autonomy policy verify run

Sample a scenario’s input model against a bundle and report the decision distribution

Synopsis

Generates seeded Monte Carlo cases over the scenario's declared input model,
evaluates each through the runtime policy engine, and reports the decision
distribution (ALLOW / DEFER / DENY) plus any rule-effect breakdown.

Deterministic: the same (bundle, scenario, seed) yields the same result.

  autonomy policy verify run --bundle bundle.tar.gz --scenario scenario.yaml

Usage

autonomy policy verify run --bundle <dir|.tar.gz> --scenario <scenario.yaml> [flags]

Options

      --boundary                     sweep each numeric input's range to report decision cliffs (opt-in)
      --bundle string                path to the policy bundle directory or .tar.gz (required)
      --deployment-manifest string   path to the signed deployment manifest (#1369): applies the execution-decision model so a GRADED policy's verdict/effect bands (ALLOW/CONSTRAIN/AVOID/HOLD) are visible, and enables expect_verdict_in/expect_effect_in invariants
      --export-failures string       write one replayable fixture per finding into this directory
      --fail-on string               exit nonzero when a finding is at/above this severity: none|low|medium|high (default "none")
      --format string                output format: "terminal" or "json" (JSON is the default when --output is set) (default "terminal")
      --grid int                     sweep resolution for --boundary/--perturb (default 21)
      --invariants string            path to an invariants YAML to check (overrides the scenario's linked one)
      --iterations int               number of cases to sample (overrides the scenario's; 0 = use scenario)
      --oscillation-flips int        minimum decision flips to flag oscillation under --perturb (default 2)
      --output string                write the report to this file (default: stdout)
      --perturb                      report oscillation (≥N decision flips) across each numeric input's sweep (opt-in)
      --rego-coverage                report OPA expression/line coverage of the policy Rego (works for hand-authored Rego; opt-in — re-runs the sample with tracing)
      --scenario string              path to the scenario YAML (input model) (required)
      --seed int                     PRNG seed (overrides the scenario's seed)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also