Skip to content

shared-policy — Shared policy across repositories and workers

A policy can be shared across repositories and workers, with local override remaining explicit and drift from the shared source detectable in one command.

BLOCKED 0 of 5 issues done

ready
0
blocked
5
active
0
verify
0
done
0
cancelled
0

Problem

Policy is per repository. An organisation running many repositories has no way to state a rule once, and no way to see where it is not being followed.

Outcome

A policy can be shared across repositories and workers, with local override remaining explicit and drift from the shared source detectable in one command.

Current state

Not started. Everything the tool does today is scoped to a single checkout.

Desired state

One policy statement governs many repositories, and every deviation from it is visible rather than assumed.

Scope

  • bin
  • lib
  • share
  • test/cases
  • docs
  • site/data/generated

Out of scope

  • A hosted service, a registry, or any component that must be running for the tool to work

Acceptance criteria

  • A shared policy can be consumed by more than one repository without copying it
  • A local override is explicit and survives an update of the shared source
  • Drift between the shared policy and a repository's effective policy is reported by one command

Validation

  • bash test/run.sh

Evidence required

  • suite

Risks

  • Shared policy is where a local tool becomes a distributed one; the offline guarantee has to survive it.

Issues

Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.

issuestatuswavedepends ontitle
I0601 BLOCKED 0 — Let a policy name a shared source it does not copy
I0602 BLOCKED 1 I0601 Make a local override explicit and prove it survives an update of the shared source
I0603 BLOCKED 2 I0602 Report drift from the shared policy in one command
I0604 BLOCKED 3 I0603 Prove the offline guarantee survives sharing
I0605 BLOCKED 4 I0604 Publish the shared-policy claim and what sharing still cannot do

The graph

shared-policy dependency graphfrom .ai/repo/project
flowchart LR
    I0601["I0601<br/>Let a policy name a shared source it does not copy"]:::blocked
    I0602["I0602<br/>Make a local override explicit and prove it survives an update of the shared source"]:::blocked
    I0603["I0603<br/>Report drift from the shared policy in one command"]:::blocked
    I0604["I0604<br/>Prove the offline guarantee survives sharing"]:::blocked
    I0605["I0605<br/>Publish the shared-policy claim and what sharing still cannot do"]:::blocked
    I0601 --> I0602
    I0602 --> I0603
    I0603 --> I0604
    I0604 --> I0605
    classDef done stroke:#16a34a,fill:#052e16,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,stroke-width:2px

Canonical record: .ai/repo/project/milestones/shared-policy.yaml. Read it back with majordomus plan show shared-policy.