feat(s3): serve the bucket policy operations through Hilt's /s3/bucket/policy

[pyropy]

Answers GET/PUT/DELETE /{bucket}?policy ahead of versitygw's route table and forwards them to Hilt's /s3/bucket/policy. Versitygw's own controller rejects Forge policy documents and cannot carry preconditions or an ETag.

• policy_routes.go: routes, handler and S3 error rendering
• bucketauthority.BucketPolicy and policy error sentinels
• A refused create-time policy renders as MalformedPolicy
• Unit tests plus a guarded TestForgeBucketPolicy itest
• Temporary pins: hilt to feat(rpc): read and write bucket policies over /s3/bucket/policy hilt#89, libforge to feat(s3): add the /s3/bucket/policy command libforge#80; re-pin before merge

🤖 Generated with Claude Code

[pyropy]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T14:11:22.597912Z	919e46f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 06b3229ff3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pyropy]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 51b19bdd05

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pyropy]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 919e46f58b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alanshaw]

Can we use the constants for these?

[pyropy]

Done in bf3ed39: the four literals now use bucketpolicysvc.{PolicyNotFound,PreconditionFailed,ConcurrentChange}ErrorName and InvalidPreconditionName. The comment justifying the literals was wrong — hilt/pkg/rpc/service/bucket already imports the service package, so it was in our build graph anyway. Dropped it.

[alanshaw]

which a Forge policy is not,

Is it not? Why is it not?

[pyropy]

We do use similar format as AWS bucket policies, but it's not 100% compatible. Here's an example of how principals are listed in AWS bucket policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "editors",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::111122223333:user/alice",
          "arn:aws:iam::111122223333:user/bob"
        ]
      },
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::photos", "arn:aws:s3:::photos/*"]
    },
    {
      "Sid": "readers",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:root" },
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::photos", "arn:aws:s3:::photos/*"]
    },
    {
      "Sid": "noWritesForBob",
      "Effect": "Deny",
      "Principal": { "AWS": "arn:aws:iam::111122223333:user/bob" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::photos/*"
    }
  ]
}

While in Forge it would look more like this:

{
  "Statement": [
    {
      "Sid": "editors",
      "Effect": "Allow",
      "Principal": ["alice", "bob"],
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
    },
    {
      "Sid": "readers",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:ListBucket"]
    },
    {
      "Sid": "no-writes-for-bob",
      "Effect": "Deny",
      "Principal": ["bob"],
      "Action": ["s3:PutObject"]
    }
  ]
}