Fix deep-review findings for prepare/closed-handle safety

Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/c2c0f3ef-f641-4d83-94f8-a3cd3ede6db8 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>
Address review nits after validation feedback
2026-08-05 02:16:11 +00:00 · 2026-05-15 12:04:40 +00:00 · 2026-05-14 20:11:51 +00:00 · 2026-05-14 20:07:11 +00:00 · 2026-05-14 13:18:27 +00:00 · 2026-05-14 13:13:43 +00:00
44 changed files with 611 additions and 1537 deletions
--- a/.github/copilot-setup-steps.yml
+++ b/.github/copilot-setup-steps.yml
@@ -8,5 +8,3 @@ steps:
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
      fetch-depth: 0 # full history needed for git diff against main
-  - run: git fetch origin main:refs/remotes/origin/main
-    name: Ensure origin/main ref is available for diff computation
--- a/.github/skills/code-review/SKILL.md
+++ b/.github/skills/code-review/SKILL.md
@@ -25,21 +25,15 @@ Key constraints (details in copilot-instructions.md):
 ## Step 1: Get the Diff

 ```bash
-# Primary: use gh pr diff (works in cloud agent + any PR context).
-# Fallback: git merge-base for local non-PR usage.
-if gh pr diff --name-only >/dev/null 2>&1; then
-  echo "---STAT---"
-  gh pr diff --name-only
-  echo "---DIFF---"
-  gh pr diff
-else
-  BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
-      || git merge-base origin/main HEAD 2>/dev/null \
-      || git merge-base main HEAD 2>/dev/null)
-  echo "Reviewing changes since: $BASE"
-  git diff "$BASE"..HEAD --stat
-  git diff "$BASE"..HEAD
+BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
+    || git merge-base origin/main HEAD 2>/dev/null)
+if [ -z "$BASE" ]; then
+  echo "ERROR: Cannot find upstream/main or origin/main. Cannot determine review scope."
+  exit 1
 fi
+echo "Reviewing changes since: $BASE"
+git diff "$BASE"..HEAD --stat
+git diff "$BASE"..HEAD -- '*.rs' '*.toml' 'examples/'
 ```

 If the diff is empty, stop and report: "No changes found to review."
@@ -202,9 +196,3 @@ one pass. If any were skipped, note them and briefly assess.
 ### Summary

 X findings (N critical, N high, N medium, N low). One sentence overall assessment.
-
-### Output
-
-After generating the report above, write the COMPLETE report to `/tmp/code-review-report.md`
-using the `create` tool or shell. This ensures the full report is preserved even if
-display output is truncated.
--- a/.github/skills/deep-review/SKILL.md
+++ b/.github/skills/deep-review/SKILL.md
@@ -40,25 +40,22 @@ Use `read_agent` with `wait: true` to wait for each background agent.
 ## Step 1: Get the Diff and Build Inventory

 ```bash
-# Primary: use gh pr diff (works in cloud agent + any PR context).
-# Fallback: git merge-base for local non-PR usage.
-if gh pr diff --name-only >/dev/null 2>&1; then
-  echo "---STAT---"
-  gh pr diff --name-only
-  echo "---DIFF---"
-  gh pr diff
-else
-  BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
-      || git merge-base origin/main HEAD 2>/dev/null \
-      || git merge-base main HEAD 2>/dev/null)
-  echo "Reviewing changes since: $BASE"
-  git diff "$BASE"..HEAD --stat
-  git diff "$BASE"..HEAD
+BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
+    || git merge-base origin/main HEAD 2>/dev/null)
+if [ -z "$BASE" ]; then
+  echo "ERROR: Cannot find upstream/main or origin/main."
+  exit 1
 fi
+echo "Reviewing changes since: $BASE"
+git diff "$BASE"..HEAD --stat
+git diff "$BASE"..HEAD -- '*.rs' '*.toml' 'examples/' | head -2000
 ```

 If the diff is empty, stop and report: "No changes found to review."

+**Scope rule:** Focus on code files (`*.rs`, `*.toml`, examples). Do NOT pass
+docs/config diffs to agents.
+
 **Build a risk-classified inventory.** List every changed function, struct,
 impl, trait, pub item, and significant code block. Number them and tag with
 risk predicates:
@@ -109,10 +106,8 @@ Use `model: "gpt-5.4"` in the task tool call (provides model diversity).
 > Get the diff:
 > ```
 > BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
->     || git merge-base origin/main HEAD 2>/dev/null \
->     || git merge-base main HEAD 2>/dev/null)
-> # If no merge-base, use: gh pr diff
-> git diff "$BASE"..HEAD  # or: gh pr diff
+>     || git merge-base origin/main HEAD 2>/dev/null)
+> git diff "$BASE"..HEAD -- '*.rs' '*.toml' 'examples/'
 > ```
 >
 > Key regorus constraints:
@@ -166,10 +161,8 @@ Use `model: "claude-opus-4.6"` in the task tool call.
 > Get the diff AND read full source files for context:
 > ```
 > BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
->     || git merge-base origin/main HEAD 2>/dev/null \
->     || git merge-base main HEAD 2>/dev/null)
-> # If no merge-base, use: gh pr diff
-> git diff "$BASE"..HEAD  # or: gh pr diff
+>     || git merge-base origin/main HEAD 2>/dev/null)
+> git diff "$BASE"..HEAD -- '*.rs' '*.toml' 'examples/'
 > ```
 > Then use `view` to read the full source files that were changed.
 >
@@ -226,10 +219,8 @@ Use the default model (no `model` parameter).
 > Get the diff:
 > ```
 > BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
->     || git merge-base origin/main HEAD 2>/dev/null \
->     || git merge-base main HEAD 2>/dev/null)
-> # If no merge-base, use: gh pr diff
-> git diff "$BASE"..HEAD  # or: gh pr diff
+>     || git merge-base origin/main HEAD 2>/dev/null)
+> git diff "$BASE"..HEAD -- '*.rs' '*.toml' 'examples/'
 > ```
 > Use `view` to read surrounding context.
 >
@@ -448,10 +439,8 @@ Launch **1 general-purpose agent in background mode**.
 > Get the diff:
 > ```
 > BASE=$(git merge-base upstream/main HEAD 2>/dev/null \
->     || git merge-base origin/main HEAD 2>/dev/null \
->     || git merge-base main HEAD 2>/dev/null)
-> # If no merge-base, use: gh pr diff
-> git diff "$BASE"..HEAD  # or: gh pr diff
+>     || git merge-base origin/main HEAD 2>/dev/null)
+> git diff "$BASE"..HEAD -- '*.rs' '*.toml' 'examples/'
 > ```
 > Use `view` to read full source files.
 >
@@ -492,8 +481,8 @@ Launch **1 general-purpose agent in background mode**.

 ## Step 5: Synthesize and Report

-**CRITICAL:** Write the report to `/tmp/deep-review-report.md` FIRST, then display it.
-Use a shell command to write the file before any other output in this step.
+**IMPORTANT:** This is the primary output. Everything above was preparation.
+Keep the report COMPACT — one finding per block, no filler prose.

 Apply verdicts from the adversarial verifier:
 - **CONFIRMED**: keep at stated severity
@@ -533,9 +522,3 @@ would catch it. If not, name the minimal test that should exist.
 X findings (N critical, N high, N medium, N low). Y "likely" findings.
 Z dropped (one-line reasons).
 Risk assessment in one sentence.
-
---
-
-**Remember:** The report above MUST be written to `/tmp/deep-review-report.md` at the
-START of Step 5 (before displaying it). Use shell: `cat > /tmp/deep-review-report.md << 'REPORT_EOF'`
-... report content ... `REPORT_EOF`
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -180,9 +180,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"

 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -650,9 +650,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.17.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
 dependencies = [
 "foldhash 0.2.0",
 ]
@@ -835,7 +835,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "serde",
 "serde_core",
 ]
@@ -881,9 +881,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "fc59d2432e047d6090ba1d83c782d0128bd6203857978218f5614dbd3287281f"
 dependencies = [
 "ahash",
 "bytecount",
@@ -1353,9 +1353,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "cb674900ca31acd75c4aaf63f48e43e719631c0539ea5a9e64163d1296bcb730"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -1410,7 +1410,7 @@ dependencies = [
 "dashmap",
 "data-encoding",
 "globset",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "icu_casemap",
 "indexmap",
 "ipnet",
@@ -2193,9 +2193,9 @@ dependencies = [

 [[package]]
 name = "zerofrom"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
 "zerofrom-derive",
 ]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -114,7 +114,7 @@ regex = {version = "1.12.3", optional = true, default-features = false }
 semver = {version = "1.0.28", optional = true, default-features = false }
 url = { version = "2.5.4", optional = true }
 uuid = { version = "1.22.0", default-features = false, features = ["v4", "fast-rng"], optional = true }
-jsonschema = { version = "0.46.5", default-features = false, optional = true }
+jsonschema = { version = "0.46.4", default-features = false, optional = true }
 chrono = { version = "0.4.44", optional = true }
 chrono-tz = { version = "0.10.1", optional = true }
 ipnet = { version = "2.12.0", optional = true, default-features = false }
--- a/bindings/cpp/regorus.hpp
+++ b/bindings/cpp/regorus.hpp
@@ -80,6 +80,10 @@ namespace regorus {
 	    return std::unique_ptr<Engine>(new Engine(regorus_engine_clone(engine)));
 	}

+	Result prepare() {
+	    return Result(regorus_engine_prepare(engine));
+	}
+
 	Result set_rego_v0(bool enable) {
 		return Result(regorus_engine_set_rego_v0(engine, enable));
 	}
--- a/bindings/csharp/Regorus/Engine.cs
+++ b/bindings/csharp/Regorus/Engine.cs
@@ -68,6 +68,18 @@ namespace Regorus
            });
        }

+        /// <summary>
+        /// Prepare internal evaluation structures without executing a query.
+        /// This is optional: if skipped, the first evaluation pays this setup cost.
+        /// </summary>
+        public void Prepare()
+        {
+            UseHandle(enginePtr =>
+            {
+                CheckAndDropResult(Regorus.Internal.API.regorus_engine_prepare((Regorus.Internal.RegorusEngine*)enginePtr));
+            });
+        }
+
        public void SetStrictBuiltinErrors(bool strict)
        {
            UseHandle(enginePtr =>
--- a/bindings/csharp/Regorus/NativeMethods.cs
+++ b/bindings/csharp/Regorus/NativeMethods.cs
@@ -92,6 +92,12 @@ namespace Regorus.Internal
        [DllImport(LibraryName, EntryPoint = "regorus_engine_clone", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
        internal static extern RegorusEngine* regorus_engine_clone(RegorusEngine* engine);

+        /// <summary>
+        /// Prepare a RegorusEngine for evaluation without executing a query.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_prepare", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_prepare(RegorusEngine* engine);
+
        /// <summary>
        /// Compile an RVM program from the engine state with entry points.
        /// </summary>
--- a/bindings/ffi/Cargo.lock
+++ b/bindings/ffi/Cargo.lock
@@ -172,9 +172,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -508,9 +508,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.17.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
 dependencies = [
 "foldhash 0.2.0",
 ]
@@ -687,7 +687,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "serde",
 "serde_core",
 ]
@@ -724,9 +724,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "fc59d2432e047d6090ba1d83c782d0128bd6203857978218f5614dbd3287281f"
 dependencies = [
 "ahash",
 "bytecount",
@@ -1082,9 +1082,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "cb674900ca31acd75c4aaf63f48e43e719631c0539ea5a9e64163d1296bcb730"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -1136,7 +1136,7 @@ dependencies = [
 "dashmap",
 "data-encoding",
 "globset",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "icu_casemap",
 "indexmap",
 "ipnet",
@@ -1837,9 +1837,9 @@ dependencies = [

