From 255cde50029f90db12539f4be7d7e12a15dfc0c0 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Wed, 12 Aug 2026 18:49:06 +0000
Subject: [PATCH] =?UTF-8?q?verify(P5):=20review=20fixes=20=E2=80=94=20wire?=
 =?UTF-8?q?=20Step=205c=20meta-policies=20+=20fix=20smoke=20policy=20(P1-1?=
 =?UTF-8?q?,=20P1-2,=20P1-3)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies
(block-on-any-critical, tagging-rules-agree) over the merged PCR list after
Step 5b, appending the meta-PCRs to pcr.json before the confidence signal
runs. Closes the D-118/D-119 declarative-critical-block gap (the
confidence_signal.py hard-override stays as defense-in-depth).

P1-2 (testing): test_meta_policies.py behavioral assertions strengthened —
test_no_critical_passes asserts no fails, test_critical_fail_present asserts
a non-pass result, test_pcrs_validate_against_schema validates output.

P1-3 (correctness): _smoke.json assertion rewritten from malformed
'{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'.

---ci---
project: acdl
phase: 5
milestone: v1.25
status: execute
phase_role: final
---/ci---
---
 adapters/kyverno-json/policies/_smoke.json    |  2 +-
 scripts/run_platform.sh                       | 42 +++++++++++++++++++
 tests/test_run_platform_plan_json_policies.py |  5 +++
 3 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/adapters/kyverno-json/policies/_smoke.json b/adapters/kyverno-json/policies/_smoke.json
index cf16dcb..c35e67d 100644
--- a/adapters/kyverno-json/policies/_smoke.json
+++ b/adapters/kyverno-json/policies/_smoke.json
@@ -18,7 +18,7 @@
             "all": [
               {
                 "check": {
-                  "id": "{{ to_string(@) }}"
+                  "id": "(regex_match('^[a-z][a-z0-9-]{2,5}$', @))"
                 }
               }
             ]
diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index a27889f..1a4e39f 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -572,6 +572,48 @@ else
 fi
 echo ""
 
+# ============================================================================
+# Step 5c: kyverno-json meta-policies over the merged PCR list (v1.25, REQ-303)
+# ============================================================================
+# After Step 5b merges the Checkov/Wiz + kj plan-JSON PCRs into pcr.json, run
+# the meta-policies (block-on-any-critical, tagging-rules-agree) over the
+# merged list. The meta-policy PCRs are appended to pcr.json before the
+# confidence signal runs. The confidence_signal.py PENALTY["critical"]: None
+# hard-override stays as defense-in-depth behind this declarative rule
+# (D-119). Skips gracefully when kj is absent (D-120).
+if command -v kj >/dev/null 2>&1 && [ -s "$WORK/pcr.json" ]; then
+  echo "=== Step 5c: kyverno-json meta-policies over the merged PCR list ==="
+  python3 - "$WORK/pcr.json" "$CONTRACT_ID" <<'PY' > "$WORK/meta-pcr.json" 2>"$WORK/meta.err" || echo "[]"
+import json, sys
+from pathlib import Path
+sys.path.insert(0, ".")
+import importlib.util
+_spec = importlib.util.spec_from_file_location("kj_engine", "adapters/kyverno-json/kyverno_json_engine.py")
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+eng = _mod.KyvernoJsonEngine()
+if not eng.is_configured():
+    print("[]"); sys.exit(0)
+pcrs = json.load(open(sys.argv[1]))
+out = eng.evaluate(pcrs, Path("adapters/kyverno-json/policies/meta"), sys.argv[2])
+print(json.dumps(out))
+PY
+  if [ -s "$WORK/meta-pcr.json" ]; then
+    python3 -c "
+import json
+merged = json.load(open('$WORK/pcr.json'))
+meta = json.load(open('$WORK/meta-pcr.json'))
+json.dump(merged + meta, open('$WORK/pcr.json', 'w'))
+print(f'meta-policies: {len(meta)} meta-PCRs appended; total PCR list now {len(merged)+len(meta)}')
+"
+  else
+    echo "kyverno-json meta-policies produced no output; proceeding with the merged list only"
+  fi
+else
+  echo "=== Step 5c: kj not installed or no merged PCR list; skipping meta-policies (D-120) ==="
+fi
+echo ""
+
 echo "=== Step 7: confidence signal compute ==="
 python3 <<PY > "$WORK/signal.json" || fail "confidence signal failed"
 import json
diff --git a/tests/test_run_platform_plan_json_policies.py b/tests/test_run_platform_plan_json_policies.py
index f31501d..de849b0 100644
--- a/tests/test_run_platform_plan_json_policies.py
+++ b/tests/test_run_platform_plan_json_policies.py
@@ -27,6 +27,11 @@ class TestStep5bKyvernoJsonWiring:
         assert "Step 5b: kyverno-json plan-JSON policies" in s, \
             "run_platform.sh must have a Step 5b kyverno-json block (REQ-301)"
 
+    def test_step_5c_meta_block_present(self):
+        s = _read_script()
+        assert "Step 5c: kyverno-json meta-policies over the merged PCR list" in s, \
+            "run_platform.sh must have a Step 5c meta-policy block (REQ-303, P1-1 fix)"
+
     def test_kj_scan_invocation_present(self):
         s = _read_script()
         assert "adapters/kyverno-json/policies/plan-json" in s, \