Skip to main content

Component: DAG Compiler

What it is: a policy compiler that composes every reconciled manifest touching a scope into a versioned scope → capability graph.

What it does: rejects delegation cycles outright, then computes the transitive closure per scope — effective hop budget (the minimum along each path), unioned data classes, and any unresolved downstream reference — and persists the result as an immutable, pinned compiled policy.

Why a cycle is the one thing that rolls everything back: every other reconciliation outcome (rejected, needs-review, reconciled) is committed as append-only history — even a rejection is evidence of what was tried. A delegation cycle is different: a cyclic manifest set is not a valid policy in any form, so compiling one must leave no trace, not a partially-compiled policy a later read could stumble on.