policy-as-code-engine 0.1.1__py3-none-any.whl

policy_as_code_engine/__init__.py

@@ -0,0 +1,50 @@
+"""
+policy-as-code-engine — declarative policy evaluation for Python services.
+
+This package answers one question: *given this context object and these rules,
+should the request be allowed?* It is deliberately small. Rules are JSON/YAML
+documents; the engine walks them and produces a structured decision (allow /
+deny / not-applicable) with the matching rule and the reason.
+
+Designed to compose with the rest of the Kinetic Gain ecosystem:
+
+    procurement-decision-api   -> drafts a Decision Card with conditions[]
+    policy-as-code-engine      -> converts those conditions into a PolicyBundle,
+                                  then evaluates them against live requests
+
+Two surfaces:
+
+    Library:  from policy_as_code_engine import PolicyEvaluator
+    HTTP:     uvicorn policy_as_code_engine.app:app (optional `[api]` extra)
+"""
+
+from __future__ import annotations
+
+from .evaluator import PolicyEvaluator
+from .from_decision_card import policy_bundle_from_decision_card
+from .models import (
+    Decision,
+    DecisionKind,
+    EvaluationContext,
+    EvaluationResult,
+    Matcher,
+    Policy,
+    PolicyBundle,
+    Rule,
+)
+
+__version__ = "0.1.1"
+
+__all__ = [
+    "Decision",
+    "DecisionKind",
+    "EvaluationContext",
+    "EvaluationResult",
+    "Matcher",
+    "Policy",
+    "PolicyBundle",
+    "PolicyEvaluator",
+    "Rule",
+    "__version__",
+    "policy_bundle_from_decision_card",
+]

policy_as_code_engine/__main__.py

@@ -0,0 +1,53 @@
+"""
+Entry point. Either run the HTTP API or evaluate a bundle from the CLI.
+
+    # API
+    python -m policy_as_code_engine                          # binds 0.0.0.0:8089
+
+    # CLI eval
+    python -m policy_as_code_engine eval bundle.yaml ctx.json
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from pathlib import Path
+
+from .evaluator import PolicyEvaluator
+from .loader import load_bundle_from_file
+from .models import EvaluationContext
+
+
+def _serve() -> None:
+    import uvicorn
+
+    port = int(os.environ.get("PORT", "8089"))
+    host = os.environ.get("HOST", "0.0.0.0")
+    uvicorn.run("policy_as_code_engine.app:app", host=host, port=port, log_level="info")
+
+
+def _eval(bundle_path: str, context_path: str) -> int:
+    bundle = load_bundle_from_file(bundle_path)
+    raw_ctx = Path(context_path).read_text(encoding="utf-8")
+    context = EvaluationContext.model_validate_json(raw_ctx)
+    result = PolicyEvaluator().evaluate(bundle, context)
+    print(json.dumps(result.model_dump(mode="json"), indent=2))
+    return 0 if result.decision.kind != "deny" else 1
+
+
+def main() -> None:
+    args = sys.argv[1:]
+    if not args:
+        _serve()
+        return
+    if args[0] == "eval" and len(args) == 3:
+        sys.exit(_eval(args[1], args[2]))
+    print("usage: python -m policy_as_code_engine                # run HTTP API")
+    print("       python -m policy_as_code_engine eval BUNDLE CTX  # CLI eval")
+    sys.exit(2)
+
+
+if __name__ == "__main__":
+    main()

