Appendix: Policy and Ignore Rules

Repository policy and ignore rules#

This page documents the two repository-root text files that control admission requirements and filesystem visibility. They solve different problems: .ait/policy.yaml decides which evidence is required; .aitignore decides which workspace paths AIT sees.

.ait/policy.yaml#

ait init creates this file with owner-only permissions. Its policy_id must match .ait/config.json.policy_profile. RC.8 supports the policy IDs prototype, team, and release.

version: 1
policy_id: prototype
defaults:
  require_attestation: true
  require_tests: true
  require_lint: false
  require_security_scan: false
  require_license_scan: false
  require_ai_provenance: false
  require_code_review_summary: false
class_overrides:
  - when:
      content_class: docs_only
    set:
      require_tests: false
      require_lint: false
      require_security_scan: false
      require_license_scan: false

Root and requirement fields#

Every requirement value is an exact YAML boolean:

The same seven names are accepted under an override's set map. defaults must contain all seven; set is partial and changes only the fields it names.

Override selectors#

Each class_overrides[] entry requires a nonempty when map and a nonempty set map. when accepts either or both selectors:

Overrides are evaluated in file order. Keep conditions explicit and avoid overlapping entries whose result depends on ordering.

Generated profile baselines#

All three generated profiles require attestation and tests and leave AI provenance and code-review-summary requirements off. Their other defaults are:

The generated documentation-only override turns tests, lint, security scan, and license scan off. Changing a generated policy is an admission-policy change; review it together with the matching profile setting.

YAML acceptance rules#

• Use spaces, never tabs, with two-space indentation steps.
• Use exact lowercase true and false values.
• Duplicate and unknown fields fail validation.
• Keep version, policy_id, defaults, and any override map at the exact nesting shown above.
• A first remote registration in RC.8 admits the exact prototype baseline and its complete documentation-only override. Select that profile before registering a new Repository. Locally configured team and release profiles remain valid policy files for their supported local use.

.aitignore#

.aitignore is a line-oriented repository visibility contract. It applies to workspace inspection and to the files considered by status, Snapshot, and Plan filesystem discovery. It augments AIT's built-in exclusions; it does not replace them.

# Generated outputs
dist/
*.tmp

# Keep one fixture visible
!fixtures/expected.tmp

# Literal leading markers
\#notes.txt
\!important.txt

Rule syntax#

Rules are evaluated from top to bottom and the last matching rule wins. Other regular-expression characters are treated literally; character-class syntax is not part of the RC.8 matcher. .aitignore itself remains visible so its effect can be captured and reviewed.

An ignore rule changes visibility, not ownership or deletion. It does not erase an existing Snapshot, authorize secret storage, or make a generated directory safe to commit.

Verification#

After changing either file, use read-only inspection before normal work:

ait config show --json
ait status
ait diff

For remote registration, run the actual ait remote add command only after the policy and Patchset CI catalog are ready; its validation is authoritative.

Related references#

• Configuration-file map
• Repository and worktree configuration
• Patchset CI configuration