- merge_policies: interpreter failure now aborts with the temp file
removed instead of moving an empty tmp into place (errexit is
suppressed when the function is called in a || context, so the
status is checked explicitly); config stays untouched on failure
- move info/ok/warn/die above arg parsing so --allow-provider without
a value prints the intended error, not 'die: command not found'
- install_enterprise_policy: compare content before writing on the
sudo path (skip when already enforced, warn on drift), repair the
no-root-with-existing-file case instead of pinning env vars, chmod
644 the policy file in both paths
- tests: in-place merge, fail-closed on bad JSON, clean arg error
- Install /etc/openchamber/policy.json (enterpriseMode, organization,
pinned relayUrl); sudo with OPENCHAMBER_ENTERPRISE_MODE=1 env fallback;
--no-enterprise opt-out
- Inject OpenCode provider policies into the synced config: deny all
providers, allow those derived from the config's own providers block,
BASELINE_ALLOWED_PROVIDERS (openai via codex-auth plugin), and
repeatable --allow-provider extras (e.g. constellation)
- Extend verification: policy file state, pinned relay, effective
provider allow-list
- Restructure into sourceable functions with a main guard so the policy
and merge logic is testable
c4ch3c4d3