pi-opa-net 0.1.0

package/policy/safety.rego

@@ -0,0 +1,374 @@
+# Example: cc-safety-net rules → OPA/Rego translation
+# ----------------------------------------------------------------
+# STATUS: explore artifact (NOT a deployed implementation).
+# Purpose: demonstrate how each of the 38 current rules looks in OPA,
+#          as evidence supporting locked decision [LD1] (engine = OPA).
+#
+# Scope: [LD3] bash command guarding ONLY. No other OPA logic here.
+#
+# Two-halves framing (from turn3):
+#   1. PARSE  "git stash list" → {program, subcommand, args[]}
+#      (the half OPA does NOT solve — open thread [OT1])
+#   2. DECIDE {program, subcommand, args[]} → allow/deny
+#      (the half this .rego implements)
+#
+# This file assumes the parse half produced a normalized struct:
+#   input = {
+#     program:    "git" | "docker" | "rm" | ...    (string, lowercase)
+#     subcommand: "commit" | "stash" | ""          (string; "" if none)
+#     args:       ["-am", "--hard", ...]           (array of strings)
+#     raw:        "git stash list"                 (original string, for regex fallback)
+#   }
+#
+# Fail-mode: `default allow := true` = fail-OPEN. Matches pi-safety-net
+# fork's behavior. Fail-mode when OPA itself is down is [OT2] (open).
+
+package safety
+
+import rego.v1
+
+# ──────────────────────────────────────────────────────────────────
+# DEFAULT — fail-open base
+# ──────────────────────────────────────────────────────────────────
+default allow := true
+
+# Any deny reason ⇒ block
+allow := false if {
+    count(deny) > 0
+}
+
+# ──────────────────────────────────────────────────────────────────
+# HELPERS — arg matching
+# ──────────────────────────────────────────────────────────────────
+
+# True if any arg token exactly matches one of `tokens`
+has_any_arg(args, tokens) if {
+    some t in tokens
+    args[_] == t
+}
+
+# True if any arg starts with one of `prefixes` (e.g. "--project-name=")
+has_arg_prefix(args, prefixes) if {
+    some p in prefixes
+    some a in args
+    startswith(a, p)
+}
+
+# ──────────────────────────────────────────────────────────────────
+# GROUP A — git subcommand + blocked arg tokens
+# (rule family: command + subcommand + block_args[])
+# ──────────────────────────────────────────────────────────────────
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "commit"
+    has_any_arg(input.args, ["-am", "-a"])
+    msg := "git commit -am stages ALL tracked modifications indiscriminately. Use explicit paths."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "commit"
+    has_any_arg(input.args, ["--no-verify", "-n"])
+    msg := "ALWAYS run pre-commit hooks. Bypassing hooks risks shipping broken changes."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "stash"
+    has_any_arg(input.args, ["push", "pop", "drop", "clear", "store", "create", "save"])
+    msg := "Do not mutate stashes in shared work. Others may be relying on them."
+}
+
+# BARE-DEFAULT (resolved [OT3]): `git stash` with no operation arg ≡ push.
+# cc-safety-net could not express this (no token to match). OPA solves it —
+# stash subcommand with zero args (list/show/branch carve-outs carry args).
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "stash"
+    count(input.args) == 0
+    msg := "Bare `git stash` defaults to push. Use `git stash list/show` explicitly."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "reset"
+    has_any_arg(input.args, ["--hard"])
+    msg := "Hard reset discards local work and can remove others' uncommitted changes."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "reset"
+    has_any_arg(input.args, ["--mixed"])
+    msg := "Mixed reset rewrites index state and can disrupt shared work."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "reset"
+    has_any_arg(input.args, ["--merge", "--keep"])
+    msg := "Reset modes can unexpectedly alter local changes in shared work."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "clean"
+    has_any_arg(input.args, ["-f", "-fd", "-fdx", "-xdf", "--force", "-x", "-d"])
+    msg := "git clean can permanently remove untracked files from the working tree."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "checkout"
+    has_any_arg(input.args, ["--"])
+    msg := "checkout -- discards local file changes and may destroy others' work."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "checkout"
+    has_any_arg(input.args, ["-B"])
+    msg := "git checkout -B force-resets branch refs and can trash shared branches."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "restore"
+    has_any_arg(input.args, ["--worktree", "--source=HEAD"])
+    msg := "git restore can discard tracked modifications in shared work."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "add"
+    has_any_arg(input.args, ["-A", "--all", "-a"])
+    msg := "git add -A / -a stages ALL changed files indiscriminately. Use explicit paths."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "add"
+    has_any_arg(input.args, ["."])
