[ToreMerkely]

Refuse kosli evaluate policy --control with --path or --policy before any request, naming kosli publish rego-policy and --identifier. Kosli now records a decision only from a published policy, so the server would reject the request anyway. Step 3 of refusing decisions from inline policies.

Part of kosli-dev/server#7583

🤖 Generated with Claude Code

[ToreMerkely]

• --path without --control is unchanged; evaluate trail(s) --server-side never sends a decision, so nothing else needs the check.
• The server side is kosli-dev/server#7652. An older CLI meets that server's 400 and prints it, so release order does not matter for correctness; this only gives the guidance earlier.
• The command is still hidden, so there is no docs page to regenerate.

[claude]

Claude finished @ToreMerkely's task in 51s —— View job

---

Follow-up review of new commits (d45befc → 116574a)

Scope: git diff d45befc8..116574a8 touches only cmd/kosli/root.go (flag help text) and cmd/kosli/evaluatePolicy_test.go (new test).

Previous finding status:

• The nit about policyControlFlag help text not mentioning the --identifier constraint — resolved. policyControlFlag in root.go:156 now reads "Only a published policy (--identifier) can record one." The review thread was already marked resolved (author replied confirming the fix in 116574a), so no further action needed there.

New commits review: No new issues found. The added test (TestAControlFromTheEnvironmentIsRefusedWithAPath) correctly exercises the existing refusal path — suite.cmd() already supplies --path, and o.control is populated from KOSLI_CONTROL via the existing flag/env binding, so the check at evaluatePolicy.go:213 (o.control != "" && len(policyRefs) > 0) fires as expected without any production code change. The help-text-only change to root.go carries no logic risk.

0 new inline comments posted.

[ToreMerkely]

On the review's other suggestions:

• Order of checks: skipped. The published-policy refusal coming before the missing --flow/--trail one is the right order, as the review says.
• Release note: skipped. The request failed before this change too, only at the server; the command is still hidden, and the feat(evaluate): title reaches the changelog.
• KOSLI_CONTROL from the environment: fixed in 116574a with TestAControlFromTheEnvironmentIsRefusedWithAPath.