 [[package]]
 name = "zerofrom"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
 "zerofrom-derive",
 ]
--- a/bindings/ffi/src/engine.rs
+++ b/bindings/ffi/src/engine.rs
@@ -199,6 +199,21 @@ pub extern "C" fn regorus_engine_clone(engine: *mut RegorusEngine) -> *mut Regor
    }
 }

+/// Prepare a [`RegorusEngine`] for evaluation without executing a query.
+///
+/// This is optional. If not called, first eval performs the same setup.
+/// If policy/data changes after preparation, setup is invalidated.
+#[no_mangle]
+pub extern "C" fn regorus_engine_prepare(engine: *mut RegorusEngine) -> RegorusResult {
+    with_unwind_guard(|| {
+        to_regorus_result(|| -> Result<()> {
+            let engine = to_ref(engine)?;
+            let mut guard = engine.try_write()?;
+            guard.prepare()
+        }())
+    })
+}
+
 #[no_mangle]
 pub extern "C" fn regorus_engine_drop(engine: *mut RegorusEngine) {
    if let Ok(e) = to_ref(engine) {
--- a/bindings/go/pkg/regorus/mod.go
+++ b/bindings/go/pkg/regorus/mod.go
@@ -28,6 +28,17 @@ func (e *Engine) Clone() *Engine {
 	return c
 }

+func (e *Engine) Prepare() error {
+	result := C.regorus_engine_prepare(e.e)
+	defer C.regorus_result_drop(result)
+
+	if result.status != C.Ok {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+
+	return nil
+}
+
 func (e *Engine) SetRegoV0(enable bool) error {
 	result := C.regorus_engine_set_rego_v0(e.e, C.bool(enable))
 	defer C.regorus_result_drop(result)
--- a/bindings/java/Cargo.lock
+++ b/bindings/java/Cargo.lock
@@ -109,9 +109,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"

 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -380,9 +380,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.17.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

 [[package]]
 name = "heck"
@@ -530,7 +530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "serde",
 "serde_core",
 ]
@@ -610,9 +610,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "fc59d2432e047d6090ba1d83c782d0128bd6203857978218f5614dbd3287281f"
 dependencies = [
 "ahash",
 "bytecount",
@@ -954,9 +954,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "cb674900ca31acd75c4aaf63f48e43e719631c0539ea5a9e64163d1296bcb730"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -1659,9 +1659,9 @@ dependencies = [

 [[package]]
 name = "zerofrom"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
 "zerofrom-derive",
 ]
--- a/bindings/java/com_microsoft_regorus_Engine.h
+++ b/bindings/java/com_microsoft_regorus_Engine.h
@@ -23,6 +23,14 @@ JNIEXPORT jlong JNICALL Java_com_microsoft_regorus_Engine_nativeNewEngine
 JNIEXPORT jlong JNICALL Java_com_microsoft_regorus_Engine_nativeClone
  (JNIEnv *, jclass, jlong);

+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativePrepare
+ * Signature: (J)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativePrepare
+  (JNIEnv *, jclass, jlong);
+
 /*
 * Class:     com_microsoft_regorus_Engine
 * Method:    nativeAddPolicy
--- a/bindings/java/src/lib.rs
+++ b/bindings/java/src/lib.rs
@@ -27,13 +27,30 @@ pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeNewEngine(

 #[no_mangle]
 pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeClone(
-    _env: EnvUnowned,
+    env: EnvUnowned,
    _class: JClass,
    engine_ptr: jlong,
 ) -> jlong {
-    let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
-    let c = engine.clone();
-    Box::into_raw(Box::new(c)) as jlong
+    let res = throw_err(env, |_env| {
+        let engine = unsafe { &mut *get_engine_ptr(engine_ptr)? };
+        let c = engine.clone();
+        Ok(Box::into_raw(Box::new(c)) as jlong)
+    });
+
+    res.unwrap_or_default()
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativePrepare(
+    env: EnvUnowned,
+    _class: JClass,
+    engine_ptr: jlong,
+) {
+    let _ = throw_err(env, |_env| {
+        let engine = unsafe { &mut *get_engine_ptr(engine_ptr)? };
+        engine.prepare()?;
+        Ok(())
+    });
 }

 #[no_mangle]
@@ -437,6 +454,9 @@ pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeDestroyEngine(
    _class: JClass,
    engine_ptr: jlong,
 ) {
+    if engine_ptr == 0 {
+        return;
+    }
    unsafe {
        let _engine = Box::from_raw(engine_ptr as *mut Engine);
    }
@@ -816,6 +836,13 @@ fn throw_err<T>(mut env: EnvUnowned, f: impl FnOnce(&mut Env) -> Result<T>) -> R
    }
 }

+fn get_engine_ptr(engine_ptr: jlong) -> Result<*mut Engine> {
+    if engine_ptr == 0 {
+        return Err(anyhow::anyhow!("Engine is closed"));
+    }
+    Ok(engine_ptr as *mut Engine)
+}
+
 fn get_string_array(env: &mut Env, array: jobjectArray) -> Result<Vec<String>> {
    if array.is_null() {
        return Ok(Vec::new());
--- a/bindings/java/src/main/java/com/microsoft/regorus/Engine.java
+++ b/bindings/java/src/main/java/com/microsoft/regorus/Engine.java
@@ -21,6 +21,7 @@ public class Engine implements AutoCloseable, Cloneable {
    // if you update the native API.
    private static native long nativeNewEngine();
    private static native long nativeClone(long enginePtr);
+    private static native void nativePrepare(long enginePtr);
    private static native void nativeSetRegoV0(long enginePtr, boolean enable);
    private static native String nativeAddPolicy(long enginePtr, String path, String rego);
    private static native String nativeAddPolicyFromFile(long enginePtr, String path);
@@ -45,7 +46,7 @@ public class Engine implements AutoCloseable, Cloneable {

    // Pointer to Engine allocated on Rust's heap, all native methods works on
    // engine expects this pointer. It is free'd in `close` method.
-    private final long enginePtr;
+    private long enginePtr;

    /**
     * Creates a new Regorus Engine.
@@ -63,7 +64,15 @@ public class Engine implements AutoCloseable, Cloneable {
     * Efficiently clones an Engine.
     */
    public Engine clone() {
-	return new Engine(nativeClone(enginePtr));
+	return new Engine(nativeClone(requireOpen()));
+    }
+
+    /**
+     * Prepares internal evaluation structures without executing a query.
+     * Optional: if skipped, first evaluation performs the same setup.
+     */
+    public void prepare() {
+        nativePrepare(requireOpen());
    }
    
     /**
@@ -73,7 +82,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public void setRegoV0(boolean enable) {
-        nativeSetRegoV0(enginePtr, enable);
+        nativeSetRegoV0(requireOpen(), enable);
    }

    /**
@@ -85,7 +94,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @return Rego package defined in the policy.
     */
    public String addPolicy(String filename, String rego) {
-        return nativeAddPolicy(enginePtr, filename, rego);
+        return nativeAddPolicy(requireOpen(), filename, rego);
    }

    /**
@@ -96,7 +105,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @return Rego package defined in the policy.
     */
    public String addPolicyFromFile(String path) {
-        return nativeAddPolicyFromFile(enginePtr, path);
+        return nativeAddPolicyFromFile(requireOpen(), path);
    }

    /**
@@ -105,7 +114,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @return List of Rego packages as a JSON array of strings.
     */
    public String getPackages() {
-        return nativeGetPackages(enginePtr);
+        return nativeGetPackages(requireOpen());
    }
    
    /**
@@ -114,14 +123,14 @@ public class Engine implements AutoCloseable, Cloneable {
     * @return List of Rego policies as a JSON array of sources.
     */
    public String getPolicies() {
-        return nativeGetPolicies(enginePtr);
+        return nativeGetPolicies(requireOpen());
    }
    
    /**
     * Clears the data  document.
     */
    public void clearData() {
-        nativeClearData(enginePtr);
+        nativeClearData(requireOpen());
    }

    /**
@@ -143,7 +152,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @param data Inline data document.
     */
    public void addDataJson(String data) throws RuntimeException {
-        nativeAddDataJson(enginePtr, data);
+        nativeAddDataJson(requireOpen(), data);
    }

    /**
@@ -160,7 +169,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @param path Path to JSON data document.
     */
    public void addDataJsonFromFile(String path) throws RuntimeException {
-        nativeAddDataJsonFromFile(enginePtr, path);
+        nativeAddDataJsonFromFile(requireOpen(), path);
    }

    /**
@@ -169,7 +178,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @param input inline JSON input.
     */
    public void setInputJson(String input) {
-        nativeSetInputJson(enginePtr, input);
+        nativeSetInputJson(requireOpen(), input);
    }

    /**
@@ -178,7 +187,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @param path Path to JSON input.
     */
    public void setInputJsonFromFile(String path) {
-        nativeSetInputJsonFromFile(enginePtr, path);
+        nativeSetInputJsonFromFile(requireOpen(), path);
    }

    /**
@@ -189,7 +198,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @return Query results as a JSON string.
     */
    public String evalQuery(String query) {
-        return nativeEvalQuery(enginePtr, query);
+        return nativeEvalQuery(requireOpen(), query);
    }
    
    /**
@@ -200,7 +209,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * @return Value of the rule as a JSON string.
     */
    public String evalRule(String rule) {
-        return nativeEvalRule(enginePtr, rule);
+        return nativeEvalRule(requireOpen(), rule);
    }
    
    /**
@@ -210,7 +219,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public void setEnableCoverage(boolean enable) {
-        nativeSetEnableCoverage(enginePtr, enable);
+        nativeSetEnableCoverage(requireOpen(), enable);
    }
    
    /**
@@ -218,7 +227,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public void clearCoverageData() {
-        nativeClearCoverageData(enginePtr);
+        nativeClearCoverageData(requireOpen());
    }
    
    /**
@@ -228,7 +237,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public String getCoverageReport() {
-        return nativeGetCoverageReport(enginePtr);
+        return nativeGetCoverageReport(requireOpen());
    }
    
    /**
@@ -238,7 +247,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public String getCoverageReportPretty() {
-        return nativeGetCoverageReportPretty(enginePtr);
+        return nativeGetCoverageReportPretty(requireOpen());
    }
    
    /**
@@ -248,7 +257,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public void setGatherPrints(boolean b) {
-        nativeSetGatherPrints(enginePtr, b);
+        nativeSetGatherPrints(requireOpen(), b);
    }
    
    /**
@@ -258,7 +267,7 @@ public class Engine implements AutoCloseable, Cloneable {
     * 
     */
    public String takePrints() {
-        return nativeTakePrints(enginePtr);
+        return nativeTakePrints(requireOpen());
    }

