autonomy policy verify replay

Re-evaluate exported fixtures, or faithfully replay captured production decisions (–from-wal)

Synopsis

Two modes, both through the SAME runtime engine as the edge:

EXPORTED FIXTURES (positional <fixture.json|dir>): re-evaluates each self-contained
fixture (written by "policy verify run --export-failures") and compares the verdict
to the one it froze. A same-digest divergence is a hard failure (nondeterminism /
tamper); against a NEW bundle, --fail-on-reproduced gates CI while any frozen
failure still reproduces.

FAITHFUL PRODUCTION REPLAY (--from-wal <wal-dir>): reconstructs the exact actions
the fleet governed from the runtime's autonomy.action_input capture frames (enable
with "runtime start --capture-action-input"), re-evaluates each against --bundle,
and diffs the new outcome against the outcome recorded in production —
"re-run every decision the fleet actually made against bundle v2 and show what
changed". --fail-on-changed exits nonzero if any decision changed. Captures whose
params were redacted are partial and skipped (never silently diffed). Caveat: the
replayed outcome is the POLICY decision; for a GRADED/replace deployment the
recorded WIRE outcome reflects runtime shaping a policy re-eval does not reproduce.

  autonomy policy verify replay --bundle fixed.tar.gz ./failures --fail-on-reproduced
  autonomy policy verify replay --bundle v2.tar.gz --from-wal ./wal --fail-on-changed

Usage

autonomy policy verify replay --bundle <dir|.tar.gz> {<fixture.json|dir> | --from-wal <wal-dir>} [flags]

Options

      --bundle string        path to the policy bundle directory or .tar.gz (required)
      --fail-on-changed      with --from-wal, exit nonzero if any replayed decision changed vs the outcome recorded in production
      --fail-on-reproduced   exit nonzero if any fixture still reproduces its frozen verdict (fix-verification gate)
      --format string        output format: "terminal" or "json" (JSON is the default when --output is set) (default "terminal")
      --from-wal string      faithfully replay captured production decisions from this telemetry WAL directory (#1313)
      --output string        write the report to this file (default: stdout)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also