Add fail_fast option to policies and update related configurations

docs/reference/configuration.md

@@ -27,11 +27,13 @@ policies:
   diff_size:
     max_changed_lines: 500
     mode: warning
+    fail_fast: false
   forbidden_paths:
     patterns:
       - ".env"
       - "secrets/**"
     mode: blocking
+    fail_fast: true
 
 plugins:
   gitleaks:
@@ -84,7 +86,9 @@ extension point for provider-specific nested settings.
 | `tools[].run` | `changed_files` |
 | `tools[].fail_fast` | `true` |
 | `policies.diff_size.mode` | `blocking` |
+| `policies.diff_size.fail_fast` | `true` |
 | `policies.forbidden_paths.mode` | `blocking` |
+| `policies.forbidden_paths.fail_fast` | `true` |
 | `plugins.gitleaks.enabled` | `true` |
 | `plugins.gitleaks.command` | `gitleaks` |
 | `plugins.gitleaks.timeout_seconds` | `60` |
@@ -132,8 +136,8 @@ commands. They run before plugins and configured tools.
 | `diff_size` | Counts added plus deleted text lines in the normalized changed-file list. Binary diffs do not contribute. |
 | `forbidden_paths` | Matches gitignore-like patterns against live changed paths after `ignore_paths` filtering. Deleted files are ignored. |
 
-Policy `mode` uses the same `blocking` or `warning` behavior as configured
-tools.
+Policy `mode` and `fail_fast` use the same blocking, warning, and fail-fast
+behavior as configured tools.
 
 ## Plugins
 

schemas/pushgate-config-v2.schema.json

@@ -145,6 +145,11 @@
         },
         "mode": {
           "$ref": "#/definitions/policyMode"
+        },
+        "fail_fast": {
+          "description": "Whether a blocking diff-size violation stops later deterministic checks.",
+          "type": "boolean",
+          "default": true
         }
       }
     },
@@ -164,6 +169,11 @@
         },
         "mode": {
           "$ref": "#/definitions/policyMode"
+        },
+        "fail_fast": {
+          "description": "Whether a blocking forbidden-path violation stops later deterministic checks.",
+          "type": "boolean",
+          "default": true
         }
       }
     },

src/config/normalize.ts

@@ -87,6 +87,7 @@ function normalizePolicies(
           diff_size: {
             max_changed_lines: policies.diff_size.max_changed_lines,
             mode: policies.diff_size.mode ?? "blocking",
+            fail_fast: policies.diff_size.fail_fast ?? true,
           },
         }
       : {}),
@@ -95,6 +96,7 @@ function normalizePolicies(
           forbidden_paths: {
             patterns: [...policies.forbidden_paths.patterns],
             mode: policies.forbidden_paths.mode ?? "blocking",
+            fail_fast: policies.forbidden_paths.fail_fast ?? true,
           },
         }
       : {}),

src/config/types.ts

@@ -44,6 +44,8 @@ export interface DiffSizePolicyConfig {
   max_changed_lines: number;
   /** Whether a policy violation blocks the push or only warns locally. */
   mode: BuiltInPolicyMode;
+  /** Whether a blocking violation stops later deterministic checks. */
+  fail_fast: boolean;
 }
 
 /** Built-in forbidden-path policy configuration. */
@@ -52,6 +54,8 @@ export interface ForbiddenPathsPolicyConfig {
   patterns: string[];
   /** Whether a policy violation blocks the push or only warns locally. */
   mode: BuiltInPolicyMode;
+  /** Whether a blocking violation stops later deterministic checks. */
+  fail_fast: boolean;
 }
 
 /** Optional built-in deterministic policies. */
@@ -157,12 +161,14 @@ export interface RawToolConfig {
 export interface RawDiffSizePolicyConfig {
   max_changed_lines: number;
   mode?: BuiltInPolicyMode;
+  fail_fast?: boolean;
 }
 
 /** Raw built-in forbidden-path policy shape before defaults are normalized. */
 export interface RawForbiddenPathsPolicyConfig {
   patterns: string[];
   mode?: BuiltInPolicyMode;
+  fail_fast?: boolean;
 }
 
 /** Raw built-in policy config before optional policy modes are normalized. */