Policy framework (ADR 005)

[ashleythedeveloper]

What

Build the runtime Policy framework that ADR 005 ("Doctrine and Policy Separation") specifies. Policies are adoptable strategic choices, distinct from doctrine, which is universal and CI-enforced. The framework lets a solution declare which Policies it adopts and evaluates them at runtime with auditable evidence.

Why

ADR 005 distinguishes doctrine (universal axioms, CI-enforced) from policy (adoptable strategic choices). Doctrine is already enforced via test_*.py files in core/doctrine/. Policy has no runtime mechanism — it is currently a written ADR with no enforcement. This Epic closes that gap.

Scope (in)

• Runtime Policy framework: define, register, evaluate, audit (Build the policy framework (ADR 005) #100).
• Composability of multiple Policies on a single use case.
• Auditable evidence for each Policy evaluation.
• Documentation of the Policy authoring contract.

Scope (out)

• Specific policies. Those live in solutions or contrib modules. The anti-sycophancy demo policies are tracked under Epic G.

Decomposition

Walking skeleton: a single Policy is defined, applied at runtime to a use case, and produces accept/reject with evidence.

Likely splits into walking skeleton, composability, audit evidence, docs. Deferred until pick-up.