armoriq-policy-ir (Python)

The Armor Policy v2 evaluator for Python runtimes. CI runs it on every vector in vectors/evaluate.json, the same file the TypeScript evaluate() in @armoriq/policy-ir must pass.

from armoriq_policy_ir import evaluate

evaluation = evaluate(
    {"tool": "create_payment", "arguments": {"amount": 900}, "timestamp": "2026-10-16T12:00:00.000Z"},
    {"agent": document},
)
evaluation["verdict"]  # "allow" | "hold" | "block"

Inputs and outputs are the same JSON shapes as the TypeScript package, with camelCase keys.

It follows JavaScript semantics where Python's defaults differ: numbers compare as IEEE doubles, strings are compared and matched as UTF-16 units, dotpaths read own keys only, and regex conditions are translated to JavaScript RegExp behaviour.

evaluate raises instead of guessing when an input is outside what both runtimes read alike:

• NotPortable: a regex outside the portable subset. The TypeScript validator rejects these patterns when a policy compiles.
• UnsupportedTime: a timestamp or expiry that isn't strict ISO-8601 (YYYY-MM-DDTHH:mm:ss.sssZ, with optional parts and a ±HH:mm offset), or a local time outside years 1 to 9999.

A caller must treat any exception from evaluate as a block.