policy_as_code_engine/app.py

@@ -0,0 +1,226 @@
+"""
+FastAPI app — five endpoints.
+
+  GET  /                              service info
+  GET  /healthz                       liveness probe
+  POST /bundles                       register a PolicyBundle (in-memory)
+  GET  /bundles/{bundle_id}           inspect a registered bundle
+  POST /bundles/{bundle_id}/evaluate  evaluate it against a context
+  POST /evaluate                      one-shot: bundle + context in, decision out
+  POST /bundles/from-decision-card    build a bundle from a Decision Card
+
+Bundles are held in process memory by default; restart-safe storage is a
+caller responsibility. Wire a Redis / Postgres backend by replacing the
+`_BundleStore` instance in `lifespan`.
+"""
+
+from __future__ import annotations
+
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+from threading import Lock
+from typing import Any
+
+import httpx
+from fastapi import FastAPI, HTTPException, status
+from pydantic import BaseModel, ValidationError
+
+from . import __version__, audit_stream
+from .evaluator import PolicyEvaluator
+from .from_decision_card import policy_bundle_from_decision_card
+from .models import EvaluationContext, EvaluationResult, PolicyBundle
+
+
+class _BundleStore:
+    """Thread-safe in-memory bundle store."""
+
+    __slots__ = ("_bundles", "_lock")
+
+    def __init__(self) -> None:
+        self._bundles: dict[str, PolicyBundle] = {}
+        self._lock = Lock()
+
+    def put(self, bundle: PolicyBundle) -> None:
+        with self._lock:
+            self._bundles[bundle.bundle_id] = bundle
+
+    def get(self, bundle_id: str) -> PolicyBundle:
+        with self._lock:
+            try:
+                return self._bundles[bundle_id]
+            except KeyError as err:
+                raise KeyError(bundle_id) from err
+
+    def list_ids(self) -> list[str]:
+        with self._lock:
+            return list(self._bundles.keys())
+
+
+class _OneShotRequest(BaseModel):
+    bundle: PolicyBundle
+    context: EvaluationContext
+
+
+@asynccontextmanager
+async def _lifespan(app: FastAPI) -> AsyncIterator[None]:
+    app.state.store = _BundleStore()
+    app.state.evaluator = PolicyEvaluator()
+    # Shared httpx client for best-effort audit-stream emission. Always
+    # created; the audit_stream module no-ops when AUDIT_STREAM_URL is unset.
+    app.state.http_client = httpx.AsyncClient(
+        headers={"User-Agent": f"policy-as-code-engine/{__version__} (+https://kineticgain.com)"},
+    )
+    try:
+        yield
+    finally:
+        await app.state.http_client.aclose()
+
+
+app = FastAPI(
+    title="policy-as-code-engine",
+    version=__version__,
+    description=(
+        "Declarative policy-as-code evaluator. Pairs with procurement-decision-api: "
+        "drafted Decision Cards become enforceable PolicyBundles via "
+        "POST /bundles/from-decision-card."
+    ),
+    lifespan=_lifespan,
+)
+
+
+def _store() -> _BundleStore:
+    """Typed accessor for app.state.store — keeps mypy strict happy."""
+    store = app.state.store
+    assert isinstance(store, _BundleStore)
+    return store
+
+
+def _evaluator() -> PolicyEvaluator:
+    evaluator = app.state.evaluator
+    assert isinstance(evaluator, PolicyEvaluator)
+    return evaluator
+
+
+def _http_client() -> httpx.AsyncClient:
+    """Shared httpx client used by audit_stream.emit (best-effort)."""
+    client = app.state.http_client
+    assert isinstance(client, httpx.AsyncClient)
+    return client
+
+
+@app.get("/", tags=["meta"])
+async def root() -> dict[str, Any]:
+    return {
+        "name": "policy-as-code-engine",
+        "version": __version__,
+        "description": (
+            "Evaluates declarative policy bundles against arbitrary request contexts. "
+            "Bridges to the Kinetic Gain Protocol Suite via /bundles/from-decision-card."
+        ),
+        "endpoints": {
+            "GET  /": "this page",
+            "GET  /healthz": "liveness probe",
+            "GET  /bundles": "list registered bundle IDs",
+            "POST /bundles": "register a PolicyBundle",
+            "GET  /bundles/{bundle_id}": "fetch a registered bundle",
+            "POST /bundles/{bundle_id}/evaluate": "evaluate a stored bundle against a context",
+            "POST /evaluate": "one-shot: bundle + context in, decision out",
+            "POST /bundles/from-decision-card": "build a bundle from a Decision Card",
+        },
+    }
+
+
+@app.get("/healthz", tags=["meta"])
+async def healthz() -> dict[str, str]:
+    return {"status": "ok"}
+
+
+@app.get("/bundles", tags=["bundles"])
+async def list_bundles() -> dict[str, list[str]]:
+    return {"bundle_ids": _store().list_ids()}
+
+
+@app.post("/bundles", tags=["bundles"], status_code=201)
+async def register_bundle(bundle: PolicyBundle) -> dict[str, str]:
+    _store().put(bundle)
+    await audit_stream.emit(
+        _http_client(),
+        kind="policy_bundle_registered",
+        payload={
+            "bundle_id": bundle.bundle_id,
+            "policy_count": len(bundle.policies),
+            "source": bundle.source,
+        },
+    )
+    return {"bundle_id": bundle.bundle_id, "status": "registered"}
+
+
+@app.get("/bundles/{bundle_id}", tags=["bundles"])
+async def get_bundle(bundle_id: str) -> PolicyBundle:
+    try:
+        return _store().get(bundle_id)
+    except KeyError as err:
+        raise HTTPException(status_code=404, detail=f"unknown bundle: {bundle_id!r}") from err
+
+
+async def _emit_decision(bundle_id: str, result: EvaluationResult) -> None:
+    """Emit request_allowed / request_denied; skip on not_applicable."""
+    kind_map = {"allow": "request_allowed", "deny": "request_denied"}
+    event_kind = kind_map.get(result.decision.kind)
+    if event_kind is None:
+        return
+    await audit_stream.emit(
+        _http_client(),
+        kind=event_kind,
+        payload={
+            "bundle_id": bundle_id,
+            "decision": result.decision.kind,
+            "matched_policy_id": result.decision.matched_policy_id,
+            "matched_rule_id": result.decision.matched_rule_id,
+            "reason": result.decision.reason,
+        },
+    )
+
+
+@app.post("/bundles/{bundle_id}/evaluate", tags=["evaluate"])
+async def evaluate_registered(bundle_id: str, context: EvaluationContext) -> EvaluationResult:
+    try:
+        bundle = _store().get(bundle_id)
+    except KeyError as err:
+        raise HTTPException(status_code=404, detail=f"unknown bundle: {bundle_id!r}") from err
+    result = _evaluator().evaluate(bundle, context)
+    await _emit_decision(bundle.bundle_id, result)
+    return result
+
+
+@app.post("/evaluate", tags=["evaluate"])
+async def evaluate_oneshot(request: _OneShotRequest) -> EvaluationResult:
+    result = _evaluator().evaluate(request.bundle, request.context)
+    await _emit_decision(request.bundle.bundle_id, result)
+    return result
+
+
+@app.post("/bundles/from-decision-card", tags=["bridge"], status_code=201)
+async def bundle_from_decision_card(card: dict[str, Any]) -> PolicyBundle:
+    """
+    Translate a Kinetic Gain Procurement Decision Card into a PolicyBundle
+    and register it. This is the cross-ecosystem hook.
+    """
+    try:
+        bundle = policy_bundle_from_decision_card(card)
+    except (ValueError, ValidationError) as err:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(err),
+        ) from err
+    _store().put(bundle)
+    await audit_stream.emit(
+        _http_client(),
+        kind="policy_bundle_registered",
+        payload={
+            "bundle_id": bundle.bundle_id,
+            "policy_count": len(bundle.policies),
+            "source": bundle.source,
+        },
+    )
+    return bundle