+    msg := "git add . stages ALL files in the current directory indiscriminately."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "switch"
+    has_any_arg(input.args, ["-C"])
+    msg := "git switch -C force-resets branch refs and can rewrite shared history."
+}
+
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "branch"
+    has_any_arg(input.args, ["-f", "-M", "-C"])
+    msg := "Forced branch moves or renames can rewrite refs and disrupt shared work."
+}
+
+# Rebase — block the subcommand entirely (redundant in OPA: just check subcommand)
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "rebase"
+    msg := "Rebase rewrites commit history and is blocked in this environment."
+}
+
+# Rebase lifecycle verbs — but `rebase` itself is already blocked above,
+# so these are belt-and-suspenders (covers `git rebase --continue` etc.)
+deny[msg] if {
+    input.program == "git"
+    input.subcommand == "rebase"
+    has_any_arg(input.args, ["--continue", "--skip", "--abort"])
+    msg := "git rebase --continue/--skip/--abort should be run only with explicit approval."
+}
+
+# ──────────────────────────────────────────────────────────────────
+# GROUP B — docker subcommands blocked entirely
+# (rule family: command + subcommand == subcommand; block_args redundant)
+# ──────────────────────────────────────────────────────────────────
+
+docker_blocked_subcommands := {
+    "stop":     "Direct container stop is blocked to protect services managed by Nomad.",
+    "kill":     "Direct container kill is blocked. Abrupt termination risks data loss.",
+    "rm":       "Direct container removal is blocked. Re-deploying via Nomad is safer.",
+    "restart":  "NEVER restart containers directly. This bypasses scheduling safety.",
+    "exec":     "Direct exec into containers is blocked for security.",
+    "update":   "Direct resource updates are blocked. Use Nomad job specification.",
+    "rename":   "Container renaming is blocked to prevent breaking service discovery.",
+}
+
+deny[msg] if {
+    input.program == "docker"
+    input.subcommand in object.keys(docker_blocked_subcommands)
+    msg := docker_blocked_subcommands[input.subcommand]
+}
+
+deny[msg] if {
+    input.program == "docker"
+    input.subcommand == "volume"
+    has_any_arg(input.args, ["rm", "prune"])
+    msg := "Direct volume removal is strictly blocked to prevent data loss."
+}
+
+deny[msg] if {
+    input.program == "docker"
+    input.subcommand == "volume"
+    has_any_arg(input.args, ["create"])
+    msg := "Manual volume creation is blocked to maintain infra-as-code parity."
+}
+
+# ──────────────────────────────────────────────────────────────────
+# GROUP C — docker compose with project-name / target filters
+# (the carve-out family — block ONLY litellm/omniroute, not other projects)
+# ──────────────────────────────────────────────────────────────────
+
+litellm_projects := ["--project-name=litellm", "--project-name=litellm-local", "--project-name=omniroute"]
+litellm_targets  := ["--target=litellm", "--target=litellm-local", "--target=omniroute"]
+
+deny[msg] if {
+    input.program == "docker"
+    input.subcommand == "compose"
+    has_any_arg(input.args, ["down"])
+    has_arg_prefix(input.args, litellm_projects)
+    msg := "NEVER bring down litellm/litellm-local/omniroute via docker compose."
+}
+
+deny[msg] if {
+    input.program == "docker"
+    input.subcommand == "compose"
+    has_any_arg(input.args, ["rm"])
+    has_arg_prefix(input.args, litellm_projects)
+    msg := "NEVER remove litellm/litellm-local/omniroute containers via docker compose."
