Add active package policy inspection contract

[Benoît Cortier (CBenoit)]

Summary

• add the feature-gated GET /v1/policy Rust DTO, server-template trait/route/mock, and structured unsupported/failure behavior
• embed the existing canonical PolicyDocument, namespace its OpenAPI-only component schemas to preserve existing component names, and add a shared cross-language response fixture
• add source-generated C# PolicyResponse support and BrokerClient.GetPolicy(CancellationToken) with strict successful-response validation and legacy/structured 404 continuity
• require policy-compat for OpenAPI generation and exercise all-feature policy crates in repository CI
• update Rust/.NET package documentation

Coordinated integration

• Gateway: Devolutions/devolutions-gateway#1937 — draft and publication-blocked
• UniGetUI: Devolutions/UniGetUI#5292 — draft and publication-blocked

Release note

Adds a read-only, versioned active-policy inspection API and .NET client method. GET /v1/policy returns PolicyResponse version 1.0; 404 means inspection is unsupported, while supported brokers return structured non-404 errors when an active policy cannot be supplied.

Expected Rust release-plz bumps: now-policy-api 0.4.0 and now-policy-server-template 0.4.0. The policy model is unchanged. NuGet Model/API/Client artifacts were smoke-tested together at normalized version 0.4.0.

Validation

• cargo xtask ci -v with .NET major roll-forward: 137 Rust tests and 558 .NET tests passed; formatting, Clippy, builds, lock checks, and typos passed
• OpenAPI regeneration is byte-for-byte stable
• fresh local-feed NuGet consumer restore and BrokerClient.GetPolicy execution passed, including rejection of missing, null, unknown, numeric-enum, and noncanonical-case successful response values
• permissive structured non-2xx ErrorResponse compatibility remains covered
• locked Rust path consumer passed
• now-policy-api crate package verification passed; server-template package was built with --no-verify because its matching API crate is intentionally unpublished, then compiled/executed through the path consumer
• independent code review findings for complete required/null parity, collection elements, public serializer options, strict successful responses, canonical enum casing, and structured error documentation are addressed

[Copilot]

Pull request overview

Adds a feature-gated active-policy inspection contract across Rust, OpenAPI, and .NET.

Changes:

• Adds GET /v1/policy, DTOs, routing, mocks, and structured errors.
• Adds .NET serialization and client support.
• Adds shared fixtures, tests, CI coverage, and documentation.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
xtask/src/rust.rs	Tests and lints policy features.
policies/rust/now-policy-server-template/tests/sample_documents.rs	Tests policy fixtures and routing.
policies/rust/now-policy-server-template/src/server.rs	Implements route and OpenAPI schema registration.
policies/rust/now-policy-server-template/src/mock.rs	Adds configurable policy responses.
policies/rust/now-policy-server-template/README.md	Documents policy endpoint support.
policies/rust/now-policy-server-template/Cargo.toml	Requires policy feature for generation.
policies/rust/now-policy-server-template/assets/samples/responses/policy.response.json	Adds shared response fixture.
policies/rust/now-policy-api/src/policy.rs	Defines Rust policy response DTO.
policies/rust/now-policy-api/src/lib.rs	Exports policy contract types.
policies/rust/now-policy-api/README.md	Documents the Rust DTO.
policies/rust/now-policy-api/openapi/now-policy-api.yaml	Publishes endpoint and schemas.
policies/dotnet/Devolutions.Now.Policy.Client/README.md	Documents client behavior.
policies/dotnet/Devolutions.Now.Policy.Client/BrokerClient.cs	Adds GetPolicy.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/TestData.cs	Discovers policy fixtures.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/SchemaValidationTests.cs	Validates policy schemas.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/MetaModelTests.cs	Tests response discriminator validation.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/DtoRoundTripTests.cs	Tests DTO round trips.
policies/dotnet/Devolutions.Now.Policy.Client.Tests/BrokerClientTests.cs	Tests requests, errors, and cancellation.
policies/dotnet/Devolutions.Now.Policy.Api/ResponseModels.cs	Defines .NET policy response DTO.
policies/dotnet/Devolutions.Now.Policy.Api/README.md	Documents active-policy DTOs.
policies/dotnet/Devolutions.Now.Policy.Api/BrokerJson.cs	Adds source-generated serialization.
policies/dotnet/Devolutions.Now.Policy.Api/BrokerApi.cs	Adds policy response discriminator.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated no new comments.

Suppressed comments (2)

policies/dotnet/Devolutions.Now.Policy.Client/README.md:48

• The method returns PolicyResponse, not PolicyDocument; the policy document is its Policy property. Describing the wrapper accurately prevents callers from expecting the wrong public return type.

- `GetPolicy` sends `GET /v1/policy` and returns the active parsed `PolicyDocument` after strict source-generated validation of the successful response.

policies/dotnet/Devolutions.Now.Policy.Api/BrokerJson.cs:124

• RespectNullableAnnotations does not validate nullability of collection elements. GetPolicy therefore still accepts contract-invalid payloads such as "Rules":[null] or "Sources":[null], placing nulls into non-nullable lists even though Rust and the OpenAPI schema reject them; consumers can then hit null-reference failures. Add element-level converters or post-deserialization validation (with coverage) before returning PolicyResponse.

    RespectNullableAnnotations = true,