policy_as_code_engine/audit_stream.py

@@ -0,0 +1,82 @@
+"""
+Optional audit-stream-py integration.
+
+When the `AUDIT_STREAM_URL` env var is set, this module fires governance
+events at `{AUDIT_STREAM_URL}/events` for the moments the service produces.
+Best-effort: a failed POST is logged, not raised — audit-stream outages
+must never block policy registration or evaluation.
+
+Event kinds this service emits:
+    policy_bundle_registered    on POST /bundles (any successful registration,
+                                including the from-decision-card bridge)
+    request_allowed             on POST /bundles/{id}/evaluate when the bundle
+                                decision is "allow"
+    request_denied              on the same endpoint when the bundle decision
+                                is "deny"
+
+Same opt-in pattern as procurement-decision-api.audit_stream and
+aeo-validator-service.audit_stream. Identical config envvars.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+
+import httpx
+
+DEFAULT_TIMEOUT_S = 2.5
+
+
+def is_enabled() -> bool:
+    """True when AUDIT_STREAM_URL is set to a non-empty value."""
+    return bool(os.environ.get("AUDIT_STREAM_URL", "").strip())
+
+
+def base_url() -> str | None:
+    """Stripped audit-stream base URL, or None when disabled."""
+    raw = os.environ.get("AUDIT_STREAM_URL", "").strip()
+    if not raw:
+        return None
+    return raw.rstrip("/")
+
+
+def timeout_s() -> float:
+    """Configured per-call timeout. Defaults to 2.5s."""
+    raw = os.environ.get("AUDIT_STREAM_TIMEOUT_S", "").strip()
+    if not raw:
+        return DEFAULT_TIMEOUT_S
+    try:
+        return max(0.1, float(raw))
+    except ValueError:
+        return DEFAULT_TIMEOUT_S
+
+
+async def emit(
+    client: httpx.AsyncClient,
+    *,
+    kind: str,
+    payload: dict[str, Any],
+) -> None:
+    """Fire one event. Silent no-op when AUDIT_STREAM_URL is unset."""
+    url = base_url()
+    if url is None:
+        return
+
+    body = {
+        "kind": kind,
+        "source": "policy-as-code-engine",
+        "payload": payload,
+    }
+    try:
+        response = await client.post(
+            f"{url}/events",
+            json=body,
+            timeout=timeout_s(),
+        )
+        response.raise_for_status()
+    except (httpx.HTTPError, OSError) as err:
+        print(
+            f"audit-stream emit failed (kind={kind}): {type(err).__name__}: {err}",
+            flush=True,
+        )

policy_as_code_engine/evaluator.py

@@ -0,0 +1,197 @@
+"""
+Policy evaluator. The hot path.
+
+`PolicyEvaluator.evaluate(bundle, context)` walks every policy in the bundle,
+finds the first rule whose `when` matches, and emits a `Decision` for that
+policy. The bundle-level result then combines those per-policy decisions
+(deny > allow > not_applicable).
+
+The matcher logic lives in `_match()` and uses `EvaluationContext.lookup()`
+for dotted-path traversal. Special-case: the `_MISSING` sentinel from
+`models.lookup` is recognised so `exists` / `missing` matchers work correctly
+without requiring the rule author to know about the sentinel.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from .models import (
+    _MISSING,
+    AllOfMatcher,
+    AlwaysMatcher,
+    AnyOfMatcher,
+    Decision,
+    EvaluationContext,
+    EvaluationResult,
+    FieldMatcher,
+    Matcher,
+    NotMatcher,
+    Policy,
+    PolicyBundle,
+    Rule,
+)
+
+
+class PolicyEvaluator:
+    """Stateless evaluator. Cheap to construct; reuse one per process."""
+
+    __slots__ = ("_regex_cache",)
+
+    def __init__(self) -> None:
+        # Compiled-regex cache so repeated evaluations don't pay the parse cost.
+        self._regex_cache: dict[str, re.Pattern[str]] = {}
+
+    def evaluate(self, bundle: PolicyBundle, context: EvaluationContext) -> EvaluationResult:
+        policy_decisions: list[Decision] = []
+        for policy in bundle.policies:
+            policy_decisions.append(self._evaluate_policy(policy, context))
+        return EvaluationResult.combine(bundle.bundle_id, policy_decisions)
+
+    def evaluate_policy(self, policy: Policy, context: EvaluationContext) -> Decision:
+        """Evaluate a single policy. Useful when callers manage bundles externally."""
+        return self._evaluate_policy(policy, context)
+
+    # ---- internals -----------------------------------------------------
+
+    def _evaluate_policy(self, policy: Policy, context: EvaluationContext) -> Decision:
+        for rule in policy.rules:
+            if self._match(rule.when, context):
+                return Decision(
+                    kind=rule.effect,
+                    matched_policy_id=policy.id,
+                    matched_rule_id=rule.id,
+                    reason=rule.description or f"matched rule {rule.id!r}",
+                )
+        # No rule matched — fall back to the policy default.
+        return Decision(
+            kind=policy.default_effect,
+            matched_policy_id=policy.id,
+            matched_rule_id=None,
+            reason=f"no rule matched; policy default_effect={policy.default_effect!r}",
+        )
+
+    def _match(self, matcher: Matcher, context: EvaluationContext) -> bool:
+        if isinstance(matcher, AlwaysMatcher):
+            return True
+        if isinstance(matcher, AllOfMatcher):
+            return all(self._match(m, context) for m in matcher.matchers)
+        if isinstance(matcher, AnyOfMatcher):
+            return any(self._match(m, context) for m in matcher.matchers)
+        if isinstance(matcher, NotMatcher):
+            return not self._match(matcher.matcher, context)
+        if isinstance(matcher, FieldMatcher):
+            return self._match_field(matcher, context)
+        # Exhaustive over the Matcher union — this is unreachable.
+        raise TypeError(f"unknown matcher type: {type(matcher).__name__}")  # pragma: no cover
+
+    def _match_field(self, matcher: FieldMatcher, context: EvaluationContext) -> bool:
+        actual = context.lookup(matcher.field)
+        present = actual is not _MISSING
+        kind = matcher.kind
+
+        if kind == "exists":
+            return present
+        if kind == "missing":
+            return not present
+        if not present:
+            return False  # any other matcher against a missing field is False
+
+        try:
+            return bool(_COMPARE[kind](self, actual, matcher.value))
+        except KeyError:  # pragma: no cover - safety
+            raise TypeError(f"unsupported field matcher kind: {kind}") from None
+
+    # ---- comparison helpers --------------------------------------------
+
+    @staticmethod
+    def _eq(actual: Any, expected: Any) -> bool:
+        return bool(actual == expected)
+
+    @staticmethod
+    def _ne(actual: Any, expected: Any) -> bool:
+        return bool(actual != expected)
+
+    @staticmethod
+    def _gt(actual: Any, expected: Any) -> bool:
+        try:
+            return bool(actual > expected)
+        except TypeError:
+            return False
+
+    @staticmethod
+    def _gte(actual: Any, expected: Any) -> bool:
+        try:
+            return bool(actual >= expected)
+        except TypeError:
+            return False
+
+    @staticmethod
+    def _lt(actual: Any, expected: Any) -> bool:
+        try:
+            return bool(actual < expected)
+        except TypeError:
+            return False
+
+    @staticmethod
+    def _lte(actual: Any, expected: Any) -> bool:
+        try:
+            return bool(actual <= expected)
+        except TypeError:
+            return False
+
+    @staticmethod
+    def _in(actual: Any, expected: Any) -> bool:
+        return actual in expected
+
+    @staticmethod
+    def _not_in(actual: Any, expected: Any) -> bool:
+        return actual not in expected
+
+    @staticmethod
+    def _contains(actual: Any, expected: Any) -> bool:
+        if isinstance(actual, (list, tuple, set, str)):
+            return expected in actual
+        if isinstance(actual, dict):
+            return expected in actual
+        return False
+
+    def _regex(self, actual: Any, expected: Any) -> bool:
+        if not isinstance(actual, str) or not isinstance(expected, str):
+            return False
+        pattern = self._regex_cache.get(expected)
+        if pattern is None:
+            pattern = re.compile(expected)
+            self._regex_cache[expected] = pattern
+        return pattern.search(actual) is not None
+
+    @staticmethod
+    def _starts_with(actual: Any, expected: Any) -> bool:
+        return isinstance(actual, str) and isinstance(expected, str) and actual.startswith(expected)
+
+    @staticmethod
+    def _ends_with(actual: Any, expected: Any) -> bool:
+        return isinstance(actual, str) and isinstance(expected, str) and actual.endswith(expected)
+
+
+# Dispatch table for FieldMatcher.kind. Kept module-level so `_match_field`
+# stays a tight if/else-free hot path.
+_COMPARE: dict[str, Any] = {
+    "eq": lambda self, a, b: PolicyEvaluator._eq(a, b),
+    "ne": lambda self, a, b: PolicyEvaluator._ne(a, b),
+    "gt": lambda self, a, b: PolicyEvaluator._gt(a, b),
+    "gte": lambda self, a, b: PolicyEvaluator._gte(a, b),
+    "lt": lambda self, a, b: PolicyEvaluator._lt(a, b),
+    "lte": lambda self, a, b: PolicyEvaluator._lte(a, b),
+    "in": lambda self, a, b: PolicyEvaluator._in(a, b),
+    "not_in": lambda self, a, b: PolicyEvaluator._not_in(a, b),
+    "contains": lambda self, a, b: PolicyEvaluator._contains(a, b),
+    "regex": lambda self, a, b: self._regex(a, b),
+    "starts_with": lambda self, a, b: PolicyEvaluator._starts_with(a, b),
+    "ends_with": lambda self, a, b: PolicyEvaluator._ends_with(a, b),
+}
+
+
+# Unused at runtime — re-export so tests can build `Rule(...)` directly.
+__all__ = ["PolicyEvaluator", "Rule"]

