feat!: add package policy management contract

[Benoît Cortier (CBenoit)]

Summary

• make package policy documents JSON-only and add editable PolicyDraftDocument models with explicit committed/draft conversions
• add versioned management snapshots, raw-JSON validation findings/receipts, optimistic replacement intents, and structured management errors
• add Rust server trait methods/routes/status mappings/OpenAPI plus NativeAOT-safe .NET client APIs and strict cross-language fixtures
• reject ineffective boolean match arrays containing more than one value
• enforce validation-result and management-snapshot invariants during Rust/.NET serialization and deserialization and in OpenAPI
• add a separate 16 MiB full-request-body limit for policy validation/replacement while retaining 256 KiB package-operation limits
• align policy text bounds with JSON Schema by counting Unicode scalar values in Rust and .NET

Breaking changes

• removes Rust parse_policy_yaml and .NET PolicyDocument.ParseYaml (public in Devolutions.Now.Policy.Model 2026.8.13)
• adds required PackageBrokerServer management methods

OpenAPI YAML generation and unrelated YAML request fixtures remain supported.

Contract notes

• GET /v1/policy is unchanged
• adds GET /v1/policy/management, POST /v1/policy/validate, and PUT /v1/policy
• validation preserves raw JSON/unknown fields until authoritative validation
• valid validation results require canonical draft plus receipt and forbid Error findings; invalid results require at least one Error and forbid success artifacts
• management state and write-capability combinations are structurally constrained
• strict and non-strict C# deserialization apply identical semantic invariants; unknown-member handling remains their distinction
• opaque store tokens and validation receipts use the same safe printable ASCII contract in Rust, .NET, and OpenAPI
• StringPattern, VersionString, and CustomParameterString bounds use Unicode scalar/code-point counts across Rust, .NET, and JSON Schema
• optional document fields remain nullable at the field-schema level while result/state branches require or exclude their values consistently
• StalePolicyStoreToken errors carry the atomic current Management snapshot for an exact-token confirmed overwrite retry
• UnsafePolicyPath maps to HTTP 409; authentication/admin/elevation failures retain 401/403
• configured .yaml, .yml, extensionless, or otherwise non-JSON policy paths use PolicyReadOnlyReason.UnsupportedFormat and ErrorCode.UnsupportedPolicyFormat with HTTP 422
• absent newer routes remain ordinary HTTP 404s; UnsupportedEndpoint is optional explicit implementation behavior
• confirmed overwrite remains bound to an exact newly observed store token; no unconditional force mode exists
• capabilities are advisory and implementations must reparse/revalidate/recheck storage semantics in the write transaction
• MAX_POLICY_MANAGEMENT_BODY_BYTES / BrokerApi.MaxPolicyManagementBodyBytes is 16 MiB and applies to the complete validate/replace HTTP body, including the envelope; package operations retain the separate advertised 256 KiB default

Coordination

This is the first dependency in the coordinated Phase 2 rollout. It follows merged Phase 1 inspection contract #93. Gateway and UniGetUI PR links will be added by their coordinated follow-up work.

Validation

• cargo test --workspace --locked
• cargo clippy --workspace --all-targets --locked -- -D warnings
• .NET 9/10 model suite: 51 tests per target
• .NET 9/10 client suite: 240 tests per target
• dotnet format ... --verify-no-changes
• deterministic policy schema and OpenAPI regeneration
• exact 16 MiB / 16 MiB + 1 route and .NET preflight boundary tests
• unpublished NuGet metadata and dependency versions verified against exact commit provenance

Unpublished exact-head artifacts

Built from ec592a91f95a66c8a79b7d612ed73d931ef74aeb as version 2026.8.29-phase2.ec592a91; not published.

• API nupkg: 8f7cf0e463bbeced08a79c726d70c847360c1e0c3ff4f470a6b1aa8a14f461c8
• API snupkg: df5a120ab6735f3f88ba822e9f941aa210d5d1afc5de9699639552473bd4fe7e
• Client nupkg: 9f0d75c5410d58e3984e9c5c1782082eaec8e8d43f7dd3f636f7729b500e03a8
• Client snupkg: 18268e0d6dc036a3ad20a4c8329f92fb57052210435c5b5733ca797263396f8e
• Model nupkg: 90cde0d7953901c8012ce2aecc621ae7b8a05c12423bc26b38f172cd151bba28
• Model snupkg: e98147e0b6d9c2a2cfbc83d2f2f00af2673a62c544c7240e0c8f4a90e612b017

Source artifacts:

• OpenAPI: 759481ac915fb0d48a602f90ad037261d5045c9a3ae906d293fef7ff3c74d469
• policy schema: cd156264ed107890e0eeb9046d19fe0caf9bbc3f270235d434533bb325626fe8

[Copilot]

Pull request overview

Adds cross-language package-policy management contracts, including draft validation, optimistic replacement, management snapshots, and JSON-only policy models.

Changes:

• Adds Rust and .NET management APIs, routes, DTOs, validation, and clients.
• Introduces editable policy drafts and removes YAML policy parsing.
• Adds fixtures and stricter boolean-match validation.

