Module org 

Central, signed org policy distribution (GL #674).

An organisation authors one policy pack, signs it into an OrgPolicyV1 artifact (model) with its org key, and distributes both the artifact and its public key. Each endpoint pins that key once, out-of-band (trust), then installs artifacts (store); from then on the runtime folds the org pack in as an un-bypassable floor (crate::core::policy::floor) beneath the local project pack.

Two independent checks gate application, both required:

1. signature — the artifact’s bytes were signed by the embedded key (OrgPolicyV1::verify); and
2. trust — that key is one this endpoint pinned (trust::is_trusted).

With no key pinned, a present artifact is informational only (opt-in). An invalid or untrusted artifact is never applied and never bricks the agent (fail-open) — it is logged and surfaced by policy org status.

Re-exports

pub use model::OrgPolicyV1;

pub use model::OrgVerifyResult;

pub use trust::TrustStore;

pub use trust::TrustedKey;

Modules

model

The signed org-policy artifact (GL #674).

store

Where the active org policy artifact lives, and how it gets there (GL #674).

trust

Trust anchors for org policy distribution (GL #674).

Structs

OrgStatus

A snapshot of org-policy state for policy org status / show.

Functions

active_resolved

The org policy resolved to a ResolvedPolicy iff it is present, signed by a trusted key, and resolves cleanly. Returns None (after a warn!) in every other case so the caller falls back to the local pack alone. This is the single entry point the runtime uses.

org_key_id

Keystore identity used for an org’s signing key. Namespaced + sanitised so org sign --org "ACME Corp" maps to a safe, stable key file.

status

Compute the current org-policy OrgStatus for display.