policy_as_code_engine/from_decision_card.py

@@ -0,0 +1,162 @@
+"""
+Bridge: AI Procurement Decision Card -> PolicyBundle.
+
+The decision card spec encodes a buyer's posture toward a vendor as a `decision`
+plus zero or more `conditions[]`. This module converts that human-authored
+artifact into something a service can enforce automatically:
+
+    decision.status = "rejected*"                     -> single deny-all policy
+    decision.status = "approved"                      -> single allow-all policy
+    decision.status = "approved-with-conditions"      -> per-condition policy +
+                                                         fail-safe deny-all default
+    decision.status = "withdrawn" / "expired" / etc.  -> single deny-all policy
+
+For each condition we emit one Policy whose default_effect is `deny` and whose
+single rule allows when the condition is *known to be satisfied* (signal field
+`conditions_satisfied.{condition_id} == true` on the EvaluationContext).
+Callers wire their own satisfaction signal into the context — e.g. result of a
+verification job, a recent attestation timestamp, an external compliance check.
+
+This is the most important hook in the package: it's what closes the loop
+between the Kinetic Gain Protocol Suite (spec #11) and runtime enforcement.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .models import (
+    AlwaysMatcher,
+    FieldMatcher,
+    Policy,
+    PolicyBundle,
+    Rule,
+)
+
+_REJECT_STATUSES = {"rejected", "rejected-with-remediation", "withdrawn", "expired"}
+_APPROVE_STATUSES = {"approved"}
+_CONDITIONAL_STATUSES = {"approved-with-conditions"}
+
+
+def policy_bundle_from_decision_card(card: dict[str, Any]) -> PolicyBundle:
+    """
+    Build a PolicyBundle from a v0.1 Decision Card dict (matching the upstream
+    `decision-card.schema.json`).
+
+    The returned bundle is **runtime-evaluatable** — every policy's first
+    matching rule fires `allow` or `deny`. Conditions become policies whose
+    satisfaction is signalled by `conditions_satisfied.{id}` on the context.
+    """
+    _validate_minimal_shape(card)
+    decision_id = card["decision_id"]
+    status = card["decision"]["status"]
+    vendor = card["subject"]["vendor_name"]
+    conditions = card.get("conditions") or []
+    source = f"decision-card:{decision_id}"
+
+    if status in _REJECT_STATUSES:
+        return _bundle(decision_id, source, [_deny_all_policy(decision_id, status, vendor)])
+
+    if status in _APPROVE_STATUSES:
+        return _bundle(decision_id, source, [_allow_all_policy(decision_id, vendor)])
+
+    if status in _CONDITIONAL_STATUSES:
+        if not conditions:
+            # The card itself should have failed validation upstream, but be
+            # defensive: an approved-with-conditions card with no conditions
+            # is treated as deny-all to fail safe.
+            return _bundle(decision_id, source, [_deny_all_policy(decision_id, status, vendor)])
+        policies = [_condition_policy(decision_id, c) for c in conditions]
+        return _bundle(decision_id, source, policies)
+
+    # Any unknown / pending status: fail safe.
+    return _bundle(decision_id, source, [_deny_all_policy(decision_id, status, vendor)])
+
+
+# ---------------------------------------------------------------------------
+# Builders
+# ---------------------------------------------------------------------------
+
+
+def _bundle(decision_id: str, source: str, policies: list[Policy]) -> PolicyBundle:
+    return PolicyBundle(
+        bundle_id=f"decision-card-{decision_id}",
+        version="0.1.0",
+        description=f"Generated from Decision Card {decision_id!r}.",
+        source=source,
+        policies=policies,
+    )
+
+
+def _allow_all_policy(decision_id: str, vendor: str) -> Policy:
+    return Policy(
+        id=f"{decision_id}__approved",
+        description=f"Vendor {vendor!r} is approved; all requests permitted.",
+        default_effect="allow",
+        rules=[
+            Rule(
+                id="approved-allow",
+                effect="allow",
+                when=AlwaysMatcher(),
+                description=f"Decision Card {decision_id!r} approved vendor {vendor!r}.",
+                tags=["approved"],
+            )
+        ],
+    )
+
+
+def _deny_all_policy(decision_id: str, status: str, vendor: str) -> Policy:
+    return Policy(
+        id=f"{decision_id}__{status}",
+        description=f"Vendor {vendor!r} is {status}; all requests denied.",
+        default_effect="deny",
+        rules=[
+            Rule(
+                id=f"{status}-deny",
+                effect="deny",
+                when=AlwaysMatcher(),
+                description=f"Decision Card {decision_id!r} status={status!r} for vendor {vendor!r}.",
+                tags=[status],
+            )
+        ],
+    )
+
+
+def _condition_policy(decision_id: str, condition: dict[str, Any]) -> Policy:
+    """
+    Translate a single condition into a single policy:
+      - rule 1: ALLOW when conditions_satisfied.{id} is true
+      - default: DENY (fail-safe)
+    """
+    cid = condition.get("id")
+    if not cid or not isinstance(cid, str):
+        raise ValueError("each condition must carry a non-empty `id`")
+    description = condition.get("description") or f"Condition {cid!r}"
+    return Policy(
+        id=f"{decision_id}__condition__{cid}",
+        description=description,
+        default_effect="deny",
+        rules=[
+            Rule(
+                id=f"{cid}-satisfied",
+                effect="allow",
+                when=FieldMatcher(
+                    kind="eq",
+                    field=f"conditions_satisfied.{cid}",
+                    value=True,
+                ),
+                description=description,
+                tags=["condition", cid],
+            )
+        ],
+    )
+
+
+def _validate_minimal_shape(card: dict[str, Any]) -> None:
+    for k in ("decision_id", "decision", "subject"):
+        if k not in card:
+            raise ValueError(f"Decision Card is missing required key {k!r}")
+    if "status" not in card["decision"]:
+        raise ValueError("Decision Card.decision is missing required key 'status'")
+    if "vendor_name" not in card["subject"]:
+        raise ValueError("Decision Card.subject is missing required key 'vendor_name'")

policy_as_code_engine/loader.py

@@ -0,0 +1,46 @@
+"""
+File loaders for `PolicyBundle`.
+
+Supports JSON and YAML so operators can author bundles in whichever format
+their tooling already speaks. The loader is intentionally thin — the heavy
+lifting is in `models.PolicyBundle.model_validate`.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from .models import PolicyBundle
+
+
+def load_bundle_from_string(raw: str, *, fmt: str | None = None) -> PolicyBundle:
+    """
+    Parse a serialized bundle. `fmt` may be `"json"` or `"yaml"`; if omitted
+    the loader sniffs the leading character (`{` / `[` -> JSON, else YAML).
+    """
+    fmt = (fmt or _sniff(raw)).lower()
+    if fmt == "json":
+        parsed: Any = json.loads(raw)
+    elif fmt in ("yaml", "yml"):
+        parsed = yaml.safe_load(raw)
+    else:
+        raise ValueError(f"unsupported bundle format: {fmt!r}")
+    return PolicyBundle.model_validate(parsed)
+
+
+def load_bundle_from_file(path: str | Path) -> PolicyBundle:
+    p = Path(path)
+    raw = p.read_text(encoding="utf-8")
+    fmt = "yaml" if p.suffix.lower() in (".yaml", ".yml") else "json"
+    return load_bundle_from_string(raw, fmt=fmt)
+
+
+def _sniff(raw: str) -> str:
+    stripped = raw.lstrip()
+    if stripped.startswith(("{", "[")):
+        return "json"
+    return "yaml"

