[intel352]

Summary

• add optional policy_profile fields to Signal trust-policy check and batch contracts
• resolve named profiles (allow_new, established_only, fresh_30d, reset_only) into existing trust status/freshness gates while preserving explicit overrides
• return resolved policy profile in single, batch, and decision outputs and exercise it in the trust-reset pipeline fixture
• bump plugin metadata to 0.32.0 for release

Verification

• RED: GOWORK=off go test ./internal -run 'TrustPolicy' -count=1 failed before proto fields existed with missing PolicyProfile fields/getters\n- GOWORK=off go test ./internal -run 'TrustPolicy|ProviderContracts' -count=1\n- GOWORK=off go test ./... -count=1\n- GOWORK=off go vet ./...\n- make build VERSION=0.32.0\n- make pipeline-test VERSION=0.32.0\n- wfctl plugin validate-contract --for-publish --tag v0.32.0 .\n- wfctl plugin verify-capabilities --binary <tmp-built-0.32.0-binary> .\n- bash /Users/jon/.codex/plugins/cache/autodev-marketplace/autodev/6.5.11/tests/no-machine-paths.sh .\n- git diff --check\n\n## Notes\n- wfctl plugin audit -strict -strict-contracts . still reports existing legacy manifest/static descriptor gaps (legacy_plugin_manifest, 52/57 strict step descriptors, 0/2 trigger descriptors). That is not introduced by this PR and is broader than the profile boundary.\n

[Copilot]

Pull request overview

This PR adds a compact “trust policy profile” abstraction to Signal trust-policy checks, allowing callers to select common policy presets (e.g., established-only, freshness-gated) while keeping existing explicit knobs (allowed statuses / max age) as higher-precedence overrides. It also propagates the resolved profile through single, batch, and per-decision outputs, updates fixtures/docs, and bumps the plugin version for release.

Changes:

• Added policy_profile fields to trust-policy config/input/subject contracts and surfaced the resolved profile in outputs.
• Implemented profile resolution (allow_new/default, established_only, fresh_30d, reset_only) by mapping profiles onto existing status/freshness gates with explicit overrides taking precedence.
• Updated pipeline fixture + tests to exercise profile behavior and bumped plugin metadata/version to 0.32.0.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
testdata/pipelines/signal-trust-reset.yaml	Switches fixture policy checks to policy_profile: established_only and records profile in summary outputs.
README.md	Documents policy_profile presets, precedence/override behavior, and fail-closed behavior for unknown profiles.
proto/signal.proto	Adds policy_profile to public proto contracts for trust-policy config/input/output and batch/subject/decision messages.
plugin.json	Bumps plugin version and download URLs to v0.32.0.
Makefile	Bumps default VERSION to 0.32.0.
internal/trust_store.go	Introduces profile constants, threads profile through policy-check request/result, and includes profile in batch policy ref hashing.
internal/trust_policy_test.go	Adds coverage for profile resolution, explicit overrides, unknown profile fail-closed, freshness gating, and batch behavior.
internal/steps.go	Resolves profiles into effective allowed-status/max-age gates and returns resolved profile via single/batch/decision outputs.
internal/contracts/signal.proto	Mirrors proto contract changes for internal generated contracts.
internal/contracts/signal.pb.go	Regenerated protobuf Go bindings to include new policy_profile fields/getters.

Files not reviewed (1)

• internal/contracts/signal.pb.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.