@neurcode-ai/cli 0.9.35 → 0.9.37

package/dist/commands/policy.js

@@ -10,6 +10,7 @@ const policy_governance_1 = require("../utils/policy-governance");
 const policy_audit_1 = require("../utils/policy-audit");
 const policy_packs_1 = require("../utils/policy-packs");
 const policy_compiler_1 = require("../utils/policy-compiler");
+const artifact_signature_1 = require("../utils/artifact-signature");
 // Import chalk with fallback
 let chalk;
 try {
@@ -63,6 +64,21 @@ function resolveActor(explicit) {
         return explicit.trim();
     return process.env.NEURCODE_ACTOR || process.env.GITHUB_ACTOR || process.env.USER || 'unknown';
 }
+function validateExceptionWindowByGovernance(expiresAt, maxExpiryDays) {
+    const expiryMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expiryMs)) {
+        throw new Error('expiresAt must be a valid ISO datetime');
+    }
+    const maxWindowMs = Math.max(1, maxExpiryDays) * 24 * 60 * 60 * 1000;
+    if (expiryMs - Date.now() > maxWindowMs) {
+        throw new Error(`exception expiry exceeds governance max window (${maxExpiryDays} days)`);
+    }
+}
+function normalizeListLimit(value, fallback, min, max) {
+    if (!Number.isFinite(value))
+        return fallback;
+    return Math.max(min, Math.min(max, Math.floor(Number(value))));
+}
 async function resolveCustomPolicies(client, includeDashboardPolicies, requireDashboardPolicies) {
     if (!includeDashboardPolicies) {
         return {
@@ -153,7 +169,7 @@ function policyCommand(program) {
     policy
         .command('install')
         .description('Install a policy pack for this repository')
-        .argument('<pack-id>', 'Policy pack ID (fintech|hipaa|soc2|startup-fast)')
+        .argument('<pack-id>', 'Policy pack ID (run `neurcode policy list` for all available stacks)')
         .option('--force', 'Replace any existing installed policy pack')
         .option('--json', 'Output as JSON')
         .action((packId, options) => {
@@ -372,6 +388,7 @@ function policyCommand(program) {
         .option('--intent <text>', 'Optional intent constraints to compile alongside policy rules')
         .option('--no-dashboard', 'Exclude dashboard custom policies from compiled artifact')
         .option('--require-dashboard', 'Fail if dashboard custom policies cannot be loaded')
+        .option('--require-deterministic-match', 'Fail if any intent statement cannot be compiled into deterministic enforcement rules')
         .option('--output <path>', 'Output file path (default: neurcode.policy.compiled.json)')
         .option('--json', 'Output as JSON')
         .action(async (options) => {
@@ -392,7 +409,7 @@ function policyCommand(program) {
                 customRules,
                 includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
             });
-            const compiled = (0, policy_compiler_1.buildCompiledPolicyArtifact)({
+            const compiledUnsigned = (0, policy_compiler_1.buildCompiledPolicyArtifact)({
                 includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
                 policyLockPath: (0, policy_packs_1.getPolicyLockPath)(cwd),
                 policyLockFingerprint: snapshot.effective.fingerprint,
@@ -410,6 +427,19 @@ function policyCommand(program) {
                 intentConstraints: options.intent,
                 policyRules: customPolicyResolution.customPolicies.map((policy) => policy.rule_text),
             });
+            const artifactSigningConfig = (0, artifact_signature_1.resolveGovernanceArtifactSigningConfigFromEnv)();
+            const compiled = (0, artifact_signature_1.signGovernanceArtifact)(compiledUnsigned, artifactSigningConfig);
+            if (options.requireDeterministicMatch === true
+                && compiled.compilation.unmatchedStatements.length > 0) {
+                const unmatchedError = new Error(`Deterministic policy compilation blocked: ${compiled.compilation.unmatchedStatements.length} intent statement(s) could not be converted into enforceable rules.`);
+                unmatchedError.code = 'POLICY_COMPILE_UNMATCHED_INTENT';
+                unmatchedError.unmatchedStatements = [
+                    ...compiled.compilation.unmatchedStatements,
+                ];
+                unmatchedError.deterministicRuleCount =
+                    compiled.compilation.deterministicRuleCount;
+                throw unmatchedError;
+            }
             const outputPath = (0, policy_compiler_1.writeCompiledPolicyArtifact)(cwd, compiled, options.output);
             const readBack = (0, policy_compiler_1.readCompiledPolicyArtifact)(cwd, options.output);
             try {
@@ -423,6 +453,8 @@ function policyCommand(program) {
                         deterministicRuleCount: compiled.compilation.deterministicRuleCount,
                         unmatchedStatements: compiled.compilation.unmatchedStatements.length,
                         dashboardMode: compiled.source.includeDashboardPolicies ? 'dashboard' : 'disabled',
+                        signaturePresent: Boolean(compiled.signature && compiled.signature.value),
+                        signatureKeyId: compiled.signature?.keyId || null,
                     },
                 });
             }
@@ -444,6 +476,12 @@ function policyCommand(program) {
             console.log(chalk.dim(`Fingerprint: ${compiled.fingerprint}`));
             console.log(chalk.dim(`Deterministic rules: ${compiled.compilation.deterministicRuleCount}`));
             console.log(chalk.dim(`Unmatched statements: ${compiled.compilation.unmatchedStatements.length}`));
+            if (compiled.signature?.value) {
+                console.log(chalk.dim(`Artifact signature: signed (${compiled.signature.keyId ? `key ${compiled.signature.keyId}` : 'inline key'})`));
+            }
+            else {
+                console.log(chalk.dim('Artifact signature: unsigned (set NEURCODE_GOVERNANCE_SIGNING_KEY to sign artifacts)'));
