[shiju-nv]

Summary

Add openshell policy lint <file> to validate authored policies without a gateway. After parsing, it reports file-only semantic violations together and identifies deferred live checks.

Related Issue

Closes #4035

Changes

• Reuse shared safety, authoring, ambiguity and built-in middleware validation.
• Dispatch lint before gateway selection and authentication.
• Cover offline operation, multiple violations and gateway rejection parity.

Release Notes

openshell policy lint policy.yaml validates authored files offline. Success does not establish that a sandbox can start.

Testing

• Checks appropriate to the affected code pass: two policy unit functions, the CLI integration table, two in-process gateway functions and production Clippy with -D warnings.
• Unit and integration coverage added. The real Codex review policy also passed offline lint with an unreachable gateway.
• E2E tests added/updated (not applicable; no full E2E run).

Checklist

• Follows Conventional Commits.
• Commit signed and signed off for DCO.
• Architecture docs updated (not applicable; command guide and policy/CLI skills updated).

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

CreateSandbox size rejections after MCP defaulting previously included BadRequest(spec.policy) and ErrorInfo(INVALID_ARGUMENT), but now return bare INVALID_ARGUMENT.

• Impact: SDK consumers handling policies that cross 262,144 bytes during MCP defaulting lose the structured field and reason needed for automated error handling.
• Action: For v0.1.8, preserve BadRequest(spec.policy) and ErrorInfo(INVALID_ARGUMENT) by retaining the existing gateway size-check path or returning the equivalent structured error.
• PR: feat(policy): lint authored policy files offline #5358

Review details

• Execution: complete
• Candidate: PR #5358 (4afdab630a7d3dfc4c2176bf892815e453513935)
• Baseline: af8182f7b63da6dd8bbea8b3c313227764ee0dea (af8182f7b63da6dd8bbea8b3c313227764ee0dea)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run