786d09b88f
Policy Engine: moves gate evaluation, snapshots, orchestrator job tracking, and ledger export from in-memory state to Postgres-backed stores. - New persistence migrations 007 (runtime state), 008 (snapshot artifact identity), 009 (orchestrator jobs). - New repositories: PolicyEngineSnapshotRepository, PolicyEngineLedgerExportRepository, PolicyEngineOrchestratorJobRepository, WorkerResultRepository. - Gateway services: GateEvaluationJobDispatchService, GateEvaluationJobStatusService, GateEvaluationJobWorker, SchedulerBackedGateEvaluationQueue (plus Unsupported fallback), GateTargetSnapshotMaterializer, PersistedKnowledgeSnapshotStore, GateBaselineBootstrapper, PolicyGateEvaluationJobExecutor. - New endpoints: GateJobEndpoints for job status + dispatch. - Worker host: PolicyOrchestratorJobWorkerHost to drain the persistent queue. - PersistedOrchestratorStores + DeltaSnapshotServiceAdapter swap in the persistent implementations via DI. Tests: PersistedDeltaRuntimeTests, PolicyEngineGateTargetSnapshotRuntimeTests, PolicyEngineRegistryWebhookRuntimeTests, PostgresLedgerExportStoreTests, PostgresSnapshotStoreTests, PolicyGatewayPersistedDeltaRuntimeTests, RegistryWebhookQueueRuntimeTests. Archives the old S001 demo seed. Docs: policy API + architecture pages updated. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Policy
Container(s): stellaops-policy-engine Slot: 14 | Port: 8080 | Consumer Group: policy-engine Resource Tier: medium
Purpose
The Policy Engine evaluates security policies against scan results, computes risk scores (CVSS v4, EPSS, EWS), manages exceptions with approval workflows, and produces go/no-go gate decisions for release promotions. It includes merged Policy Gateway functionality (delta computation, drift gates, unknowns gates, score-based gates, tool lattice access control).
API Surface
policy-engine(via Router) — policy compilation, evaluation, simulation, batch context, risk profiles, CVSS receipts, exception management, delta/snapshot endpoints, gate evaluation (drift, unknowns, score-based), overlay projection, trust weighting, advisory AI knobs, sealed-mode, air-gap bundle import/export, governance, tool lattice, verification policies, attestation reports, registry webhooks
Storage
PostgreSQL schema policy (via Postgres:Policy); Valkey for cache
Background Workers
ExceptionLifecycleWorker— exception state machine transitionsExceptionExpiryWorker— auto-expire stale exceptionsIncidentModeExpirationWorker— incident mode TTL enforcementPolicyEngineBootstrapWorker— startup initializationGateEvaluationWorker— async gate evaluation queue processing