test(evaluate): pin the CLI's OPA/Rego contract

[mbevc1]

Policies passed to kosli evaluate are written by users, so a change in Rego parsing, safety checking, or the built-in surface is a breaking change for us even when our own Go code still compiles. The OPA 1.18.2 -> 1.19.0 bump in #1071 is the case in point: stricter safety checking for := invalidates a class of previously working customer policies, and nothing in the suite would have caught it.

Add the coverage that would have. These are characterisation tests split by layer: internal/evaluate owns Rego semantics, cmd/kosli proves only that diagnostics and verdicts reach the terminal.

internal/evaluate/opa_contract_test.go:

• a realistic default-deny policy end to end, with --params-driven required attestations against trail-shaped input
• the built-in surface real policies reach for (regex.match, semver.compare, time.parse_rfc3339_ns, every, some ... in, walk)
• Rego v1 as the default parser version
• the 1.19.0 := strictness change, paired with an over-strictness guard so a release that breaks correct := usage also goes red
• unsafe-var reporting, and a broken violations rule failing before any verdict is produced

cmd/kosli:

• the same boundary through evaluate input
• TestPolicyFixturesStillCompile, a corpus-wide canary over testdata/policies that checks every fixture against each future bump

Two sharp edges are pinned as characterisation, not endorsement: an undefined allow errors instead of denying, and with --params omitted data.params is undefined, so object.get(data.params, k, fallback) yields undefined rather than the fallback.

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed

[claude]

Claude finished @mbevc1's task in 2m 15s —— View job

---

Review: pin the CLI's OPA/Rego contract

• Gather context (read changed files + production Evaluate)
• Static analysis (go build ./..., go vet, go mod tidy)
• Code review
• Post summary

Static analysis

Check	Result
go build ./...	✅ clean
go vet ./internal/evaluate/... ./cmd/kosli/...	✅ clean
go mod tidy + git diff --exit-code go.mod go.sum	✅ no changes

(I couldn't execute go test in this sandbox — approval declined — but I verified the assertions against the fixtures and production code by hand; see below.)

What this PR does well

This is a genuinely thoughtful characterisation suite, and it earns its +667/-0:

• The layer split is the right call.internal/evaluate owns Rego semantics; cmd/kosli proves only that a diagnostic and a verdict reach the terminal (evaluateInput_test.go:151-203). No behavioural duplication across layers.
• //go:embed kills the drift risk. The realistic policy is a single fixture (internal/evaluate/testdata/policies/realistic-compliance.rego), embedded here and pointed at by the CLI test via relative path — a rename/delete now breaks the build rather than silently forking two copies. This resolves the earlier duplication thread cleanly.
• The 1.19.0 regression is pinned from both sides.TestOPAContract_AssignmentRHSSafetyIsStrict locks the strictness change, and TestOPAContract_SafeAssignmentFromInputStillCompiles is the over-strictness guard so a future release that breaks correct:= also goes red. That pairing is exactly what would have caught chore(deps): bump the go-dependencies group with 10 updates #1071.
• Sharp edges are pinned as characterisation, not endorsement, each with a "this is the test to invert when we fix it" note: undefined allow errors instead of denying (:271), data.params undefined without --params (:412), non-string violations silently dropped (:313).
• Security property is documented, not hidden.TestOPAContract_PolicyCanReachTheNetwork (:351) makes the http.send exfiltration surface explicit and testable — the honest way to carry a known risk until the ast.Capabilities allowlist lands.
• All four earlier review threads (embed the fixture, mirror the deliberatelyBroken skip-set, version-stamp both canary failures) are addressed by the follow-up commits.

Minor observations (non-blocking)

1. Cross-package relative path.evaluateInput_test.go:184,190 reach ../../internal/evaluate/testdata/policies/realistic-compliance.rego. It's well-justified in the comment and runs fine from the package dir, but it's the one spot that would break silently on a testdata reshuffle (the embed on the other side would still compile). The comment already flags the trade-off, so this is just noting it out loud.
2. TestOPAContract_UnsafeVarIsReportedWithFileAndLine and TestOPAContract_AssignmentRHSSafetyIsStrict both drive the same x := y shape — deliberate (one pins file:line, one pins the safety message text), just flagging the overlap so a future refactor doesn't collapse them and lose one dimension.
3. The http.send follow-up still has no home. The invert-this-assertion note at :358 is good, but without a tracked issue number it relies on a grep to be found again. Worth filing the ast.Capabilities allowlist ticket and linking it in that comment. Open a follow-up →

Nothing here blocks. This is exactly the kind of contract coverage that turns a customer-facing dependency-bump regression into a red CI run. Nice work.
• 20260803_opa_testing