[TheGreatAxios]

A stored policy pack whose labels step names a label Triage takes back (a risk or sensitive level label) no longer fails to parse as a whole. That step is left out, so it never runs, and is named in the pack's dropped list by its stored position, with the other labels that are not added either; the rest of the pack loads. A policy file, an extended file's override and a pushed file checked by the hub still refuse such a step with the same message as before. Level-label comparison was already case-insensitive on both sides. The contracts README now describes this.

Verified with contracts tests (a stored pack with the step, a file refused through checkPolicyFile) and the repo's check, lint and contracts tests.

Closes CL-11709

[linear-code]

CL-11709

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• Risk: medium (2 recently fixed files)

[corbits-triage]

Stored policy packs with a labels step naming a risk or sensitive level label now load instead of failing; that step is skipped and reported in the dropped list, while policy files, extended overrides and pushed files still refuse it. The main defect is that the dropped message can misreport other level labels as ordinary labels that are not added.

[corbits-triage]

Changes stored policy pack loading so a labels step naming a risk or sensitive level label is dropped and reported in the pack's dropped list, instead of failing the whole pack. Policy files, extended overrides and pushed files still refuse such a step with the same error. The contracts README is updated to match.