Add Policy DSL Validator, Schema Exporter, and Simulation Smoke tools

- Implemented PolicyDslValidator with command-line options for strict mode and JSON output.
- Created PolicySchemaExporter to generate JSON schemas for policy-related models.
- Developed PolicySimulationSmoke tool to validate policy simulations against expected outcomes.
- Added project files and necessary dependencies for each tool.
- Ensured proper error handling and usage instructions across tools.

docs/ci/20_CI_RECIPES.md

@@ -8,7 +8,9 @@
 | `DOCKER_HOST` | How containers reach your Docker daemon (because we no longer mount `/var/run/docker.sock`)                                       | `tcp://docker:2375`                                  |
 | `WORKSPACE`   | Directory where the pipeline stores artefacts (SBOM file)                                                                         | `$(pwd)`                                             |
 | `IMAGE`       | The image you are building & scanning                                                                                             | `acme/backend:sha-${COMMIT_SHA}`                     |
-| `SBOM_FILE`   | Immutable SBOM name – `<image-ref>‑YYYYMMDDThhmmssZ.sbom.json`                                                                    | `acme_backend_sha‑abc123‑20250804T153050Z.sbom.json` |
+| `SBOM_FILE`   | Immutable SBOM name – `<image-ref>‑YYYYMMDDThhmmssZ.sbom.json`                                                                    | `acme_backend_sha‑abc123‑20250804T153050Z.sbom.json` |
+
+> **Authority graph scopes note (2025‑10‑27):** CI stages that spin up the Authority compose profile now rely on the checked-in `etc/authority.yaml`. Before running integration smoke jobs, inject real secrets for every `etc/secrets/*.secret` file (Cartographer, Graph API, Policy Engine, Concelier, Excititor). The repository defaults contain `*-change-me` placeholders and Authority will reject tokens if those secrets are not overridden.
 
 ```bash
 export STELLA_URL="stella-ops.ci.acme.example"
@@ -291,6 +293,40 @@ Host the resulting bundle via any static file server for review (for example `py
 - [ ] Markdown link check (`npx markdown-link-check`) reports no broken references.
 - [ ] Preview bundle archived (or attached) for stakeholders.
 
+### 4.5 Policy DSL lint stage
+
+Policy Engine v2 pipelines now fail fast if policy documents are malformed. After checkout and dotnet restore, run:
+
+```bash
+dotnet run \
+  --project tools/PolicyDslValidator/PolicyDslValidator.csproj \
+  -- \
+  --strict docs/examples/policies/*.yaml
+```
+
+- `--strict` treats warnings as errors so missing metadata doesn’t slip through.
+- The validator accepts globs, so you can point it at tenant policy directories later (`policies/**/*.yaml`).
+- Exit codes follow UNIX conventions: `0` success, `1` parse/errors, `2` warnings when `--strict` is set, `64` usage mistakes.
+
+Capture the validator output as part of your build logs; Support uses it when triaging policy rollout issues.
+
+### 4.6 Policy simulation smoke
+
+Catch unexpected policy regressions by exercising a small set of golden SBOM findings via the simulation smoke tool:
+
+```bash
+dotnet run \
+  --project tools/PolicySimulationSmoke/PolicySimulationSmoke.csproj \
+  -- \
+  --scenario-root samples/policy/simulations \
+  --output artifacts/policy-simulations
+```
+
+- The tool loads each `scenario.json` under `samples/policy/simulations`, evaluates the referenced policy, and fails the build if projected verdicts change.
+- In CI the command runs twice (to `run1/` and `run2/`) and `diff -u` compares the summaries—any mismatch signals a determinism regression.
+- Artifacts land in `artifacts/policy-simulations/policy-simulation-summary.json`; upload them for later inspection (see CI workflow).
+- Expand scenarios by copying real-world findings into the samples directory—ensure expected statuses are recorded so regressions trip the pipeline.
+
 ---
 
 ## 5 · Troubleshooting cheat‑sheet