policy_as_code_engine/models.py

@@ -0,0 +1,218 @@
+"""
+Pydantic v2 models for policies, rules, matchers, and evaluation results.
+
+A `PolicyBundle` is the top-level object — a named, versioned collection of
+`Policy` objects. Each `Policy` is a list of `Rule` objects, evaluated in
+declared order; the first match wins (deny rules trump allow rules at the
+PolicyBundle level — see `EvaluationResult.combine`).
+
+A `Rule` has:
+    - id          stable identifier for telemetry
+    - effect      "allow" | "deny"
+    - description optional human-readable note
+    - when        a `Matcher` — the predicate over the EvaluationContext
+
+A `Matcher` is one of the supported operators. Matchers are recursive: `all_of`,
+`any_of`, and `not_` wrap child matchers, so the result is a small DSL that
+covers ~95% of real-world request gates without having to ship a parser.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+
+
+class StrictModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+DecisionKind = Literal["allow", "deny", "not_applicable"]
+Effect = Literal["allow", "deny"]
+
+
+# ---------------------------------------------------------------------------
+# Matchers — the DSL
+# ---------------------------------------------------------------------------
+
+
+class FieldMatcher(StrictModel):
+    """Compare a JSON-pointer-ish dotted path against a literal value."""
+
+    kind: Literal[
+        "eq",
+        "ne",
+        "gt",
+        "gte",
+        "lt",
+        "lte",
+        "in",
+        "not_in",
+        "contains",
+        "missing",
+        "exists",
+        "regex",
+        "starts_with",
+        "ends_with",
+    ]
+    field: str = Field(..., min_length=1)
+    value: Any = None
+
+    @model_validator(mode="after")
+    def _check_value_required(self) -> FieldMatcher:
+        if self.kind in ("exists", "missing"):
+            return self
+        if self.value is None:
+            raise ValueError(f"matcher {self.kind!r} requires a `value`")
+        if self.kind in ("in", "not_in") and not isinstance(self.value, list):
+            raise ValueError(f"matcher {self.kind!r} requires `value` to be a list")
+        return self
+
+
+class AllOfMatcher(StrictModel):
+    kind: Literal["all_of"] = "all_of"
+    matchers: list[Matcher] = Field(..., min_length=1)
+
+
+class AnyOfMatcher(StrictModel):
+    kind: Literal["any_of"] = "any_of"
+    matchers: list[Matcher] = Field(..., min_length=1)
+
+
+class NotMatcher(StrictModel):
+    kind: Literal["not"] = "not"
+    matcher: Matcher
+
+
+class AlwaysMatcher(StrictModel):
+    """Useful as a catch-all final rule (effectively the default)."""
+
+    kind: Literal["always"] = "always"
+
+
+Matcher = FieldMatcher | AllOfMatcher | AnyOfMatcher | NotMatcher | AlwaysMatcher
+
+
+# Pydantic v2 forward-ref resolution for the recursive aliases.
+AllOfMatcher.model_rebuild()
+AnyOfMatcher.model_rebuild()
+NotMatcher.model_rebuild()
+
+
+# ---------------------------------------------------------------------------
+# Rules / policies / bundles
+# ---------------------------------------------------------------------------
+
+
+class Rule(StrictModel):
+    id: str = Field(..., min_length=1)
+    effect: Effect
+    when: Matcher
+    description: str | None = None
+    tags: list[str] | None = None
+
+
+class Policy(StrictModel):
+    """A named ordered list of rules. First match wins."""
+
+    id: str = Field(..., min_length=1)
+    description: str | None = None
+    default_effect: Effect = "deny"
+    rules: list[Rule] = Field(..., min_length=1)
+
+
+class PolicyBundle(StrictModel):
+    """The unit a service loads at startup. Versioned."""
+
+    bundle_id: str = Field(..., min_length=1)
+    version: str = "0.1.0"
+    description: str | None = None
+    source: str | None = Field(
+        default=None,
+        description="Where the bundle came from (a Decision Card id, URL, file path).",
+    )
+    policies: list[Policy] = Field(..., min_length=1)
+
+
+# ---------------------------------------------------------------------------
+# Evaluation
+# ---------------------------------------------------------------------------
+
+
+class EvaluationContext(StrictModel):
+    """
+    The thing rules are evaluated against. Free-form `data` so callers can pour
+    in whatever shape the rules expect (subject, action, resource, claims, ...).
+    """
+
+    data: dict[str, Any] = Field(default_factory=dict)
+    subject: dict[str, Any] | None = None
+    action: str | None = None
+    resource: dict[str, Any] | None = None
+
+    def lookup(self, path: str) -> Any:
+        """
+        Dotted-path lookup over the merged context. Returns the sentinel
+        `_MISSING` when any segment doesn't exist, so `exists` / `missing`
+        matchers behave correctly.
+        """
+        merged: dict[str, Any] = {**self.data}
+        if self.subject is not None:
+            merged["subject"] = self.subject
+        if self.action is not None:
+            merged["action"] = self.action
+        if self.resource is not None:
+            merged["resource"] = self.resource
+
+        cur: Any = merged
+        for segment in path.split("."):
+            if isinstance(cur, dict) and segment in cur:
+                cur = cur[segment]
+            elif isinstance(cur, list):
+                try:
+                    cur = cur[int(segment)]
+                except (ValueError, IndexError):
+                    return _MISSING
+            else:
+                return _MISSING
+        return cur
+
+
+_MISSING: Any = object()
+
+
+class Decision(StrictModel):
+    kind: DecisionKind
+    matched_policy_id: str | None = None
+    matched_rule_id: str | None = None
+    reason: str | None = None
+
+
+class EvaluationResult(StrictModel):
+    """
+    Bundle-wide result. Per-policy decisions are kept in `policy_decisions` so
+    operators can see *why* the final outcome happened. Combining rule:
+
+        - If ANY policy returns `deny`, the bundle returns `deny`.
+        - Else if ANY policy returns `allow`, the bundle returns `allow`.
+        - Else `not_applicable`.
+    """
+
+    bundle_id: str
+    decision: Decision
+    policy_decisions: list[Decision]
+
+    @classmethod
+    def combine(cls, bundle_id: str, policy_decisions: list[Decision]) -> EvaluationResult:
+        deny = next((d for d in policy_decisions if d.kind == "deny"), None)
+        if deny is not None:
+            return cls(bundle_id=bundle_id, decision=deny, policy_decisions=policy_decisions)
+        allow = next((d for d in policy_decisions if d.kind == "allow"), None)
+        if allow is not None:
+            return cls(bundle_id=bundle_id, decision=allow, policy_decisions=policy_decisions)
+        return cls(
+            bundle_id=bundle_id,
+            decision=Decision(kind="not_applicable", reason="no policy applied"),
+            policy_decisions=policy_decisions,
+        )