+}
+
+deny[msg] if {
+    input.program == "docker"
+    input.subcommand == "compose"
+    has_arg_prefix(input.args, litellm_targets)
+    msg := "NEVER stop litellm/litellm-local/omniroute via docker compose --target."
+}
+
+# ──────────────────────────────────────────────────────────────────
+# GROUP D — command-level token blocks (no subcommand)
+# ──────────────────────────────────────────────────────────────────
+
+deny[msg] if {
+    input.program == "bd"
+    has_any_arg(input.args, ["--notes"])
+    msg := "Use --append-notes instead to preserve existing notes."
+}
+
+# gcloud — mutation verbs
+gcloud_blocked_verbs := [
+    "create", "delete", "update", "replace", "patch", "deploy",
+    "undelete", "restore", "restore-backup", "clone",
+    "import", "export", "execute", "failover", "switchover",
+]
+
+deny[msg] if {
+    input.program == "gcloud"
+    # verb appears anywhere in args (gcloud nests: compute instances delete)
+    some v in gcloud_blocked_verbs
+    has_any_arg(input.args, [v])
+    msg := sprintf("Mutation-capable gcloud operation '%s' is blocked by default.", [v])
+}
+
+# bq — mutation commands
+bq_blocked_verbs := [
+    "mk", "rm", "update", "load", "insert", "truncate",
+    "set-iam-policy", "add-iam-policy-binding", "remove-iam-policy-binding",
+]
+
+deny[msg] if {
+    input.program == "bq"
+    some v in bq_blocked_verbs
+    has_any_arg(input.args, [v])
+    msg := sprintf("BigQuery mutation command '%s' is blocked by default.", [v])
+}
+
+# ──────────────────────────────────────────────────────────────────
+# GROUP E — `rm` rules (the misnamed "allow-*" family)
+# ──────────────────────────────────────────────────────────────────
+#
+# IMPORTANT (turn1 insight): the rules named `allow-rm-bd-sub-skills`
+# and `allow-rm-beads-subdirs` are MISNAMED. In cc-safety-net they
+# actually BLOCK those exact tokens (there is no carve-out primitive).
+#
+# In OPA we can express them two ways. The faithful translation
+# (matches current behavior — blocks the named paths):
+#
+rm_bd_blocked := [
+    "bd-workflow", "bd-planning", "bd-troubleshoot", "bd-config",
+    "bd-workflow-init", "bd-formula-workflow", "bd-worktree", "bd-as-doc",
+]
+
+deny[msg] if {
+    input.program == "rm"
+    has_any_arg(input.args, rm_bd_blocked)
+    msg := "Removing deprecated bd sub-skill directories is blocked (rule is misnamed 'allow')."
+}
+
+rm_beads_blocked := ["adr", "references", "resources"]
+
+deny[msg] if {
+    input.program == "rm"
+    has_any_arg(input.args, rm_beads_blocked)
+    msg := "Removing symlink subdirs in beads/ skill is blocked (rule is misnamed 'allow')."
+}
+
+# ──────────────────────────────────────────────────────────────────
+# GROUP F — gh / glab repo lifecycle
+# ──────────────────────────────────────────────────────────────────
+
+deny[msg] if {
+    input.program == "gh"
+    input.subcommand == "repo"
+    has_any_arg(input.args, ["delete", "archive"])
+    msg := "Destructive GitHub repository lifecycle actions are blocked by default."
+}
+
+deny[msg] if {
+    input.program == "gh"
+    input.subcommand == "repo"
+    has_any_arg(input.args, ["--public"])
+    msg := "Public GitHub repository creation is blocked by default."
+}
+
+deny[msg] if {
+    input.program == "gh"
+    input.subcommand == "repo"
+    has_any_arg(input.args, ["--visibility"])
+    msg := "GitHub repository visibility changes are blocked by default."
+}
+
+deny[msg] if {
+    input.program == "glab"
+    input.subcommand == "repo"
+    has_any_arg(input.args, ["delete", "archive"])
+    msg := "Destructive GitLab repository lifecycle actions are blocked by default."
