autonomy policy compile-graph

Compile a graph-format approval-chain policy into Rego (writes data.autonomy)

Synopsis

Reads a graph-format approval-chain YAML and writes the equivalent
Rego module to stdout (or --out). The wire shape is documented in
docs/architecture/policy-graph-frontend.md:

  version: "1.0.0"
  chains:
    - id: prod-shell-approval
      tool: tool.shell
      branches:
        - id: production-strict
          when:
            op: eq
            field: params.env
            value: production
          approvers: [on-call, security]
          require: all

Each branch lowers to exactly one IR rule with effect=require_approval
(shipped by epic #1070 F3b). Compiled Rule.IDs are
"<chain.id>/<branch.id>" — chain + branch IDs MUST NOT contain '/'
(reserved separator). branch.approvers + branch.require are operator
intent today; future workflow tooling will consume them once an
IR Approval block is added.

The generated Rego carries explainability metadata (a rules_meta map
keyed on rule ID and a parallel matched_rule_id chain) so runtime
Decision events emitted to the WAL surface which branch matched,
where it lives in source, and a one-line remediation hint (#747 C05
+ C06).

Example:
  autonomy policy compile-graph chains.graph.yaml --out compiled/policy.rego
  autonomy policy build --in compiled --out bundle.tar.gz --version 1.0.0 \
    --policy-frontend graph

Usage

autonomy policy compile-graph <input.graph.yaml> [flags]

Options

      --out string   output .rego file path (default: stdout)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also