policy_as_code_engine-0.1.1.dist-info/METADATA

@@ -0,0 +1,278 @@
+Metadata-Version: 2.4
+Name: policy-as-code-engine
+Version: 0.1.1
+Summary: Declarative policy-as-code evaluator. JSON/YAML rules + Python predicates over arbitrary context objects. Enforces AI Procurement Decision Card conditions at request time. Optional audit-stream-py integration via AUDIT_STREAM_URL.
+Project-URL: Homepage, https://github.com/mizcausevic-dev/policy-as-code-engine
+Project-URL: Repository, https://github.com/mizcausevic-dev/policy-as-code-engine
+Project-URL: Issues, https://github.com/mizcausevic-dev/policy-as-code-engine/issues
+Project-URL: Decision Card spec, https://github.com/mizcausevic-dev/ai-procurement-decision-spec
+Project-URL: Author Site, https://kineticgain.com/
+Author-email: Miz Causevic <miz@kineticgain.com>
+License: MIT
+License-File: LICENSE
+Keywords: ai-governance,decision-intelligence,fastapi,kinetic-gain-protocol-suite,policy,policy-as-code,rules-engine
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: api
+Requires-Dist: fastapi>=0.115; extra == 'api'
+Requires-Dist: uvicorn[standard]>=0.30; extra == 'api'
+Provides-Extra: dev
+Requires-Dist: fastapi>=0.115; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.2; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
+Requires-Dist: uvicorn[standard]>=0.30; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# policy-as-code-engine
+
+[![CI](https://github.com/mizcausevic-dev/policy-as-code-engine/actions/workflows/ci.yml/badge.svg)](https://github.com/mizcausevic-dev/policy-as-code-engine/actions/workflows/ci.yml)
+[![Python](https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13-blue)](https://www.python.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+**Declarative policy-as-code evaluator for Python services.** JSON/YAML rules → first-match-wins evaluation → structured allow/deny decision with the matching rule and the reason. Cheap to embed; ships with a FastAPI surface; **pairs directly with [`procurement-decision-api`](https://github.com/mizcausevic-dev/procurement-decision-api)** so the same Decision Card that records a buyer's posture also becomes the runtime gate that enforces it.
+
+---
+
+## Why
+
+Most policy engines either ask you to learn a DSL (Rego, Cedar) or hand you a dictionary-of-lambdas and call it a library. Neither is the right shape when the *source of truth* is a JSON document a human signed off on. This engine:
+
+1. **Reads JSON/YAML bundles.** No DSL. The matcher tree is the policy.
+2. **Returns *why*, not just *what*.** Every decision carries the matched policy + rule + reason. Operators get a real audit log on each evaluation.
+3. **Bridges to the Kinetic Gain Protocol Suite.** A single endpoint turns an AI Procurement Decision Card into a runtime-enforceable `PolicyBundle` — approve, reject, or approve-with-conditions all map to concrete allow/deny logic.
+
+---
+
+## Install
+
+```bash
+pip install policy-as-code-engine
+# with the FastAPI surface:
+pip install "policy-as-code-engine[api]"
+```
+
+Python 3.11+. Runtime deps: `pydantic` + `PyYAML`.
+
+---
+
+## Library quickstart
+
+```python
+from policy_as_code_engine import (
+    EvaluationContext,
+    PolicyBundle,
+    PolicyEvaluator,
+)
+
+bundle = PolicyBundle.model_validate({
+    "bundle_id": "edu-gate",
+    "policies": [{
+        "id": "writes-require-admin",
+        "default_effect": "deny",
+        "rules": [
+            {
+                "id": "admin-writes",
+                "effect": "allow",
+                "when": {
+                    "kind": "all_of",
+                    "matchers": [
+                        {"kind": "in", "field": "action", "value": ["create", "update", "delete"]},
+                        {"kind": "eq", "field": "subject.role", "value": "admin"},
+                    ],
+                },
+            },
+        ],
+    }],
+})
+
+ctx = EvaluationContext(
+    subject={"id": "u-42", "role": "admin"},
+    action="update",
+    resource={"id": "doc-7"},
+)
+
+result = PolicyEvaluator().evaluate(bundle, ctx)
+print(result.decision.kind)             # "allow"
+print(result.decision.matched_rule_id)  # "admin-writes"
+print(result.decision.reason)           # "matched rule 'admin-writes'"
+```
+
+`result.policy_decisions` carries every per-policy outcome — drop it straight into your audit log.
+
+---
+
+## Bundle DSL
+
+A bundle is a small recursive structure. Matchers compose; rules ordered.
+
+### Field matchers
+
+| Kind            | Notes |
+| --------------- | --- |
+| `eq` / `ne`     | Strict equality. |
+| `gt` / `gte` / `lt` / `lte` | Comparison; returns `false` on incompatible types (won't raise). |
+| `in` / `not_in` | `value` must be a list. |
+| `contains`      | Works against strings, lists, sets, dicts. |
