feat(evaluate): let evaluate policy take --policy more than once

[pbeckham]

kosli evaluate policy now takes --policy more than once, so a policy and a shared Rego library can be sent in one command from wherever each is kept. The help now says what a bundle carries, which of its files the evaluator loads, and which rules it evaluates and prints.

Why

A policy written against a shared library had to be copied into one directory with that library before it could be evaluated, and the copy drifts from the library's own repository. Authors also had no way to learn from the CLI which of their files decide the verdict: that a README travels but is not read, that data.yaml lands under data, or that allow must be defined while every entrypoint: true rule is returned beside it.

What changed

• Every --policy joins one bundle, and each file is keyed relative to its own root, as opa eval -d one -d two reads them. Modules import each other by package, so their location does not matter, and a data file keeps the data path its own root gives it.
• Two files the evaluator loads under one name are refused, naming both roots, because keeping either would choose which policy runs. For any other file, such as a second README.md, the first --policy wins and the copy left behind is named on stderr.
• A directory no longer sends what sits in dot-directories, so a policy kept at a repository's root does not ship .git and hit the 100-file cap.
• Every other file still travels, so notes stay with the policy. The same rules are meant to govern publishing a policy bundle later.

evaluate trail --server-side still takes one --policy; its behaviour is unchanged apart from the dot-directory rule.

Verification

New tests in evaluatePolicy_test.go pin down a policy plus a library file travelling as one evaluation, per-root keys including a nested data.yaml, refusal of a loaded clash for .rego, data.yaml, data.json and *.ergo.yml, first-wins with a stderr notice for README.md and *_test.rego, the caps counted across roots, dot-directories left out, and both help paragraphs. The existing bundle and cap tests still pass unchanged apart from the fixture README's wording. main.yml runs the full integration suite on push, which covers the evaluate trail and trails suites that share the bundle code.

🤖 Generated with Claude Code

[claude]

Claude finished @pbeckham's task in 1m 1s —— View job

---

Review of commits since last pass (d7c82629..146f07f5)

• Fetch previous review comments and diff
• Check status of each previous finding
• Review new diff for regressions
• Post summary

Previous findings — both resolved in 146f07f5:

1. Repeated --policy dir --policy dir — resolved. policyRoots now compares refs via filepath.Abs and silently drops an exact repeat (TestARepeatedRootIsSentOnce covers the plain, trailing-slash, and ../ spellings).
2. Overlapping roots (--policy dir --policy dir/lib) — resolved. policyRoots now rejects one root nested inside another, in either order and for a file or directory, before anything is read: --policy %s is inside --policy %s, so its files would be sent twice (TestARootInsideAnotherIsRefused covers directory-before, directory-after, and file cases). The evaluatorLoads drift-coverage nit is also addressed with the new table-driven TestEvaluatorLoads.

New diff review: Only evaluateHelpers.go (+54) and evaluatePolicy_test.go (+61) changed. Walked through policyRoots/isWithin against the new tests — dedup and nesting checks are symmetric, use the already-imported path/filepath/strings packages (no new import issues), and error messages reference the original --policy spelling rather than the resolved absolute path, which is correct for user-facing output. No bugs or regressions found in the new code.

Note: I wasn't able to run go build/go test in this sandboxed session (command approval unavailable here), so this is a manual code review rather than a verified test run — the existing test suite (TestARepeatedRootIsSentOnce, TestARootInsideAnotherIsRefused, TestEvaluatorLoads) looks correct by inspection but wasn't executed.

No new inline comments — all touched findings resolved, nothing new flagged.

[pbeckham]

On issue 1 of the review summary: the policyBundleKey comment is corrected in 146f07f. A single file that the evaluator would not load is still accepted on purpose. Under the bundle rule, --policy ctrl.rego --policy README.md is how a note travels with a policy. A bundle with no module is not a silent no-op either, because the evaluator fails it with "the bundle holds no policy module".