@neurcode-ai/cli 0.9.34 → 0.9.36

package/dist/commands/policy.js

@@ -9,6 +9,7 @@ const policy_exceptions_1 = require("../utils/policy-exceptions");
 const policy_governance_1 = require("../utils/policy-governance");
 const policy_audit_1 = require("../utils/policy-audit");
 const policy_packs_1 = require("../utils/policy-packs");
+const policy_compiler_1 = require("../utils/policy-compiler");
 // Import chalk with fallback
 let chalk;
 try {
@@ -62,6 +63,16 @@ function resolveActor(explicit) {
         return explicit.trim();
     return process.env.NEURCODE_ACTOR || process.env.GITHUB_ACTOR || process.env.USER || 'unknown';
 }
+function validateExceptionWindowByGovernance(expiresAt, maxExpiryDays) {
+    const expiryMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expiryMs)) {
+        throw new Error('expiresAt must be a valid ISO datetime');
+    }
+    const maxWindowMs = Math.max(1, maxExpiryDays) * 24 * 60 * 60 * 1000;
+    if (expiryMs - Date.now() > maxWindowMs) {
+        throw new Error(`exception expiry exceeds governance max window (${maxExpiryDays} days)`);
+    }
+}
 async function resolveCustomPolicies(client, includeDashboardPolicies, requireDashboardPolicies) {
     if (!includeDashboardPolicies) {
         return {
@@ -152,7 +163,7 @@ function policyCommand(program) {
     policy
         .command('install')
         .description('Install a policy pack for this repository')
-        .argument('<pack-id>', 'Policy pack ID (fintech|hipaa|soc2|startup-fast)')
+        .argument('<pack-id>', 'Policy pack ID (run `neurcode policy list` for all available stacks)')
         .option('--force', 'Replace any existing installed policy pack')
         .option('--json', 'Output as JSON')
         .action((packId, options) => {
@@ -365,14 +376,161 @@ function policyCommand(program) {
         }
         process.exit(pass ? 0 : 1);
     });
+    policy
+        .command('compile')
+        .description('Compile deterministic policy constraints into a committed artifact')
+        .option('--intent <text>', 'Optional intent constraints to compile alongside policy rules')
+        .option('--no-dashboard', 'Exclude dashboard custom policies from compiled artifact')
+        .option('--require-dashboard', 'Fail if dashboard custom policies cannot be loaded')
+        .option('--output <path>', 'Output file path (default: neurcode.policy.compiled.json)')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const config = loadPolicyRuntimeConfig();
+        const client = new api_client_1.ApiClient(config);
+        const includeDashboard = options.dashboard !== false;
+        try {
+            const customPolicyResolution = await resolveCustomPolicies(client, includeDashboard, options.requireDashboard === true);
+            const installedPack = (0, policy_packs_1.getInstalledPolicyPackRules)(cwd);
+            const customRules = customPolicyResolution.includeDashboardPolicies
+                ? (0, custom_policy_rules_1.mapActiveCustomPoliciesToRules)(customPolicyResolution.customPolicies)
+                : [];
+            const snapshot = (0, policy_packs_1.buildPolicyStateSnapshot)({
+                policyPack: installedPack,
+                policyPackRules: installedPack?.rules || [],
+                customPolicies: customPolicyResolution.customPolicies,
+                customRules,
+                includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
+            });
+            const compiled = (0, policy_compiler_1.buildCompiledPolicyArtifact)({
+                includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
+                policyLockPath: (0, policy_packs_1.getPolicyLockPath)(cwd),
+                policyLockFingerprint: snapshot.effective.fingerprint,
+                policyPack: installedPack
+                    ? {
+                        id: installedPack.packId,
+                        name: installedPack.packName,
+                        version: installedPack.version,
+                    }
+                    : null,
+                defaultRuleCount: snapshot.defaultRules.count,
+                policyPackRuleCount: installedPack?.rules.length || 0,
+                customRuleCount: customRules.length,
+                effectiveRuleCount: snapshot.effective.ruleCount,
+                intentConstraints: options.intent,
+                policyRules: customPolicyResolution.customPolicies.map((policy) => policy.rule_text),
+            });
+            const outputPath = (0, policy_compiler_1.writeCompiledPolicyArtifact)(cwd, compiled, options.output);
+            const readBack = (0, policy_compiler_1.readCompiledPolicyArtifact)(cwd, options.output);
