Repo polish v2

[kenwalger]

No description provided.

[greptile-apps]

Greptile Summary

This PR adds a warnings diagnostic attribute to AirlockPolicyViolation so that pre-sieve warn-action messages are not lost when a deny exception propagates, fixes AirlockConfigurationError double-wrapping in PolicyEngine.__init__, and migrates pyproject.toml to SPDX license metadata.

• exception.py / boundary.py: AirlockPolicyViolation gains an optional warnings parameter; both the pre-sieve and post-sieve deny raise sites now forward verdict.warnings — though the post-sieve path omits post_verdict.warnings, silently dropping any prose-tax or telemetry warn-action messages that fired in the same post-sieve pass.
• policy.py: An explicit except AirlockConfigurationError: raise guard is inserted before the broad except (KeyError, TypeError, ValueError) handler so clean validation errors from _parse_rule surface with their original message rather than a redundant "Invalid rule definition" prefix.
• pyproject.toml: license migrated from deprecated TOML table form to SPDX string literal; deprecated OSI classifier removed.

Confidence Score: 4/5

Safe to merge with the understanding that post-sieve deny exceptions will carry incomplete warning context until the one-line fix is applied.

The post-sieve deny path in boundary.py passes only verdict.warnings (pre-sieve) to the exception, discarding any post_verdict.warnings accumulated during the same evaluate_post_sieve call — including prose-tax threshold warnings and any concurrent warn-action telemetry rules. This is a gap in the very feature this PR introduces, and the new test suite covers only the pre-sieve case, leaving the post-sieve scenario untested.

packages/sovereign-airlock/src/sovereign_airlock/boundary.py — the post-sieve raise path at line 151.

Important Files Changed

Filename	Overview
packages/sovereign-airlock/src/sovereign_airlock/boundary.py	Post-sieve deny now carries pre-sieve warnings on the exception; however, the post-sieve pass's own warnings (prose-tax, warn-action telemetry rules) are silently dropped in the same raise path.
packages/sovereign-airlock/src/sovereign_airlock/exception.py	Adds warnings: list[str] attribute to AirlockPolicyViolation via a correctly defensive list(warnings) copy in __init__; no issues.
packages/sovereign-airlock/src/sovereign_airlock/policy.py	Adds except AirlockConfigurationError: raise guard before the broad ValueError/KeyError/TypeError handler to prevent clean validation errors from being re-wrapped with a redundant prefix; correct Python exception-ordering idiom.
packages/sovereign-airlock/tests/test_boundary.py	New test covers pre-sieve deny preserving warn-rule messages; no test for the post-sieve deny + post-sieve warnings scenario, leaving the dropped-warnings bug undetected.
packages/sovereign-airlock/pyproject.toml	Migrates license from deprecated TOML table form to SPDX string literal and removes the deprecated OSI classifier; correct PEP 639 / Setuptools guidance.
CHANGELOG.md	Version bumped to 1.4.0 with accurate entries for warnings attribute, de-duplication fix, and SPDX migration.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Caller
    participant AirlockBoundary
    participant PolicyEngine
    participant Sieve

    Caller->>AirlockBoundary: process(payload)
    AirlockBoundary->>PolicyEngine: evaluate(payload)
    PolicyEngine-->>AirlockBoundary: verdict (allowed/denied, warnings[])

    alt pre-sieve deny
        AirlockBoundary-->>Caller: "raise AirlockPolicyViolation(violations, warnings=verdict.warnings)"
    else allowed
        AirlockBoundary->>Sieve: sieve_with_metrics(content)
        Sieve-->>AirlockBoundary: sieve_output + telemetry
        AirlockBoundary->>PolicyEngine: evaluate_post_sieve(telemetry)
        PolicyEngine-->>AirlockBoundary: post_verdict (allowed/denied, post_warnings[])

        alt post-sieve deny
            Note over AirlockBoundary: post_verdict.warnings dropped
            AirlockBoundary-->>Caller: "raise AirlockPolicyViolation(violations, warnings=verdict.warnings only)"
        else allowed
            AirlockBoundary->>AirlockBoundary: verdict.warnings.extend(post_verdict.warnings)
            AirlockBoundary-->>Caller: AirlockResult(sieved_content, telemetry, receipt, policy_warnings)
        end
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Caller
    participant AirlockBoundary
    participant PolicyEngine
    participant Sieve

    Caller->>AirlockBoundary: process(payload)
    AirlockBoundary->>PolicyEngine: evaluate(payload)
    PolicyEngine-->>AirlockBoundary: verdict (allowed/denied, warnings[])

    alt pre-sieve deny
        AirlockBoundary-->>Caller: "raise AirlockPolicyViolation(violations, warnings=verdict.warnings)"
    else allowed
        AirlockBoundary->>Sieve: sieve_with_metrics(content)
        Sieve-->>AirlockBoundary: sieve_output + telemetry
        AirlockBoundary->>PolicyEngine: evaluate_post_sieve(telemetry)
        PolicyEngine-->>AirlockBoundary: post_verdict (allowed/denied, post_warnings[])

        alt post-sieve deny
            Note over AirlockBoundary: post_verdict.warnings dropped
            AirlockBoundary-->>Caller: "raise AirlockPolicyViolation(violations, warnings=verdict.warnings only)"
        else allowed
            AirlockBoundary->>AirlockBoundary: verdict.warnings.extend(post_verdict.warnings)
            AirlockBoundary-->>Caller: AirlockResult(sieved_content, telemetry, receipt, policy_warnings)
        end
    end

Loading

_{Reviews (1): Last reviewed commit: "fix(airlock): close pre-sieve warning as..." | Re-trigger Greptile}

[greptile-apps]

Post-sieve deny drops concurrent post-sieve warnings. When a post-sieve deny fires, the code passes only verdict.warnings (pre-sieve) to the exception, silently discarding any post_verdict.warnings accumulated during the same evaluate_post_sieve call. This includes prose-tax threshold warnings and any warn-action telemetry rules that fired alongside the deny. A caller inspecting exc.warnings for diagnostics will be missing half the context in this scenario.

Suggested change

	post_verdict = self._policy.evaluate_post_sieve(telemetry)
	if not post_verdict.allowed:
	raise AirlockPolicyViolation("; ".join(post_verdict.violations))
	raise AirlockPolicyViolation(
	"; ".join(post_verdict.violations),
	warnings=verdict.warnings,
	)
	post_verdict = self._policy.evaluate_post_sieve(telemetry)
	if not post_verdict.allowed:
	raise AirlockPolicyViolation(
	"; ".join(post_verdict.violations),
	warnings=verdict.warnings + post_verdict.warnings,
	)