security: contracts + tests for all 5 security modules (87→123 checks)

org/security-policy.org

@@ -11,8 +11,26 @@ This is the "Radical Transparency" invariant in practice. The agent must explain
 
 The Policy skill is intentionally simple. It has one job: ensure every action has a meaningful explanation. Other security concerns (secret scanning, path blocking, network exfiltration) are handled by the Bouncer. The Policy is about values, not threats.
 
+** Contract
+
+1. (policy-compliance-check action context): if ~action~ has an
+   ~:explanation~ string longer than 10 characters, returns the action
+   unchanged. Otherwise, returns a ~:LOG~ rejection plist with
+   ~:level :warn~.
+
+** Boundaries
+
+- Does NOT check for dangerous content — the Bouncer does that.
+- Does NOT validate explanation quality — only length and presence.
+- Does NOT consider ~context~ — implementation ignores it currently.
+
 * Implementation
 
+** Package Context
+#+begin_src lisp
+(in-package :passepartout)
+#+end_src
+
 ** Policy Logic (policy-compliance-check)
 ;; REPL-VERIFIED: 2026-05-03T13:00:00
 #+begin_src lisp
@@ -37,3 +55,38 @@ The Policy skill is intentionally simple. It has one job: ensure every action ha
   :trigger (lambda (ctx) (declare (ignore ctx)) t)
   :deterministic #'policy-compliance-check)
 #+end_src
+
+* Test Suite
+
+#+begin_src lisp
+(eval-when (:compile-toplevel :load-toplevel :execute)
+  (ql:quickload :fiveam :silent t))
+
+(defpackage :passepartout-security-policy-tests
+  (:use :cl :fiveam :passepartout)
+  (:export #:policy-suite))
+
+(in-package :passepartout-security-policy-tests)
+
+(def-suite policy-suite :description "Verification of the Constitutional Policy Layer")
+(in-suite policy-suite)
+
+(test test-policy-passes-valid-explanation
+  "Contract 1: action with sufficient explanation passes through unchanged."
+  (let* ((action '(:type :REQUEST :payload (:action :read :explanation "The user asked me to read the TODO list for today.")))
+         (result (policy-compliance-check action nil)))
+    (is (equal action result))))
+
+(test test-policy-rejects-short-explanation
+  "Contract 1: action with explanation ≤10 characters is rejected with :LOG."
+  (let* ((action '(:type :REQUEST :payload (:action :read :explanation "hi")))
+         (result (policy-compliance-check action nil)))
+    (is (eq :LOG (getf result :type)))
+    (is (search "blocked" (getf (getf result :payload) :text) :test #'char-equal))))
+
+(test test-policy-rejects-missing-explanation
+  "Contract 1: action without :explanation is rejected."
+  (let* ((action '(:type :REQUEST :payload (:action :read)))
+         (result (policy-compliance-check action nil)))
+    (is (eq :LOG (getf result :type)))))
+#+end_src