+            }
             console.log(chalk.dim(`Policy source: ${compiled.source.includeDashboardPolicies ? 'dashboard + local packs' : 'local packs only'}`));
             if (customPolicyResolution.dashboardWarning) {
                 console.log(chalk.yellow(`\n⚠️  ${customPolicyResolution.dashboardWarning}`));
@@ -453,7 +491,22 @@ function policyCommand(program) {
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
             if (options.json) {
-                console.log(JSON.stringify({ error: message }, null, 2));
+                const payload = { error: message };
+                if (error && typeof error === 'object') {
+                    const maybeCode = error.code;
+                    const maybeUnmatched = error.unmatchedStatements;
+                    const maybeRuleCount = error.deterministicRuleCount;
+                    if (typeof maybeCode === 'string') {
+                        payload.code = maybeCode;
+                    }
+                    if (Array.isArray(maybeUnmatched)) {
+                        payload.unmatchedStatements = maybeUnmatched.filter((item) => typeof item === 'string');
+                    }
+                    if (typeof maybeRuleCount === 'number' && Number.isFinite(maybeRuleCount)) {
+                        payload.deterministicRuleCount = maybeRuleCount;
+                    }
+                }
+                console.log(JSON.stringify(payload, null, 2));
                 process.exit(1);
             }
             console.error(chalk.red(`\n❌ ${message}\n`));
@@ -466,8 +519,61 @@ function policyCommand(program) {
     governance
         .command('status')
         .description('Show policy governance settings for this repository')
+        .option('--org', 'Fetch centralized organization governance settings from Neurcode Cloud')
         .option('--json', 'Output as JSON')
-        .action((options) => {
+        .action(async (options) => {
+        if (options.org) {
+            try {
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const settings = await client.getOrgGovernanceSettings();
+                if (!settings) {
+                    throw new Error('Organization governance settings not found');
+                }
+                const policyGovernance = settings.policyGovernance || null;
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        settings,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.bold('\n🏢 Org Policy Governance\n'));
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/governance/settings)'));
+                if (!policyGovernance) {
+                    console.log(chalk.yellow('No org-level policy governance configured.\n'));
+                    return;
+                }
+                console.log(chalk.dim(`Exception approvals required: ${policyGovernance.exceptionApprovals?.required ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Minimum approvals: ${policyGovernance.exceptionApprovals?.minApprovals ?? 1}`));
+                console.log(chalk.dim(`Disallow self approval: ${policyGovernance.exceptionApprovals?.disallowSelfApproval !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Reason required: ${policyGovernance.exceptionApprovals?.requireReason !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Minimum reason length: ${policyGovernance.exceptionApprovals?.minReasonLength ?? 12}`));
+                console.log(chalk.dim(`Maximum exception window (days): ${policyGovernance.exceptionApprovals?.maxExpiryDays ?? 30}`));
+                console.log(chalk.dim(`Allowed approvers: ${Array.isArray(policyGovernance.exceptionApprovals?.allowedApprovers)
+                    && policyGovernance.exceptionApprovals.allowedApprovers.length > 0
+                    ? policyGovernance.exceptionApprovals.allowedApprovers.join(', ')
+                    : '(any)'}`));
+                console.log(chalk.dim(`Critical rule patterns: ${Array.isArray(policyGovernance.exceptionApprovals?.criticalRulePatterns)
+                    && policyGovernance.exceptionApprovals.criticalRulePatterns.length > 0
+                    ? policyGovernance.exceptionApprovals.criticalRulePatterns.join(', ')
+                    : '(none)'}`));
+                console.log(chalk.dim(`Critical minimum approvals: ${policyGovernance.exceptionApprovals?.criticalMinApprovals ?? 2}`));
+                console.log(chalk.dim(`Require audit integrity: ${policyGovernance.audit?.requireIntegrity ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Updated at: ${settings.updatedAt || '(unknown)'}`));
+                console.log('');
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         const config = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
         if (options.json) {
@@ -482,37 +588,155 @@ function policyCommand(program) {
         console.log(chalk.dim(`Exception approvals required: ${config.exceptionApprovals.required ? 'yes' : 'no'}`));
         console.log(chalk.dim(`Minimum approvals: ${config.exceptionApprovals.minApprovals}`));
         console.log(chalk.dim(`Disallow self approval: ${config.exceptionApprovals.disallowSelfApproval ? 'yes' : 'no'}`));
+        console.log(chalk.dim(`Reason required: ${config.exceptionApprovals.requireReason ? 'yes' : 'no'}`));
+        console.log(chalk.dim(`Minimum reason length: ${config.exceptionApprovals.minReasonLength}`));
+        console.log(chalk.dim(`Maximum exception window (days): ${config.exceptionApprovals.maxExpiryDays}`));
         console.log(chalk.dim(`Allowed approvers: ${config.exceptionApprovals.allowedApprovers.length > 0 ? config.exceptionApprovals.allowedApprovers.join(', ') : '(any)'}`));
+        console.log(chalk.dim(`Critical rule patterns: ${config.exceptionApprovals.criticalRulePatterns.length > 0 ? config.exceptionApprovals.criticalRulePatterns.join(', ') : '(none)'}`));
