredApproverRoles.length > 0)
+                ? "step_up"
+                : "allow";
+    const determining = matching.filter((rule) => {
+        if (selectedEffect === "deny")
+            return rule.effect === "deny";
+        if (selectedEffect === "step_up") {
+            return (rule.effect === "step_up" ||
+                (rule.effect === "allow" &&
+                    rule.obligations.requiredApproverRoles.length > 0));
+        }
+        return rule.effect === "allow";
+    });
+    const obligations = mergeRuleObligations(matching);
+    const blockedPath = actionPaths(action).find((path) => obligations.blockedPaths.some((prefix) => path.startsWith(prefix)));
+    const now = context.now ?? new Date();
+    const timeWindowClosed = obligations.timeWindow && !insideTimeWindow(now, obligations.timeWindow);
+    const rateLimitExceeded = obligations.rateLimit &&
+        (context.rateLimitCounts?.[obligations.rateLimit.ruleId] ?? 0) >=
+            obligations.rateLimit.maxActions;
+    let effect = selectedEffect;
+    const reasons = determining.map((rule) => rule.reason ?? `policy_rule:${rule.id}`);
+    if (blockedPath) {
+        effect = "deny";
+        reasons.splice(0, reasons.length, `obligation_blocked_path:${blockedPath}`);
+    }
+    else if (timeWindowClosed) {
+        effect = "deny";
+        reasons.splice(0, reasons.length, "obligation_time_window_closed");
+    }
+    else if (rateLimitExceeded) {
+        effect = "deny";
+        reasons.splice(0, reasons.length, "obligation_rate_limit_exceeded");
+    }
+    else if (effect === "step_up" &&
+        obligations.requiredApproverRoles.length > 0 &&
+        !reasons.includes("required_approver_role")) {
+        reasons.push("required_approver_role");
+    }
+    const primaryRule = determining[0] ?? matching[0];
+    return {
+        decision: decision(effect, reasons, config, {
+            maxFilesChanged: 0,
+            blockedPaths: obligations.blockedPaths,
+        }, {
+            ruleId: primaryRule.id,
+            matchedRuleIds: matching.map((rule) => rule.id),
+            expiresInSeconds: obligations.expiresInSeconds,
+            requiredApproverRoles: obligations.requiredApproverRoles,
+            timeWindow: obligations.timeWindow,
+            rateLimit: obligations.rateLimit,
+        }),
+        traces,
+    };
+}
 function evaluateGitHubContentWrite(action, config) {
     const policy = config.github.pullRequests;
     const path = getString(action.capability.payload.path);
@@ -657,6 +1407,86 @@ function evaluateGitHubBranchCreate(action, config) {
         blockedPaths: [],
     });
 }
+function evaluateGitHubReviewComment(action, config) {
+    const policy = config.github.pullRequests;
+    const payload = action.capability.payload;
+    const path = getString(payload.path);
+    const body = getString(payload.body);
+    const commitId = getString(payload.commitId);
+    const side = getString(payload.side);
+    const pullNumber = getPositiveInteger(payload.pullNumber);
+    const line = getPositiveInteger(payload.line);
+    if (!path || !body || !commitId || !pullNumber || !line) {
+        return decision("deny", ["github_review_comment_payload_invalid"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (side !== "LEFT" && side !== "RIGHT") {
+        return decision("deny", ["github_review_comment_side_invalid"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (pathsMatch([path], policy.denyPathPrefixes)) {
+        return decision("deny", ["payload_touches_denied_path"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: policy.denyPathPrefixes,
+        });
+    }
+    if (pathsMatch([path], policy.stepUpPathPrefixes)) {
+        return decision("step_up", ["github_review_protected_path_step_up"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [
+                ...policy.denyPathPrefixes,
+                ...policy.stepUpPathPrefixes,
+            ],
+        });
+    }
+    return decision("allow", ["github_review_comment_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [
+            ...policy.denyPathPrefixes,
+            ...policy.stepUpPathPrefixes,
+        ],
+    });
+}
+function evaluateGitHubCheckRun(action, config) {
+    const payload = action.capability.payload;
+    const name = getString(payload.name);
+    const headSha = getString(payload.headSha);
+    const status = getString(payload.status);
+    const conclusion = getString(payload.conclusion);
+    if (!name || !headSha) {
+        return decision("deny", ["github_check_run_payload_invalid"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    if (status === "completed" && !conclusion) {
+        return decision("deny", ["github_check_run_conclusion_required"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["github_check_run_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [],
+    });
+}
+function evaluateGitHubIssueComment(action, config) {
+    const payload = action.capability.payload;
+    if (!getPositiveInteger(payload.issueNumber) || !getString(payload.body)) {
