[Benoît Cortier (CBenoit)]

Policies move to a 2.x format whose evaluation is specified exactly enough that independent implementations decide every request alike, and whose requests are the 2.0 package requests the broker receives.

• policies/INTENT.md, INTENT.legacy.md and INTENT.wire.md state the design: fail-closed checks, Deny always winning, grants that add up, how 1.x policies are converted, and the 2.0 request encoding.
• policies/CONTRACT.policy.md specifies document reading, error reporting, request reading per package manager (each request is read the way the broker builds its command, and a request the policy cannot read safely is denied as unreadable), the vocabulary of decisions, unreadable requests and errors, and evaluation with three-valued matching: an unknown property lets a Deny rule apply and keeps an Allow rule, a trusted source or an Except entry from matching.
• policies/CONTRACT.wire.md specifies the 2.0 package broker wire contract; the evaluator reads its package request without RequestId.
• policies/test-data/policy-conformance is a language-neutral conformance suite of 587 document cases and 1642 evaluation cases, written from the contracts alone.
• policies/rust/now-policy-eval is a new crate, with no runtime dependency and no dependency on the 1.x crates, that reads documents, reads requests and evaluates decisions, and passes the whole suite. evaluate returns a decision for every well-formed request, an unreadable one included, and the error BadRequest, with no decision, for a request that is not well-formed. Property tests check that adding an Allow or Deny rule only widens or narrows what is allowed, and that rule order never matters.
• xtask/unicode-tables is a standalone generator for the Unicode 16.0.0 tables the contract pins; cargo xtask unicode tables runs it on demand. It has its own workspace and lockfile so that xtask gains no dependency; CI does not build it or check its lockfile.

🤖 Generated with Claude Code

[Benoît Cortier (CBenoit)]

Intent drift audit

Audited against policies/INTENT.md (63 statements), INTENT.legacy.md (11), INTENT.wire.md (16), CONTRACT.policy.md, and the package-request half of CONTRACT.wire.md (§values, request reading in §json, §package-request, §opt-ins). The crate was read file by file, except the generated unicode_tables.rs; the suite was checked through its COVERAGE.*.md files and spot-checked cases.

The crate conforms to every CONTRACT.policy.md section checked, including each per-manager reading bullet, and to the request shape, opt-ins and targeting statements of INTENT.wire.md.

Violation: needs a decision on intent

• INTENT.md §trusted-sources: "A rule may name a source the list does not trust, to govern uninstalls of packages from that source."
  • The contract reads the source of every Uninstall as unknown, because no uninstall command is limited to packages installed from Source.Name.
  • It also requires a selection naming a source to list Operations without Uninstall, which realises §fail-closed: "Rules that silently never match uninstalls … are rejected".
  • So no rule can select uninstalls by source. A rule whose named sources are all untrusted never affects a decision.
  • Either this intent sentence changes, or the contract gives an Uninstall a known source wherever the uninstall command is limited to one source.

Partials

1. CONTRACT.wire.md §package-request, INTENT.wire.md §targeting: a malformed request, such as Machine with NonElevated, is a BadRequest.

   • Request::is_well_formed implements and tests every bound, but it is crate-private, and evaluate denies such a request as UnreadableRequest.
   • The broker, which answers BadRequest, can get a public check when it is built.

2. CONTRACT.policy.md §managers: the source of every Uninstall is unknown. No valid policy can observe this, and the code carries an UNTESTED: comment.

3. INTENT.md §fail-closed, read broadly: some Allow rules still never match some uninstalls without being rejected:

   • Packages and Architectures under Vcpkg;
   • Scopes on Pip and PowerShell uninstalls.

   The sentence conforms when read, with the sentence before it, as being about version conditions.

4. CONTRACT.policy.md §install-location: the check reads only the text of the path. This is review-only by nature, and the code carries an UNTESTED: comment.

Not yet realised

• The C# library and its risk guidance.
• Editors.
• The broker: command building, the pre/post refusal, and policy replacement.
• 1.x conversion and the earlier wire paths.
• /v2/ routing.
• Every CONTRACT.wire.md section beyond the package request and its opt-ins.

Agreement between the Rust and C# implementations needs the C# implementation. Whether each manager's reading matches its command needs the broker's command builders.

Not covered by intent

• A malformed request is denied as UnreadableRequest; neither contract decides how an evaluator treats one.
• Policy exposes no Metadata.Id, Revision or PublishedAt, which policy replacement will need.
• A key repeated three times yields two identical DuplicateKey errors; the contract does not say whether that is one error or two.
• xtask/unicode-tables is a standalone tool depending on sha2, outside the workspace; xtask itself gains no dependency.

Note

LLM-assisted content (no human feedback).

[Benoît Cortier (CBenoit)]

Intent drift audit: update for ff735ef

• INTENT.md §trusted-sources now conforms. The intent now says the source of an uninstall is unknown and that rules govern uninstalls by package. The contract's rule that a selection naming a source lists Operations without Uninstall realises §fail-closed, which now covers source as well as version.
• The source of an update is the source the request names under every manager. Where Scoop or Windows PowerShell updates from the source recorded at install, the broker must check every such record before running anything. If it has not read records that all name the request's source, the operation ends Failed without running a step. That check is broker behaviour: no conformance case can observe it, so it is verified by review only.
• A decision covers the packages a request names. Vcpkg Updates and Uninstalls now read their port and triplet architecture like an Install's.
• Partial 1 is resolved. A request that is not well-formed now gets the error BadRequest from evaluate and no decision. A well-formed unreadable request still gets Deny with UnreadableRequest. The conformance runner reports the error as a failed case; it never maps it to a decision.
• Partials 2 to 4 and "Not yet realised" are unchanged. Still not realised: §broker-limits on resolving source names only through machine-wide configuration on elevated runs, and the recorded-source check. Both belong to the broker.

Note

LLM-assisted content (no human feedback).