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: resolveActor(),
+                    action: 'policy_compiled',
+                    entityType: 'policy_compiled_artifact',
+                    entityId: outputPath,
+                    metadata: {
+                        fingerprint: compiled.fingerprint,
+                        deterministicRuleCount: compiled.compilation.deterministicRuleCount,
+                        unmatchedStatements: compiled.compilation.unmatchedStatements.length,
+                        dashboardMode: compiled.source.includeDashboardPolicies ? 'dashboard' : 'disabled',
+                    },
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+            if (options.json) {
+                console.log(JSON.stringify({
+                    artifact: compiled,
+                    path: outputPath,
+                    resolvedPath: (0, policy_compiler_1.resolveCompiledPolicyPath)(cwd, options.output),
+                    verified: readBack.artifact !== null,
+                    warning: customPolicyResolution.dashboardWarning || null,
+                }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Policy compilation complete\n'));
+            console.log(chalk.cyan(`Path: ${outputPath}`));
+            console.log(chalk.dim(`Fingerprint: ${compiled.fingerprint}`));
+            console.log(chalk.dim(`Deterministic rules: ${compiled.compilation.deterministicRuleCount}`));
+            console.log(chalk.dim(`Unmatched statements: ${compiled.compilation.unmatchedStatements.length}`));
+            console.log(chalk.dim(`Policy source: ${compiled.source.includeDashboardPolicies ? 'dashboard + local packs' : 'local packs only'}`));
+            if (customPolicyResolution.dashboardWarning) {
+                console.log(chalk.yellow(`\n⚠️  ${customPolicyResolution.dashboardWarning}`));
+            }
+            console.log(chalk.dim('Run `neurcode verify --enforce-change-contract` to enforce this compiled contract.\n'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
     const governance = policy
         .command('governance')
         .description('Configure exception approval and policy audit governance');
     governance
         .command('status')
         .description('Show policy governance settings for this repository')
+        .option('--org', 'Fetch centralized organization governance settings from Neurcode Cloud')
         .option('--json', 'Output as JSON')
-        .action((options) => {
+        .action(async (options) => {
+        if (options.org) {
+            try {
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const settings = await client.getOrgGovernanceSettings();
+                if (!settings) {
+                    throw new Error('Organization governance settings not found');
+                }
+                const policyGovernance = settings.policyGovernance || null;
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        settings,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.bold('\n🏢 Org Policy Governance\n'));
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/governance/settings)'));
+                if (!policyGovernance) {
+                    console.log(chalk.yellow('No org-level policy governance configured.\n'));
+                    return;
+                }
+                console.log(chalk.dim(`Exception approvals required: ${policyGovernance.exceptionApprovals?.required ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Minimum approvals: ${policyGovernance.exceptionApprovals?.minApprovals ?? 1}`));
+                console.log(chalk.dim(`Disallow self approval: ${policyGovernance.exceptionApprovals?.disallowSelfApproval !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Reason required: ${policyGovernance.exceptionApprovals?.requireReason !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Minimum reason length: ${policyGovernance.exceptionApprovals?.minReasonLength ?? 12}`));
+                console.log(chalk.dim(`Maximum exception window (days): ${policyGovernance.exceptionApprovals?.maxExpiryDays ?? 30}`));
+                console.log(chalk.dim(`Allowed approvers: ${Array.isArray(policyGovernance.exceptionApprovals?.allowedApprovers)
+                    && policyGovernance.exceptionApprovals.allowedApprovers.length > 0
+                    ? policyGovernance.exceptionApprovals.allowedApprovers.join(', ')
+                    : '(any)'}`));
+                console.log(chalk.dim(`Critical rule patterns: ${Array.isArray(policyGovernance.exceptionApprovals?.criticalRulePatterns)
+                    && policyGovernance.exceptionApprovals.criticalRulePatterns.length > 0
