Summary

Clarify in existing policy documentation (docs/FILE_POLICY.md, docs/POLICY_ALLOWLISTS.md) that the non-Rust allowlist rollout is an organized decomposition of planned work scheduled to be converted to Rust/xtask. Add explicit language tying each allowlist to its corresponding xtask implementation PR.

Investigation

Current state:

• docs/FILE_POLICY.md (lines 90–92): "Rollout" section exists but is brief; refers to PR numbers without explaining the decomposition strategy.
• docs/POLICY_ALLOWLISTS.md (lines 141–160): "Rollout Status" table lists allowlists and their PR numbers, marked "planned", but no language explaining why files live in docs/policy/ today or what conversion to Rust/xtask means.
• docs/agent-context/review-invariants.md: No coverage of rollout rationale.

Missing:

• No document explains that policy/*.toml files are intended to be converted to Rust/xtask (per master tracking Roadmap: post-v0.3.0-rc.1 product scorecard across nine competencies #109).
• "Planned" status lacks context: is this a feature not yet started, or a documented policy waiting for implementation tooling?

Related:

• PR 9: file-policy and companion allowlists #180 (umbrella: file-policy and companion allowlists)
• Roadmap: post-v0.3.0-rc.1 product scorecard across nine competencies #109 (master roadmap: nine competencies, "Harden" includes encoding registry/policy knowledge)

Plan

1. Edit docs/FILE_POLICY.md (line 90–92): Expand "Rollout" section with one paragraph:

   • Reason: "Policy files are initially authored as TOML for human review; scheduled to be converted to Rust/xtask in subsequent PRs."
   • Map rollout PRs to allowlist type (e.g., "PR 9: non-rust, generated, executable, dependency-surface, workflow allowlists").

2. Edit docs/POLICY_ALLOWLISTS.md (table header or new row): Add reason column or footer explaining status value "planned":

   • "Planned: Allowlist authored in TOML; conversion to Rust/xtask implementation tracked in PR 9: file-policy and companion allowlists #180 and Roadmap: post-v0.3.0-rc.1 product scorecard across nine competencies #109."

3. New file docs/policy/NON_RUST_ROLLOUT.md: Detailed tracker (if layout is acceptable; see open question below).

   • Lists all 15 allowlist files, PR mapping, current vs. target state, and conversion readiness checklist.

4. Acceptance: cargo check --workspace --locked passes (no source code changes).

Open Questions

1. Documentation layout: Should docs/policy/NON_RUST_ROLLOUT.md live under docs/policy/ (policy domain focus) or docs/ci/ (CI tooling focus)?
2. Scope: Should this PR also include a placeholder/stub for the Rust/xtask implementation (e.g., a tracking comment in crates/xtask/src/), or is documentation-only sufficient for the rollout clarification goal?

Acceptance Criteria

• cargo check --workspace --locked passes.
• FILE_POLICY.md Rollout section expanded with reason and PR map.
• POLICY_ALLOWLISTS.md status values explained (in-table or footer).
• New docs/policy/NON_RUST_ROLLOUT.md created (or -ci variant per feedback).
• Changes link PR 9: file-policy and companion allowlists #180 and Roadmap: post-v0.3.0-rc.1 product scorecard across nine competencies #109 as related issues.

Relation to Umbrella Issues

Refines #180 (file-policy and companion allowlists).
Tracks #109 (master roadmap: nine competencies).

Filed during non-Rust whitelist rollout planning, 2026-05-11.