Documentation
¶
Overview ¶
Package evaluator is L5 of the SigComply CLI: runs each policy's rule against the records collected for it and emits a PolicyResult. Hosts the rule registry, the Rego runner, the Go rule runner, and the YAML DSL transpiler. Rules are pure functions over RuleInput; they do no I/O.
See docs/architecture/02-layers.md for the full layer contract.
Package evaluator is L5 of the SigComply CLI: runs each policy's rule with the records collected for it and emits PolicyResult. Hosts the Rego runner and the Go rule runner; the YAML DSL transpiler is deferred (post-M6).
See docs/architecture/02-layers.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type GoRule ¶
type GoRule struct {
IDValue string
Fn func(ctx context.Context, in core.RuleInput) (core.RuleResult, error)
}
GoRule is a thin core.Rule implementation backed by a closure. It exists so framework packages can register hand-written Go rules without each defining its own type.
type Input ¶
type Input struct {
Plan *planner.RunPlan
Rules *registry.Registry[core.Rule]
RecordsByPolicy map[string]map[string][]core.EvidenceRecord
EnvelopesByPolicy map[string][]string
CollectErrorsByPolicy map[string]error
Now time.Time
}
Input is the per-run input to Evaluate. RecordsByPolicy is keyed by PolicyID; the inner map is keyed by slot name. CollectErrorsByPolicy holds collector-side errors (network, auth, schema-validation); a non-empty entry forces the policy's status to "error" without invoking the rule.
type RegoRule ¶
type RegoRule struct {
// contains filtered or unexported fields
}
RegoRule wraps an OPA Rego module. The module is prepared once at New; each Evaluate call instantiates a fresh evaluator with the per-policy input. Pure-function semantics are preserved by OPA's sandbox.
func NewRegoRule ¶
NewRegoRule prepares the module for repeated evaluation. The query is a Rego reference, e.g. "data.sigcomply.rules.manual_presence.v1.result"; the rule's result document must expose a "status" string and an optional "violations" array of {resource_id, reason, details}.
Source Files