autonomy policy eval

Evaluate an action against a local policy bundle (SIL harness use)

Synopsis

Loads a policy bundle from --bundle (directory or .tar.gz), evaluates
--kind with --params against it, and exits 0 (allow) or 1 (deny).

Outputs one JSON line to stdout:
  {"outcome":"allow","reason":"","kind":"tool.echo","params":{}}

When the bundle was authored via the YAML DSL (#747 C03b), the JSON
also carries the explainability fields the runtime populates on
Decision (#747 C05 + C06):
  - matched_rule_id / matched_rule_file / matched_rule_line (when a rule fires)
  - evaluation_trace (one-line summary per match)
  - remediation_hint (on deny outcomes that fired an explicit rule)

These fields are absent for legacy hand-written Rego bundles and for
default-outcome paths (no rule matched).

Exit codes: 0=allow  1=not-allowed (deny or defer)  2=error

  Defer outcomes (e.g. require_approval, #1070 F3b) exit 1 with
  outcome=defer in the JSON line so harnesses keying off the exit
  status see a blocking signal. The documented runtime.Outcome
  contract says callers treat Defer as Deny unless they have a
  higher-authority evaluator available; "policy eval" is a local
  one-shot evaluator with no such upstream.

Usage

autonomy policy eval [flags]

Options

      --bundle string   path to policy bundle directory or .tar.gz (required)
      --kind string     action kind to evaluate, e.g. tool.echo (required)
      --params string   action params as JSON object (default: {}) (default "{}")

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also