+        console.log(chalk.dim(`Critical minimum approvals: ${config.exceptionApprovals.criticalMinApprovals}`));
         console.log(chalk.dim(`Require audit integrity: ${config.audit.requireIntegrity ? 'yes' : 'no'}`));
         console.log('');
     });
     governance
         .command('set')
         .description('Update policy governance settings')
+        .option('--org', 'Update centralized organization governance settings in Neurcode Cloud')
         .option('--require-approval', 'Require approvals before exceptions become effective')
         .option('--no-require-approval', 'Do not require approvals for exceptions')
         .option('--min-approvals <n>', 'Minimum approvals required when approval mode is enabled', (value) => parseInt(value, 10))
         .option('--allow-self-approval', 'Allow requester to approve their own exception')
         .option('--restrict-approvers <csv>', 'Comma-separated allow-list of approver identities')
         .option('--clear-approvers', 'Clear approver allow-list (allow any approver)')
+        .option('--require-reason', 'Require non-trivial exception reason text')
+        .option('--no-require-reason', 'Do not enforce minimum reason text length')
+        .option('--min-reason-length <n>', 'Minimum exception reason length (default: 12)', (value) => parseInt(value, 10))
+        .option('--max-expiry-days <n>', 'Maximum exception expiry window in days (default: 30)', (value) => parseInt(value, 10))
+        .option('--critical-rules <csv>', 'Comma-separated critical rule patterns requiring elevated approvals')
+        .option('--clear-critical-rules', 'Clear critical rule patterns')
+        .option('--critical-min-approvals <n>', 'Minimum approvals for critical rule exceptions (default: 2)', (value) => parseInt(value, 10))
         .option('--require-audit-integrity', 'Fail verify if policy audit chain integrity is broken')
         .option('--no-require-audit-integrity', 'Do not enforce policy audit integrity in verify')
         .option('--json', 'Output as JSON')
-        .action((options) => {
+        .action(async (options) => {
+        const hasRestrictApprovers = typeof options.restrictApprovers === 'string';
+        const hasCriticalRules = typeof options.criticalRules === 'string';
+        const parsedApprovers = options.clearApprovers
+            ? []
+            : hasRestrictApprovers
+                ? options.restrictApprovers
+                    .split(',')
+                    .map((item) => item.trim())
+                    .filter(Boolean)
+                : undefined;
+        const parsedCriticalRules = options.clearCriticalRules
+            ? []
+            : hasCriticalRules
+                ? options.criticalRules
+                    .split(',')
+                    .map((item) => item.trim())
+                    .filter(Boolean)
+                : undefined;
+        if (options.org) {
+            try {
+                const exceptionApprovalsPatch = {};
+                if (typeof options.requireApproval === 'boolean') {
+                    exceptionApprovalsPatch.required = options.requireApproval;
+                }
+                if (Number.isFinite(options.minApprovals)) {
+                    exceptionApprovalsPatch.minApprovals = options.minApprovals;
+                }
+                if (typeof options.allowSelfApproval === 'boolean') {
+                    exceptionApprovalsPatch.disallowSelfApproval = !options.allowSelfApproval;
+                }
+                if (parsedApprovers) {
+                    exceptionApprovalsPatch.allowedApprovers = parsedApprovers;
+                }
+                if (typeof options.requireReason === 'boolean') {
+                    exceptionApprovalsPatch.requireReason = options.requireReason;
+                }
+                if (Number.isFinite(options.minReasonLength)) {
+                    exceptionApprovalsPatch.minReasonLength = options.minReasonLength;
+                }
+                if (Number.isFinite(options.maxExpiryDays)) {
+                    exceptionApprovalsPatch.maxExpiryDays = options.maxExpiryDays;
+                }
+                if (parsedCriticalRules) {
+                    exceptionApprovalsPatch.criticalRulePatterns = parsedCriticalRules;
+                }
+                if (Number.isFinite(options.criticalMinApprovals)) {
+                    exceptionApprovalsPatch.criticalMinApprovals = options.criticalMinApprovals;
+                }
+                const auditPatch = {};
+                if (typeof options.requireAuditIntegrity === 'boolean') {
+                    auditPatch.requireIntegrity = options.requireAuditIntegrity;
+                }
+                const policyGovernancePatch = {};
+                if (Object.keys(exceptionApprovalsPatch).length > 0) {
+                    policyGovernancePatch.exceptionApprovals = exceptionApprovalsPatch;
+                }
+                if (Object.keys(auditPatch).length > 0) {
+                    policyGovernancePatch.audit = auditPatch;
+                }
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const settings = await client.updateOrgGovernanceSettings({
+                    policyGovernance: policyGovernancePatch,
+                });
+                if (!settings) {
+                    throw new Error('Failed to update org governance settings');
+                }
+                const next = settings.policyGovernance;
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        settings,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.green('\n✅ Organization policy governance updated.\n'));
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/governance/settings)'));
+                if (!next) {
+                    console.log(chalk.yellow('No org-level policy governance payload returned.\n'));
+                    return;
+                }
