Add aggregate semantics to Policy Compiler

conformance/testdata/aggregate/config.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate"
+variables:
+  - name: "resource"
+    type_name: "map"
+    params:
+      - type_name: "string"
+      - type_name: "dyn"

conformance/testdata/aggregate/policy.yaml

@@ -0,0 +1,26 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate
+rule:
+  aggregate:
+    - condition: "resource.is_pii == true"
+      emit: "'PII'"
+    - condition: "resource.is_confidential == true"
+      emit: "'CONFIDENTIAL'"
+    - condition: "true"
+      rule:
+        match:
+          - condition: "resource.nested_cond == true"
+            output: "'NESTED'"

conformance/testdata/aggregate/tests.yaml

@@ -0,0 +1,42 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Aggregate semantic conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_match_nested_triggered"
+        input:
+          resource:
+            expr: "{'is_pii': true, 'is_confidential': true, 'nested_cond': true}"
+        output:
+          expr: "['PII', 'CONFIDENTIAL', 'NESTED']"
+      - name: "all_match_nested_fallback"
+        input:
+          resource:
+            expr: "{'is_pii': true, 'is_confidential': true, 'nested_cond': false}"
+        output:
+          expr: "['PII', 'CONFIDENTIAL']"
+      - name: "some_match"
+        input:
+          resource:
+            expr: "{'is_pii': true, 'is_confidential': false, 'nested_cond': false}"
+        output:
+          expr: "['PII']"
+      - name: "none_match"
+        input:
+          resource:
+            expr: "{'is_pii': false, 'is_confidential': false, 'nested_cond': false}"
+        output:
+          expr: "[]"

conformance/testdata/aggregate_explicit_list_output/policy.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_explicit_list_output
+rule:
+  aggregate:
+    - condition: "true"
+      emit: "['tag1', 'tag2']"

conformance/testdata/aggregate_explicit_list_output/tests.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Explicit list output conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_match"
+        input: {}
+        output:
+          expr: "[['tag1', 'tag2']]"

conformance/testdata/aggregate_explicit_optional_none/policy.yaml

@@ -0,0 +1,19 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_explicit_optional_none
+rule:
+  aggregate:
+    - condition: "true"
+      emit: "optional.none()"

conformance/testdata/aggregate_explicit_optional_none/tests.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Explicit optional none conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_match"
+        input: {}
+        output:
+          expr: "[optional.none()]"

conformance/testdata/aggregate_nested_explicit_list_double_wrapping/policy.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: aggregate_nested_explicit_list_double_wrapping
+rule:
+  aggregate:
+    - rule:
+        match:
+          - condition: "true"
+            output: "['tag1', 'tag2']"

conformance/testdata/aggregate_nested_explicit_list_double_wrapping/tests.yaml

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_nested_explicit_list_double_wrapping"
+description: "Tests that aggregate policies cleanly support double-wrapped lists when a nested first_match rule returns an explicit list literal"
+sections:
+- name: "compile"
+  tests:
+  - name: "nested_explicit_list"
+    output:
+      value: [["tag1", "tag2"]]

conformance/testdata/aggregate_nested_mixed_semantics/config.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_nested_mixed_semantics"
+variables:
+  - name: "resource"
+    type_name: "map"
+    params:
+      - type_name: "string"
+      - type_name: "dyn"

conformance/testdata/aggregate_nested_mixed_semantics/policy.yaml

@@ -0,0 +1,39 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: document_classification
+rule:
+  aggregate:
+    # PRIVACY CLASSIFICATION BLOCK
+    - condition: "resource.is_privacy_related == true"
+      rule:
+        match:
+          - condition: "resource.is_eu_origin == true"
+            rule:
+              aggregate: # In the EU, we must accumulate ALL applicable sub-tags
+                - condition: "resource.has_pii == true"
+                  rule:
+                    match:
+                      - condition: "resource.has_health_data == true"
+                        output: "'GDPR_SENSITIVE_HEALTH'"
+                      - condition: "resource.has_standard_pii == true"
+                        output: "'GDPR_STANDARD'"
+                - condition: "resource.is_b2c == true"
+                  emit: "'EU_B2C_NOTICE_REQUIRED'"
+          - condition: "resource.is_us_origin == true"
+            output: "'CCPA_APPLIES'"
+
+    # FINANCIAL RETENTION BLOCK
+    - condition: "resource.is_financial_record == true"
+      emit: "'RETAIN_7_YEARS'"

conformance/testdata/aggregate_nested_mixed_semantics/tests.yaml

@@ -0,0 +1,77 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+description: Deeply nested document classification conformance tests
+section:
+  - name: "basic"
+    tests:
+      - name: "all_true"
+        input:
+          resource:
+            expr: >
+              {
+                'is_privacy_related': true, 'is_eu_origin': true, 'has_pii': true,
+                'has_health_data': true, 'has_standard_pii': true, 'is_b2c': true,
+                'is_us_origin': true, 'is_financial_record': true
+              }
+        output:
+          expr: "['GDPR_SENSITIVE_HEALTH', 'EU_B2C_NOTICE_REQUIRED', 'RETAIN_7_YEARS']"
+
+      - name: "fallback_in_nested_first_match"
+        input:
+          resource:
+            expr: >
+              {
+                'is_privacy_related': true, 'is_eu_origin': true, 'has_pii': true,
+                'has_health_data': false, 'has_standard_pii': true, 'is_b2c': true,
+                'is_us_origin': true, 'is_financial_record': true
+              }
+        output:
+          expr: "['GDPR_STANDARD', 'EU_B2C_NOTICE_REQUIRED', 'RETAIN_7_YEARS']"
+
+      - name: "propagation_all_fail_to_empty"
+        input:
+          resource:
+            expr: >
+              {
+                'is_privacy_related': true, 'is_eu_origin': true, 'has_pii': true,
+                'has_health_data': false, 'has_standard_pii': false, 'is_b2c': false,
+                'is_us_origin': false, 'is_financial_record': false
+              }
+        output:
+          expr: "[]"
+
+      - name: "propagation_nested_fail_with_outer_fallback"
+        input:
+          resource:
+            expr: >
+              {
+                'is_privacy_related': true, 'is_eu_origin': true, 'has_pii': true,
+                'has_health_data': false, 'has_standard_pii': false, 'is_b2c': false,
+                'is_us_origin': false, 'is_financial_record': true
+              }
+        output:
+          expr: "['RETAIN_7_YEARS']"
+
+      - name: "failed_nested_first_match_all_fail"
+        input:
+          resource:
+            expr: >
+              {
+                'is_privacy_related': true, 'is_eu_origin': true, 'has_pii': true,
+                'has_health_data': false, 'has_standard_pii': false, 'is_b2c': true,
+                'is_us_origin': true, 'is_financial_record': true
+              }
+        output:
+          expr: "['EU_B2C_NOTICE_REQUIRED', 'RETAIN_7_YEARS']"

conformance/testdata/aggregate_shadowed_variables/config.yaml

@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "aggregate_shadowed_variables"
+variables:
+  - name: "resource"
+    type_name: "map"
+    params:
+      - type_name: "string"
+      - type_name: "dyn"