+        return decision("deny", ["github_issue_comment_payload_invalid"], config, {
+            maxFilesChanged: 0,
+            blockedPaths: [],
+        });
+    }
+    return decision("allow", ["github_issue_comment_inside_policy"], config, {
+        maxFilesChanged: 0,
+        blockedPaths: [],
+    });
+}
 export function toCedarRequest(actionInput) {
     const action = NormalizedActionSchema.parse(actionInput);
     return {
@@ -1050,7 +1880,7 @@ function evaluateMcpToolCall(action, config) {
         blockedPaths: [],
     });
 }
-function decision(value, reasons, config, constraints) {
+function decision(value, reasons, config, constraints, options) {
     return {
         decision: value,
         reasons,
@@ -1061,12 +1891,128 @@ function decision(value, reasons, config, constraints) {
             opaCompatible: true,
         },
         constraints: {
-            expiresInSeconds: DEFAULT_EXPIRES_IN_SECONDS,
+            expiresInSeconds: options?.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS,
             maxFilesChanged: constraints.maxFilesChanged,
             blockedPaths: constraints.blockedPaths,
         },
+        rule: options
+            ? {
+                id: options.ruleId,
+                matchedRuleIds: options.matchedRuleIds,
+            }
+            : undefined,
+        obligations: options
+            ? {
+                requiredApproverRoles: options.requiredApproverRoles ?? [],
+                timeWindow: options.timeWindow,
+                rateLimit: options.rateLimit,
+            }
+            : undefined,
+    };
+}
+function traceRule(rule, action) {
+    const mismatches = [];
+    if (!rule.enabled) {
+        mismatches.push("rule_disabled");
+    }
+    if (rule.match.tools &&
+        !matchesAny(action.capability.tool, asMatchers(rule.match.tools))) {
+        mismatches.push("tool");
+    }
+    if (rule.match.resources &&
+        !matchesAny(action.capability.resource, asMatchers(rule.match.resources))) {
+        mismatches.push("resource");
+    }
+    const actor = rule.match.actors;
+    if (actor?.agentIds && !matchesAny(action.actor.agentId, asMatchers(actor.agentIds))) {
+        mismatches.push("actor.agentId");
+    }
+    if (actor?.humanOwners &&
+        !matchesAny(action.actor.humanOwner, asMatchers(actor.humanOwners))) {
+        mismatches.push("actor.humanOwner");
+    }
+    if (actor?.runtimes &&
+        !matchesAny(action.actor.runtime, asMatchers(actor.runtimes))) {
+        mismatches.push("actor.runtime");
+    }
+    if (actor?.tenants &&
+        !matchesAny(action.actor.tenant ?? "", asMatchers(actor.tenants))) {
+        mismatches.push("actor.tenant");
+    }
+    return {
+        ruleId: rule.id,
+        matched: mismatches.length === 0,
+        effect: rule.effect,
+        mismatches,
+        obligations: rule.obligations,
     };
 }
+function asMatchers(value) {
+    return Array.isArray(value) ? value : [value];
+}
+function matchesAny(value, patterns) {
+    return patterns.some((pattern) => wildcardMatch(value, pattern));
+}
+function wildcardMatch(value, pattern) {
+    if (pattern === "*") {
+        return true;
+    }
+    const expression = pattern
+        .split("*")
+        .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join(".*");
+    return new RegExp(`^${expression}$`).test(value);
+}
+function actionPaths(action) {
+    return [
+        ...getStringArray(action.capability.payload.filesChanged),
+        ...getStringArray(action.capability.payload.paths),
+        getString(action.capability.payload.path),
+        getString(action.capability.payload.prefix),
+    ].filter((value) => Boolean(value));
+}
+function mergeRuleObligations(rules) {
+    const expires = rules
+        .map((rule) => rule.obligations.expiresInSeconds)
+        .filter((value) => value !== undefined);
+    const timeWindows = rules
+        .map((rule) => rule.obligations.timeWindow)
+        .filter((value) => value !== undefined);
+    const rateLimits = rules.flatMap((rule) => rule.obligations.rateLimit
+        ? [
+            {
+                ruleId: rule.id,
+                ...rule.obligations.rateLimit,
+            },
+        ]
+        : []);
+    return {
+        expiresInSeconds: expires.length > 0 ? Math.min(...expires) : DEFAULT_EXPIRES_IN_SECONDS,
+        requiredApproverRoles: [
+            ...new Set(rules.flatMap((rule) => rule.obligations.requiredApproverRoles)),
+        ].sort(),
+        blockedPaths: [
+            ...new Set(rules.flatMap((rule) => rule.obligations.blockedPathPrefixes)),
+        ].sort(),
+        timeWindow: timeWindows[0],
+        rateLimit: rateLimits.sort((left, right) => left.maxActions / left.windowSeconds -
+            right.maxActions / right.windowSeconds)[0],
+    };
+}
+function insideTimeWindow(now, window) {
+    if (window.daysOfWeek.length > 0 &&
+        !window.daysOfWeek.includes(now.getUTCDay())) {
+        return false;
+    }
+    const hour = now.getUTCHours();
+    if (window.startHourUtc === window.endHourUtc) {
