Jon Chery
e044a2de0d
---ci--- project: acdl phase: 6 milestone: v1.1 status: plan-as-execute persona: lead-developer tasks: [T-6.1, T-6.2, T-6.3, T-6.4] ---/ci--- Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the real platform. Wave 1 of the Phase 06 plan. - T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/, contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/ - T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/, terraform/, modules-ir/) with .gitkeep - T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify scripts) - T-6.4: rewrite README.md to reflect the real platform (vision + architecture links, new layout, status v1.1 active); add runner-data/ to .gitignore All moves via git mv (history preserved). Repo root now contains only README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.
51 lines
1.3 KiB
Python
Executable File
51 lines
1.3 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""policy_checker.py — REQ-07 / D-025
|
|
|
|
Reads a contract.yaml and enforces the single Phase-03 policy rule:
|
|
`public-ingress: true` is forbidden.
|
|
|
|
Input: argv[1] = path to a contract.yaml file.
|
|
Output: stdout "POLICY_PASS" or "POLICY_VIOLATION:PUBLIC_INGRESS"
|
|
Exit: 0 on pass, 1 on violation.
|
|
|
|
Idempotent, no side effects (no file writes). Treats an absent or falsy
|
|
`public-ingress` key as a pass.
|
|
"""
|
|
import sys
|
|
import yaml
|
|
|
|
|
|
def main() -> int:
|
|
if len(sys.argv) < 2:
|
|
print("usage: policy_checker.py <contract.yaml>", file=sys.stderr)
|
|
return 2
|
|
|
|
contract_path = sys.argv[1]
|
|
|
|
try:
|
|
with open(contract_path, "r", encoding="utf-8") as fh:
|
|
contract = yaml.safe_load(fh)
|
|
except FileNotFoundError:
|
|
print(f"contract not found: {contract_path}", file=sys.stderr)
|
|
return 2
|
|
except yaml.YAMLError as exc:
|
|
print(f"invalid yaml: {exc}", file=sys.stderr)
|
|
return 2
|
|
|
|
# Treat missing/non-mapping as no policy violation.
|
|
if not isinstance(contract, dict):
|
|
print("POLICY_PASS")
|
|
return 0
|
|
|
|
public_ingress = contract.get("public-ingress", False)
|
|
|
|
if public_ingress is True:
|
|
print("POLICY_VIOLATION:PUBLIC_INGRESS")
|
|
return 1
|
|
|
|
print("POLICY_PASS")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main()) |