    /**
@@ -267,24 +276,34 @@ public class Engine implements AutoCloseable, Cloneable {
     * @param config Policy length configuration.
     */
    public void setPolicyLengthConfig(PolicyLengthConfig config) {
-        nativeSetPolicyLengthConfig(enginePtr, config.maxCol, config.maxFileBytes, config.maxLines);
+        nativeSetPolicyLengthConfig(requireOpen(), config.maxCol, config.maxFileBytes, config.maxLines);
    }

    /**
     * Clear the policy length configuration, reverting to defaults.
     */
    public void clearPolicyLengthConfig() {
-        nativeClearPolicyLengthConfig(enginePtr);
+        nativeClearPolicyLengthConfig(requireOpen());
    }

    long getPtr() {
+        return requireOpen();
+    }
+
+    private long requireOpen() {
+        if (enginePtr == 0) {
+            throw new IllegalStateException("Engine is closed");
+        }
        return enginePtr;
    }

    
    @Override
    public void close() {
-        nativeDestroyEngine(enginePtr);
+        if (enginePtr != 0) {
+            nativeDestroyEngine(enginePtr);
+            enginePtr = 0;
+        }
    }

    // Loading native library from JAR is adapted from:
--- a/bindings/java/src/test/java/com/microsoft/regorus/EngineTest.java
+++ b/bindings/java/src/test/java/com/microsoft/regorus/EngineTest.java
@@ -22,8 +22,19 @@ public class EngineTest extends TestCase
                "package test\nmessage = concat(\", \", [input.message, data.message])"
            );
            engine.addDataJson("{\"message\":\"World!\"}");
+            engine.prepare();
            engine.setInputJson("{\"message\":\"Hello\"}");
            resJson = engine.evalQuery("data.test.message");
+
+            try (Engine template = engine.clone()) {
+                template.setInputJson("{\"message\":\"Hi\"}");
+                String templateResJson = template.evalQuery("data.test.message");
+                Map templateRes = new Gson().fromJson(templateResJson, Map.class);
+                ArrayList templateResults = (ArrayList) templateRes.get("result");
+                ArrayList templateExpressions = (ArrayList) ((Map) templateResults.get(0)).get("expressions");
+                Map templateExpression = (Map) templateExpressions.get(0);
+                Assert.assertEquals("Hi, World!", templateExpression.get("value"));
+            }
        }

        Gson gson = new Gson();
@@ -33,4 +44,28 @@ public class EngineTest extends TestCase
        Map expression = (Map) expressions.get(0);
        Assert.assertEquals("Hello, World!", expression.get("value"));
    }
+
+    public void test_closed_engine_operations_throw()
+    {
+        Engine engine = new Engine();
+        engine.close();
+
+        try {
+            engine.prepare();
+            fail("prepare should fail on closed engine");
+        } catch (IllegalStateException expected) {
+        }
+
+        try {
+            engine.clone();
+            fail("clone should fail on closed engine");
+        } catch (IllegalStateException expected) {
+        }
+
+        try {
+            engine.evalQuery("data");
+            fail("evalQuery should fail on closed engine");
+        } catch (IllegalStateException expected) {
+        }
+    }
 }
--- a/bindings/python/Cargo.lock
+++ b/bindings/python/Cargo.lock
@@ -103,9 +103,9 @@ checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"

 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -364,9 +364,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.17.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

 [[package]]
 name = "heck"
@@ -514,7 +514,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "serde",
 "serde_core",
 ]
@@ -545,9 +545,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "fc59d2432e047d6090ba1d83c782d0128bd6203857978218f5614dbd3287281f"
 dependencies = [
 "ahash",
 "bytecount",
@@ -963,9 +963,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "cb674900ca31acd75c4aaf63f48e43e719631c0539ea5a9e64163d1296bcb730"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -1613,9 +1613,9 @@ dependencies = [

 [[package]]
 name = "zerofrom"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
 "zerofrom-derive",
 ]
--- a/bindings/python/src/lib.rs
+++ b/bindings/python/src/lib.rs
@@ -463,6 +463,13 @@ impl Engine {
        self.engine.take_prints()
    }

+    /// Prepare internal evaluation structures without executing a query.
+    ///
+    /// Optional: if skipped, first evaluation performs the same setup.
+    pub fn prepare(&mut self) -> Result<()> {
+        self.engine.prepare()
+    }
+
    /// Clone a [`Engine`]
    ///
    /// To avoid having to parse same policy again, the engine can be cloned
--- a/bindings/python/test.py
+++ b/bindings/python/test.py
@@ -87,6 +87,7 @@ report = engine.get_coverage_report_pretty()
 print(report)

 # Clone engine
+engine.prepare()
 engine1 = engine.clone()


--- a/bindings/ruby/Cargo.lock
+++ b/bindings/ruby/Cargo.lock
@@ -121,9 +121,9 @@ checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"

 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -393,9 +393,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.17.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

 [[package]]
 name = "heck"
@@ -543,7 +543,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "serde",
 "serde_core",
 ]
@@ -583,9 +583,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "fc59d2432e047d6090ba1d83c782d0128bd6203857978218f5614dbd3287281f"
 dependencies = [
 "ahash",
 "bytecount",
@@ -994,9 +994,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "cb674900ca31acd75c4aaf63f48e43e719631c0539ea5a9e64163d1296bcb730"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -1672,9 +1672,9 @@ dependencies = [

 [[package]]
 name = "zerofrom"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
 "zerofrom-derive",
 ]
--- a/bindings/ruby/ext/regorusrb/src/lib.rs
+++ b/bindings/ruby/ext/regorusrb/src/lib.rs
@@ -115,6 +115,13 @@ impl Engine {
        Ok(())
    }

+    fn prepare(&self) -> Result<(), Error> {
+        self.engine
+            .borrow_mut()
+            .prepare()
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to prepare engine: {e}")))
+    }
+
    fn get_packages(&self) -> Result<Vec<String>, Error> {
        self.engine
            .borrow()
@@ -373,6 +380,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
        method!(Engine::add_data_from_json_file, 1),
    )?;
    engine_class.define_method("clear_data", method!(Engine::clear_data, 0))?;
+    engine_class.define_method("prepare", method!(Engine::prepare, 0))?;

    // input operations
    engine_class.define_method("set_input", method!(Engine::set_input, 1))?;
--- a/bindings/ruby/test/test_regorus.rb
+++ b/bindings/ruby/test/test_regorus.rb
@@ -150,6 +150,7 @@ class TestRegorus < Minitest::Test
  end

  def test_engine_cloning
+    @engine.prepare
    cloned_engine = @engine.clone

    assert_instance_of ::Regorus::Engine, cloned_engine
--- a/bindings/wasm/Cargo.lock
+++ b/bindings/wasm/Cargo.lock
@@ -120,9 +120,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"

 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -396,9 +396,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.17.1"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

 [[package]]
 name = "heck"
@@ -546,7 +546,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
 "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown 0.17.0",
 "serde",
 "serde_core",
 ]
@@ -577,9 +577,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a5fe5206f06e589caf25e79fc05ccdf91fca745685fe9fe1a13bbdfb479a631"
+checksum = "fc59d2432e047d6090ba1d83c782d0128bd6203857978218f5614dbd3287281f"
 dependencies = [
 "ahash",
 "bytecount",
@@ -953,9 +953,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.46.5"
+version = "0.46.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4e17ef386c5383591d07623d3de49cbc601156e7582973e6db98d66a57de2"
+checksum = "cb674900ca31acd75c4aaf63f48e43e719631c0539ea5a9e64163d1296bcb730"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -1692,9 +1692,9 @@ dependencies = [

 [[package]]
 name = "zerofrom"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
 "zerofrom-derive",
 ]
--- a/bindings/wasm/README.md
+++ b/bindings/wasm/README.md
@@ -21,3 +21,9 @@ Run `cargo xtask build-wasm` to invoke wasm-pack with sensible defaults, or `car
 ## Usage

 See [test.js](https://github.com/microsoft/regorus/blob/main/bindings/wasm/test.js) for example usage.
+
+For best performance with large policies, call `engine.prepare()` after loading
+policy/data, then use `engine.clone()` to create per-request engines. If
+`prepare()` is skipped, the first `eval*` call performs the same one-time
+setup. Adding/changing policy or data after `prepare()` invalidates the
+prepared state.
--- a/bindings/wasm/src/lib.rs
+++ b/bindings/wasm/src/lib.rs
@@ -138,6 +138,17 @@ impl Engine {
        self.engine.set_rego_v0(enable)
    }

+    /// Clone this engine.
+    ///
+    /// Useful for creating per-request engines after loading policy/data once.
+    ///
+    /// Clone is designed to avoid reparsing policy text and reloading immutable
+    /// policy structures. Mutable evaluation state is copied for isolation.
+    #[wasm_bindgen(js_name = "clone")]
+    pub fn cloneEngine(&self) -> Engine {
+        Clone::clone(self)
+    }
+
    /// Add a policy
    ///
    /// The policy is parsed into AST.
@@ -158,6 +169,20 @@ impl Engine {
        self.engine.add_data(data).map_err(error_to_jsvalue)
    }

+    /// Prepare the engine for evaluation.
+    ///
+    /// The first evaluation on an unprepared engine performs one-time setup.
+    /// Calling `prepare()` performs that setup eagerly.
+    ///
+    /// This is optional for correctness. If omitted, the first `eval*` call
+    /// implicitly performs preparation.
+    ///
+    /// If policies/data are modified after `prepare()`, preparation is
+    /// invalidated and must be performed again (explicitly or via first eval).
+    pub fn prepare(&mut self) -> Result<(), JsValue> {
+        self.engine.prepare().map_err(error_to_jsvalue)
+    }
+
    /// Get the list of packages defined by loaded policies.
    ///
    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.get_packages
@@ -487,6 +512,9 @@ mod tests {
        )?;
        assert_eq!(pkg, "data.test");

+        // Prepare before first evaluation.
+        engine.prepare()?;
+
        let results = engine.evalQuery("data".to_string())?;
        let r = regorus::Value::from_json_str(&results).map_err(error_to_jsvalue)?;

--- a/bindings/wasm/test.js
+++ b/bindings/wasm/test.js
@@ -40,6 +40,13 @@ engine.addDataJson(`
 }
 `);

+// Prepare internal evaluation structures once.
+engine.prepare();
+
+// Clone a prepared template engine for reuse.
+var template = engine.clone();
+engine = template.clone();
+
 // Set policy input
 engine.setInputJson(`
 {
--- a/examples/regorus/azure_policy.rs
+++ b/examples/regorus/azure_policy.rs
@@ -23,7 +23,8 @@ use regorus::languages::azure_policy::aliases::AliasRegistry;
 use regorus::languages::azure_policy::compiler;
 use regorus::languages::azure_policy::parser;
 use regorus::rvm::RegoVM;
-use regorus::{Rc, Source, Value};
+use regorus::Source;
+use regorus::Value;

 /// Evaluate an Azure Policy definition against a resource.
 ///
@@ -59,8 +60,11 @@ pub fn azure_policy_eval(
    println!("Parsed policy definition from {policy_definition}");

    // 3. Compile to RVM bytecode.
-    let registry = Rc::new(registry);
-    let program = compiler::compile_policy_definition_with_aliases(&defn, Rc::clone(&registry))?;
+    let program = compiler::compile_policy_definition_with_aliases(
+        &defn,
+        registry.alias_map(),
+        registry.alias_modifiable_map(),
+    )?;
    println!("Compiled policy to RVM bytecode");