+                    ? policyGovernance.exceptionApprovals.criticalRulePatterns.join(', ')
+                    : '(none)'}`));
+                console.log(chalk.dim(`Critical minimum approvals: ${policyGovernance.exceptionApprovals?.criticalMinApprovals ?? 2}`));
+                console.log(chalk.dim(`Require audit integrity: ${policyGovernance.audit?.requireIntegrity ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Updated at: ${settings.updatedAt || '(unknown)'}`));
+                console.log('');
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         const config = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
         if (options.json) {
@@ -387,37 +545,155 @@ function policyCommand(program) {
         console.log(chalk.dim(`Exception approvals required: ${config.exceptionApprovals.required ? 'yes' : 'no'}`));
         console.log(chalk.dim(`Minimum approvals: ${config.exceptionApprovals.minApprovals}`));
         console.log(chalk.dim(`Disallow self approval: ${config.exceptionApprovals.disallowSelfApproval ? 'yes' : 'no'}`));
+        console.log(chalk.dim(`Reason required: ${config.exceptionApprovals.requireReason ? 'yes' : 'no'}`));
+        console.log(chalk.dim(`Minimum reason length: ${config.exceptionApprovals.minReasonLength}`));
+        console.log(chalk.dim(`Maximum exception window (days): ${config.exceptionApprovals.maxExpiryDays}`));
         console.log(chalk.dim(`Allowed approvers: ${config.exceptionApprovals.allowedApprovers.length > 0 ? config.exceptionApprovals.allowedApprovers.join(', ') : '(any)'}`));
+        console.log(chalk.dim(`Critical rule patterns: ${config.exceptionApprovals.criticalRulePatterns.length > 0 ? config.exceptionApprovals.criticalRulePatterns.join(', ') : '(none)'}`));
+        console.log(chalk.dim(`Critical minimum approvals: ${config.exceptionApprovals.criticalMinApprovals}`));
         console.log(chalk.dim(`Require audit integrity: ${config.audit.requireIntegrity ? 'yes' : 'no'}`));
         console.log('');
     });
     governance
         .command('set')
         .description('Update policy governance settings')
+        .option('--org', 'Update centralized organization governance settings in Neurcode Cloud')
         .option('--require-approval', 'Require approvals before exceptions become effective')
         .option('--no-require-approval', 'Do not require approvals for exceptions')
         .option('--min-approvals <n>', 'Minimum approvals required when approval mode is enabled', (value) => parseInt(value, 10))
         .option('--allow-self-approval', 'Allow requester to approve their own exception')
         .option('--restrict-approvers <csv>', 'Comma-separated allow-list of approver identities')
         .option('--clear-approvers', 'Clear approver allow-list (allow any approver)')
+        .option('--require-reason', 'Require non-trivial exception reason text')
+        .option('--no-require-reason', 'Do not enforce minimum reason text length')
+        .option('--min-reason-length <n>', 'Minimum exception reason length (default: 12)', (value) => parseInt(value, 10))
+        .option('--max-expiry-days <n>', 'Maximum exception expiry window in days (default: 30)', (value) => parseInt(value, 10))
+        .option('--critical-rules <csv>', 'Comma-separated critical rule patterns requiring elevated approvals')
+        .option('--clear-critical-rules', 'Clear critical rule patterns')
+        .option('--critical-min-approvals <n>', 'Minimum approvals for critical rule exceptions (default: 2)', (value) => parseInt(value, 10))
         .option('--require-audit-integrity', 'Fail verify if policy audit chain integrity is broken')
         .option('--no-require-audit-integrity', 'Do not enforce policy audit integrity in verify')
         .option('--json', 'Output as JSON')
-        .action((options) => {
+        .action(async (options) => {
+        const hasRestrictApprovers = typeof options.restrictApprovers === 'string';
+        const hasCriticalRules = typeof options.criticalRules === 'string';
+        const parsedApprovers = options.clearApprovers
+            ? []
+            : hasRestrictApprovers
+                ? options.restrictApprovers
+                    .split(',')
+                    .map((item) => item.trim())
+                    .filter(Boolean)
+                : undefined;
+        const parsedCriticalRules = options.clearCriticalRules
+            ? []
+            : hasCriticalRules
+                ? options.criticalRules
+                    .split(',')
+                    .map((item) => item.trim())
+                    .filter(Boolean)
+                : undefined;
+        if (options.org) {