+| `exists` / `missing` | No `value`. Operates against the dotted-path resolver. |
+| `regex`         | Compiled patterns are cached per-evaluator. |
+| `starts_with` / `ends_with` | String-only. |
+
+### Composite matchers
+
+| Kind     | Children | Truth |
+| -------- | -------- | --- |
+| `all_of` | `matchers: [...]` | All children true. |
+| `any_of` | `matchers: [...]` | At least one child true. |
+| `not`    | `matcher: {...}`  | Inverts the child. |
+| `always` | —                 | Always true. Useful as a final catch-all. |
+
+### Dotted paths
+
+The resolver looks at the merged context (`data` + `subject` + `action` + `resource`):
+
+```
+subject.role
+resource.tags.0          # list index
+data.conditions_satisfied.dpa-signed
+```
+
+Missing segments produce a `_MISSING` sentinel — `exists` / `missing` matchers see it; every other matcher returns `false`.
+
+---
+
+## FastAPI surface
+
+```bash
+pip install "policy-as-code-engine[api]"
+python -m policy_as_code_engine     # binds 0.0.0.0:8089 by default
+```
+
+| Method | Path | What it does |
+| --- | --- | --- |
+| GET | `/healthz` | Liveness probe. |
+| GET | `/` | Service info. |
+| POST | `/bundles` | Register a `PolicyBundle` in memory. |
+| GET | `/bundles` | List registered bundle IDs. |
+| GET | `/bundles/{bundle_id}` | Inspect a registered bundle. |
+| POST | `/bundles/{bundle_id}/evaluate` | Evaluate a stored bundle against an `EvaluationContext`. |
+| POST | `/evaluate` | One-shot. Bundle + context in, decision out. |
+| POST | `/bundles/from-decision-card` | **The cross-ecosystem hook.** Turn a Kinetic Gain Procurement Decision Card into a `PolicyBundle` and register it. |
+
+---
+
+## The cross-ecosystem hook
+
+The headline feature. An AI Procurement Decision Card is the buyer-side record that says "we evaluated this vendor and our position is X." This engine turns that human-authored artifact into a runtime gate, mechanically.
+
+```bash
+curl -X POST http://localhost:8089/bundles/from-decision-card \
+  -H 'Content-Type: application/json' \
+  -d @decision-card.json
+```
+
+Mapping:
+
+| Decision Card status | Resulting bundle |
+| --- | --- |
+| `approved` | Single `allow-all` policy. |
+| `rejected` · `rejected-with-remediation` · `withdrawn` · `expired` · `pending` | Single `deny-all` policy (fail safe). |
+| `approved-with-conditions` | One policy *per* condition. Each policy `allow`s only when `conditions_satisfied.{condition_id}` is `true` in the evaluation context; `deny` otherwise. The bundle combiner does deny-trumps-allow, so **every** condition must be satisfied to allow. |
+
+Wire your own satisfaction signal — DPA verifier, bias-audit freshness check, attestation timestamp — into the context, and the bundle does the rest.
+
+```python
+from policy_as_code_engine import (
+    EvaluationContext,
+    PolicyEvaluator,
+    policy_bundle_from_decision_card,
+)
+
+card = {...}  # POST /decisions/draft output from procurement-decision-api
+bundle = policy_bundle_from_decision_card(card)
+
+ctx = EvaluationContext(
+    subject={"id": "u-1"},
+    action="enroll",
+    data={
+        "conditions_satisfied": {
+            "dpa-signed":         True,
+            "bias-audit-fresh":   True,
+        }
+    },
+)
+
+decision = PolicyEvaluator().evaluate(bundle, ctx).decision
+```
+
+---
+
+## CLI
+
+```bash
+python -m policy_as_code_engine eval examples/example-bundle.yaml examples/example-context.json
+```
+
+Prints the full `EvaluationResult` as JSON. Exits non-zero on `deny`.
+
+---
+
+## How decisions combine
+
+Inside a single policy: **first matching rule wins**, otherwise `default_effect`.
+
+Across the bundle:
+
+```
+deny     -> deny      (any policy denies => bundle denies)
+allow    -> allow     (otherwise, any allow => bundle allows)
+neither  -> not_applicable
+```
+
+Per-policy decisions are always returned — useful for "we denied because of policy B, but A would have allowed" audit narratives.
+
+---
+
+## Tests
+
+```bash
+pip install -e ".[dev]"
+ruff check src tests && ruff format --check src tests
+mypy src
+pytest -v
+```
+
+CI matrix runs Python 3.11 / 3.12 / 3.13.
+
+---
+
+## Related in this ecosystem
+
+- **[procurement-decision-api](https://github.com/mizcausevic-dev/procurement-decision-api)** — drafts the Decision Cards that this engine enforces.
+- **[ai-procurement-decision-spec](https://github.com/mizcausevic-dev/ai-procurement-decision-spec)** — the v0.1 schema.
+- **[slo-budget-tracker](https://github.com/mizcausevic-dev/slo-budget-tracker)** — error-budget tracker that you can wire into the same FastAPI app.
+- **[reliability-toolkit-rs](https://github.com/mizcausevic-dev/reliability-toolkit-rs)** — Rust async reliability primitives.
+- More at [kineticgain.com](https://kineticgain.com/).
+
+---
+
+## License
+
+MIT. See [LICENSE](LICENSE).