    // 4. Build normalized input.
@@ -134,7 +138,7 @@ pub fn azure_policy_aliases(aliases: String, resource_type: Option<String>) -> R
    if let Some(ref rt) = resource_type {
        let rt_lower = rt.to_lowercase();
        let mut found = false;
-        for alias_name in registry.alias_map().keys() {
+        for (alias_name, _) in registry.alias_map() {
            if alias_name.to_lowercase().starts_with(&rt_lower) {
                println!("  {alias_name}");
                found = true;
@@ -144,7 +148,7 @@ pub fn azure_policy_aliases(aliases: String, resource_type: Option<String>) -> R
            bail!("no aliases found for resource type '{rt}'");
        }
    } else {
-        for alias_name in registry.alias_map().keys() {
+        for (alias_name, _) in registry.alias_map() {
            println!("  {alias_name}");
        }
    }
--- a/src/engine.rs
+++ b/src/engine.rs
@@ -505,6 +505,47 @@ impl Engine {
        self.add_data(Value::from_json_str(data_json)?)
    }

+    /// Prepare the engine for evaluation without executing a query or rule.
+    ///
+    /// The first evaluation on an unprepared engine performs one-time setup
+    /// (analysis, scheduling, imports/rules processing, and initialization of
+    /// internal evaluation structures). Calling this method performs that work
+    /// eagerly so a later call to [`Engine::eval_rule`] / [`Engine::eval_query`]
+    /// does not pay that startup cost.
+    ///
+    /// This method is optional for correctness. If omitted, the first
+    /// evaluation will implicitly prepare the engine.
+    ///
+    /// Preparation is invalidated when policy/data that affects evaluation is
+    /// changed (for example: [`Engine::add_policy`], [`Engine::add_policy_from_file`],
+    /// [`Engine::add_data`], [`Engine::clear_data`]). In those cases, the next
+    /// evaluation (or another explicit call to `prepare`) performs setup again.
+    ///
+    /// This is especially useful before cloning template engines used for
+    /// repeated evaluations.
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    /// engine.add_policy("test.rego".to_string(), r#"
+    ///   package test
+    ///   import rego.v1
+    ///   allow if input.user == "alice"
+    /// "#.to_string())?;
+    ///
+    /// engine.prepare()?;
+    /// let mut cloned = engine.clone();
+    ///
+    /// cloned.set_input_json(r#"{"user":"alice"}"#)?;
+    /// assert_eq!(cloned.eval_rule("data.test.allow".to_string())?, Value::from(true));
+    /// # Ok(())
+    /// # }
+    /// ```
+    pub fn prepare(&mut self) -> Result<()> {
+        self.prepare_for_eval(false, false)
+    }
+
    /// Set whether builtins should raise errors strictly or not.
    ///
    /// Regorus differs from OPA in that by default builtins will
@@ -1084,9 +1125,10 @@ impl Engine {
        limits::enforce_memory_limit().map_err(|err| anyhow!(err))?;

        self.interpreter.set_traces(enable_tracing);
+        let newly_prepared = !self.prepared;

        // if the data/policies have changed or the interpreter has never been prepared
-        if !self.prepared {
+        if newly_prepared {
            // Analyze the modules and determine how statements must be scheduled.
            let analyzer = Analyzer::new();
            let schedule = Rc::new(analyzer.analyze(&self.modules)?);
@@ -1116,23 +1158,28 @@ impl Engine {

            // Set schedule after hoisting completes
            self.interpreter.set_schedule(Some(schedule));
+        }

-            #[cfg(feature = "azure_policy")]
+        #[cfg(feature = "azure_policy")]
+        {
            if for_target {
-                // Resolve and validate target specifications across all modules
+                // Resolve and validate target specifications across all modules.
+                // This must run for target-aware compilation even if generic prepare()
+                // was already called.
                crate::interpreter::target::resolve::resolve_and_apply_target(
                    &mut self.interpreter,
                )?;
                // Infer resource types
                crate::interpreter::target::infer::infer_resource_type(&mut self.interpreter)?;
-            }
-
-            if !for_target {
-                // Check if any module specifies a target and warn if so
-                #[cfg(feature = "azure_policy")]
+            } else if newly_prepared {
+                // Check if any module specifies a target and warn if so.
                self.warn_if_targets_present();
            }
+        }
+        #[cfg(not(feature = "azure_policy"))]
+        let _ = for_target;

+        if newly_prepared {
            self.prepared = true;
        }

--- a/src/interpreter.rs
+++ b/src/interpreter.rs
@@ -1782,7 +1782,6 @@ impl Interpreter {

                let mut comps = self.eval_rule_ref(&rule_ref)?;
                if let Some(ke) = &key_expr {
-                    is_const_rule = is_const_rule && Self::is_simple_literal(ke)?;
                    comps.push(self.eval_expr(ke)?);
                }
                let output = if let Some(oe) = &output_expr {
--- a/src/languages/azure_policy/aliases/mod.rs
+++ b/src/languages/azure_policy/aliases/mod.rs
@@ -172,31 +172,11 @@ impl AliasRegistry {
        let prefix = alloc::format!("{}/", fq_type);

        for alias in aliases {
-            // Skip aliases without a default_path — the normalizer's
-            // resolve_resource_type also skips these, so inserting them into
-            // compiler maps would cause a divergence where the compiler
-            // resolves the alias but normalized input never contains the field.
-            if alias.default_path.is_none() {
-                continue;
-            }
-
            // Derive the short name by stripping the resource type prefix.
            let raw_short = if alias.name.len() > prefix.len()
-                && alias
-                    .name
-                    .get(..prefix.len())
-                    .is_some_and(|s| s.eq_ignore_ascii_case(&prefix))
+                && alias.name[..prefix.len()].eq_ignore_ascii_case(&prefix)
            {
-                // Both slice boundaries are valid: prefix is ASCII
-                // (resource type + '/'), so if `..prefix.len()` succeeded
-                // above, `prefix.len()..` is guaranteed to be on a char
-                // boundary too.  The `unwrap_or` is a defensive fallback
-                // that can never trigger for well-formed Azure alias names.
-                alias
-                    .name
-                    .get(prefix.len()..)
-                    .unwrap_or(&alias.name)
-                    .to_string()
+                alias.name[prefix.len()..].to_string()
            } else if let Some(rest) = alias
                .name
                .rfind('/')
@@ -280,19 +260,20 @@ impl AliasRegistry {
            .map(String::as_str)
    }

-    /// Return a reference to the alias-to-short-name map.
+    /// Return a clone of the alias-to-short-name map for use by the compiler.
    ///
-    /// Keys are lowercase fully-qualified alias names; values are short names.
-    pub const fn alias_map(&self) -> &BTreeMap<String, String> {
-        &self.alias_to_short
+    /// The compiler stores this map internally so it can resolve fully-qualified
+    /// alias names without holding a reference to the registry.
+    pub fn alias_map(&self) -> BTreeMap<String, String> {
+        self.alias_to_short.clone()
    }

-    /// Return a reference to the alias-to-modifiable map.
+    /// Return a clone of the alias-to-modifiable map for use by the compiler.
    ///
-    /// Keys are lowercase fully-qualified alias names; values are `true` when
-    /// the alias has `defaultMetadata.attributes = "Modifiable"`.
-    pub const fn alias_modifiable_map(&self) -> &BTreeMap<String, bool> {
-        &self.alias_modifiable
+    /// Maps lowercase fully-qualified alias names to `true` when the alias
+    /// has `defaultMetadata.attributes = "Modifiable"`.
+    pub fn alias_modifiable_map(&self) -> BTreeMap<String, bool> {
+        self.alias_modifiable.clone()
    }

    /// Normalize a raw ARM resource and wrap it in the input envelope.
--- a/src/languages/azure_policy/aliases/normalizer/alias_resolution.rs
+++ b/src/languages/azure_policy/aliases/normalizer/alias_resolution.rs
@@ -4,13 +4,14 @@
 //! Per-alias path resolution: reads values from versioned ARM paths and places
 //! them at alias short name paths in the normalized output.

-use crate::Rc;
+use alloc::string::String;
+
 use crate::Value;

 use super::super::obj_map::remove_element_field;
 use super::super::obj_map::{
-    collision_safe_key, is_root_field_collision, obj_contains, obj_insert, obj_insert_rc,
-    obj_remove, set_nested_lowercased, ObjMap,
+    collision_safe_key, is_root_field_collision, obj_contains, obj_insert, obj_remove,
+    set_nested_lowercased, ObjMap,
 };
 use super::super::types::ResolvedAliases;
 use super::element_remap::apply_element_remap_precomputed;
@@ -47,14 +48,12 @@ pub fn apply_alias_entries(
        if let Some(value) = value {
            let value = normalize_value(&value, &entry.short_name, None);

-            if is_root_field_collision(&entry.short_name, &entry.default_path) {
-                let target = collision_safe_key(&entry.short_name);
-                set_nested_lowercased(result, &target, value);
-            } else if entry.short_name.contains('.') {
-                set_nested_lowercased(result, &entry.short_name, value);
+            let target = if is_root_field_collision(&entry.short_name, &entry.default_path) {
+                collision_safe_key(&entry.short_name)
            } else {
-                obj_insert_rc(result, Rc::clone(&entry.short_name_lc), value);
-            }
+                entry.short_name.clone()
+            };
+            set_nested_lowercased(result, &target, value);
        }
    }

@@ -85,13 +84,13 @@ pub fn apply_alias_entries(
 }

 /// Navigate an ARM path using precomputed segments (avoids per-call split).
-fn navigate_arm_path_segments(value: &Value, segments: &[Rc<str>]) -> Option<Value> {
+fn navigate_arm_path_segments(value: &Value, segments: &[String]) -> Option<Value> {
    let mut current = value;
    for segment in segments {
        current = current
            .as_object()
            .ok()?
-            .get(&Value::String(Rc::clone(segment)))?;
+            .get(&Value::from(segment.as_str()))?;
    }
    Some(current.clone())
 }
--- a/src/languages/azure_policy/aliases/obj_map.rs
+++ b/src/languages/azure_policy/aliases/obj_map.rs
@@ -7,7 +7,7 @@
 //! then converts to `Value::Object` (a `BTreeMap<Value, Value>`) only at
 //! the output boundary via [`make_value`].

