[Chris Dayne (cdayne)]

Summary

Adds direct policy.xml support for service-level and workspace policy fragments while retaining compatibility with existing JSON-only artifacts.

Changes

• Extracts policy fragments using the split APIOps layout:

• policyFragmentInformation.json for metadata

• policy.xml for policy content

• Publishes JSON-only, XML-only, and split policy-fragment artifacts.

• Treats policy.xml as authoritative for properties.value and sets properties.format to rawxml.

• Supports policy-fragment XML throughout artifact discovery, incremental publishing, transitive dependency resolution, environment mapping, policy-reference rewriting, and secret-redaction checks.

• Skips fragments when no string policy value is available after overrides, while allowing explicitly empty string values.

• Applies the same missing-value behaviour during dry runs.

• Updates reference documentation and integration expectations for the split artifact layout.

Backwards Compatibility

Existing policyFragmentInformation.json artifacts containing properties.value continue to publish without requiring policy.xml.

Validation

• npm test — 61 test files, 1,524 tests passed

• npm run build

• npm run lint -- --quiet

Related Issue(s)

Refs #304 — addresses the policy fragment body differences (items 3 and 4). The named values/, policy fragments/ and version sets/ folder-name differences are not covered by this PR.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation is cohesive and well tested; remaining feedback concerns diagnostic accuracy and documentation consistency.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Report the authoritative policy artifact in scanPolicy findings · New
• Update glossary to document metadata-only policy fragments · New

What changed in this PR

Adds split policy.xml support for service and workspace policy fragments while preserving legacy JSON-only artifacts.

Changes:

• Adds extraction, publishing, discovery, mapping, redaction, and dependency handling for XML policy fragments.
• Handles partial artifact deletion and missing policy values consistently, including dry runs.
• Expands unit, integration, and reference documentation coverage.

File	Description
src/​services/​policy-fragment-artifact.ts	Implements split artifact reading and writing.
src/​services/​resource-extractor.ts	Extracts fragment XML separately from metadata.
src/​services/​resource-publisher.ts	Publishes XML-only, JSON-only, and split fragments.
src/​services/​publish-service.ts	Reconciles partial fragment deletions.
src/​services/​dry-run-reporter.ts	Plans fragment skips and publications.
src/​services/​transitive-resolver.ts	Scans fragment XML references.
src/​services/​transitive-extractor.ts	Writes transitive fragments in split format.
src/​services/​secret-redaction-guard.ts	Scans fragment payloads for redaction markers.
src/​lib/​resource-path.ts	Recognizes fragment policy.xml paths.
tests/​unit/​services/​policy-fragment-artifact.test.ts	Tests split artifact helpers.
tests/​unit/​services/​resource-extractor.test.ts	Tests split extraction.
tests/​unit/​services/​resource-publisher.test.ts	Tests publishing variants and missing values.
tests/​unit/​services/​publish-service.test.ts	Tests incremental deletion behavior.
tests/​unit/​services/​dry-run-reporter.test.ts	Tests dry-run fragment handling.
tests/​unit/​services/​transitive-resolver.test.ts	Tests XML reference discovery.
tests/​unit/​services/​secret-redaction-guard.test.ts	Tests XML redaction detection.
tests/​unit/​services/​git-diff-service.test.ts	Tests XML change mapping.
tests/​unit/​lib/​resource-path.test.ts	Tests service/workspace path parsing.
tests/​unit/​clients/​artifact-store.test.ts	Tests XML-only discovery.
tests/​integration/​all-resource-types/​expected-structure.json	Expects extracted fragment XML files.
docs/​reference/​resource-types.md	Documents fragment file layout.
docs/​reference/​artifact-format.md	Documents split and legacy representations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation consistently supports split and legacy artifacts across extraction, publishing, discovery, validation, and tests.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Report the authoritative policy artifact in scanPolicy findings
• Update glossary to document metadata-only policy fragments

[Copilot]

🟡 Changes recommended

Extraction can omit policy content or alter XML entities, and dry-run actions and workspace diagnostics need correction.

4 open issues

• Preserve XML entities when writing raw policy fragments · New
• Fetch full policy fragments before splitting LIST responses · New
• WebSocket PUT/PATCH actions are incorrectly skipped after import · New
• Workspace fragment override provenance is resolved at the wrong scope · New

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No unresolved blocking issues remain, and tests cover the supported layouts and key workflow integrations.

No open issues 🎉

4 resolved since last review

• Fetch full policy fragments before splitting LIST responses
• Preserve XML entities when writing raw policy fragments
• Workspace fragment override provenance is resolved at the wrong scope
• WebSocket PUT/PATCH actions are incorrectly skipped after import

_{Review effort: Balanced}