Unify DefaultPolicyEngine decision and explanation rule chain

[dgenio]

What changed

• replace the duplicated DefaultPolicyEngine.evaluate() / .explain() condition trees with one ordered _DEFAULT_RULES chain
• keep decision semantics short-circuiting while explanation traverses the same rules in collect-all mode
• add RateLimiter.peek() so explanation can predict rate-limit denials without creating, pruning, or consuming limiter state
• preserve denial reason codes and decision trace semantics while returning constraints from the shared traversal
• split rule helpers by concern so every new module remains below the repository's 300-line module ceiling
• update architecture and agent guidance so future rules are registered once in the shared chain
• add agreement regressions across safety, sensitivity, memory, constraint, and rate-limit cases, plus strict no-mutation tests for explain()

Verification

Authoritative make ci passed on the final architecture:

• Ruff format: clean
• Ruff lint: clean
• mypy: 70 source files, no issues
• pytest: 835 passed, 1 skipped
• branch coverage: 94.23% (90% required)
• all repository examples completed successfully

The new policy modules are all below the mandatory 300-line ceiling. policy.py itself is reduced substantially by removing the two hand-maintained rule copies.

Closes #219.

[Copilot]

Pull request overview

This PR refactors DefaultPolicyEngine so both authorization decisions (evaluate()) and denial explanations (explain()) are driven by a single canonical ordered rule chain, eliminating the prior duplicated condition trees. It also adds a read-only rate-limit path (RateLimiter.peek()) so explanations can predict rate-limit denials without mutating limiter state, and adds regression tests to enforce evaluate/explain agreement and strict no-mutation behavior.

Changes:

• Introduce a shared _DEFAULT_RULES rule chain (DefaultPolicyRuleChain) and route DefaultPolicyEngine.evaluate() / .explain() through it (short-circuit vs collect-all).
• Add RateLimiter.peek() and use it for read-only rate-limit evaluation during explanation.
• Add targeted tests for decision/explanation agreement and read-only invariants; update docs and contributor guidance accordingly.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/test_policy_rule_chain.py	Adds agreement + read-only invariant tests to prevent drift and limiter mutation in explain().
src/weaver_kernel/rate_limit.py	Adds RateLimiter.peek() for non-mutating rate-limit prediction.
src/weaver_kernel/policy.py	Replaces duplicated evaluate/explain logic with shared chain traversal; preserves trace + reason-code behavior.
src/weaver_kernel/default_policy_rules.py	Defines canonical ordered _DEFAULT_RULES and DefaultPolicyRuleChain.run() traversal.
src/weaver_kernel/default_policy_rule_types.py	Adds shared context/result/failure datatypes and shared constants for the rule chain.
src/weaver_kernel/default_policy_limit_rules.py	Implements row-cap and rate-limit rules, including read-only limiter behavior.
src/weaver_kernel/default_policy_access_rules.py	Implements safety/sensitivity/secrets/memory access rules as chain components.
docs/architecture.md	Documents the unified chain and read-only rate-limit explanation behavior.
CHANGELOG.md	Notes the behavior-preserving refactor and new agreement/no-mutation coverage.
AGENTS.md	Updates “Adding a policy rule” guidance to register rules once in _DEFAULT_RULES + add agreement coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.