-use alloc::string::String;
+use alloc::string::{String, ToString as _};
 use alloc::vec::Vec;

 use hashbrown::HashMap;
@@ -41,33 +41,6 @@ pub fn obj_insert(map: &mut ObjMap, key: &str, val: Value) {
    map.insert(Rc::from(key), val);
 }

-/// Insert a key-value pair using a pre-allocated `Rc<str>` key.
-///
-/// Avoids the `Rc::from(key)` heap allocation that [`obj_insert`] performs.
-pub fn obj_insert_rc(map: &mut ObjMap, key: Rc<str>, val: Value) {
-    map.insert(key, val);
-}
-
-/// Lowercase a string, returning an `Rc<str>`.
-///
-/// Both paths allocate an `Rc<str>` (header + string bytes).  The fast-path
-/// avoids creating an intermediate lowercased `String` when the input is
-/// already all-lowercase ASCII.
-pub fn rc_lowercase(s: &str) -> Rc<str> {
-    if s.bytes().all(|b| !b.is_ascii_uppercase()) {
-        Rc::from(s)
-    } else {
-        Rc::from(s.to_ascii_lowercase())
-    }
-}
-
-/// Insert a key-value pair with the key lowercased, using [`rc_lowercase`]
-/// for the allocation fast-path.
-pub fn obj_insert_lc(map: &mut ObjMap, key: &str, val: Value) {
-    let lc = rc_lowercase(key);
-    map.insert(lc, val);
-}
-
 /// Check whether a key exists.
 pub fn obj_contains(map: &ObjMap, key: &str) -> bool {
    map.contains_key(key)
@@ -139,7 +112,7 @@ pub fn set_nested_lowercased(result: &mut ObjMap, path: &str, value: Value) {
    }
    if segments.len() == 1 {
        if let Some(&seg) = segments.first() {
-            obj_insert_lc(result, seg, value);
+            obj_insert(result, &seg.to_ascii_lowercase(), value);
        }
        return;
    }
@@ -171,28 +144,28 @@ fn set_nested_inner(obj: &mut ObjMap, segments: &[&str], value: Value, lowercase
    };

    if segments.len() == 1 {
-        let key: Rc<str> = if lowercase {
-            rc_lowercase(first)
+        let key = if lowercase {
+            first.to_ascii_lowercase()
        } else {
-            Rc::from(first)
+            first.to_string()
        };
-        obj_insert_rc(obj, key, value);
+        obj_insert(obj, &key, value);
        return;
    }

-    let seg: Rc<str> = if lowercase {
-        rc_lowercase(first)
+    let seg = if lowercase {
+        first.to_ascii_lowercase()
    } else {
-        Rc::from(first)
+        first.to_string()
    };

    // Ensure an intermediate object exists at `seg`.
-    if !obj.contains_key(&*seg) {
-        obj_insert_rc(obj, Rc::clone(&seg), make_value(new_map()));
+    if !obj_contains(obj, &seg) {
+        obj_insert(obj, &seg, make_value(new_map()));
    }

    // Descend directly into the BTreeMap, avoiding ObjMap round-trip.
-    if let Some(Value::Object(inner_rc)) = obj.get_mut(&*seg) {
+    if let Some(Value::Object(inner_rc)) = obj_get_mut(obj, &seg) {
        let inner_btree = Rc::make_mut(inner_rc);
        set_nested_in_btree(
            inner_btree,
@@ -218,12 +191,12 @@ pub fn set_nested_in_btree(
        return;
    };

-    let key_rc: Rc<str> = if lowercase {
-        rc_lowercase(first)
+    let key_str: String = if lowercase {
+        first.to_ascii_lowercase()
    } else {
-        Rc::from(first)
+        first.to_string()
    };
-    let key_val = Value::String(Rc::clone(&key_rc));
+    let key_val = Value::String(Rc::from(key_str.as_str()));

    if segments.len() == 1 {
        btree.insert(key_val, value);
@@ -270,24 +243,13 @@ pub const ROOT_FIELDS: &[&str] = &[
    "extendedLocation",
 ];

-const PROPERTIES_DOT: &[u8] = b"properties.";
-
 /// Check whether an alias short name collides with a reserved ARM root field
 /// and needs a collision-safe key.
 pub fn is_root_field_collision(short_name: &str, default_path: &str) -> bool {
    ROOT_FIELDS
        .iter()
        .any(|f| f.eq_ignore_ascii_case(short_name))
-        && default_path.len() > PROPERTIES_DOT.len()
-        && default_path
-            .as_bytes()
-            .get(..PROPERTIES_DOT.len())
-            .is_some_and(|prefix| {
-                prefix
-                    .iter()
-                    .zip(PROPERTIES_DOT)
-                    .all(|(a, b)| a.to_ascii_lowercase() == *b)
-            })
+        && default_path.to_ascii_lowercase().starts_with("properties.")
 }

 /// Return a collision-safe key for an alias whose short name collides with a
--- a/src/languages/azure_policy/aliases/types.rs
+++ b/src/languages/azure_policy/aliases/types.rs
@@ -18,22 +18,6 @@ use alloc::vec::Vec;

 use serde::{Deserialize, Deserializer};

-use crate::Rc;
-
-// ---------------------------------------------------------------------------
-// Deserialization helpers
-// ---------------------------------------------------------------------------
-
-/// Deserialize a `Vec<T>` that tolerates JSON `null` by mapping it to an
-/// empty vector.
-fn deserialize_null_as_empty_vec<'de, T, D>(deserializer: D) -> Result<Vec<T>, D::Error>
-where
-    T: Deserialize<'de>,
-    D: Deserializer<'de>,
-{
-    Ok(Option::<Vec<T>>::deserialize(deserializer)?.unwrap_or_default())
-}
-
 // ─── Top-level response wrappers ────────────────────────────────────────────

 /// ARM API response envelope: `{ "value": [...] }`
@@ -114,10 +98,7 @@ pub struct AliasEntry {

    /// Versioned path entries.  Empty for the vast majority of aliases that
    /// have only a `defaultPath`.
-    ///
-    /// In real Azure catalog data (~97% of aliases), `az provider list` emits
-    /// `"paths": null` rather than an empty array.
-    #[serde(default, deserialize_with = "deserialize_null_as_empty_vec")]
+    #[serde(default)]
    pub paths: Vec<AliasPath>,
 }

@@ -423,13 +404,11 @@ pub struct ResolvedEntry {
    // ── Precomputed fields (derived at registry-load time) ──────────────
    /// Whether `short_name` contains `[*]` (i.e., this is a wildcard/array alias).
    pub is_wildcard: bool,
-    /// Pre-lowercased short name as `Rc<str>` for allocation-free common-case inserts.
-    pub(crate) short_name_lc: Rc<str>,
    /// Precomputed `default_path.split('.').collect()` for fast ARM path navigation.
-    pub(crate) default_path_segments: Vec<Rc<str>>,
+    pub default_path_segments: Vec<String>,
    /// Precomputed path segments for each versioned path, in the same order
    /// as `versioned_paths`.
-    pub(crate) versioned_path_segments: Vec<Vec<Rc<str>>>,
+    pub versioned_path_segments: Vec<Vec<String>>,
 }

 impl ResolvedEntry {
@@ -441,15 +420,10 @@ impl ResolvedEntry {
        metadata: Option<AliasPathMetadata>,
    ) -> Self {
        let is_wildcard = short_name.contains("[*]");
-        let short_name_lc = if short_name.bytes().all(|b| !b.is_ascii_uppercase()) {
-            Rc::from(short_name.as_str())
-        } else {
-            Rc::from(short_name.to_ascii_lowercase())
-        };
-        let default_path_segments = default_path.split('.').map(Rc::from).collect();
+        let default_path_segments = default_path.split('.').map(String::from).collect();
        let versioned_path_segments = versioned_paths
            .iter()
-            .map(|(_, p)| p.split('.').map(Rc::from).collect())
+            .map(|(_, p)| p.split('.').map(String::from).collect())
            .collect();
        Self {
            short_name,
@@ -457,7 +431,6 @@ impl ResolvedEntry {
            versioned_paths,
            metadata,
            is_wildcard,
-            short_name_lc,
            default_path_segments,
            versioned_path_segments,
        }
@@ -483,7 +456,7 @@ impl ResolvedEntry {
    /// Returns the versioned segments if `api_version` matches, otherwise
    /// the default segments.  This avoids per-call `split('.')` for both
    /// default and versioned scalar alias navigation.
-    pub(crate) fn select_path_segments(&self, api_version: Option<&str>) -> &[Rc<str>] {
+    pub fn select_path_segments(&self, api_version: Option<&str>) -> &[String] {
        if let Some(ver) = api_version {
            for (i, (v, _)) in self.versioned_paths.iter().enumerate() {
                if v.eq_ignore_ascii_case(ver) {
--- a/src/languages/azure_policy/compiler/core.rs
+++ b/src/languages/azure_policy/compiler/core.rs
@@ -18,7 +18,6 @@ use crate::rvm::program::{Program, SpanInfo};
 use crate::rvm::Instruction;
 use crate::{Rc, Value};

-use crate::languages::azure_policy::aliases::AliasRegistry;
 use crate::languages::azure_policy::ast::PolicyRule;

 // ---------------------------------------------------------------------------
@@ -45,9 +44,10 @@ pub(super) struct Compiler {
    pub(super) cached_input_reg: Option<u8>,
    /// Cached register for `LoadContext` — allocated once on first use.
    pub(super) cached_context_reg: Option<u8>,
-    /// Alias registry for resolving fully-qualified alias names.
-    /// Shared via `Rc` to avoid cloning the 73K-entry alias maps.
-    pub(super) alias_registry: Option<Rc<AliasRegistry>>,
+    /// Map from lowercase fully-qualified alias name → short name.
+    pub(super) alias_map: BTreeMap<String, String>,
+    /// Map from lowercase fully-qualified alias name → modifiable flag.
+    pub(super) alias_modifiable: BTreeMap<String, bool>,
    /// Default values for policy parameters.
    pub(super) parameter_defaults: Option<Value>,
    /// Cached literal-table index for `parameter_defaults` (or an empty object
@@ -338,13 +338,8 @@ impl Compiler {
        path: &str,
        span: &crate::lexer::Span,
    ) -> Result<String> {
-        let alias_map = match &self.alias_registry {
-            Some(reg) => reg.alias_map(),
-            None => return Ok(path.to_string()),
-        };
-
        let lc = path.to_ascii_lowercase();
-        if let Some(short) = alias_map.get(&lc) {
+        if let Some(short) = self.alias_map.get(&lc) {
            let resolved = short.clone();
            let result = Self::strip_fq_prefix(&resolved).to_ascii_lowercase();
            return Ok(result);
@@ -353,7 +348,7 @@ impl Compiler {
        // Fallback: derive array path from a corresponding `[*]` alias.
        if !lc.contains("[*]") {
            let wildcard_key = alloc::format!("{}[*]", lc);
-            if let Some(short) = alias_map.get(&wildcard_key) {
+            if let Some(short) = self.alias_map.get(&wildcard_key) {
                let resolved = Self::strip_fq_prefix(short).to_ascii_lowercase();
                if let Some(base) = resolved.strip_suffix("[*]") {
                    return Ok(base.to_string());
@@ -361,14 +356,14 @@ impl Compiler {
            }
        }

-        if !alias_map.is_empty() && !self.alias_fallback_to_raw {
+        if !self.alias_map.is_empty() && !self.alias_fallback_to_raw {
            bail!(span.error(&alloc::format!(
                "unknown alias '{}': field references must use fully-qualified alias names when an alias catalog is loaded",
                path
            )));
        }