+        return true;
+    }
+    if (window.startHourUtc < window.endHourUtc) {
+        return hour >= window.startHourUtc && hour < window.endHourUtc;
+    }
+    return hour >= window.startHourUtc || hour < window.endHourUtc;
+}
 function resourceToCedar(resource) {
     const [kind, id] = resource.split(":", 2);
     return {
@@ -1083,87 +2029,6 @@ function isUnsafeRelativePath(path) {
     }
     return path.split(/[\\/]+/).some((segment) => segment === ".." || segment === "");
 }
-function decisionSummary(decisionInput) {
-    if (decisionInput.decision === "allow") {
-        return "The normalized action is inside the active policy and can proceed through ActionPass issuance.";
-    }
-    if (decisionInput.decision === "step_up") {
-        return "The normalized action is in scope only after exact payload-bound reviewer approval.";
-    }
-    return "The normalized action is outside the active policy and must not execute.";
-}
-function reasonDetail(reason) {
-    if (reason === "github_pr_inside_policy") {
-        return "Base branch, changed paths, file count, and test evidence satisfy the GitHub PR rule.";
-    }
-    if (reason === "github_content_write_inside_policy") {
-        return "The write path and branch are inside the configured repository guardrails.";
-    }
-    if (reason === "github_branch_inside_policy") {
-        return "The branch creation request is tied to the configured base branch.";
-    }
-    if (reason === "content_read_denied_path") {
-        return "The requested file path matches a protected content-read prefix.";
-    }
-    if (reason === "payload_touches_denied_path") {
-        return "The payload touches a path prefix that policy blocks outright.";
-    }
-    if (reason === "payload_touches_step_up_path") {
-        return "The payload touches a protected path prefix that requires exact review.";
-    }
-    if (reason === "file_count_exceeds_policy_limit") {
-        return "The PR changes more files than the active policy allows without review.";
-    }
-    if (reason === "tests_required_before_pr") {
-        return "The PR payload does not include passing test evidence required by policy.";
-    }
-    if (reason === "payload_declares_production_impact") {
-        return "The action declares production impact, so reviewer approval is required.";
-    }
-    if (reason === "slack_channel_not_allowed") {
-        return "The Slack channel is not in the configured allowlist.";
-    }
-    if (reason === "slack_external_recipient_step_up") {
-        return "The message reaches external recipients and must be reviewed exactly.";
-    }
-    if (reason === "linear_status_requires_step_up") {
-        return "The Linear status transition targets a configured protected status.";
-    }
-    if (reason === "jira_status_requires_step_up") {
-        return "The Jira status transition targets a configured protected status.";
-    }
-    if (reason.endsWith("_project_not_allowed")) {
-        return "The issue project key is outside the configured tracker allowlist.";
-    }
-    if (reason === "docs_search_inside_policy") {
-        return "The document search request stays inside the configured workspace and result limit.";
-    }
-    if (reason === "docs_read_inside_policy") {
-        return "The document path and requested byte limit are inside the configured documentation scope.";
-    }
-    if (reason === "docs_workspace_not_allowed") {
-        return "The document workspace is outside the configured allowlist.";
-    }
-    if (reason === "docs_path_denied") {
-        return "The requested document path matches a protected documentation prefix.";
-    }
-    if (reason === "docs_path_not_allowed") {
-        return "The requested document path is outside the configured documentation prefixes.";
-    }
-    if (reason === "docs_result_limit_exceeds_policy") {
-        return "The search request asks for more document results than policy allows.";
-    }
-    if (reason === "docs_read_bytes_exceeds_policy") {
-        return "The read request asks for more document bytes than policy allows.";
-    }
-    if (reason.startsWith("unsupported_tool:")) {
-        return "The tool is not supported by the native policy evaluator and fails closed.";
-    }
-    if (reason.startsWith("base_branch_mismatch:")) {
-        return "The requested base branch differs from the configured branch and needs review.";
-    }
-    return "The active native policy emitted this reason for the normalized action.";
-}
 function collectPatchPaths(input, prefix = "") {
     if (!isPlainObject(input)) {
         return prefix ? [prefix] : [];
@@ -1196,6 +2061,12 @@ function getString(value) {
 function getNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function getPositiveInteger(value) {
+    const number = getNumber(value);
+    return number !== null && Number.isInteger(number) && number > 0
+        ? number
+        : null;
+}
 function deepMerge(base, patch) {
     if (Array.isArray(base) || Array.isArray(patch)) {
         return (patch ?? base);