+                console.log(chalk.dim(`Approval required: ${next.exceptionApprovals?.required ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Min approvals: ${next.exceptionApprovals?.minApprovals ?? 1}`));
+                console.log(chalk.dim(`Disallow self approval: ${next.exceptionApprovals?.disallowSelfApproval !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Reason required: ${next.exceptionApprovals?.requireReason !== false ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Min reason length: ${next.exceptionApprovals?.minReasonLength ?? 12}`));
+                console.log(chalk.dim(`Max expiry days: ${next.exceptionApprovals?.maxExpiryDays ?? 30}`));
+                console.log(chalk.dim(`Critical min approvals: ${next.exceptionApprovals?.criticalMinApprovals ?? 2}`));
+                console.log(chalk.dim(`Critical rule patterns: ${Array.isArray(next.exceptionApprovals?.criticalRulePatterns)
+                    && next.exceptionApprovals.criticalRulePatterns.length > 0
+                    ? next.exceptionApprovals.criticalRulePatterns.join(', ')
+                    : '(none)'}`));
+                console.log(chalk.dim(`Require audit integrity: ${next.audit?.requireIntegrity ? 'yes' : 'no'}`));
+                console.log(chalk.dim(`Updated at: ${settings.updatedAt || '(unknown)'}`));
+                console.log('');
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         try {
             const next = (0, policy_governance_1.updatePolicyGovernanceConfig)(cwd, {
                 required: typeof options.requireApproval === 'boolean' ? options.requireApproval : undefined,
                 minApprovals: Number.isFinite(options.minApprovals) ? options.minApprovals : undefined,
                 disallowSelfApproval: typeof options.allowSelfApproval === 'boolean' ? !options.allowSelfApproval : undefined,
-                allowedApprovers: options.clearApprovers
-                    ? []
-                    : typeof options.restrictApprovers === 'string'
-                        ? options.restrictApprovers
-                            .split(',')
-                            .map((item) => item.trim())
-                            .filter(Boolean)
-                        : undefined,
+                allowedApprovers: parsedApprovers,
+                requireReason: typeof options.requireReason === 'boolean' ? options.requireReason : undefined,
+                minReasonLength: Number.isFinite(options.minReasonLength) ? options.minReasonLength : undefined,
+                maxExpiryDays: Number.isFinite(options.maxExpiryDays) ? options.maxExpiryDays : undefined,
+                criticalRulePatterns: parsedCriticalRules,
+                criticalMinApprovals: Number.isFinite(options.criticalMinApprovals) ? options.criticalMinApprovals : undefined,
                 requireAuditIntegrity: typeof options.requireAuditIntegrity === 'boolean' ? options.requireAuditIntegrity : undefined,
             });
             try {
@@ -526,6 +750,11 @@ function policyCommand(program) {
                         minApprovals: next.exceptionApprovals.minApprovals,
                         disallowSelfApproval: next.exceptionApprovals.disallowSelfApproval,
                         allowedApprovers: next.exceptionApprovals.allowedApprovers,
+                        requireReason: next.exceptionApprovals.requireReason,
+                        minReasonLength: next.exceptionApprovals.minReasonLength,
+                        maxExpiryDays: next.exceptionApprovals.maxExpiryDays,
+                        criticalRulePatterns: next.exceptionApprovals.criticalRulePatterns,
+                        criticalMinApprovals: next.exceptionApprovals.criticalMinApprovals,
                         requireAuditIntegrity: next.audit.requireIntegrity,
                     },
                 });
@@ -542,6 +771,11 @@ function policyCommand(program) {
             console.log(chalk.dim(`Approval required: ${next.exceptionApprovals.required ? 'yes' : 'no'}`));
             console.log(chalk.dim(`Min approvals: ${next.exceptionApprovals.minApprovals}`));
             console.log(chalk.dim(`Disallow self approval: ${next.exceptionApprovals.disallowSelfApproval ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`Reason required: ${next.exceptionApprovals.requireReason ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`Min reason length: ${next.exceptionApprovals.minReasonLength}`));
+            console.log(chalk.dim(`Max expiry days: ${next.exceptionApprovals.maxExpiryDays}`));
+            console.log(chalk.dim(`Critical min approvals: ${next.exceptionApprovals.criticalMinApprovals}`));
+            console.log(chalk.dim(`Critical rule patterns: ${next.exceptionApprovals.criticalRulePatterns.length > 0 ? next.exceptionApprovals.criticalRulePatterns.join(', ') : '(none)'}`));
             console.log(chalk.dim(`Require audit integrity: ${next.audit.requireIntegrity ? 'yes' : 'no'}`));
             console.log(chalk.dim('Commit governance + audit files so CI can enforce approval and integrity rules.'));
             console.log('');
@@ -592,9 +826,59 @@ function policyCommand(program) {
     exception
         .command('list')
         .description('List policy exceptions for this repository')
+        .option('--org', 'List centralized organization policy exceptions from Neurcode Cloud')
         .option('--all', 'Include inactive/expired exceptions')
         .option('--json', 'Output as JSON')
-        .action((options) => {
+        .action(async (options) => {
+        if (options.org) {
+            try {
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const exceptions = await client.listOrgPolicyExceptions({ limit: 250 });
+                const items = options.all
+                    ? exceptions
+                    : exceptions.filter((entry) => entry.effectiveState !== 'revoked' && entry.effectiveState !== 'expired');