+            try {
+                const exceptionApprovalsPatch = {};
+                if (typeof options.requireApproval === 'boolean') {
+                    exceptionApprovalsPatch.required = options.requireApproval;
+                }
+                if (Number.isFinite(options.minApprovals)) {
+                    exceptionApprovalsPatch.minApprovals = options.minApprovals;
+                }
+                if (typeof options.allowSelfApproval === 'boolean') {
+                    exceptionApprovalsPatch.disallowSelfApproval = !options.allowSelfApproval;
+                }
+                if (parsedApprovers) {
+                    exceptionApprovalsPatch.allowedApprovers = parsedApprovers;
+                }
+                if (typeof options.requireReason === 'boolean') {
+                    exceptionApprovalsPatch.requireReason = options.requireReason;
+                }
+                if (Number.isFinite(options.minReasonLength)) {
+                    exceptionApprovalsPatch.minReasonLength = options.minReasonLength;
+                }
+                if (Number.isFinite(options.maxExpiryDays)) {
+                    exceptionApprovalsPatch.maxExpiryDays = options.maxExpiryDays;
+                }
+                if (parsedCriticalRules) {
+                    exceptionApprovalsPatch.criticalRulePatterns = parsedCriticalRules;
+                }
+                if (Number.isFinite(options.criticalMinApprovals)) {
+                    exceptionApprovalsPatch.criticalMinApprovals = options.criticalMinApprovals;
+                }
+                const auditPatch = {};
+                if (typeof options.requireAuditIntegrity === 'boolean') {
+                    auditPatch.requireIntegrity = options.requireAuditIntegrity;
+                }
+                const policyGovernancePatch = {};
+                if (Object.keys(exceptionApprovalsPatch).length > 0) {
+                    policyGovernancePatch.exceptionApprovals = exceptionApprovalsPatch;
+                }
+                if (Object.keys(auditPatch).length > 0) {
+                    policyGovernancePatch.audit = auditPatch;
+                }
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const settings = await client.updateOrgGovernanceSettings({
+                    policyGovernance: policyGovernancePatch,
+                });
+                if (!settings) {
+                    throw new Error('Failed to update org governance settings');
+                }
+                const next = settings.policyGovernance;
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        settings,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.green('\n✅ Organization policy governance updated.\n'));
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/governance/settings)'));
+                if (!next) {
+                    console.log(chalk.yellow('No org-level policy governance payload returned.\n'));
+                    return;
+                }
+                console.log(chalk.dim(`Approval required: ${next.exceptionApprovals?.required ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Min approvals: ${next.exceptionApprovals?.minApprovals ?? 1}`));
+                console.log(chalk.dim(`Disallow self approval: ${next.exceptionApprovals?.disallowSelfApproval !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Reason required: ${next.exceptionApprovals?.requireReason !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Min reason length: ${next.exceptionApprovals?.minReasonLength ?? 12}`));
+                console.log(chalk.dim(`Max expiry days: ${next.exceptionApprovals?.maxExpiryDays ?? 30}`));
+                console.log(chalk.dim(`Critical min approvals: ${next.exceptionApprovals?.criticalMinApprovals ?? 2}`));
+                console.log(chalk.dim(`Critical rule patterns: ${Array.isArray(next.exceptionApprovals?.criticalRulePatterns)
+                    && next.exceptionApprovals.criticalRulePatterns.length > 0
+                    ? next.exceptionApprovals.criticalRulePatterns.join(', ')
+                    : '(none)'}`));
+                console.log(chalk.dim(`Require audit integrity: ${next.audit?.requireIntegrity ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Updated at: ${settings.updatedAt || '(unknown)'}`));
+                console.log('');
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         try {
             const next = (0, policy_governance_1.updatePolicyGovernanceConfig)(cwd, {
                 required: typeof options.requireApproval === 'boolean' ? options.requireApproval : undefined,
                 minApprovals: Number.isFinite(options.minApprovals) ? options.minApprovals : undefined,