+}
+
+deny[msg] if {
+    input.program == "glab"
+    input.subcommand == "repo"
+    has_any_arg(input.args, ["--public"])
+    msg := "Public GitLab repository creation is blocked by default."
+}
+
+# ──────────────────────────────────────────────────────────────────
+# USAGE
+# ──────────────────────────────────────────────────────────────────
+# After your parser normalizes a raw command into the input struct:
+#
+#   opa eval -d safety.rego -i input.json 'data.safety.allow'
+#
+# input.json example:
+#   {"program":"git","subcommand":"stash","args":["list"],"raw":"git stash list"}
+#   → true  (allowed — list is carve-out)
+#
+#   {"program":"git","subcommand":"stash","args":["pop"],"raw":"git stash pop"}
+#   → false (denied)
+#
+#   {"program":"git","subcommand":"","args":[],"raw":"git stash"}
+#   → false (denied — bare-default handled natively; [OT3] resolved in OPA)

package/schemas/decision-output.v1.json

@@ -0,0 +1,298 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://buihongduc132/pi-safety-net/schemas/decision-output.v1.json",
+  "title": "Bash Guard Decision Output (--json mode, v1)",
+  "description": "Programmatic output schema for the OPA-backed bash guard. INPUT stays OPA/Rego; THIS schema governs the OUTPUT wrapper consumed by pi extensions, scripts, and other agents. Symmetric: both allow and deny emit this shape. Exit codes map 0=allow, 2=deny (backward-compat with Claude Code hook protocol).",
+
+  "type": "object",
+  "required": ["schema_version", "decision", "action", "source", "input", "evaluated_at", "decision_id"],
+  "additionalProperties": false,
+
+  "properties": {
+    "schema_version": {
+      "type": "string",
+      "const": "1.0",
+      "description": "Pinned schema version. Bump on breaking change. Consumers MUST validate this before reading other fields."
+    },
+
+    "decision": {
+      "type": "string",
+      "enum": ["allow", "deny"],
+      "description": "Primary verdict. Maps to exit code: allow→0, deny→2."
+    },
+
+    "action": {
+      "type": "string",
+      "enum": ["allow", "block", "prompt_user", "log_only"],
+      "description": "Caller guidance. allow=proceed silently; block=stop with message; prompt_user=ask human (future ask-mode, like pi-control's 5 outcomes); log_only=proceed but record. Today only allow/block are emitted; prompt_user/log_only reserved for v2."
+    },
+
+    "source": {
+      "type": "string",
+      "enum": ["opa", "fail-open", "fail-closed", "cached"],
+      "description": "Where the decision came from. opa=live OPA eval; fail-open=OPA unreachable, defaulted allow (see [OT2]); fail-closed=OPA unreachable, defaulted deny; cached=replay of prior decision for identical input within TTL."
+    },
+
+    "reasons": {
+      "type": "array",
+      "description": "Every fired deny rule contributes one entry. Empty array on allow. NOT collapsed to a single string — preserves rule provenance for audit. Order = rule evaluation order (deterministic).",
+      "items": { "$ref": "#/$defs/Reason" }
+    },
+
+    "input": {
+      "$ref": "#/$defs/EvaluatedInput",
+      "description": "Echo of the normalized command the parser produced (the decide-half input). Lets consumer verify what was actually evaluated vs what they sent."
+    },
+
+    "summary": {
+      "type": "string",
+      "description": "Human-readable one-liner for TUI/logging. e.g. 'BLOCKED: git stash pop (rule: block-git-stash-mutations)'. Optional on allow (may be empty string)."
+    },
+
+    "suggestions": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Safe alternatives the user could run instead. e.g. ['git stash list', 'git stash show']. Empty array if none. Powering future 'did you mean?' UX."
+    },
+
+    "metadata": {
+      "$ref": "#/$defs/DecisionMetadata",
+      "description": "Provenance for audit: which rulebook, which OPA version, which policy digest decided this. Enables after-the-fact replay and drift detection."
+    },
+
+    "evaluated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO-8601 UTC timestamp of decision. Millisecond precision."