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        total: exceptions.length,
+                        exceptions: items,
+                    }, null, 2));
+                    return;
+                }
+                if (items.length === 0) {
+                    console.log(chalk.yellow('\n⚠️  No organization policy exceptions found.\n'));
+                    console.log(chalk.dim('Add one: neurcode policy exception add --org --rule <pattern> --file <glob> --reason "<why>"\n'));
+                    return;
+                }
+                console.log(chalk.bold('\n🏢 Org Policy Exceptions\n'));
+                items.forEach((entry) => {
+                    console.log(chalk.cyan(`• ${entry.id}`));
+                    console.log(chalk.dim(`  state=${entry.effectiveState} workflow=${entry.workflowState}`));
+                    console.log(chalk.dim(`  rule=${entry.rulePattern} file=${entry.filePattern}`));
+                    console.log(chalk.dim(`  expires=${entry.expiresAt} active=${entry.active ? 'yes' : 'no'}`));
+                    console.log(chalk.dim(`  approvals=${entry.approvalCount}` +
+                        `${entry.requiredApprovals > 0 ? ` required=${entry.requiredApprovals}` : ''}` +
+                        `${entry.critical ? ' critical=yes' : ''}`));
+                    console.log(chalk.dim(`  reason=${entry.reason}`));
+                    if (entry.ticket) {
+                        console.log(chalk.dim(`  ticket=${entry.ticket}`));
+                    }
+                    console.log('');
+                });
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/policy-exceptions)\n'));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         const data = (0, policy_exceptions_1.listPolicyExceptions)(cwd);
         const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
@@ -609,17 +893,27 @@ function policyCommand(program) {
             if (allowedApprovers.size > 0) {
                 effectiveApprovals = effectiveApprovals.filter((item) => allowedApprovers.has(item.approver.toLowerCase()));
             }
+            const requiredApprovalResolution = (0, policy_governance_1.resolveRequiredApprovalsForRule)(entry.rulePattern, governance);
+            const requiredApprovals = governance.exceptionApprovals.required
+                ? requiredApprovalResolution.requiredApprovals
+                : 0;
+            const reasonValid = !governance.exceptionApprovals.requireReason
+                || (entry.reason || '').trim().length >= governance.exceptionApprovals.minReasonLength;
             const status = !entry.active || !unexpired
                 ? 'inactive'
-                : !governance.exceptionApprovals.required
-                    ? 'active'
-                    : effectiveApprovals.length >= governance.exceptionApprovals.minApprovals
-                        ? 'approved'
-                        : 'pending';
+                : !reasonValid
+                    ? 'invalid_reason'
+                    : !governance.exceptionApprovals.required
+                        ? 'active'
+                        : effectiveApprovals.length >= requiredApprovals
+                            ? 'approved'
+                            : 'pending';
             return {
                 ...entry,
                 status,
                 effectiveApprovals: effectiveApprovals.length,
+                requiredApprovals,
+                criticalRule: requiredApprovalResolution.critical,
             };
         });
         const items = options.all ? withStatus : withStatus.filter((entry) => entry.status !== 'inactive');
@@ -645,7 +939,10 @@ function policyCommand(program) {
             console.log(chalk.dim(`  status=${entry.status || (entry.active ? 'active' : 'inactive')}`));
             console.log(chalk.dim(`  rule=${entry.rulePattern} file=${entry.filePattern}`));
             console.log(chalk.dim(`  expires=${entry.expiresAt} active=${entry.active ? 'yes' : 'no'}`));
-            console.log(chalk.dim(`  approvals=${entry.approvals.length}${typeof entry.effectiveApprovals === 'number' ? ` (effective=${entry.effectiveApprovals})` : ''}`));
+            console.log(chalk.dim(`  approvals=${entry.approvals.length}` +
+                `${typeof entry.effectiveApprovals === 'number' ? ` (effective=${entry.effectiveApprovals})` : ''}` +
+                `${typeof entry.requiredApprovals === 'number' && entry.requiredApprovals > 0 ? ` required=${entry.requiredApprovals}` : ''}` +
+                `${entry.criticalRule ? ' critical=yes' : ''}`));
             console.log(chalk.dim(`  reason=${entry.reason}`));
             console.log(chalk.dim(`  requestedBy=${entry.requestedBy || entry.createdBy || 'unknown'}`));
             if (entry.ticket) {
@@ -661,6 +958,7 @@ function policyCommand(program) {
     exception
         .command('add')
         .description('Add a policy exception entry')
+        .option('--org', 'Create centralized organization policy exception in Neurcode Cloud')
         .requiredOption('--rule <pattern>', 'Rule pattern (exact, wildcard, or /regex/)')
         .requiredOption('--file <pattern>', 'File pattern (exact, wildcard, or /regex/)')
         .requiredOption('--reason <text>', 'Business justification for this exception')
@@ -669,7 +967,7 @@ function policyCommand(program) {
         .option('--expires-at <iso>', 'Expiry timestamp in ISO-8601')
         .option('--expires-in-days <n>', 'Expiry offset in days (default: 30)', (value) => parseInt(value, 10))
         .option('--json', 'Output as JSON')
-        .action((options) => {
+        .action(async (options) => {
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         try {
             const severity = options.severity === 'allow' || options.severity === 'warn' || options.severity === 'block'
@@ -682,6 +980,43 @@ function policyCommand(program) {
