Policy + Exceptions Gateway Contract (draft v0.1)

This contract exposes Stella Ops policy evaluation results that include exception metadata, plus simulation endpoints that accept exception overrides for what-if analysis. It is the integration surface for Console views that show effective verdicts and let operators preview how an exception would change them.

Security / headers

• Authorization: Bearer <token> (or DPoP where configured).
• X-StellaOps-TenantId: <tenantId> (required; see tenant-auth).
• X-StellaOps-Project: <projectId> (optional; legacy alias X-Stella-Project is accepted only when the gateway is started with EnableLegacyHeaders=true).
• X-StellaOps-TraceId: <traceId> (optional; clients SHOULD send one).
• Scopes:
  • POST /policy/effective: policy:read AND exceptions:read.
  • POST /policy/simulate: policy:simulate AND exceptions:read.

Endpoints

• POST /policy/effective — deterministic effective policy view over a list of findings.
• POST /policy/simulate — simulate policy result changes with exception overrides.

Request/response notes

• Requests MUST remain deterministic: stable ordering and ISO-8601 UTC timestamps only.
• Pagination uses limit (max 200) and continuationToken (opaque string).
• Exception metadata SHOULD reuse the Exception schema, but MAY omit large fields such as audit trails.

Samples

• samples/policy-effective-sample.json
• samples/policy-simulate-sample.json