Consolidate and minimize raw polpAudit-recorded policy grants into a clean, deployable JGDMS policy set using org.apache.river.tool.PolicyCondenser, PolicyUpdatePostProcessor, and ProxyPolicyGenerator (tools/policy-condenser module). Use when policy files need condensing/deduplicating after a polpAudit run, when deriving GrantPermission ceilings or META-INF/PERMISSIONS.LIST for proxy codebases, or when running the qa/build.xml policy-update targets. Triggers on "condense the policy", "PolicyCondenser", "policy-update target", "GrantPermission ceiling", "PERMISSIONS.LIST", "proxy policy generator", "policy file has too many redundant grants".
Generate or extend a least-privilege java.policy file for JGDMS/DirtyChai services and tests using DirtyChai's polpAudit SecurityManager (au.zeus.jdk.authorization.tool.SecurityPolicyWriter). Use when a test/service needs new permission grants added to a policy file, when policy-generation properties (polpAudit.path.properties) need setting, or when a manually-edited policy file's grants aren't taking effect. Triggers on "generate a policy file", "missing permission", "polpAudit", "SecurityPolicyWriter", "-Djava.security.manager=polpAudit", "least-privilege policy", "AccessControlException during test runs".
JGDMS design/security/code review heuristics distilled from four retired board seats (ASN.1/DER + module-boundary, adversarial security, JERI transport, rule-fidelity/determinism/cross-language). Use before scoping or conducting any nontrivial design review, security review, or PR review in this repo — covers canonical-form contracts, outcome-vs-mechanism checks, fail-closed audits, confused-deputy hunts, and domain-specific war stories/checklists. Triggers on "review this design", "security review", "is this safe", "board guidance", "review heuristics", or any request to review JGDMS code/design for correctness or security.