                 expiresAt: options.expiresAt,
                 expiresInDays: options.expiresInDays,
             });
+            if (options.org) {
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const created = await client.createOrgPolicyException({
+                    rulePattern: options.rule,
+                    filePattern: options.file,
+                    reason: options.reason,
+                    ticket: options.ticket,
+                    severity,
+                    expiresAt,
+                });
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        exception: created,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.green('\n✅ Organization policy exception created\n'));
+                console.log(chalk.cyan(`ID: ${created.id}`));
+                console.log(chalk.dim(`State: ${created.effectiveState}`));
+                console.log(chalk.dim(`Rule: ${created.rulePattern}`));
+                console.log(chalk.dim(`File: ${created.filePattern}`));
+                console.log(chalk.dim(`Expires: ${created.expiresAt}`));
+                console.log(chalk.dim(`Approvals: ${created.approvalCount}/${created.requiredApprovals}`));
+                if (created.ticket) {
+                    console.log(chalk.dim(`Ticket: ${created.ticket}`));
+                }
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/policy-exceptions)\n'));
+                return;
+            }
+            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            if (governance.exceptionApprovals.requireReason
+                && options.reason.trim().length < governance.exceptionApprovals.minReasonLength) {
+                throw new Error(`reason must be at least ${governance.exceptionApprovals.minReasonLength} characters (governance policy)`);
+            }
+            validateExceptionWindowByGovernance(expiresAt, governance.exceptionApprovals.maxExpiryDays);
             const createdBy = resolveActor();
             const created = (0, policy_exceptions_1.addPolicyException)(cwd, {
                 rulePattern: options.rule,
@@ -693,7 +1028,7 @@ function policyCommand(program) {
                 createdBy,
                 requestedBy: createdBy,
             });
-            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            const approvalResolution = (0, policy_governance_1.resolveRequiredApprovalsForRule)(created.rulePattern, governance);
             try {
                 (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
                     actor: createdBy,
@@ -705,6 +1040,10 @@ function policyCommand(program) {
                         filePattern: created.filePattern,
                         expiresAt: created.expiresAt,
                         requireApproval: governance.exceptionApprovals.required,
+                        requiredApprovals: governance.exceptionApprovals.required
+                            ? approvalResolution.requiredApprovals
+                            : 0,
+                        criticalRule: approvalResolution.critical,
                     },
                 });
             }
@@ -716,6 +1055,10 @@ function policyCommand(program) {
                     created,
                     path: (0, policy_exceptions_1.getPolicyExceptionsPath)(cwd),
                     requiresApproval: governance.exceptionApprovals.required,
+                    requiredApprovals: governance.exceptionApprovals.required
+                        ? approvalResolution.requiredApprovals
+                        : 0,
+                    criticalRule: approvalResolution.critical,
                 }, null, 2));
                 return;
             }
@@ -726,7 +1069,8 @@ function policyCommand(program) {
             console.log(chalk.dim(`Expires: ${created.expiresAt}`));
             console.log(chalk.dim(`Reason: ${created.reason}`));
             if (governance.exceptionApprovals.required) {
-                console.log(chalk.yellow(`Approval required: ${governance.exceptionApprovals.minApprovals} approver(s) before this exception is active.`));
+                const requiredApprovals = approvalResolution.requiredApprovals;
+                console.log(chalk.yellow(`Approval required: ${requiredApprovals} approver(s) before this exception is active${approvalResolution.critical ? ' (critical rule gate)' : ''}.`));
             }
             if (created.ticket) {
                 console.log(chalk.dim(`Ticket: ${created.ticket}`));
@@ -747,13 +1091,57 @@ function policyCommand(program) {
         .command('approve')
         .description('Approve a policy exception by ID')
         .argument('<id>', 'Exception ID to approve')
+        .option('--org', 'Approve centralized organization policy exception in Neurcode Cloud')
         .option('--by <actor>', 'Approver identity (defaults to NEURCODE_ACTOR/GITHUB_ACTOR/USER)')
         .option('--comment <text>', 'Approval comment')
         .option('--json', 'Output as JSON')
-        .action((id, options) => {
+        .action(async (id, options) => {
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         const approver = resolveActor(options.by);
         try {
+            if (options.org) {
+                if (options.by) {
+                    throw new Error('--by is not supported with --org (identity comes from authenticated Neurcode user)');
+                }
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const updated = await client.approveOrgPolicyException(String(id).trim(), {
+                    note: options.comment,
+                });
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        approved: true,
+                        exception: updated,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.green('\n✅ Organization policy exception approval recorded.\n'));
+                console.log(chalk.dim(`ID: ${updated.id}`));
+                console.log(chalk.dim(`State: ${updated.effectiveState}`));
