Crate agentstategraph_policy_rego 

OPA/Rego runner for AgentStateGraph policies (0.7.5 §4b).

RegoEvaluator shells out to the opa binary on $PATH (or an explicit override via RegoEvaluator::with_opa_path). The Rego source is written to a temp file, the evaluation input is streamed in on stdin, and the decision is pulled from data.policy.decision.

Policy contract

The Rego module MUST declare package policy and define a decision rule that evaluates to a JSON object matching Decision’s serde representation, e.g.:

package policy

decision := {
  "kind": "allow",
  "matched_policy": "infra/my-policy@1",
  "preconditions": []
} {
  input.action == "deploy"
}

Input shape

{
  "situation": { "<key>": "<value>", ... },
  "action": "<action>",
  "agent_id": "<id>"
}

Source variants

• EvaluatorSource::Inline — body is Rego source text.
• EvaluatorSource::FilePath — Rego source is read from disk.
• EvaluatorSource::CommitRef — unsupported; returns ExternalError::SourceResolution.

Structs

RegoEvaluator

Shells out to opa eval.