feat(policy-engine): add fuzz harness for tree config + evaluation (#…

[Peace-001]

…234)

• Add MaxDepthExceeded error variant (value 5) and MAX_CHECKS=16 constant to keep per-evaluate resource cost bounded
• Enforce depth limit in add_check; returns Err(MaxDepthExceeded) when the check list is already at capacity
• Convert CheckKind enum to tuple variants (DenylistCheck / JurisdictionCheck wrapper structs) to comply with contracttype constraint on named struct-like enum variants
• Add contracts/policy-engine/src/fuzz.rs: seeded xorshift32 PRNG loop exercising random AddDenylist / AddJurisdiction / RemoveCheck sequences with an All/Any oracle; verifies no panic and result consistency across all seeds
• Add contracts/policy-engine/src/test_utils.rs: self-contained MockDenylist and MockJurisdiction inline contracts used by both fuzz and unit tests (avoids dependency on broken dev-dep crates)
• Update test.rs to use inline mocks; add test_max_depth_exceeded
• Add contracts/policy-engine to workspace members in Cargo.toml
• Fix stray closing paren in jurisdiction-flag is_permitted_jurisdiction
• Document harness in fuzz/README.md under policy-engine (Add a fuzz harness for policy-engine tree configuration + evaluation #234) section

Tested: FUZZ_ITERATIONS=10000 FUZZ_OPS=32 → 10k iterations, 0 failures, 905s wall time. All 6 policy-engine unit tests pass.

Closes

Closes #

What changed and why

Checklist

• cargo test --workspace passes locally
• cargo clippy --workspace --all-targets -- -D warnings passes locally
• New functionality has test coverage for the happy path and at least one failure/auth case
  Closes Add a fuzz harness for policy-engine tree configuration + evaluation #234

[drips-wave]

@Peace-001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@Peace-001 is attempting to deploy a commit to the idaonoli-2655's projects Team on Vercel.

A member of the Team first needs to authorize it.