-        if alias_map.is_empty() {
+        if self.alias_map.is_empty() {
            Ok(path.to_string())
        } else {
            let result = Self::strip_fq_prefix(path).to_ascii_lowercase();
--- a/src/languages/azure_policy/compiler/count.rs
+++ b/src/languages/azure_policy/compiler/count.rs
@@ -998,13 +998,7 @@ impl Compiler {
                    return Ok(result);
                }
            }
-            Err(e)
-                if self
-                    .alias_registry
-                    .as_ref()
-                    .is_some_and(|r| !r.alias_map().is_empty())
-                    && !self.alias_fallback_to_raw =>
-            {
+            Err(e) if !self.alias_map.is_empty() && !self.alias_fallback_to_raw => {
                return Err(e);
            }
            _ => {}
--- a/src/languages/azure_policy/compiler/effects.rs
+++ b/src/languages/azure_policy/compiler/effects.rs
@@ -692,18 +692,13 @@ impl Compiler {
        field_path: &str,
        span: &crate::lexer::Span,
    ) -> Result<()> {
-        let modifiable_map = match &self.alias_registry {
-            Some(reg) => reg.alias_modifiable_map(),
-            None => return Ok(()),
-        };
-
-        if modifiable_map.is_empty() {
+        if self.alias_modifiable.is_empty() {
            return Ok(());
        }

        let lc = field_path.to_lowercase();

-        if let Some(&modifiable) = modifiable_map.get(&lc) {
+        if let Some(&modifiable) = self.alias_modifiable.get(&lc) {
            if !modifiable {
                bail!(span.error(&format!(
                    "alias '{}' is not modifiable (defaultMetadata.attributes != 'Modifiable')",
@@ -808,6 +803,7 @@ fn unescape_arm_literal(s: &str) -> alloc::string::String {
 /// 1. Build a template `BTreeMap` with `Value::Undefined` placeholders.
 /// 2. Sort keys by their literal value (BTreeMap order).
 /// 3. Emit `ObjectCreate`.
+#[allow(clippy::indexing_slicing)]
 pub(super) fn build_object_from_keys(
    compiler: &mut Compiler,
    mut keys: Vec<(u16, u8)>,
@@ -816,33 +812,17 @@ pub(super) fn build_object_from_keys(
    // Build template: object with all keys set to Undefined.
    let mut template = BTreeMap::new();
    for &(key_idx, _) in &keys {
-        // key_idx was returned by `add_literal_u16` in the calling code,
-        // so it is always in bounds.  We use `.get()` + `?` instead of
-        // direct indexing to satisfy the crate-wide `deny(indexing_slicing)`.
-        let key_val = compiler
-            .program
-            .literals
-            .get(usize::from(key_idx))
-            .ok_or_else(|| {
-                anyhow!(
-                    "internal error in build_object_from_keys: \
-                     literal index {} out of bounds (literals len = {})",
-                    key_idx,
-                    compiler.program.literals.len()
-                )
-            })?
-            .clone();
+        // SAFETY: key_idx was just returned by `add_literal_u16`, so the
+        // index is guaranteed to be in bounds.
+        let key_val = compiler.program.literals[usize::from(key_idx)].clone();
        template.insert(key_val, Value::Undefined);
    }
    let template_idx = compiler.add_literal_u16(Value::Object(crate::Rc::new(template)))?;

-    // Sort keys by literal value (BTreeMap order).  All indices were
-    // validated in the loop above (which returns Err for out-of-bounds),
-    // so `.get()` always returns `Some` here — `None` is unreachable.
+    // Sort keys by literal value (BTreeMap order).
    keys.sort_by(|a, b| {
-        let a_val = compiler.program.literals.get(usize::from(a.0));
-        let b_val = compiler.program.literals.get(usize::from(b.0));
-        a_val.cmp(&b_val)
+        compiler.program.literals[usize::from(a.0)]
+            .cmp(&compiler.program.literals[usize::from(b.0)])
    });

    let dest = compiler.alloc_register()?;
--- a/src/languages/azure_policy/compiler/mod.rs
+++ b/src/languages/azure_policy/compiler/mod.rs
@@ -30,11 +30,11 @@ mod metadata;
 mod template_dispatch;
 mod utils;

-use alloc::string::ToString as _;
+use alloc::collections::BTreeMap;
+use alloc::string::{String, ToString as _};

 use anyhow::Result;

-use crate::languages::azure_policy::aliases::AliasRegistry;
 use crate::languages::azure_policy::ast::{PolicyDefinition, PolicyRule};
 use crate::rvm::program::Program;
 use crate::{Rc, Value};
@@ -69,14 +69,17 @@ pub fn compile_policy_rule(rule: &PolicyRule) -> Result<Rc<Program>> {

 /// Compile a parsed Azure Policy rule with alias resolution.
 ///
-/// The registry provides alias-to-short-name resolution and modifiability
-/// data.  Pass it as an `Rc` to avoid cloning the internal alias maps.
+/// The `alias_map` maps lowercase fully-qualified alias names to their short
+/// names.  Obtain it from
+/// [`AliasRegistry::alias_map()`](crate::languages::azure_policy::aliases::AliasRegistry::alias_map).
 pub fn compile_policy_rule_with_aliases(
    rule: &PolicyRule,
-    registry: Rc<AliasRegistry>,
+    alias_map: BTreeMap<String, String>,
+    alias_modifiable: BTreeMap<String, bool>,
 ) -> Result<Rc<Program>> {
    let mut compiler = Compiler::new();
-    compiler.alias_registry = Some(registry);
+    compiler.alias_map = alias_map;
+    compiler.alias_modifiable = alias_modifiable;
    init_effect_annotation(&mut compiler, rule);
    compiler.compile(rule)
 }
@@ -97,10 +100,12 @@ pub fn compile_policy_definition(defn: &PolicyDefinition) -> Result<Rc<Program>>
 /// Compile a parsed Azure Policy definition with alias resolution.
 pub fn compile_policy_definition_with_aliases(
    defn: &PolicyDefinition,
-    registry: Rc<AliasRegistry>,
+    alias_map: BTreeMap<String, String>,
+    alias_modifiable: BTreeMap<String, bool>,
 ) -> Result<Rc<Program>> {
    let mut compiler = Compiler::new();
-    compiler.alias_registry = Some(registry);
+    compiler.alias_map = alias_map;
+    compiler.alias_modifiable = alias_modifiable;
    compiler.parameter_defaults = Some(build_parameter_defaults(&defn.parameters)?);
    compiler.populate_definition_metadata(defn);
    init_effect_annotation(&mut compiler, &defn.policy_rule);
@@ -114,11 +119,13 @@ pub fn compile_policy_definition_with_aliases(
 /// a known alias are silently treated as raw property paths.
 pub fn compile_policy_definition_with_aliases_opts(
    defn: &PolicyDefinition,
-    registry: Rc<AliasRegistry>,
+    alias_map: BTreeMap<String, String>,
+    alias_modifiable: BTreeMap<String, bool>,
    alias_fallback_to_raw: bool,
 ) -> Result<Rc<Program>> {
    let mut compiler = Compiler::new();
-    compiler.alias_registry = Some(registry);
+    compiler.alias_map = alias_map;
+    compiler.alias_modifiable = alias_modifiable;
    compiler.alias_fallback_to_raw = alias_fallback_to_raw;
    compiler.parameter_defaults = Some(build_parameter_defaults(&defn.parameters)?);
    compiler.populate_definition_metadata(defn);
--- a/src/languages/rego/compiler/error.rs
+++ b/src/languages/rego/compiler/error.rs
@@ -63,14 +63,6 @@ pub enum CompilerError {
    #[error("Invalid function expression with package")]
    InvalidFunctionExpressionWithPackage,

-    #[error("partial object rules with constant keys are not yet supported by the RVM compiler")]
-    PartialObjectConstantKeyUnsupported,
-
-    #[error(
-        "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    )]
-    PartialObjectNestedKeyUnsupported,
-
    #[error("Compilation error: {message}")]
    General { message: String },
 }
--- a/src/languages/rego/compiler/rules.rs
+++ b/src/languages/rego/compiler/rules.rs
@@ -59,7 +59,7 @@ impl<'a> Compiler<'a> {
                            crate::ast::Expr::RefBrack { .. } if assign.is_some() => {
                                RuleType::PartialObject
                            }
-                            crate::ast::Expr::RefBrack { .. } => RuleType::PartialObject,
+                            crate::ast::Expr::RefBrack { .. } => RuleType::PartialSet,
                            _ => RuleType::Complete,
                        },
                        _ => RuleType::Complete,
@@ -88,54 +88,6 @@ impl<'a> Compiler<'a> {
        })
    }

-    fn validate_partial_object_shape(&self, refr: &ExprRef) -> Result<()> {
-        let Expr::RefBrack {
-            refr: prefix,
-            index,
-            ..
-        } = refr.as_ref()
-        else {
-            return Ok(());
-        };
-
-        if Self::has_unsupported_bracket_prefix(prefix) {
-            return Err(CompilerError::PartialObjectNestedKeyUnsupported.at(refr.span()));
-        }
-
-        if Self::is_simple_literal(index) {
-            return Err(CompilerError::PartialObjectConstantKeyUnsupported.at(index.span()));
-        }
-
-        Ok(())
-    }
-
-    fn has_unsupported_bracket_prefix(expr: &ExprRef) -> bool {
-        match expr.as_ref() {
-            Expr::RefBrack { refr, index, .. } => {
-                !Self::is_string_literal(index) || Self::has_unsupported_bracket_prefix(refr)
-            }
-            Expr::RefDot { refr, .. } => Self::has_unsupported_bracket_prefix(refr),
-            _ => false,
-        }
-    }
-
-    fn is_string_literal(expr: &ExprRef) -> bool {
-        matches!(expr.as_ref(), Expr::String { .. } | Expr::RawString { .. })
-    }
-
-    fn is_simple_literal(expr: &ExprRef) -> bool {
-        match expr.as_ref() {
-            Expr::String { .. }
-            | Expr::RawString { .. }
-            | Expr::Number { .. }
-            | Expr::Bool { .. }
-            | Expr::Null { .. } => true,
-            // Unary expressions like `-1` are constant literals too.
-            Expr::UnaryExpr { expr, .. } => Self::is_simple_literal(expr),
-            _ => false,
-        }
-    }
-
    pub(super) fn get_or_assign_rule_index(&mut self, rule_path: &str) -> Result<u16> {
        if let Some(&index) = self.rule_index_map.get(rule_path) {
            return Ok(index);
@@ -393,10 +345,6 @@ impl<'a> Compiler<'a> {

                    let (key_expr, value_expr) = match head {
                        RuleHead::Compr { refr, assign, .. } => {
-                            if rule_type == RuleType::PartialObject {
-                                self.validate_partial_object_shape(refr)?;
-                            }
-
                            self.rule_definition_function_params[rule_index as usize].push(None);
                            self.rule_definition_destructuring_patterns[rule_index as usize]
                                .push(None);
--- a/tests/azure_policy/mod.rs
+++ b/tests/azure_policy/mod.rs
@@ -23,7 +23,8 @@ use regorus::languages::azure_policy::aliases::AliasRegistry;
 use regorus::languages::azure_policy::compiler;
 use regorus::languages::azure_policy::parser;
 use regorus::rvm::RegoVM;
-use regorus::{Rc, Source, Value};
+use regorus::Source;
+use regorus::Value;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use std::fs;
@@ -193,7 +194,7 @@ fn yaml_test_impl(file: &str) -> Result<()> {
    let test: YamlTest = serde_yaml::from_str(&yaml_str)?;