policy_as_code_engine-0.1.1.dist-info/RECORD

@@ -0,0 +1,13 @@
+policy_as_code_engine/__init__.py,sha256=YdLkvc2VuV3HU8BmrOSrHvABbNjUtaZxUZq4sJBllrg,1399
+policy_as_code_engine/__main__.py,sha256=HArqi8lokgiY41lvNeOmZkbTidToHqscch75L9c_iF8,1493
+policy_as_code_engine/app.py,sha256=rJJZHZnw47nFIUaYSbdseYOwp1ag9sRoO62m8LrI4Yo,7582
+policy_as_code_engine/audit_stream.py,sha256=3Y0YvgvmQzpUVlR9WpWb0bH7KidMHY_ap9OXjdMUqiY,2376
+policy_as_code_engine/evaluator.py,sha256=4PufA3teQXr_6J5rl8pNk_bNzlJ14uyDHO_3HlxyVxs,7161
+policy_as_code_engine/from_decision_card.py,sha256=uYVLCOHHrgIsCbx6yse5p5t5QTMV5JAfCO2No_u8IlM,6155
+policy_as_code_engine/loader.py,sha256=e0ZyWe8qO5j2X3vGaTTBJoFMfuiEuBMZNK2Ep1iPFi8,1313
+policy_as_code_engine/models.py,sha256=ff418E8NjpWu5IuhdHa3awaO7Q-1iSfg8B4pAsOVZu0,6805
+policy_as_code_engine-0.1.1.dist-info/METADATA,sha256=PiIeJwq_ziwTkJdo3wTpTVpjDX09h4f_X9z5Jdcub1Q,10222
+policy_as_code_engine-0.1.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+policy_as_code_engine-0.1.1.dist-info/entry_points.txt,sha256=M4F2M0hYy4uU4DgGDelJczeh4homL8wEV5QXxCQ8VZA,68
+policy_as_code_engine-0.1.1.dist-info/licenses/LICENSE,sha256=9REhXrEWXVgwUgFKw9H__Zaboj9yGUNNVJeYTlmqvG8,1084
+policy_as_code_engine-0.1.1.dist-info/RECORD,,

policy_as_code_engine-0.1.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

policy_as_code_engine-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+policy-eval = policy_as_code_engine.__main__:main

policy_as_code_engine-0.1.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Miz Causevic / Kinetic Gain
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.