+                console.log(chalk.dim(`Approvals: ${updated.approvalCount}/${updated.requiredApprovals}`));
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/policy-exceptions)\n'));
+                return;
+            }
+            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            const target = (0, policy_exceptions_1.listPolicyExceptions)(cwd).all.find((entry) => entry.id === String(id).trim());
+            if (!target) {
+                if (options.json) {
+                    console.log(JSON.stringify({ error: 'Exception not found' }, null, 2));
+                    process.exit(1);
+                }
+                console.log(chalk.yellow('\n⚠️  Exception not found.\n'));
+                process.exit(1);
+            }
+            const normalizedApprover = approver.toLowerCase();
+            const requestedBy = (target.requestedBy || target.createdBy || '').toLowerCase();
+            if (governance.exceptionApprovals.disallowSelfApproval && requestedBy && normalizedApprover === requestedBy) {
+                throw new Error('self-approval is disallowed by governance policy');
+            }
+            if (governance.exceptionApprovals.allowedApprovers.length > 0
+                && !governance.exceptionApprovals.allowedApprovers.map((item) => item.toLowerCase()).includes(normalizedApprover)) {
+                throw new Error('approver is not in governance allow-list');
+            }
             const updated = (0, policy_exceptions_1.approvePolicyException)(cwd, String(id).trim(), {
                 approver,
                 comment: options.comment,
@@ -766,6 +1154,19 @@ function policyCommand(program) {
                 console.log(chalk.yellow('\n⚠️  Exception not found.\n'));
                 process.exit(1);
             }
+            const requiredApprovalResolution = (0, policy_governance_1.resolveRequiredApprovalsForRule)(updated.rulePattern, governance);
+            const acceptedApprovals = updated.approvals.filter((item) => {
+                const actor = item.approver.toLowerCase();
+                if (governance.exceptionApprovals.allowedApprovers.length > 0
+                    && !governance.exceptionApprovals.allowedApprovers.map((entry) => entry.toLowerCase()).includes(actor)) {
+                    return false;
+                }
+                if (governance.exceptionApprovals.disallowSelfApproval && requestedBy && actor === requestedBy) {
+                    return false;
+                }
+                return true;
+            });
+            const effectiveApprovals = acceptedApprovals.length;
             try {
                 (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
                     actor: approver,
@@ -775,6 +1176,9 @@ function policyCommand(program) {
                     metadata: {
                         comment: options.comment || null,
                         approvals: updated.approvals.length,
+                        effectiveApprovals,
+                        requiredApprovals: requiredApprovalResolution.requiredApprovals,
+                        criticalRule: requiredApprovalResolution.critical,
                     },
                 });
             }
@@ -785,12 +1189,20 @@ function policyCommand(program) {
                 console.log(JSON.stringify({
                     approved: true,
                     exception: updated,
+                    effectiveApprovals,
+                    requiredApprovals: requiredApprovalResolution.requiredApprovals,
+                    approvalSatisfied: !governance.exceptionApprovals.required
+                        || effectiveApprovals >= requiredApprovalResolution.requiredApprovals,
+                    criticalRule: requiredApprovalResolution.critical,
                 }, null, 2));
                 return;
             }
             console.log(chalk.green('\n✅ Policy exception approval recorded.\n'));
             console.log(chalk.dim(`ID: ${updated.id}`));
-            console.log(chalk.dim(`Approvals: ${updated.approvals.length}`));
+            console.log(chalk.dim(`Approvals: ${updated.approvals.length} (effective=${effectiveApprovals})`));
+            if (governance.exceptionApprovals.required) {
+                console.log(chalk.dim(`Required approvals: ${requiredApprovalResolution.requiredApprovals}${requiredApprovalResolution.critical ? ' (critical rule gate)' : ''}`));
+            }
             console.log(chalk.dim(`Approver: ${approver}`));
             console.log('');
         }
@@ -804,12 +1216,185 @@ function policyCommand(program) {
             process.exit(1);
         }
     });
+    exception
+        .command('reject')
+        .description('Reject a pending organization policy exception by ID')
+        .argument('<id>', 'Exception ID to reject')
+        .requiredOption('--reason <text>', 'Reason for rejecting this exception')
+        .option('--org', 'Reject centralized organization policy exception in Neurcode Cloud')
+        .option('--json', 'Output as JSON')
+        .action(async (id, options) => {
+        if (!options.org) {
+            const message = '`policy exception reject` is only supported for --org exceptions. Use `policy exception remove` for local exceptions.';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+        const reason = typeof options.reason === 'string' ? options.reason.trim() : '';
+        if (!reason) {
+            const message = '--reason is required';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+        try {
+            const config = loadPolicyRuntimeConfig();
+            const client = new api_client_1.ApiClient(config);
+            const updated = await client.rejectOrgPolicyException(String(id).trim(), { reason });
+            if (options.json) {
+                console.log(JSON.stringify({
+                    source: 'org',