    // Load alias registry if an aliases file is specified.
-    let alias_registry: Option<Rc<AliasRegistry>> = if let Some(ref aliases_file) = test.aliases {
+    let alias_registry = if let Some(ref aliases_file) = test.aliases {
        let aliases_dir = Path::new(file)
            .parent()
            .unwrap_or_else(|| Path::new("."))
@@ -208,7 +209,7 @@ fn yaml_test_impl(file: &str) -> Result<()> {
        })?;
        let mut registry = AliasRegistry::new();
        registry.load_from_json(&aliases_json)?;
-        Some(Rc::new(registry))
+        Some(registry)
    } else {
        None
    };
@@ -280,7 +281,11 @@ fn yaml_test_impl(file: &str) -> Result<()> {
                        );
                    }
                    if let Some(ref registry) = alias_registry {
-                        compiler::compile_policy_definition_with_aliases(&defn, Rc::clone(registry))
+                        compiler::compile_policy_definition_with_aliases(
+                            &defn,
+                            registry.alias_map(),
+                            registry.alias_modifiable_map(),
+                        )
                    } else {
                        compiler::compile_policy_definition(&defn)
                    }
@@ -303,7 +308,11 @@ fn yaml_test_impl(file: &str) -> Result<()> {
                        );
                    }
                    if let Some(ref registry) = alias_registry {
-                        compiler::compile_policy_rule_with_aliases(&ast, Rc::clone(registry))
+                        compiler::compile_policy_rule_with_aliases(
+                            &ast,
+                            registry.alias_map(),
+                            registry.alias_modifiable_map(),
+                        )
                    } else {
                        compiler::compile_policy_rule(&ast)
                    }
@@ -357,7 +366,7 @@ fn yaml_test_impl(file: &str) -> Result<()> {

        let mut vm = RegoVM::new();
        vm.load_program(program);
-        vm.set_input(make_input(case, alias_registry.as_deref())?);
+        vm.set_input(make_input(case, alias_registry.as_ref())?);
        vm.set_context(make_context(case)?);

        // Load host-await responses (for auditIfNotExists / deployIfNotExists policies).
@@ -382,11 +391,7 @@ fn yaml_test_impl(file: &str) -> Result<()> {
                        if let Some(rt) = effective_type {
                            inject_type_field(&mut raw, rt);
                        }
-                        normalizer::normalize(
-                            &raw,
-                            Some(registry.as_ref()),
-                            case.api_version.as_deref(),
-                        )
+                        normalizer::normalize(&raw, Some(registry), case.api_version.as_deref())
                    } else {
                        raw
                    }
--- a/tests/engine/mod.rs
+++ b/tests/engine/mod.rs
@@ -102,6 +102,135 @@ fn extension_with_state() -> Result<()> {
    Ok(())
 }

+#[test]
+fn prepare_then_clone_without_initial_eval() -> Result<()> {
+    let mut engine = Engine::new();
+    engine.add_policy(
+        "test.rego".to_string(),
+        r#"package test
+           import rego.v1
+
+           default allow := false
+
+           allow if {
+             input.user in data.allowed_users
+           }
+        "#
+        .to_string(),
+    )?;
+    engine.add_data(Value::from_json_str(
+        r#"{"allowed_users":["alice","bob"]}"#,
+    )?)?;
+
+    // Prepare once and clone without running an initial evaluation.
+    engine.prepare()?;
+
+    let mut alice_engine = engine.clone();
+    alice_engine.set_input_json(r#"{"user":"alice"}"#)?;
+    assert_eq!(
+        alice_engine.eval_rule("data.test.allow".to_string())?,
+        Value::from(true)
+    );
+
+    let mut mallory_engine = engine.clone();
+    mallory_engine.set_input_json(r#"{"user":"mallory"}"#)?;
+    assert_eq!(
+        mallory_engine.eval_rule("data.test.allow".to_string())?,
+        Value::from(false)
+    );
+
+    Ok(())
+}
+
+#[test]
+#[cfg(feature = "azure_policy")]
+#[cfg_attr(docsrs, doc(cfg(feature = "azure_policy")))]
+fn prepare_then_compile_for_target() -> Result<()> {
+    if !registry::targets::contains("target.tests.sample_test_target") {
+        let target = Target::from_json_str(include_str!(
+            "../interpreter/cases/target/definitions/sample_target.json"
+        ))?;
+        registry::targets::register(Rc::new(target))?;
+    }
+
+    let mut engine = Engine::new();
+    engine.add_policy(
+        "test.rego".to_string(),
+        r#"package test
+           import rego.v1
+           __target__ := "target.tests.sample_test_target"
+
+           default allow := false
+
+           allow if {
+               input.type == "test_resource"
+           }
+        "#
+        .to_string(),
+    )?;
+
+    engine.prepare()?;
+    let compiled = engine.compile_for_target()?;
+    let info = compiled.get_policy_info()?;
+    assert_eq!(
+        info.target_name.as_deref(),
+        Some("target.tests.sample_test_target")
+    );
+
+    let result = compiled.eval_with_input(Value::from_json_str(
+        r#"{"name":"resource-1","type":"test_resource"}"#,
+    )?)?;
+    assert_eq!(result, Value::from(true));
+
+    Ok(())
+}
+
+#[test]
+#[cfg(feature = "azure_policy")]
+#[cfg_attr(docsrs, doc(cfg(feature = "azure_policy")))]
+fn prepare_then_compile_for_target_error_recovery() -> Result<()> {
+    let target_name = "target.tests.prepare_recovery_test_target";
+
+    let mut engine = Engine::new();
+    engine.add_policy(
+        "test.rego".to_string(),
+        format!(
+            r#"package test
+           import rego.v1
+           __target__ := "{target_name}"
+
+           default allow := false
+
+           allow if {{
+               input.type == "test_resource"
+           }}
+        "#
+        ),
+    )?;
+
+    engine.prepare()?;
+    assert!(engine.compile_for_target().is_err());
+
+    if !registry::targets::contains(target_name) {
+        let target_json =
+            include_str!("../interpreter/cases/target/definitions/sample_target.json")
+                .replace("target.tests.sample_test_target", target_name);
+        let target = Target::from_json_str(&target_json)?;
+        registry::targets::register(Rc::new(target))?;
+    }
+
+    let compiled = engine.compile_for_target()?;
+    let info = compiled.get_policy_info()?;
+    assert_eq!(info.target_name.as_deref(), Some(target_name));
+
+    let result = compiled.eval_with_input(Value::from_json_str(
+        r#"{"name":"resource-1","type":"test_resource"}"#,
+    )?)?;
+    assert_eq!(result, Value::from(true));
+
+    Ok(())
+}
+
 #[test]
 #[cfg(feature = "azure_policy")]
 #[cfg_attr(docsrs, doc(cfg(feature = "azure_policy")))]
--- a/tests/interpreter/cases/rule/partial_object_v1.yaml
+++ b/tests/interpreter/cases/rule/partial_object_v1.yaml
@@ -1,150 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-cases:
-  - note: constant_key_partial_object_v1
-    data: {}
-    input:
-      enabled: true
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p["fixed"] if {
-          input.enabled
-        }
-    query: data.test
-    want_result:
-      p:
-        fixed: true
-
-  - note: multilevel_partial_object_v1
-    data: {}
-    input:
-      nested:
-        app:
-          read: 1
-          write: 2
-        ops:
-          deploy: 3
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p[a][b] if {
-          some a, obj in input.nested
-          some b, _ in obj
-        }
-    query: data.test
-    want_result:
-      p:
-        app:
-          read: true
-          write: true
-        ops:
-          deploy: true
-
-  - note: constant_key_partial_object_explicit_value_v1
-    data: {}
-    input:
-      enabled: true
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p["fixed"] := 7 if {
-          input.enabled
-        }
-    query: data.test
-    want_result:
-      p:
-        fixed: 7
-
-  - note: multilevel_partial_object_explicit_value_v1
-    data: {}
-    input:
-      nested:
-        app:
-          read: 1
-          write: 2
-        ops:
-          deploy: 3
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        p[a][b] := v if {
-          some a, obj in input.nested
-          some b, v in obj
-        }
-    query: data.test
-    want_result:
-      p:
-        app:
-          read: 1
-          write: 2
-        ops:
-          deploy: 3
-
-  - note: issue_712_reproducer_v0_partial_set
-    data: {}
-    input:
-      servers:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-        import future.keywords.in
-
-        violations[k] {
-          some k, _ in input.servers
-        }
-    query: data.test.violations
-    want_result:
-      set!: ["BAR", "BAZ", "FOO"]
-
-  - note: issue_712_reproducer_v1_partial_object
-    data: {}
-    input:
-      servers:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        violations[k] if {
-          some k, _ in input.servers
-        }
-    query: data.test.violations
-    want_result:
-      BAR: true
-      BAZ: true
-      FOO: true
-
-  - note: issue_712_reproducer_v1_contains_partial_set
-    data: {}
-    input:
-      servers:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        violations contains k if {
-          some k, _ in input.servers
-        }
-    query: data.test.violations
-    want_result:
-      set!: ["BAR", "BAZ", "FOO"]
--- a/tests/opa.rs
+++ b/tests/opa.rs
@@ -275,14 +275,6 @@ fn is_with_keyword_unsupported_error(err: &anyhow::Error) -> bool {
    })
 }

-fn is_partial_object_unsupported_error(err: &anyhow::Error) -> bool {
-    err.chain().any(|cause| {
-        let msg = cause.to_string();
-        msg.contains("partial object rules with constant keys are not yet supported")
-            || msg.contains("partial object rules with nested bracket keys are not yet supported")
-    })
-}
-
 fn maybe_verify_rvm_case(case: &TestCase, is_rego_v0_test: bool, actual: &Value) -> Result<()> {
    if case.note == "defaultkeyword/function with var arg, ref head query" {
        println!(
@@ -316,14 +308,6 @@ fn maybe_verify_rvm_case(case: &TestCase, is_rego_v0_test: bool, actual: &Value)
                return Ok(());
            }