                 disallowSelfApproval: typeof options.allowSelfApproval === 'boolean' ? !options.allowSelfApproval : undefined,
-                allowedApprovers: options.clearApprovers
-                    ? []
-                    : typeof options.restrictApprovers === 'string'
-                        ? options.restrictApprovers
-                            .split(',')
-                            .map((item) => item.trim())
-                            .filter(Boolean)
-                        : undefined,
+                allowedApprovers: parsedApprovers,
+                requireReason: typeof options.requireReason === 'boolean' ? options.requireReason : undefined,
+                minReasonLength: Number.isFinite(options.minReasonLength) ? options.minReasonLength : undefined,
+                maxExpiryDays: Number.isFinite(options.maxExpiryDays) ? options.maxExpiryDays : undefined,
+                criticalRulePatterns: parsedCriticalRules,
+                criticalMinApprovals: Number.isFinite(options.criticalMinApprovals) ? options.criticalMinApprovals : undefined,
                 requireAuditIntegrity: typeof options.requireAuditIntegrity === 'boolean' ? options.requireAuditIntegrity : undefined,
             });
             try {
@@ -431,6 +707,11 @@ function policyCommand(program) {
                         minApprovals: next.exceptionApprovals.minApprovals,
                         disallowSelfApproval: next.exceptionApprovals.disallowSelfApproval,
                         allowedApprovers: next.exceptionApprovals.allowedApprovers,
+                        requireReason: next.exceptionApprovals.requireReason,
+                        minReasonLength: next.exceptionApprovals.minReasonLength,
+                        maxExpiryDays: next.exceptionApprovals.maxExpiryDays,
+                        criticalRulePatterns: next.exceptionApprovals.criticalRulePatterns,
+                        criticalMinApprovals: next.exceptionApprovals.criticalMinApprovals,
                         requireAuditIntegrity: next.audit.requireIntegrity,
                     },
                 });
@@ -447,6 +728,11 @@ function policyCommand(program) {
             console.log(chalk.dim(`Approval required: ${next.exceptionApprovals.required ? 'yes' : 'no'}`));
             console.log(chalk.dim(`Min approvals: ${next.exceptionApprovals.minApprovals}`));
             console.log(chalk.dim(`Disallow self approval: ${next.exceptionApprovals.disallowSelfApproval ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`Reason required: ${next.exceptionApprovals.requireReason ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`Min reason length: ${next.exceptionApprovals.minReasonLength}`));
+            console.log(chalk.dim(`Max expiry days: ${next.exceptionApprovals.maxExpiryDays}`));
+            console.log(chalk.dim(`Critical min approvals: ${next.exceptionApprovals.criticalMinApprovals}`));
+            console.log(chalk.dim(`Critical rule patterns: ${next.exceptionApprovals.criticalRulePatterns.length > 0 ? next.exceptionApprovals.criticalRulePatterns.join(', ') : '(none)'}`));
             console.log(chalk.dim(`Require audit integrity: ${next.audit.requireIntegrity ? 'yes' : 'no'}`));
             console.log(chalk.dim('Commit governance + audit files so CI can enforce approval and integrity rules.'));
             console.log('');
@@ -514,17 +800,27 @@ function policyCommand(program) {
             if (allowedApprovers.size > 0) {
                 effectiveApprovals = effectiveApprovals.filter((item) => allowedApprovers.has(item.approver.toLowerCase()));
             }
+            const requiredApprovalResolution = (0, policy_governance_1.resolveRequiredApprovalsForRule)(entry.rulePattern, governance);
+            const requiredApprovals = governance.exceptionApprovals.required
+                ? requiredApprovalResolution.requiredApprovals
+                : 0;
+            const reasonValid = !governance.exceptionApprovals.requireReason
+                || (entry.reason || '').trim().length >= governance.exceptionApprovals.minReasonLength;
             const status = !entry.active || !unexpired
                 ? 'inactive'
-                : !governance.exceptionApprovals.required
-                    ? 'active'
-                    : effectiveApprovals.length >= governance.exceptionApprovals.minApprovals
-                        ? 'approved'
-                        : 'pending';
+                : !reasonValid
+                    ? 'invalid_reason'
+                    : !governance.exceptionApprovals.required
+                        ? 'active'
