[shiju-nv]

Summary

Bound the diagnostics returned when the OPA engine rejects a policy load or reload. Report fixed validation categories instead of authored names, values, paths or nested error text, with at most eight items and 512 UTF-8 bytes per message. Preserve safe YAML source positions and active state when candidate validation rejects a reload.

Related Issue

Partially addresses accepted #3092: bounded policy-load diagnostics.

Changes

• Map typed policy violations exhaustively to fixed categories and reserve space for an explicit omission notice before adding each item.
• Sanitize YAML, middleware conversion/catalog, L7, endpoint ambiguity, Rego, file and internal policy-data errors, discarding their original error chains.
• Return before emitting authored L7 warnings when validation rejects the candidate.
• Add hostile ASCII/Unicode payload, item/byte bound, source-chain, file/string/protobuf loader and rejected-reload regressions.
• Retain the merged raw-container validation before normalization and preserve upstream MCP endpoint identity derivation.
• Preserve upstream binary-identity selection, including the endpoint-only file loader, and cover its error redaction and successful construction.
• Align the parity fixture with the merged runtime split by using the Debian supervisor base and recording the separate sandbox runtime image.
• Document the returned-error boundary and distinguish engine-state retention from the supervisor's configured rejection behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

Label test:e2e applied for e5f606f. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

This change is scoped to the accepted policy-validation work in #3092. The initial code review found no blocking defects: policy-load diagnostics are bounded and redacted, rejected reloads retain active state, and the direct operator-facing diagnostic contract is documented.

Blocking findings:

• No blocking findings remain

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Partially implements accepted issue #3092 with a focused policy-diagnostic and rejected-reload change.
• Docs: Fern policy reference and architecture documentation are updated.
• Checks: Branch Checks, Helm Lint, and Trivy Changes are green on the current head; the required E2E rerun is queued.
• E2E: test:e2e applied; E2E Label Help required rerunning current-head run 35070313194, and the new attempt is queued.
• Head SHA: e5f606fdd36a92779d1ce3441a6d238e92c89840
• Base SHA: b3e4ad4579e24dacfb285924876473b50a04b988
• Merge base SHA: b3e4ad4579e24dacfb285924876473b50a04b988
• Patch ID: 7272c436d91eed928257c7bba3dd1f6511d699ad
• Gator payload: 9
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

PR Review Status

The follow-up review found no blocking defects. The original bounded-diagnostics patch remains patch-identical after merging main, and the author-owned documentation resolution preserves both the canonical parser contract and the previously reviewed policy-load diagnostic boundary.

Blocking findings:

• No blocking findings remain

Carried findings:

• None

Gator metadata

• Validation: Partially implements accepted issue #3092 with a focused policy-diagnostic and rejected-reload change.
• Docs: Fern policy reference and architecture documentation remain updated after the merge resolution.
• Checks: Current-head Branch Checks and E2E are queued or running; Helm Lint and Trivy Changes are green.
• E2E: test:e2e is applied and current-head run 35178560069 is queued.
• Head SHA: 33bd9c9916bbb72a724ab20e4404f9da9d913b15
• Base SHA: 2ccef97769e0e39c4dc06b4c3953d3735814f146
• Merge base SHA: 2ccef97769e0e39c4dc06b4c3953d3735814f146
• Patch ID: 169d8fedf79631da6d3d5eb3a338fa43e6f8c222
• Gator payload: 9
• Review mode: follow_up
• Previous reviewed SHA: e5f606fdd36a92779d1ce3441a6d238e92c89840
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: The PR reached gator:merge-ready with maintainer approval and required checks complete.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: 33bd9c9916bbb72a724ab20e4404f9da9d913b15
• Gator payload: 9