file_policy

Diff-scoped file policy runner for verification rule packs. One combined git changed-path pass, per-path read cache, TOML rule registry, JSON-lines violations, and exit codes for CI.

Rule pack corpora are authored in agent-standards (file_policy/rule_packs/<slug>/). Assemble copies only <slug>.py into app repos as flat file-policy/packs/<slug>.py; policy and fixtures ship in file-policy/assembled_policy.py. This repo is the engine only.

Install

Engine development:

pip install -e ".[dev]"

App repos: assemble.py verification writes file-policy/requirements.txt from agent-standards file_policy/engine_version.txt. This repo: pushes to main run .github/workflows/release.yml: if pyproject.toml’s version is not yet on PyPI it publishes; if it already is, CI bumps the patch and re-runs (see AGENTS.md). Optional tag v* still publishes. scripts/verify/file_policy.ps1 bootstraps .venv-file-policy.

pip install file-policy==0.1.12

One-time publish setup (then forget it): On PyPI → file-policy → Publishing, add a trusted publisher — Owner sidboilie, Repository file-policy, Workflow release.yml, Environment (leave blank). GitHub repo can stay private; the PyPI wheel is public and needs no install auth. No PYPI_API_TOKEN secret.

CLI

python -m file_policy run --repo ROOT [--manifest file-policy/manifest.toml] [--packs PACKS_DIR] [--git-base BASE] [--scope changed|full] [--verbose]
python -m file_policy rule test SLUG --repo ROOT [--manifest file-policy/manifest.toml] [--packs PACKS_DIR]
python -m file_policy rule new SLUG --packs PACKS_DIR [--kind per-file|multi-file]

Exit codes: 0 clean, 1 violations, 2 usage/config errors.

Rule pack layout

Authoring (agent-standards): file_policy/rule_packs/<slug>/ with meta.toml, fixtures.toml, and <slug>.py.

Pack language: meta.toml must declare exactly one language: language = "…" (dart, rust, sql, …). Do not use languages (invalid). fixtures.toml does not define language per row; any stray language key there is ignored — meta.toml is the only language source.

App repo after assemble: file-policy/packs/<slug>.py (scripts only) plus file-policy/assembled_policy.py and file-policy/manifest.toml.

Legacy: PACKS_DIR/<slug>/ with meta.toml is still supported when not using assembled_policy.

MDL (minimal data loading)

from file_policy import run_minimal_data_loading

violations = run_minimal_data_loading(repo_root, config_dict, git_base)

Tests

python -m pytest tests/ -q