policy

type AttestationState interface {
	// Signed reports whether the artifact carries a verified signature.
	Signed() bool
	// Verified reports whether an attestation of the given predicate-type URI
	// was present and verified.
	Verified(predicateType string) bool
	// VerifiedPredicates lists all verified predicate-type URIs.
	VerifiedPredicates() []string
}

type Case struct {
	Name string `json:"name"`
	// Now is the evaluation time (RFC3339). Empty uses the suite's default,
	// keeping waiver-expiry tests deterministic and independent of the wall clock.
	Now string `json:"now,omitempty"`
	// Input is the world to evaluate.
	Input CaseInput `json:"input"`
	// Expect is the required aggregate decision.
	Expect DecisionType `json:"expect"`
	// ExpectFiring, when set, is the exact set of rule ids that must fire
	// unwaived (order-independent). Nil means "do not check individual rules".
	ExpectFiring []string `json:"expect_firing,omitempty"`
}

type CaseInput struct {
	Findings []FindingJSON     `json:"findings,omitempty"`
	Image    Image             `json:"image,omitempty"`
	Workload Workload          `json:"workload,omitempty"`
	Attest   StaticAttestation `json:"attest,omitempty"`
	Licenses []string          `json:"licenses,omitempty"`
	Packages []string          `json:"packages,omitempty"`
}

type CaseResult struct {
	Name   string       `json:"name"`
	Pass   bool         `json:"pass"`
	Want   DecisionType `json:"want"`
	Got    DecisionType `json:"got"`
	Detail string       `json:"detail,omitempty"`
}

type DecisionType string

type Effect string

type Engine struct {
	// contains filtered or unexported fields
}

type Explanation struct {
	Policy   string            `json:"policy"`
	Decision DecisionType      `json:"decision"`
	Summary  string            `json:"summary"`
	Denials  []RuleExplanation `json:"denials,omitempty"`
	Warnings []RuleExplanation `json:"warnings,omitempty"`
	Waived   []RuleExplanation `json:"waived,omitempty"`
	// Remediation is the de-duplicated set of actions that, if taken, would
	// clear the current denials — the agent's to-do list to get admitted.
	Remediation []string  `json:"remediation,omitempty"`
	EvaluatedAt time.Time `json:"evaluated_at"`
}

type FindingJSON struct {
	RuleID      string            `json:"rule_id"`
	Module      string            `json:"module"`
	Severity    string            `json:"severity"`
	Title       string            `json:"title"`
	Description string            `json:"description,omitempty"`
	Resource    string            `json:"resource,omitempty"`
	Remediation string            `json:"remediation,omitempty"`
	References  []string          `json:"references,omitempty"`
	Metadata    map[string]string `json:"metadata,omitempty"`
}

type Image struct {
	Reference  string `json:"reference,omitempty"`
	Registry   string `json:"registry,omitempty"`
	Repository string `json:"repository,omitempty"`
	Tag        string `json:"tag,omitempty"`
	Digest     string `json:"digest,omitempty"`
}

type Input struct {
	// Findings are the security findings under judgement (from a scan Report).
	Findings []engine.Finding
	// Image identifies the artifact being gated.
	Image Image
	// Workload is the Kubernetes security context, when gating a manifest.
	Workload Workload
	// Attest is the supply-chain verification state. It is an interface so the
	// policy engine never imports the attestation package — Phase 2 supplies an
	// adapter; tests and the CI gate use StaticAttestation.
	Attest AttestationState
	// Licenses lists SPDX license identifiers discovered in the artifact's SBOM.
	Licenses []string
	// Packages lists package names discovered in the artifact's SBOM.
	Packages []string
}

type Kind uint8

type Mode string

type Policy struct {
	// Version is the policy schema version. Only "1" is understood today; an
	// explicit version means a future engine can refuse or migrate old files.
	Version string `json:"version"`
	// Name identifies the policy in decisions and reports.
	Name string `json:"name"`
	// Description is a one-line human summary.
	Description string `json:"description,omitempty"`
	// Mode is enforce (default) or audit.
	Mode Mode `json:"mode,omitempty"`
	// Rules are evaluated in document order; order only affects report/explain
	// ordering, not the final decision (deny always wins over warn).
	Rules []Rule `json:"rules"`
	// Waivers are documented, expiring exceptions.
	Waivers []Waiver `json:"waivers,omitempty"`
}

type ReportJSON struct {
	TargetType string        `json:"target_type"`
	Target     string        `json:"target"`
	Findings   []FindingJSON `json:"findings"`
}

type Result struct {
	Policy   string       `json:"policy"`
	Mode     Mode         `json:"mode"`
	Decision DecisionType `json:"decision"`
	// Rules holds every rule's outcome in policy document order.
	Rules []RuleResult `json:"rules"`
	// EvaluatedAt is the injected evaluation time (for waiver expiry). It is
	// recorded so a decision is self-describing and auditable.
	EvaluatedAt time.Time `json:"evaluated_at"`
}

