From 538200c0b55c953fa200dc9f531a365c3b41782d Mon Sep 17 00:00:00 2001
From: Binay <150876063+bkd-dotcom@users.noreply.github.com>
Date: Tue, 8 Sep 2026 14:35:11 -0400
Subject: [PATCH] harden(policy/django): deny the Django startup hooks inside
 apps/**
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The policy's summary promises that "anything that runs at manage.py startup
stays off-limits", and it denies **/conftest.py on exactly that reasoning —
code that executes on import has a far larger blast radius than app code.

AppConfig.ready() in apps.py, and the signal handlers it imports, run on
every boot: every manage.py invocation, every worker, every test session.
Both live under apps/**, which is otherwise allowed, so the promise did not
hold for the two files that most obviously break it.

Adds them to forbidden_paths and declares apps/billing/apps.py in
@policy blocks, so tests/test_policy_registry.py proves the deny through
the real evaluate_contract rather than asserting it in a comment.
---
 signetry_core/policies/django.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/signetry_core/policies/django.yaml b/signetry_core/policies/django.yaml
index 311514b..270dde6 100644
--- a/signetry_core/policies/django.yaml
+++ b/signetry_core/policies/django.yaml
@@ -8,7 +8,7 @@
 #   pinned bump is routine; an unpinned add is a new dependency at deploy time.
 # @policy stack: python, django, pytest-django, drf
 # @policy author: kuangwojia-netizen
-# @policy blocks: apps/billing/migrations/0012_add_plan.py, config/settings/production.py, manage.py, .github/workflows/deploy.yml
+# @policy blocks: apps/billing/migrations/0012_add_plan.py, config/settings/production.py, manage.py, apps/billing/apps.py, .github/workflows/deploy.yml
 # @policy allows: apps/billing/models.py, apps/billing/views.py, tests/test_billing.py, requirements/base.txt
 version: 2
 task_type: feature-work
@@ -40,6 +40,12 @@ forbidden_paths:
   # CI job that touches the package — a far larger blast radius than app code.
   - "**/conftest.py"
   - "conftest.py"
+  # AppConfig.ready() and the signal handlers it imports run on every boot — each
+  # `manage.py` invocation, each worker, each test session. Same blast radius as
+  # conftest.py, and inside apps/** which is otherwise allowed, so it needs the
+  # same explicit deny for the summary's "nothing that runs at startup" to hold.
+  - "**/apps.py"
+  - "**/signals.py"
   - ".github/**"
   - "infra/**"
   - "deploy/**"