Module policy 

Context Policy Packs v1 — Policies-as-Code (GL #489).

A policy pack is a declarative, versioned governance preset: which tools an agent may call, the default read mode, redaction patterns for sensitive data, an audit-retention expectation and a context-budget cap. Packs are plain TOML, support single inheritance via extends, and resolve into one ResolvedPolicy a team can review like code.

v1 ships the format, validation, resolution, curated built-ins and the lean-ctx policy CLI (see cli::policy_cmd). Runtime enforcement wires in afterward (deliberately decoupled so this module stays free of hot-path churn — see the contract docs/contracts/context-policy-packs-v1.md).

Inheritance semantics are security-first and predictable:

• scalars (default_read_mode, max_context_tokens, audit_retention_days) — the child overrides when set;
• deny_tools and [redaction] — accumulate down the chain (restrictions inherited from a parent can never be silently dropped; a child may only tighten or re-point a named redaction pattern);
• allow_tools — the child overrides when set (an allowlist is a deliberate posture choice, not an accumulating set).

Modules

builtin

Curated built-in policy packs (GL #489), embedded at compile time.

coverage

CGB coverage — automated partial assessment of a resolved policy pack against the Context Governance Benchmark v1.0-draft (GL #426).

Structs

ContextRules

The [context] section of a pack. All fields optional — only what a pack states is constrained; everything else stays at engine defaults.

PolicyPack

One policy pack as written in TOML. Unknown keys are rejected so a typo (alow_tools) fails validation instead of silently weakening a policy.

ResolvedPolicy

A pack with its full extends chain folded in — what enforcement and policy show consume.

Enums

PolicyError

Why a pack failed to parse, validate or resolve. Rendered verbatim by the CLI, so every variant names the offending field and value.

Constants

KNOWN_READ_MODES

Read modes a pack may pin as default_read_mode — the documented ctx_read mode vocabulary (range reads like lines:N-M are call-site specific and make no sense as a policy default).

Functions

load

Parse + validate + resolve in one step — the common CLI path.

parse

Parse one pack from TOML text (no I/O) and validate it standalone. extends is checked against the built-ins during resolve.

parse_file

Parse a pack from a file path. Read errors surface as PolicyError::Toml with the OS message — the CLI shows them verbatim.

resolve

Fold a pack’s extends chain (against the built-ins) into one ResolvedPolicy. See the module docs for the inheritance semantics.

validate

Field-level validation of a single (unresolved) pack.