ctrlrun.parse_conditions — function, defined at src/ctrlrun/policy.py:934
when:-shaped mapping into conditions, keyed by the raw condition key.
Public since SPEC-v0.3 §11: a grant’s constraints: is in exactly this syntax and MUST be
parsed by this code (§4.5). The key is injective given §3.2’s longest-suffix split, which
is what lets Grant’s containment check look a dimension up by name.
allow_derived admits §7.4’s derived subjects and defaults to off, so authority.py —
which calls this without it — sees exactly the surface it saw in v0.3. A grant naming
data_scope is refused as it always was, which is what keeps §11’s “matching a grant on a
data label” out of v0.6 rather than letting it in through a shared parser.