From d59b4a013bb3b975ab14171b745e56bd2b9077e5 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Tue, 21 Jul 2026 13:24:09 +0000
Subject: [PATCH] feat(P03): policy_checker.py (T-3.5)

---ci---
phase: 3
milestone: v1.0
status: execute
persona: backend-engineer
task: T-3.5
requirements:
  covered: [REQ-07]
---/ci---

Wave 2, task T-3.5. Policy enforcement script: rejects contracts with public-ingress: true.
---
 scripts/policy_checker.py | 51 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100755 scripts/policy_checker.py

diff --git a/scripts/policy_checker.py b/scripts/policy_checker.py
new file mode 100755
index 0000000..59fe163
--- /dev/null
+++ b/scripts/policy_checker.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""policy_checker.py — REQ-07 / D-025
+
+Reads a contract.yaml and enforces the single Phase-03 policy rule:
+`public-ingress: true` is forbidden.
+
+Input:  argv[1] = path to a contract.yaml file.
+Output: stdout "POLICY_PASS" or "POLICY_VIOLATION:PUBLIC_INGRESS"
+Exit:   0 on pass, 1 on violation.
+
+Idempotent, no side effects (no file writes). Treats an absent or falsy
+`public-ingress` key as a pass.
+"""
+import sys
+import yaml
+
+
+def main() -> int:
+    if len(sys.argv) < 2:
+        print("usage: policy_checker.py <contract.yaml>", file=sys.stderr)
+        return 2
+
+    contract_path = sys.argv[1]
+
+    try:
+        with open(contract_path, "r", encoding="utf-8") as fh:
+            contract = yaml.safe_load(fh)
+    except FileNotFoundError:
+        print(f"contract not found: {contract_path}", file=sys.stderr)
+        return 2
+    except yaml.YAMLError as exc:
+        print(f"invalid yaml: {exc}", file=sys.stderr)
+        return 2
+
+    # Treat missing/non-mapping as no policy violation.
+    if not isinstance(contract, dict):
+        print("POLICY_PASS")
+        return 0
+
+    public_ingress = contract.get("public-ingress", False)
+
+    if public_ingress is True:
+        print("POLICY_VIOLATION:PUBLIC_INGRESS")
+        return 1
+
+    print("POLICY_PASS")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
\ No newline at end of file