# ACP Interceptor (Phase 1)

Go/Gin **Policy Enforcement Point** for the ACP platform. This component lives under `interceptor/` in the monorepo.

It accepts `POST /tool-call`, evaluates **OPA**, returns **allow / deny / escalate**, propagates **trace IDs**, and emits **structured JSON audit** lines.

## Python SDK (governed execution)

For framework-agnostic wrappers (`@governed_tool`) that call this service before running side effects, see [`../sdk/python/README.md`](../sdk/python/README.md).

## Prerequisites

- Go **1.22+**
- **OPA** on your PATH (for `scripts/run-local.sh`) or run via **Docker Compose**

## Run locally (OPA + server)

From this directory (`interceptor/`):

```bash
chmod +x scripts/run-local.sh
./scripts/run-local.sh
```

Or start OPA yourself:

```bash
opa run --server --addr :8181 ./policies
```

Then:

```bash
export OPA_URL=http://localhost:8181
export OPA_DECISION_PATH=acp/decision
export POLICIES_DIR="$(pwd)/policies"
go run ./cmd/server
```

The dashboard **Policies** tab calls `GET /api/v1/policies/catalog`, which reads `.rego` files from `POLICIES_DIR` (same tree OPA loads).

## Example request

```bash
curl -sS localhost:8080/tool-call \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"refund-agent","tool":"refund_api","action":"issue_refund","amount":9500,"risk_score":0.82}'
```

## Configuration

See `.env.example`. Key variables:

- `HTTP_ADDR` (default `:8080`)
- `OPA_URL` (default `http://localhost:8181`)
- `OPA_DECISION_PATH` (default `acp/decision`)
- `POLICIES_DIR` (optional; directory of `.rego` files for `GET /api/v1/policies/catalog` — set to `./policies` when running from `interceptor/`)
- `API_KEY` (optional; when set, requires `X-API-Key`)

## Docker Compose

From repository root:

```bash
docker compose -f interceptor/deployments/docker/docker-compose.yml up --build
```

Or from `interceptor/`:

```bash
docker compose -f deployments/docker/docker-compose.yml up --build
```

## Tests

From `interceptor/`:

```bash
go mod tidy
go test ./...
```

## OpenAPI

`api/openapi.yaml`

## Skills / scope

See `skills/skills.md`.