type Rule struct {
	// ID is a stable, human-meaningful identifier, unique within the policy.
	ID string `json:"id"`
	// Description explains the intent for reviewers.
	Description string `json:"description,omitempty"`
	// Match is the boolean condition; the rule fires when it evaluates to true.
	Match string `json:"match"`
	// Effect is deny, warn, or allow.
	Effect Effect `json:"effect"`
	// Severity is the finding severity when this rule fires. Empty defaults from
	// the effect (deny -> HIGH, warn -> MEDIUM).
	Severity string `json:"severity,omitempty"`
	// Message is the human explanation attached to a firing.
	Message string `json:"message,omitempty"`
	// Remediation tells an operator (or an agent) how to become compliant.
	Remediation string `json:"remediation,omitempty"`
	// References are standards/citations (CIS, NIST, internal runbooks).
	References []string `json:"references,omitempty"`
}

type RuleExplanation struct {
	RuleID       string            `json:"rule_id"`
	Effect       Effect            `json:"effect"`
	Severity     string            `json:"severity,omitempty"`
	Reason       string            `json:"reason,omitempty"`
	Condition    string            `json:"condition"`
	Facts        map[string]string `json:"facts,omitempty"`
	Remediation  string            `json:"remediation,omitempty"`
	References   []string          `json:"references,omitempty"`
	Waived       bool              `json:"waived,omitempty"`
	WaiverReason string            `json:"waiver_reason,omitempty"`
}

type RuleResult struct {
	RuleID      string   `json:"rule_id"`
	Description string   `json:"description,omitempty"`
	Effect      Effect   `json:"effect"`
	Matched     bool     `json:"matched"`
	Message     string   `json:"message,omitempty"`
	Remediation string   `json:"remediation,omitempty"`
	References  []string `json:"references,omitempty"`
	// Severity is the finding severity name for a matched deny/warn.
	Severity string `json:"severity,omitempty"`
	// Waived is set when a matching, unexpired waiver suppressed this firing.
	Waived bool `json:"waived,omitempty"`
	// WaiverReason carries the waiver's justification and expiry when waived.
	WaiverReason string `json:"waiver_reason,omitempty"`
	// Error, when set, is the evaluation error for this rule (fail-closed:
	// a rule that errors is treated as if it denied).
	Error string `json:"error,omitempty"`
}

type Scope struct {
	// ImagePattern is a regexp matched against the image reference. Empty = any.
	ImagePattern string `json:"image_pattern,omitempty"`
	// Registry is an exact registry host match. Empty = any.
	Registry string `json:"registry,omitempty"`
}

type StaticAttestation struct {
	IsSigned   bool     `json:"signed,omitempty"`
	Predicates []string `json:"predicates,omitempty"`
}

type Suite struct {
	// Policy is the path to the policy under test, relative to the suite file.
	Policy string `json:"policy"`
	// Cases are the individual test cases.
	Cases []Case `json:"cases"`
}

type SuiteResult struct {
	Results []CaseResult `json:"results"`
	Passed  int          `json:"passed"`
	Failed  int          `json:"failed"`
}

type Value struct {
	Kind Kind
	// contains filtered or unexported fields
}

type Waiver struct {
	// RuleID is the rule to suppress. Matching is exact.
	RuleID string `json:"rule_id"`
	// Reason is the mandatory justification recorded in the audit trail.
	Reason string `json:"reason"`
	// Owner is who accepted the risk (for accountability).
	Owner string `json:"owner,omitempty"`
	// Expires is when the waiver stops applying (RFC3339, or a bare YYYY-MM-DD
	// treated as end-of-day UTC). A missing or unparseable value is treated as
	// already expired — a waiver must have an end date to be honored.
	Expires string `json:"expires"`
	// Scope optionally narrows the waiver to matching images.
	Scope Scope `json:"scope,omitempty"`
}

type Waivers struct {
	// contains filtered or unexported fields
}

type Workload struct {
	Present                  bool     `json:"present,omitempty"`
	Privileged               bool     `json:"privileged,omitempty"`
	RunAsRoot                bool     `json:"run_as_root,omitempty"`
	HostNetwork              bool     `json:"host_network,omitempty"`
	HostPID                  bool     `json:"host_pid,omitempty"`
	HostIPC                  bool     `json:"host_ipc,omitempty"`
	ReadOnlyRootFS           bool     `json:"read_only_root_fs,omitempty"`
	AllowPrivilegeEscalation bool     `json:"allow_privilege_escalation,omitempty"`
	UsesHostPath             bool     `json:"uses_host_path,omitempty"`
	Capabilities             []string `json:"capabilities,omitempty"`
	Images                   []string `json:"images,omitempty"`
}