+    },
+
+    "decision_id": {
+      "type": "string",
+      "format": "uuid",
+      "description": "Unique ID per decision. Carry through to audit log, hook response, user-facing message — enables end-to-end tracing."
+    },
+
+    "duration_ms": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Wall-clock time from input received to decision emitted. For perf monitoring / OPA cold-start detection (relevant to lazy-load topology [LD2])."
+    }
+  },
+
+  "$defs": {
+    "Reason": {
+      "type": "object",
+      "required": ["rule_id", "message"],
+      "additionalProperties": false,
+      "properties": {
+        "rule_id": {
+          "type": "string",
+          "description": "Stable rule identifier. Matches the cc-safety-net rule `name` field (e.g. 'block-git-stash-mutations') OR a synthesized ID for built-in semantic rules (e.g. 'builtin:git-stash-drop'). Lets audits trace decision→rule→source line."
+        },
+        "message": {
+          "type": "string",
+          "description": "Human-readable explanation. Same text as the rule's `reason` field. NOT redacted of secrets here — redaction happens at display layer."
+        },
+        "family": {
+          "type": "string",
+          "enum": ["git", "docker", "rm", "gcloud", "bq", "gh", "glab", "bd", "builtin", "custom"],
+          "description": "Rule family for grouping/filtering. Matches the 6 families in the rego translation (turn6)."
+        },
+        "severity": {
+          "type": "string",
+          "enum": ["block", "warn", "info"],
+          "description": "Reserved for v2 tiered outcomes. Today always 'block'. Lets future prompt_user/log_only rules coexist with hard blocks."
+        }
+      }
+    },
+
+    "EvaluatedInput": {
+      "type": "object",
+      "required": ["raw"],
+      "additionalProperties": false,
+      "properties": {
+        "raw": {
+          "type": "string",
+          "description": "Original command string as received. May be redacted of secrets at display layer but stored verbatim in JSON for audit (consumer is trusted)."
+        },
+        "program": {
+          "type": "string",
+          "description": "Normalized program name (lowercase). Empty string if parser could not extract."
+        },
+        "subcommand": {
+          "type": "string",
+          "description": "Normalized subcommand. Empty string if none (the bare-default case [OT3] — `git stash` with no sub)."
+        },
+        "args": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Normalized arg tokens. Empty array if none."
+        },
+        "parse_confidence": {
+          "type": "string",
+          "enum": ["full", "partial", "regex-only", "failed"],
+          "description": "Parser fidelity. full=bash-parser AST; partial=AST with gaps; regex-only=string match fallback ([OT1] common-case path); failed=could not parse, fell back to raw-string matching only."
+        }
+      }
+    },
+
+    "DecisionMetadata": {
+      "type": "object",
+      "required": ["engine", "rulebook_digest"],
+      "additionalProperties": false,
+      "properties": {
+        "engine": {
+          "type": "string",
+          "const": "opa",
+          "description": "Decision engine identity. Pinned to 'opa' per [LD1]."
+        },
+        "opa_version": {
+          "type": "string",
+          "description": "OPA binary version string (e.g. '1.18.1'). For reproducibility."
+        },
+        "rulebook_digest": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{12}$",
+          "description": "SHA-256 prefix (12 hex) of the active rego policy bundle. Matches the cc-safety-net rule.lock digest format. Lets audits detect 'decision made under different rules than current'."
+        },
+        "policy_path": {
+          "type": "string",
+          "description": "Filesystem path to the .rego bundle evaluated. For debugging 'which policy fired'."
+        },
+        "hostname": {
+          "type": "string",
+          "description": "Dev box hostname (per [LD2] — every dev box runs its own OPA). For correlating decisions across the fleet."
+        },
+        "session_id": {
+          "type": "string",
+          "description": "Calling agent's session ID if available (pi session, claude session, etc.). Empty string if not provided."
