Verify a policy locally

The Policy creator downloads a self-contained Bash script that writes the policy artifacts and runs defenseclaw policy activate <name>. Verify that script in a throwaway home before running it against a shared installation.

You need both DefenseClaw binaries. defenseclaw policy test also requires the opa binary on PATH; policy validate can use the same installation to compile the generated Rego.

1. Inspect and isolate

Save the downloaded script path before changing HOME, then create an isolated user home and DefenseClaw data directory:

INSTALL_SCRIPT="$HOME/Downloads/install-my-policy.sh"
REAL_HOME="$HOME"
REAL_DEFENSECLAW_HOME="${DEFENSECLAW_HOME:-$HOME/.defenseclaw}"
VERIFY_HOME="$(mktemp -d "${TMPDIR:-/tmp}/defenseclaw-policy-verify.XXXXXX")"

export HOME="$VERIFY_HOME"
export DEFENSECLAW_HOME="$VERIFY_HOME/.defenseclaw"

sed -n '1,240p' "$INSTALL_SCRIPT"

The generated script honors DEFENSECLAW_HOME and falls back to $HOME/.defenseclaw. Keeping both variables inside VERIFY_HOME also isolates connector files such as .codex/config.toml.

2. Initialize the throwaway installation

Create only the local configuration needed by the policy commands. This skips scanner installation, gateway startup, and readiness probes; the Codex hook it writes also stays under the temporary HOME.

defenseclaw init \
  --non-interactive \
  --yes \
  --connector codex \
  --skip-install \
  --no-start-gateway \
  --no-verify

3. Run and inspect the generated script

bash -n "$INSTALL_SCRIPT"        # syntax check; does not execute the script
bash "$INSTALL_SCRIPT"           # writes and activates the policy in the sandbox

defenseclaw policy list
defenseclaw policy show my-policy

Replace my-policy with the policy name shown by the creator. The second command reports the resolved severity actions, guardrail thresholds, firewall, and other fields that activation loaded.

4. Validate and test the active Rego

policy validate checks the generated data.json shape and compiles the Rego. policy test runs any Rego unit tests in the same directory.

defenseclaw policy validate \
  --rego-dir "$DEFENSECLAW_HOME/policies/rego"

defenseclaw policy test \
  --rego-dir "$DEFENSECLAW_HOME/policies/rego" \
  --verbose

An opa binary not found error from policy test means the optional OPA CLI is missing; it does not mean the generated YAML failed to activate.

5. Dry-run an admission decision

Admission evaluation belongs to the Go sidecar binary. It reads the isolated config and policy because DEFENSECLAW_HOME is still set:

defenseclaw-gateway policy evaluate \
  --target-type skill \
  --target-name test-skill \
  --severity HIGH \
  --findings 3

Compare the JSON decision with the HIGH action configured in the creator. Change --severity, --findings, or --target-type to exercise other cases. This command evaluates locally; it does not require the gateway daemon to be running.

6. Confirm the audit record

Policy activation is written to the isolated audit database. Export it with the gateway binary and select the activation event:

defenseclaw-gateway audit export --limit 20 --output - \
  | jq 'select(.action == "policy-activate")'

7. Promote or clean up

Run the already-reviewed script with the real home values to install it for the operator, or delete only the temporary directory:

HOME="$REAL_HOME" DEFENSECLAW_HOME="$REAL_DEFENSECLAW_HOME" \
  bash "$INSTALL_SCRIPT"

rm -rf -- "$VERIFY_HOME"

Omit the promotion command when this was only a CI check. Never point VERIFY_HOME or DEFENSECLAW_HOME at /, a shared home, or an existing DefenseClaw data directory.

Troubleshooting

• policy activate cannot find the policy — confirm the generated script and the CLI see the same DEFENSECLAW_HOME.
• policy validate cannot find data.json — activation did not complete, or --rego-dir does not point at $DEFENSECLAW_HOME/policies/rego.
• The dry run differs from the creator preview — compare defenseclaw policy show my-policy with the creator's review pane, then test the exact severity and target type used by the preview.