+                        : effectiveApprovals.length >= requiredApprovals
+                            ? 'approved'
+                            : 'pending';
             return {
                 ...entry,
                 status,
                 effectiveApprovals: effectiveApprovals.length,
+                requiredApprovals,
+                criticalRule: requiredApprovalResolution.critical,
             };
         });
         const items = options.all ? withStatus : withStatus.filter((entry) => entry.status !== 'inactive');
@@ -550,7 +846,10 @@ function policyCommand(program) {
             console.log(chalk.dim(`  status=${entry.status || (entry.active ? 'active' : 'inactive')}`));
             console.log(chalk.dim(`  rule=${entry.rulePattern} file=${entry.filePattern}`));
             console.log(chalk.dim(`  expires=${entry.expiresAt} active=${entry.active ? 'yes' : 'no'}`));
-            console.log(chalk.dim(`  approvals=${entry.approvals.length}${typeof entry.effectiveApprovals === 'number' ? ` (effective=${entry.effectiveApprovals})` : ''}`));
+            console.log(chalk.dim(`  approvals=${entry.approvals.length}` +
+                `${typeof entry.effectiveApprovals === 'number' ? ` (effective=${entry.effectiveApprovals})` : ''}` +
+                `${typeof entry.requiredApprovals === 'number' && entry.requiredApprovals > 0 ? ` required=${entry.requiredApprovals}` : ''}` +
+                `${entry.criticalRule ? ' critical=yes' : ''}`));
             console.log(chalk.dim(`  reason=${entry.reason}`));
             console.log(chalk.dim(`  requestedBy=${entry.requestedBy || entry.createdBy || 'unknown'}`));
             if (entry.ticket) {
@@ -587,6 +886,12 @@ function policyCommand(program) {
                 expiresAt: options.expiresAt,
                 expiresInDays: options.expiresInDays,
             });
+            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            if (governance.exceptionApprovals.requireReason
+                && options.reason.trim().length < governance.exceptionApprovals.minReasonLength) {
+                throw new Error(`reason must be at least ${governance.exceptionApprovals.minReasonLength} characters (governance policy)`);
+            }
+            validateExceptionWindowByGovernance(expiresAt, governance.exceptionApprovals.maxExpiryDays);
             const createdBy = resolveActor();
             const created = (0, policy_exceptions_1.addPolicyException)(cwd, {
                 rulePattern: options.rule,
@@ -598,7 +903,7 @@ function policyCommand(program) {
                 createdBy,
                 requestedBy: createdBy,
             });
-            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            const approvalResolution = (0, policy_governance_1.resolveRequiredApprovalsForRule)(created.rulePattern, governance);
             try {
                 (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
                     actor: createdBy,
@@ -610,6 +915,10 @@ function policyCommand(program) {
                         filePattern: created.filePattern,
                         expiresAt: created.expiresAt,
                         requireApproval: governance.exceptionApprovals.required,
+                        requiredApprovals: governance.exceptionApprovals.required
+                            ? approvalResolution.requiredApprovals
+                            : 0,
+                        criticalRule: approvalResolution.critical,
                     },
                 });
             }
@@ -621,6 +930,10 @@ function policyCommand(program) {
                     created,
                     path: (0, policy_exceptions_1.getPolicyExceptionsPath)(cwd),
                     requiresApproval: governance.exceptionApprovals.required,
+                    requiredApprovals: governance.exceptionApprovals.required
+                        ? approvalResolution.requiredApprovals
+                        : 0,
+                    criticalRule: approvalResolution.critical,
                 }, null, 2));
                 return;
             }
@@ -631,7 +944,8 @@ function policyCommand(program) {
             console.log(chalk.dim(`Expires: ${created.expiresAt}`));
             console.log(chalk.dim(`Reason: ${created.reason}`));
             if (governance.exceptionApprovals.required) {
-                console.log(chalk.yellow(`Approval required: ${governance.exceptionApprovals.minApprovals} approver(s) before this exception is active.`));
+                const requiredApprovals = approvalResolution.requiredApprovals;
+                console.log(chalk.yellow(`Approval required: ${requiredApprovals} approver(s) before this exception is active${approvalResolution.critical ? ' (critical rule gate)' : ''}.`));
