merge(phase/05): v1.25 final review+audit+ship complete

v1.25 kyverno-json Unified Policy Engine — milestone complete.
19 requirements (REQ-291..309), 6 phases (P0 + P1..P4 + P5).
Tags v1.24.0..v1.24.5 on the v1.24.x line.
Review: 1 P0 fixed (heredoc), 3 P1 fixed (meta-policy wiring, tests, smoke).
Audit: reconstruction PASS, branch hygiene clean.

---ci---
project: acdl
phase: 5
milestone: v1.25
status: complete
phase_role: final
---/ci---

adapters/kyverno-json/policies/_smoke.json

@@ -18,7 +18,7 @@
             "all": [
               {
                 "check": {
-                  "id": "{{ to_string(@) }}"
+                  "id": "(regex_match('^[a-z][a-z0-9-]{2,5}$', @))"
                 }
               }
             ]

scripts/run_platform.sh

@@ -533,7 +533,7 @@ if command -v kj >/dev/null 2>&1; then
   if [ -f "$TF_DIR/tfplan" ]; then
     terraform -chdir="$TF_DIR" show -json tfplan > "$WORK/tfshow.json" 2>/dev/null || true
     if [ -s "$WORK/tfshow.json" ]; then
-      python3 - <<'PY' > "$WORK/kj-pcr.json" 2>"$WORK/kj.err" || echo "[]"
+      python3 - "$WORK/tfshow.json" "$CONTRACT_ID" <<'PY' > "$WORK/kj-pcr.json" 2>"$WORK/kj.err" || echo "[]"
 import json, sys
 from pathlib import Path
 sys.path.insert(0, ".")
@@ -541,10 +541,11 @@ import importlib.util
 _spec = importlib.util.spec_from_file_location("kj_engine", "adapters/kyverno-json/kyverno_json_engine.py")
 _mod = importlib.util.module_from_spec(_spec)
 _spec.loader.exec_module(_mod)
+_payload_path, _contract_id = sys.argv[1], sys.argv[2]
 eng = _mod.KyvernoJsonEngine()
 if not eng.is_configured():
     print("[]"); sys.exit(0)
-out = eng.evaluate(json.load(open("$WORK/tfshow.json")), Path("adapters/kyverno-json/policies/plan-json"), "$CONTRACT_ID")
+out = eng.evaluate(json.load(open(_payload_path)), Path("adapters/kyverno-json/policies/plan-json"), _contract_id)
 print(json.dumps(out))
 PY
       if [ -s "$WORK/kj-pcr.json" ]; then
@@ -571,6 +572,48 @@ else
 fi
 echo ""
 
+# ============================================================================
+# Step 5c: kyverno-json meta-policies over the merged PCR list (v1.25, REQ-303)
+# ============================================================================
+# After Step 5b merges the Checkov/Wiz + kj plan-JSON PCRs into pcr.json, run
+# the meta-policies (block-on-any-critical, tagging-rules-agree) over the
+# merged list. The meta-policy PCRs are appended to pcr.json before the
+# confidence signal runs. The confidence_signal.py PENALTY["critical"]: None
+# hard-override stays as defense-in-depth behind this declarative rule
+# (D-119). Skips gracefully when kj is absent (D-120).
+if command -v kj >/dev/null 2>&1 && [ -s "$WORK/pcr.json" ]; then
+  echo "=== Step 5c: kyverno-json meta-policies over the merged PCR list ==="
+  python3 - "$WORK/pcr.json" "$CONTRACT_ID" <<'PY' > "$WORK/meta-pcr.json" 2>"$WORK/meta.err" || echo "[]"
+import json, sys
+from pathlib import Path
+sys.path.insert(0, ".")
+import importlib.util
+_spec = importlib.util.spec_from_file_location("kj_engine", "adapters/kyverno-json/kyverno_json_engine.py")
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+eng = _mod.KyvernoJsonEngine()
+if not eng.is_configured():
+    print("[]"); sys.exit(0)
+pcrs = json.load(open(sys.argv[1]))
+out = eng.evaluate(pcrs, Path("adapters/kyverno-json/policies/meta"), sys.argv[2])
+print(json.dumps(out))
+PY
+  if [ -s "$WORK/meta-pcr.json" ]; then
+    python3 -c "
+import json
+merged = json.load(open('$WORK/pcr.json'))
+meta = json.load(open('$WORK/meta-pcr.json'))
+json.dump(merged + meta, open('$WORK/pcr.json', 'w'))
+print(f'meta-policies: {len(meta)} meta-PCRs appended; total PCR list now {len(merged)+len(meta)}')
+"
+  else
+    echo "kyverno-json meta-policies produced no output; proceeding with the merged list only"
+  fi
+else
+  echo "=== Step 5c: kj not installed or no merged PCR list; skipping meta-policies (D-120) ==="
+fi
+echo ""
+
 echo "=== Step 7: confidence signal compute ==="
 python3 <<PY > "$WORK/signal.json" || fail "confidence signal failed"
 import json

tests/test_run_platform_plan_json_policies.py

@@ -27,6 +27,11 @@ class TestStep5bKyvernoJsonWiring:
         assert "Step 5b: kyverno-json plan-JSON policies" in s, \
             "run_platform.sh must have a Step 5b kyverno-json block (REQ-301)"
 
+    def test_step_5c_meta_block_present(self):
+        s = _read_script()
+        assert "Step 5c: kyverno-json meta-policies over the merged PCR list" in s, \
+            "run_platform.sh must have a Step 5c meta-policy block (REQ-303, P1-1 fix)"
+
     def test_kj_scan_invocation_present(self):
         s = _read_script()
         assert "adapters/kyverno-json/policies/plan-json" in s, \