feat(test): write down the safety invariants and test them as invariants

[mkoushni]

Summary

• Write the fail-closed promise down as testable claims in docs/safety-invariants.md (linked from CONTRIBUTING) and drive them with a reusable fault-injection plugin and PDP resolver.
• Contain panics in serial, transform, and audit the same way concurrent already did: route through on_error instead of unwinding execute(). Halt vs continue still follows can_block; that difference is documented with a reason.
• Containment costs a payload clone per plugin per hook (clone_boxed into tokio::spawn). Audit used to take &payload and spawn nothing; it is no longer free. The spawn also carries the timeout and abort-on-drop cancellation, so this is a trade rather than a regression. If the clone matters for CMF payloads, catch_unwind over AssertUnwindSafe would contain panics without the clone or the spawn, at the cost of losing timeout and cancellation on those phases — measure before changing.
• Table-driven catalog: every plugin phase × {panic, error, timeout} under on_error: fail, plus ignore/disable for serial, transform, and audit. A sequential panic under ignore still runs later audit; under fail it does not.
• Malformed config covers unknown key, misspelled top-level block, and unparseable YAML. Omitted on_error in YAML is Fail. Missing subject.id pins the differential allowlist row (Cedar dispatch error, CEL eval error, OPA default deny). Malformed policy pins Cedar dispatch / CEL compile / OPA compile-or-dispatch.
• PDP {panic, error, timeout} cells drive the evaluator wrapper (FaultPdp), not the Cedar/CEL/OPA resolvers themselves. Real dialects are covered for missing attribute and malformed policy. A new phase or shipped dialect fails the build until a cell is added.
• ppe-apl-core requires a Tokio runtime: tokio::spawn panics outside one, so a host driving the evaluator on a non-Tokio executor unwinds out of evaluate_effects on every Effect::Pdp instead of failing closed.

Closes #24

Test plan

• cargo test -p praxis-policy-core --test safety_invariants
• cargo test -p praxis-policy-apl-core --test safety_invariants
• cargo test -p praxis-policy-pdp-diff safety

[praxis-bot]

Review: feat(test): write down the safety invariants and test them as invariants

Strong work. The containment model is sound: serial, transform, and audit panics now route through on_error the same way concurrent already did. The catalog approach -- exhaustive matches that fail the build when a phase or dialect is added -- is exactly the right mechanism for these invariants. The fault-injection infrastructure is well-factored and the test matrix is thorough.

Two findings, both medium.

Severity	File	Finding
Medium	executor.rs	ContainedOutcome::Lost non-blocking paths skip OnError::Disable
Medium	plugin.rs	is_dispatch_phase takes self by value; all other PluginMode methods take &self

[praxis-bot]

PR Review

Both previous findings (Lost/Disable gap and is_dispatch_phase receiver) are addressed. One new finding.

Severity	File	Finding
Medium	evaluator.rs	evaluate_pdp_contained leaks spawned tasks on timeout

[araujof]

Thanks for this PR!

A few findings and suggestions to address before merging:

• make publish-dry fails because ppe-core uses a versioned workspace self-dependency. Use the same path-only self-dependency already used by ppe-apl-core.

• A transform panic can let the original, unredacted payload continue through the pipeline. Either stop processing when on_error is Fail, or document and test this behavior explicitly.

• The spawned plugin and PDP tasks outlive a dropped request. Give both join handles abort-on-drop ownership so timeout, disconnect, and shutdown cancel the work.

• A contained serial or transform panic removes the plugin's existing local_state. Preserve and restore the previous state when the task returns no context.

• InjectedFailure::all() omits WrongType, so the matrix never checks it. Add it and correct the audit expectation, since audit results are intentionally discarded.

[mkoushni]

make publish-dry — ppe-core now uses a path-only self-dev-dependency, same as ppe-apl-core. cargo package -p praxis-policy-core succeeds.

Transform panic + original payload — Transform still cannot halt (on_error: fail is not an enforcement point). That is documented: the original unredacted payload continues, payload_modified stays false, and the failure is recorded. Pinned by a_transform_fail_panic_keeps_the_original_payload.

Abort-on-drop — Contained plugin tasks use AbortOnDropHandle; PDP tasks abort if the request future is dropped, so timeout/disconnect/shutdown cancel the work.

local_state — Serial/transform snapshot context into the task instead of taking it. A contained panic leaves the previous map in the table. Pinned by a_contained_serial_panic_keeps_prior_local_state.

WrongType — InjectedFailure::all() includes it. Audit discards results, so Audit × WrongType is Allow, not a recorded error.

[terylt]

Nice work! My review uncovered three small items.

1. Say what the containment costs

crates/ppe-core/src/executor.rs, run_serial_phase and run_ref_phase

Every entry now does payload.clone_boxed() plus a task spawn. Audit used to take
&payload and spawn nothing, so a hook with N sequential + M transform + K audit
plugins went from zero clones to N+M+K per request.

The spawn is load-bearing, since it carries the timeout and the abort-on-drop
cancellation as well as the panic containment, so this is a trade rather than a
regression. But the trade is currently unstated. Add a line to the PR body and to
the module comment saying containment costs a payload clone per plugin per hook,
and that audit is no longer free.

If the clone turns out to matter for CMF payloads, catch_unwind over
AssertUnwindSafe contains panics without the clone or the spawn, at the cost of
losing the timeout and cancellation on those phases. Worth measuring before
changing anything.

2. Fix or drop the coverage test

crates/ppe-core/tests/safety_invariants.rs, plugin_fault_catalog_covers_every_dispatch_mode

dispatch_modes() is all_plugin_modes().filter(PluginMode::is_dispatch_phase),
so asserting modes.contains(&mode) == mode.is_dispatch_phase() restates the
filter and cannot fail. The exhaustive match in all_plugin_modes() is what
actually guards I12, and it does so at compile time.

Either delete the test and point the I12 doc line at the exhaustive match, or
replace it with something the filter does not already guarantee, for example that
every mode in dispatch_modes() has a non-Allow cell for at least one injected
failure.

3. Document the Tokio requirement

crates/ppe-apl-core

tokio moved from a dev-dependency to a dependency, which is the right call and
is already explained in Cargo.toml. The gap is the failure shape: tokio::spawn
panics outside a runtime, so a host driving the evaluator on a non-Tokio executor
unwinds out of evaluate_effects on every Effect::Pdp instead of failing
closed. One line in the crate-level docs saying a Tokio runtime is required.

[mkoushni]

1. Containment cost — The executor module comment now says containment costs a payload clone per plugin per hook, and that audit is no longer free. The spawn is load-bearing for timeout and abort-on-drop. run_ref_phase and invoke_contained say the same. The PR body records the trade and the catch_unwind alternative (measure before changing).

2. I12 test — Replaced the vacuous modes.contains == is_dispatch_phase() check with plugin_fault_catalog_every_dispatch_mode_has_a_non_allow_cell: every dispatched mode has at least one injected failure that is not Allow. I12 now points at the exhaustive match as the compile-time guard.

3. Tokio requirement — Crate-level docs on ppe-apl-core state that a Tokio runtime is required: tokio::spawn panics outside one, so a host without a runtime unwinds out of evaluate_effects on every Effect::Pdp instead of failing closed.

[terylt]

LGTM