             }
             if (created.ticket) {
                 console.log(chalk.dim(`Ticket: ${created.ticket}`));
@@ -659,6 +973,25 @@ function policyCommand(program) {
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         const approver = resolveActor(options.by);
         try {
+            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            const target = (0, policy_exceptions_1.listPolicyExceptions)(cwd).all.find((entry) => entry.id === String(id).trim());
+            if (!target) {
+                if (options.json) {
+                    console.log(JSON.stringify({ error: 'Exception not found' }, null, 2));
+                    process.exit(1);
+                }
+                console.log(chalk.yellow('\n⚠️  Exception not found.\n'));
+                process.exit(1);
+            }
+            const normalizedApprover = approver.toLowerCase();
+            const requestedBy = (target.requestedBy || target.createdBy || '').toLowerCase();
+            if (governance.exceptionApprovals.disallowSelfApproval && requestedBy && normalizedApprover === requestedBy) {
+                throw new Error('self-approval is disallowed by governance policy');
+            }
+            if (governance.exceptionApprovals.allowedApprovers.length > 0
+                && !governance.exceptionApprovals.allowedApprovers.map((item) => item.toLowerCase()).includes(normalizedApprover)) {
+                throw new Error('approver is not in governance allow-list');
+            }
             const updated = (0, policy_exceptions_1.approvePolicyException)(cwd, String(id).trim(), {
                 approver,
                 comment: options.comment,
@@ -671,6 +1004,19 @@ function policyCommand(program) {
                 console.log(chalk.yellow('\n⚠️  Exception not found.\n'));
                 process.exit(1);
             }
+            const requiredApprovalResolution = (0, policy_governance_1.resolveRequiredApprovalsForRule)(updated.rulePattern, governance);
+            const acceptedApprovals = updated.approvals.filter((item) => {
+                const actor = item.approver.toLowerCase();
+                if (governance.exceptionApprovals.allowedApprovers.length > 0
+                    && !governance.exceptionApprovals.allowedApprovers.map((entry) => entry.toLowerCase()).includes(actor)) {
+                    return false;
+                }
+                if (governance.exceptionApprovals.disallowSelfApproval && requestedBy && actor === requestedBy) {
+                    return false;
+                }
+                return true;
+            });
+            const effectiveApprovals = acceptedApprovals.length;
             try {
                 (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
                     actor: approver,
@@ -680,6 +1026,9 @@ function policyCommand(program) {
                     metadata: {
                         comment: options.comment || null,
                         approvals: updated.approvals.length,
+                        effectiveApprovals,
+                        requiredApprovals: requiredApprovalResolution.requiredApprovals,
+                        criticalRule: requiredApprovalResolution.critical,
                     },
                 });
             }
@@ -690,12 +1039,20 @@ function policyCommand(program) {
                 console.log(JSON.stringify({
                     approved: true,
                     exception: updated,
+                    effectiveApprovals,
+                    requiredApprovals: requiredApprovalResolution.requiredApprovals,
+                    approvalSatisfied: !governance.exceptionApprovals.required
+                        || effectiveApprovals >= requiredApprovalResolution.requiredApprovals,
+                    criticalRule: requiredApprovalResolution.critical,
                 }, null, 2));
                 return;
             }
             console.log(chalk.green('\n✅ Policy exception approval recorded.\n'));
             console.log(chalk.dim(`ID: ${updated.id}`));
-            console.log(chalk.dim(`Approvals: ${updated.approvals.length}`));
+            console.log(chalk.dim(`Approvals: ${updated.approvals.length} (effective=${effectiveApprovals})`));
+            if (governance.exceptionApprovals.required) {
+                console.log(chalk.dim(`Required approvals: ${requiredApprovalResolution.requiredApprovals}${requiredApprovalResolution.critical ? ' (critical rule gate)' : ''}`));
+            }
             console.log(chalk.dim(`Approver: ${approver}`));
             console.log('');
         }