+                    rejected: true,
+                    exception: updated,
+                }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Organization policy exception rejected.\n'));
+            console.log(chalk.dim(`ID: ${updated.id}`));
+            console.log(chalk.dim(`State: ${updated.effectiveState}`));
+            if (updated.rejectionReason) {
+                console.log(chalk.dim(`Reason: ${updated.rejectionReason}`));
+            }
+            console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/policy-exceptions)\n'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
+    exception
+        .command('events')
+        .description('Show policy exception audit events')
+        .argument('<id>', 'Exception ID')
+        .option('--org', 'Read centralized organization policy exception events from Neurcode Cloud')
+        .option('--limit <n>', 'Maximum events to return (default: 30)', (value) => parseInt(value, 10))
+        .option('--json', 'Output as JSON')
+        .action(async (id, options) => {
+        const exceptionId = String(id).trim();
+        const limit = normalizeListLimit(options.limit, 30, 1, 300);
+        if (options.org) {
+            try {
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const events = await client.listOrgPolicyExceptionEvents(exceptionId, limit);
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        exceptionId,
+                        total: events.length,
+                        events,
+                    }, null, 2));
+                    return;
+                }
+                if (events.length === 0) {
+                    console.log(chalk.yellow('\n⚠️  No organization exception events found.\n'));
+                    return;
+                }
+                console.log(chalk.bold('\n🧾 Organization Exception Events\n'));
+                events.forEach((event) => {
+                    const actor = event.actorEmail ||
+                        [event.actorFirstName, event.actorLastName].filter(Boolean).join(' ').trim() ||
+                        event.actorUserId ||
+                        'unknown';
+                    console.log(chalk.cyan(`• ${event.createdAt}  ${event.action}`));
+                    console.log(chalk.dim(`  actor=${actor}`));
+                    if (event.note) {
+                        console.log(chalk.dim(`  note=${event.note}`));
+                    }
+                    console.log(chalk.dim(`  eventId=${event.id}`));
+                    console.log('');
+                });
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/policy-exceptions/:id/events)\n'));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const events = (0, policy_audit_1.readPolicyAuditEvents)(cwd)
+            .filter((event) => event.entityType === 'policy_exception' && event.entityId === exceptionId)
+            .sort((left, right) => right.timestamp.localeCompare(left.timestamp))
+            .slice(0, limit);
+        if (options.json) {
+            console.log(JSON.stringify({
+                source: 'local',
+                exceptionId,
+                total: events.length,
+                events,
+                path: (0, policy_audit_1.getPolicyAuditPath)(cwd),
+            }, null, 2));
+            return;
+        }
+        if (events.length === 0) {
+            console.log(chalk.yellow('\n⚠️  No local exception audit events found.\n'));
+            return;
+        }
+        console.log(chalk.bold('\n🧾 Local Exception Events\n'));
+        events.forEach((event) => {
+            console.log(chalk.cyan(`• ${event.timestamp}  ${event.action}`));
+            console.log(chalk.dim(`  actor=${event.actor}`));
+            if (event.metadata && Object.keys(event.metadata).length > 0) {
+                console.log(chalk.dim(`  metadata=${JSON.stringify(event.metadata)}`));
+            }
+            console.log(chalk.dim(`  hash=${event.hash.slice(0, 12)}...`));
+            console.log('');
+        });
+        console.log(chalk.dim(`Source: ${(0, policy_audit_1.getPolicyAuditPath)(cwd)}\n`));
+    });
     exception
         .command('remove')
         .description('Deactivate a policy exception by ID')
         .argument('<id>', 'Exception ID to deactivate')
+        .option('--org', 'Revoke centralized organization policy exception in Neurcode Cloud')
         .option('--json', 'Output as JSON')
-        .action((id, options) => {
+        .action(async (id, options) => {
+        if (options.org) {
+            try {
+                const config = loadPolicyRuntimeConfig();
+                const client = new api_client_1.ApiClient(config);
+                const updated = await client.revokeOrgPolicyException(String(id).trim());
+                if (options.json) {
+                    console.log(JSON.stringify({
+                        source: 'org',
+                        removed: true,
+                        exception: updated,
+                    }, null, 2));
+                    return;
+                }
+                console.log(chalk.green('\n✅ Organization policy exception revoked.\n'));
+                console.log(chalk.dim(`ID: ${updated.id}`));
+                console.log(chalk.dim(`State: ${updated.effectiveState}`));
+                console.log(chalk.dim('Source: Neurcode Cloud (/api/v1/org/policy-exceptions)\n'));
+                return;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                if (options.json) {
+                    console.log(JSON.stringify({ error: message }, null, 2));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`\n❌ ${message}\n`));
+                process.exit(1);
+            }
+        }
         const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
         const removed = (0, policy_exceptions_1.revokePolicyException)(cwd, String(id).trim());
         if (removed) {