Reviewed changes

Copilot reviewed 52 out of 53 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
policies/test-data/package-broker/scenarios/baseline.scenarios.json	Removes YAML-policy scenarios.
policies/test-data/package-broker/responses/policy-validation.valid.response.json	Adds valid-validation fixture.
policies/test-data/package-broker/responses/policy-validation.invalid.response.json	Adds invalid-validation fixture.
policies/test-data/package-broker/responses/policy-stale-token.error.json	Adds stale-token error fixture.
policies/test-data/package-broker/responses/policy-replacement.response.json	Adds replacement response fixture.
policies/test-data/package-broker/responses/policy-management.missing.response.json	Adds missing-policy snapshot.
policies/test-data/package-broker/responses/policy-management.invalid.response.json	Adds invalid-policy snapshot.
policies/test-data/package-broker/responses/policy-management.active.response.json	Adds active-policy snapshot.
policies/test-data/package-broker/requests/policy-validation.request.json	Adds raw validation request.
policies/test-data/package-broker/requests/policy-replacement.update.request.json	Adds update intent fixture.
policies/test-data/package-broker/requests/policy-replacement.replace-identity.request.json	Adds identity-replacement fixture.
policies/test-data/package-broker/requests/policy-replacement.repair.request.json	Adds repair intent fixture.
policies/test-data/package-broker/requests/policy-replacement.overwrite.request.json	Adds confirmed-overwrite fixture.
policies/test-data/package-broker/requests/policy-replacement.create.request.json	Adds create intent fixture.
policies/rust/now-policy/tests/policy_samples.rs	Tests drafts and boolean matches.
policies/rust/now-policy/src/schema.rs	Adds draft-schema generation.
policies/rust/now-policy/src/policy.rs	Adds draft models and validation.
policies/rust/now-policy/schema/devolutions.now-policy.schema.json	Regenerates policy schema.
policies/rust/now-policy/README.md	Documents JSON-only drafts.
policies/rust/now-policy/CHANGELOG.md	Records model changes.
policies/rust/now-policy/Cargo.toml	Removes YAML dependency.
policies/rust/now-policy/assets/samples/corporate-allowlist.policy.yaml	Removes YAML sample.
policies/rust/now-policy-server-template/tests/support/mock.rs	Extends server mock.
policies/rust/now-policy-server-template/tests/sample_documents.rs	Tests routes and fixtures.
policies/rust/now-policy-server-template/src/server.rs	Adds management routes and mappings.
policies/rust/now-policy-server-template/README.md	Documents server endpoints.
policies/rust/now-policy-server-template/CHANGELOG.md	Records server contract changes.
policies/rust/now-policy-api/src/policy.rs	Adds draft schema reference.
policies/rust/now-policy-api/src/management.rs	Defines management contracts.
policies/rust/now-policy-api/src/lib.rs	Exports management models and markers.
policies/rust/now-policy-api/src/enums.rs	Adds management error codes.
policies/rust/now-policy-api/src/api.rs	Adds validation to errors.
policies/rust/now-policy-api/README.md	Documents management architecture.
policies/rust/now-policy-api/openapi/now-policy-api.yaml	Adds generated management OpenAPI.
policies/rust/now-policy-api/CHANGELOG.md	Records API additions.
policies/dotnet/Devolutions.Now.Policy.Model/README.md	Documents .NET draft model.
policies/dotnet/Devolutions.Now.Policy.Model/PolicyModels.cs	Adds draft conversion models.
policies/dotnet/Devolutions.Now.Policy.Model/PolicyJson.cs	Adds draft and boolean validation.
policies/dotnet/Devolutions.Now.Policy.Model/Devolutions.Now.Policy.Model.csproj	Removes YamlDotNet.
policies/dotnet/Devolutions.Now.Policy.Model.Tests/PolicyTests.cs	Tests draft conversions.
policies/dotnet/Devolutions.Now.Policy.Client/README.md	Documents client methods.
policies/dotnet/Devolutions.Now.Policy.Client/BrokerClient.cs	Implements management client APIs.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/TestData.cs	Classifies new fixtures.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/PolicyManagementClientTests.cs	Tests management client behavior.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/MetaModelTests.cs	Verifies source-generated DTOs.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/DtoRoundTripTests.cs	Adds contract round-trip tests.
policies/dotnet/Devolutions.Now.Policy.Api/README.md	Documents management DTOs.
policies/dotnet/Devolutions.Now.Policy.Api/PolicyManagementModels.cs	Defines .NET management DTOs.
policies/dotnet/Devolutions.Now.Policy.Api/MetaModels.cs	Extends structured errors.
policies/dotnet/Devolutions.Now.Policy.Api/Enums.cs	Adds strict management errors.
policies/dotnet/Devolutions.Now.Policy.Api/BrokerJson.cs	Adds management serialization contexts.
policies/dotnet/Devolutions.Now.Policy.Api/BrokerApi.cs	Adds protocol discriminators.
Cargo.lock	Removes Rust YAML dependency.

Suppressed comments (1)

policies/dotnet/Devolutions.Now.Policy.Api/BrokerJson.cs:119

• This validation does not reject null entries in PolicyValidationResult.Findings. RespectNullableAnnotations does not enforce collection-element nullability, so a successful response or error containing "Findings":[null] is accepted by the .NET client while Rust rejects it, and callers can then fail when reading a finding. Explicitly reject null finding elements here.

    private static void ValidateValidation(PolicyValidationResult validation)
    {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.