package ada.pemlaam

deny[msg] {
  input.payload.contains_raw_secret == true
  msg := "raw secret material is FULL_FORBIDDEN for PEMLAAM"
}

deny[msg] {
  input.secret.class != ""
  input.destination == "PEMLAAM"
  input.mode == "FULL"
  msg := "PEMLAAM may receive metadata/proof only — AV-S20 block"
}

package ada.image

deny[msg] {
  input.image.role == "vault-auth"
  input.sbom.exists != true
  msg := "vault/auth image requires SBOM before admission"
}

deny[msg] {
  input.image.role == "vault-auth"
  input.vulns.critical > 0
  not input.waiver.valid
  msg := "critical CVEs block vault/auth image — AV-S13"
}

package ada.secret_api

deny[msg] {
  input.endpoint.class == "secret-api"
  not input.rate_limit.enabled
  msg := "secret API requires rate limiting — AV-S17"
}

deny[msg] {
  input.endpoint.class == "secret-api"
  not input.gid_bound
  msg := "secret API access must bind to GID — no anonymous access"
}

package ada.secretfact

deny[msg] {
  input.secretFact.value_present == true
  msg := "SecretFact must not contain raw value — AV-S20"
}

deny[msg] {
  input.secretFact.rotation_state == "revoked"
  input.secretFact.active_pointer == true
  msg := "revoked secret cannot retain active pointer — AV-S21"
}

deny[msg] {
  input.action == "restore"
  input.target.state == "fossil"
  not input.gates.kay_approved
  msg := "fossil resurrection requires all gates + new rotation ceremony — AV-S22"
}