file_policy
Diff-scoped file policy runner for verification rule packs. One combined git changed-path pass, per-path read cache, TOML rule registry, JSON-lines violations, and exit codes for CI.
Rule pack corpora are authored in agent-standards (file_policy/rule_packs/<slug>/). Assemble copies only <slug>.py into app repos as flat file-policy/packs/<slug>.py; policy and fixtures ship in file-policy/assembled_policy.py. This repo is the engine only.
Install
Engine development:
pip install -e ".[dev]"
App repos: assemble.py verification writes file-policy/requirements.txt from agent-standards file_policy/engine_version.txt (match pyproject.toml version before release). Release: bump version in pyproject.toml, update engine_version.txt, push main, push tag v* → GitHub Actions publishes to PyPI (trusted publishing — no tokens in GitHub). scripts/verify/file_policy.ps1 bootstraps .venv-file-policy.
pip install file-policy==0.1.5
One-time publish setup (then forget it): On PyPI → file-policy → Publishing, add a trusted publisher — Owner sidboilie, Repository file-policy, Workflow publish.yml, Environment (leave blank). GitHub repo can stay private; the PyPI wheel is public and needs no install auth. No PYPI_API_TOKEN secret.
CLI
python -m file_policy run --repo ROOT [--manifest file-policy/manifest.toml] [--packs PACKS_DIR] [--git-base BASE] [--scope changed|full] [--verbose]
python -m file_policy rule test SLUG --repo ROOT [--manifest file-policy/manifest.toml] [--packs PACKS_DIR]
python -m file_policy rule new SLUG --packs PACKS_DIR [--kind per-file|multi-file]
Exit codes: 0 clean, 1 violations, 2 usage/config errors.
Rule pack layout
Authoring (agent-standards): file_policy/rule_packs/<slug>/ with meta.toml, fixtures.toml, and <slug>.py.
App repo after assemble: file-policy/packs/<slug>.py (scripts only) plus file-policy/assembled_policy.py and file-policy/manifest.toml.
Legacy: PACKS_DIR/<slug>/ with meta.toml is still supported when not using assembled_policy.
MDL (minimal data loading)
from file_policy import run_minimal_data_loading
violations = run_minimal_data_loading(repo_root, config_dict, git_base)
Tests
python -m pytest tests/ -q
1 maintainer
Metadata
1 maintainer
Release files for file-policy 0.1.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| file_policy-0.1.5.tar.gz | 24.1 kB | With provenance | Details for file_policy-0.1.5.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| file_policy-0.1.5-py3-none-any.whl | Python 3 | none | any | Details for file_policy-0.1.5-py3-none-any.whl |
Total release size: 54.0 kB
Release files / file_policy-0.1.5.tar.gz
| Download URL | file_policy-0.1.5.tar.gz |
|---|---|
| Size | 24.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fbfd7885b98d90948a0bc266a3f34e8c86ffa5586eeda899764a50c8160d6e05
|
|
BLAKE2b-256 checksum How to use checksums |
2abe0c37f9e3351bb2aa9e2b9c5027c066b0b2f1ed8066c9f24ad3b33968bde1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 6, 2026.
Transparency logRelease files / file_policy-0.1.5-py3-none-any.whl
| Download URL | file_policy-0.1.5-py3-none-any.whl |
|---|---|
| Size | 29.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
08c07cb41ddffef46e30d2aa852a2c4525f9a8cba71ec3c4fc26724706c3ba7e
|
|
BLAKE2b-256 checksum How to use checksums |
99928d6015bbb1365c88fb737352e375b7ad3e523589664918bf2566c1fc4832
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 6, 2026.
Transparency logSecurity for file-policy 0.1.5
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for file_policy-0.1.5.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 6, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