+        }
+      }
+    }
+  },
+
+  "examples": [
+    {
+      "schema_version": "1.0",
+      "decision": "deny",
+      "action": "block",
+      "source": "opa",
+      "reasons": [
+        {
+          "rule_id": "block-git-stash-mutations",
+          "message": "Do not mutate stashes in shared work. Others may be relying on them.",
+          "family": "git",
+          "severity": "block"
+        }
+      ],
+      "input": {
+        "raw": "git stash pop",
+        "program": "git",
+        "subcommand": "stash",
+        "args": ["pop"],
+        "parse_confidence": "full"
+      },
+      "summary": "BLOCKED: git stash pop (rule: block-git-stash-mutations)",
+      "suggestions": ["git stash list", "git stash show"],
+      "metadata": {
+        "engine": "opa",
+        "opa_version": "1.18.1",
+        "rulebook_digest": "dee3746bf7b5",
+        "policy_path": "/home/agent/.pi/opa/safety.rego",
+        "hostname": "dev-box",
+        "session_id": "ses_abc123"
+      },
+      "evaluated_at": "2026-07-01T14:23:45.123Z",
+      "decision_id": "7f3a9c2e-1b4d-4e8f-9a2c-5d6e7f8a9b01",
+      "duration_ms": 4.2
+    },
+    {
+      "schema_version": "1.0",
+      "decision": "allow",
+      "action": "allow",
+      "source": "opa",
+      "reasons": [],
+      "input": {
+        "raw": "git stash list",
+        "program": "git",
+        "subcommand": "stash",
+        "args": ["list"],
+        "parse_confidence": "full"
+      },
+      "summary": "",
+      "suggestions": [],
+      "metadata": {
+        "engine": "opa",
+        "opa_version": "1.18.1",
+        "rulebook_digest": "dee3746bf7b5",
+        "policy_path": "/home/agent/.pi/opa/safety.rego",
+        "hostname": "dev-box",
+        "session_id": "ses_abc123"
+      },
+      "evaluated_at": "2026-07-01T14:23:46.456Z",
+      "decision_id": "f58c8a4b-f478-456e-b762-6fb710a3380f",
+      "duration_ms": 3.8
+    },
+    {
+      "schema_version": "1.0",
+      "decision": "deny",
+      "action": "block",
+      "source": "opa",
+      "reasons": [
+        {
+          "rule_id": "builtin:bare-stash-default",
+          "message": "Bare `git stash` defaults to push. Use `git stash list/show` explicitly.",
+          "family": "builtin",
+          "severity": "block"
+        }
+      ],
+      "input": {
+        "raw": "git stash",
+        "program": "git",
+        "subcommand": "",
+        "args": [],
+        "parse_confidence": "full"
+      },
+      "summary": "BLOCKED: bare `git stash` (rule: builtin:bare-stash-default)",
+      "suggestions": ["git stash list", "git stash show", "git stash branch <name>"],
+      "metadata": {
+        "engine": "opa",
+        "opa_version": "1.18.1",
+        "rulebook_digest": "dee3746bf7b5",
+        "policy_path": "/home/agent/.pi/opa/safety.rego",
+        "hostname": "dev-box",
+        "session_id": "ses_abc123"
+      },
+      "evaluated_at": "2026-07-01T14:23:47.789Z",
+      "decision_id": "38708bfc-dd9b-454e-9248-d071e3354fde",
+      "duration_ms": 4.0
+    },
+    {
+      "schema_version": "1.0",
+      "decision": "allow",
+      "action": "allow",
+      "source": "fail-open",
+      "reasons": [],
+      "input": {
+        "raw": "git push origin main",
+        "program": "git",
+        "subcommand": "push",
+        "args": ["origin", "main"],
+        "parse_confidence": "regex-only"
+      },
+      "summary": "ALLOWED (fail-open: OPA unreachable for 250ms)",
+      "suggestions": [],
+      "metadata": {
+        "engine": "opa",
+        "opa_version": "",
+        "rulebook_digest": "dee3746bf7b5",
+        "policy_path": "/home/agent/.pi/opa/safety.rego",
+        "hostname": "dev-box",
+        "session_id": "ses_abc123"
+      },
+      "evaluated_at": "2026-07-01T14:24:01.001Z",
+      "decision_id": "a407558c-0d12-4bed-a40b-4bd0546c3c1a",
+      "duration_ms": 250.0
+    }
+  ]
+}