Access controlled knowledge gateway functionality

tests/test_builtin_extension_catalog.py

@@ -17,6 +17,7 @@ def test_builtin_extension_registry_lists_query_processors_and_backend():
     assert "runtime.context" in ids
     assert "runtime.form-state" in ids
     assert "runtime.assessment" in ids
+    assert "policy.local-label" in ids
 
 
 def test_builtin_processor_descriptors_capture_safety_and_provenance():
@@ -81,3 +82,18 @@ def test_builtin_runtime_descriptors_expose_boundaries():
     assert {capability.id for capability in form_state.capabilities} >= {"forms", "rules"}
     assert assessment.kind == "assessment-runner"
     assert assessment.safety["provider_calls"] == "adapter-only"
+
+
+def test_builtin_policy_descriptor_exposes_cli_and_adapter_boundary():
+    registry = builtin_extension_registry()
+
+    descriptor = registry.get("policy.local-label")
+
+    assert descriptor.kind == "policy-gateway"
+    assert descriptor.safety["network"] is False
+    assert {capability.id for capability in descriptor.capabilities} >= {
+        "policy",
+        "policy_filter",
+    }
+    assert "mkt policy check" in descriptor.cli["commands"]
+    assert "RelationshipPolicyAdapter" in descriptor.metadata["external_adapters"]