-            if is_partial_object_unsupported_error(&err) {
-                println!(
-                    "    skipping RVM check for '{}' (partial object pattern unsupported)",
-                    case.note
-                );
-                return Ok(());
-            }
-
            return Err(err);
        }
    };
--- a/tests/rvm/rego/cases/partial_object_rules.yaml
+++ b/tests/rvm/rego/cases/partial_object_rules.yaml
@@ -1,939 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-cases:
-  - note: partial_object_variable_key_collects_all_bindings
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in input.items
-        }
-    query: data.test.p
-    want_result:
-      BAR: true
-      BAZ: true
-      FOO: true
-
-  - note: partial_object_explicit_value_collects_all_bindings
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-
-        p[k] := v if {
-          some k, v in input.items
-        }
-    query: data.test.p
-    want_result:
-      BAR: 2
-      BAZ: 3
-      FOO: 1
-
-  - note: partial_object_dynamic_expression_key_collects_all_bindings
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-      aliases:
-        FOO: alias-foo
-        BAR: alias-bar
-        BAZ: alias-baz
-    modules:
-      - |
-        package test
-
-        p[input.aliases[k]] := v if {
-          some k, v in input.items
-        }
-    query: data.test.p
-    want_result:
-      alias-bar: 2
-      alias-baz: 3
-      alias-foo: 1
-
-  - note: partial_object_undefined_key_skipped
-    # TODO(#719): RVM incorrectly materializes undefined keys instead of
-    # skipping iterations where the key is undefined.
-    skip: true
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-      aliases:
-        FOO: alias-foo
-    modules:
-      - |
-        package test
-
-        p[input.aliases[k]] := v if {
-          some k, v in input.items
-        }
-    query: data.test.p
-    want_result:
-      alias-foo: 1
-
-  - note: partial_object_duplicate_key_last_wins
-    # TODO(#719): regorus silently overwrites conflicting keys instead of
-    # erroring when the same key is produced with different values.
-    skip: true
-    data: {}
-    input: {}
-    modules:
-      - |
-        package test
-
-        p[k] := v if {
-          some k, v in {"a": 1}
-        }
-
-        p[k] := v if {
-          some k, v in {"a": 2}
-        }
-    query: data.test.p
-    want_error: "conflict"
-
-  - note: partial_object_duplicate_key_same_value_ok
-    data: {}
-    input: {}
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in {"a": 1}
-        }
-
-        p[k] if {
-          some k, _ in {"a": 2}
-        }
-    query: data.test.p
-    want_result:
-      a: true
-
-  - note: partial_object_single_element_input
-    data: {}
-    input:
-      items:
-        ONLY: 1
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in input.items
-        }
-    query: data.test.p
-    want_result:
-      ONLY: true
-
-  - note: partial_object_static_bracket_prefix_collects_all_bindings
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-
-        p["a"][k] := v if {
-          some k, v in input.items
-        }
-    query: data.test.p.a
-    want_result:
-      BAR: 2
-      BAZ: 3
-      FOO: 1
-
-  - note: partial_object_constant_key_unsupported_in_rvm
-    data: {}
-    input:
-      enabled: true
-    modules:
-      - |
-        package test
-
-        p["fixed"] if {
-          input.enabled
-        }
-    query: data.test.p.fixed
-    want_error: "partial object rules with constant keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_constant_key_explicit_value_unsupported_in_rvm
-    data: {}
-    input:
-      enabled: true
-    modules:
-      - |
-        package test
-
-        p["fixed"] := 7 if {
-          input.enabled
-        }
-    query: data.test.p.fixed
-    want_error: "partial object rules with constant keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_multiple_bodies_collects_all_bindings
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in input.items
-          k in {"FOO", "BAR"}
-        }
-
-        p[k] if {
-          some k, _ in input.items
-          k == "BAZ"
-        }
-    query: data.test.p
-    want_result:
-      BAR: true
-      BAZ: true
-      FOO: true
-
-  - note: partial_set_contains_collects_all_bindings
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-
-        p contains k if {
-          some k, _ in input.items
-        }
-    query: data.test.p
-    want_result:
-      set!: ["BAR", "BAZ", "FOO"]
-
-  - note: issue_712_reproducer_v1_partial_object
-    data: {}
-    input:
-      servers:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        violations[k] if {
-          some k, _ in input.servers
-        }
-    query: data.test.violations
-    want_result:
-      BAR: true
-      BAZ: true
-      FOO: true
-
-  - note: issue_712_reproducer_v1_contains_partial_set
-    data: {}
-    input:
-      servers:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-    modules:
-      - |
-        package test
-        import rego.v1
-
-        violations contains k if {
-          some k, _ in input.servers
-        }
-    query: data.test.violations
-    want_result:
-      set!: ["BAR", "BAZ", "FOO"]
-
-  - note: partial_object_multilevel_key_unsupported_in_rvm
-    data: {}
-    input:
-      nested:
-        app:
-          read: 1
-          write: 2
-        ops:
-          deploy: 3
-    modules:
-      - |
-        package test
-
-        p[a][b] if {
-          some a, obj in input.nested
-          some b, _ in obj
-        }
-
-        main := p
-    query: data.test.main
-    want_error: "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_multilevel_key_explicit_value_unsupported_in_rvm
-    data: {}
-    input:
-      nested:
-        app:
-          read: 1
-          write: 2
-        ops:
-          deploy: 3
-    modules:
-      - |
-        package test
-
-        p[a][b] := v if {
-          some a, obj in input.nested
-          some b, v in obj
-        }
-
-        main := p
-    query: data.test.main
-    want_error: "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_hidden_dynamic_prefix_unsupported_in_rvm
-    data: {}
-    input:
-      nested:
-        app:
-          q:
-            read: 1
-            write: 2
-        ops:
-          q:
-            deploy: 3
-    modules:
-      - |
-        package test
-
-        p[a].q[b] if {
-          some a, obj in input.nested
-          some b, _ in obj.q
-        }
-
-        main := p
-    query: data.test.main
-    want_error: "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_array_iteration_collects_all_bindings
-    data: {}
-    input:
-      items: ["FOO", "BAR", "BAZ"]
-    modules:
-      - |
-        package test
-
-        p[v] if {
-          some _, v in input.items
-        }
-    query: data.test.p
-    want_result:
-      BAR: true
-      BAZ: true
-      FOO: true
-
-  - note: partial_object_empty_input_is_empty_object
-    data: {}
-    input:
-      items: {}
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in input.items
-        }
-    query: data.test.p
-    want_result: {}
-
-  - note: partial_object_duplicate_paths_same_key_same_value_deduplicates
-    data: {}
-    input:
-      pairs:
-        - alias: shared
-          value: 1
-        - alias: alpha
-          value: 10
-        - alias: shared
-          value: 1
-    modules:
-      - |
-        package test
-
-        p[entry.alias] := entry.value if {
-          some entry in input.pairs
-        }
-    query: data.test.p
-    want_result:
-      alpha: 10
-      shared: 1
-
-  - note: partial_object_duplicate_paths_same_key_different_values_conflict
-    # TODO(#719): regorus silently overwrites conflicting keys instead of
-    # erroring when the same key is produced with different values.
-    skip: true
-    data: {}
-    input:
-      pairs:
-        - alias: shared
-          value: 1
-        - alias: shared
-          value: 2
-    modules:
-      - |
-        package test
-
-        p[entry.alias] := entry.value if {
-          some entry in input.pairs
-        }
-    query: data.test.p
-    want_error: "conflict"
-
-  - note: partial_object_undefined_key_skips_iteration
-    # TODO(#719): RVM incorrectly materializes undefined keys instead of
-    # skipping iterations where the key is undefined.
-    skip: true
-    data: {}
-    input:
-      items:
-        FOO: 1
-        BAR: 2
-        BAZ: 3
-      aliases:
-        FOO: alias-foo
-        BAZ: alias-baz
-    modules:
-      - |
-        package test
-
-        p[input.aliases[k]] := v if {
-          some k, v in input.items
-        }
-    query: data.test.p
-    want_result:
-      alias-baz: 3
-      alias-foo: 1
-
-  - note: partial_object_undefined_value_skips_iteration
-    # TODO(#719): RVM incorrectly materializes undefined values instead of
-    # skipping iterations where the value is undefined.
-    skip: true
-    data: {}
-    input:
-      keys: ["FOO", "BAR", "BAZ"]
-      values:
-        FOO: 1
-        BAZ: 3
-    modules:
-      - |
-        package test
-
-        p[k] := input.values[k] if {
-          some _, k in input.keys
-        }
-    query: data.test.p
-    want_result:
-      BAZ: 3
-      FOO: 1
-
-  - note: partial_object_mixed_undefined_key_value_cases_skip_bad_iterations
-    # TODO(#719): RVM incorrectly materializes undefined keys/values instead of
-    # skipping iterations where the key or value is undefined.
-    skip: true
-    data: {}
-    input:
-      rows:
-        - src: keep
-        - src: missing_alias
-        - src: missing_value
-        - src: missing_both
-      aliases:
-        keep: alias-keep
-        missing_value: alias-no-value
-      values:
-        keep: 1
-        missing_alias: 2
-    modules:
-      - |
-        package test
-
-        p[input.aliases[row.src]] := input.values[row.src] if {
-          some row in input.rows
-        }
-    query: data.test.p
-    want_result:
-      alias-keep: 1
-
-  - note: partial_object_and_partial_set_same_name_conflict
-    data: {}
-    input:
-      items:
-        FOO: 1
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in input.items
-        }
-
-        p contains "shadow" if {
-          true
-        }
-    query: data.test.p
-    want_error: "has multiple types"
-
-  - note: partial_object_complete_rule_conflicts_with_partial_object
-    data: {}
-    input:
-      items:
-        a: 1
-    modules:
-      - |
-        package test
-
-        p := {"fixed": 1}
-
-        p[k] := v if {
-          some k, v in input.items
-        }
-    query: data.test.p
-    want_error: "multiple types"
-
-  - note: partial_object_partial_set_conflicts_with_partial_object
-    data: {}
-    input:
-      items:
-        a: 1
-    modules:
-      - |
-        package test
-
-        p contains k if {
-          some k, _ in input.items
-        }
-
-        p[k] := 1 if {
-          some k, _ in input.items
-        }
-    query: data.test.p
-    want_error: "multiple types"
-
-  - note: partial_object_large_range_counts_all_entries
-    data: {}
-    input: {}
-    modules:
-      - |
-        package test
-
-        p[key] := n if {
-          n := numbers.range(0, 255)[_]
-          key := sprintf("k-%d", [n])
-        }
-
-        main := count(p)
-    query: data.test.main
-    want_result: 256
-
-  - note: partial_object_rbac_duplicate_actions_deduplicate
-    data:
-      role_permissions:
-        reader: ["read", "list"]
-        writer: ["read", "write"]
-        auditor: ["read", "list"]
-    input:
-      user_roles: ["reader", "writer", "auditor"]
-    modules:
-      - |
-        package test
-
-        allowed_actions[action] if {
-          some role in input.user_roles
-          some action in data.role_permissions[role]
-        }
-    query: data.test.allowed_actions
-    want_result:
-      list: true
-      read: true
-      write: true
-
-  - note: partial_object_violations_real_world_pattern
-    data: {}
-    input:
-      spec:
-        containers:
-          - name: api
-            securityContext:
-              readOnlyRootFilesystem: false
-          - name: worker
-            securityContext:
-              readOnlyRootFilesystem: true
-          - name: sidecar
-    modules:
-      - |
-        package test
-
-        violations[msg] if {
-          some container in input.spec.containers
-          not container.securityContext.readOnlyRootFilesystem
-          msg := sprintf("Container %s must use readOnlyRootFilesystem", [container.name])
-        }
-    query: data.test.violations
-    want_result:
-      Container api must use readOnlyRootFilesystem: true
-      Container sidecar must use readOnlyRootFilesystem: true
-
-  - note: partial_object_resource_mapping_filters_valid_resources
-    data: {}
-    input:
-      resources:
-        svc-api:
-          cpu: 1
-        job-cleanup:
-          cpu: 2
-        svc-worker:
-          cpu: 4
-    modules:
-      - |
-        package test
-
-        valid_resource(name) if {
-          startswith(name, "svc-")
-        }
-
-        resources[name] := config if {
-          some name, config in input.resources
-          valid_resource(name)
-        }
-    query: data.test.resources
-    want_result:
-      svc-api:
-        cpu: 1
-      svc-worker:
-        cpu: 4
-
-  - note: partial_object_computed_concat_key_constant_body
-    data: {}
-    modules:
-      - |
-        package test
-
-        p[concat("", ["edge", "-", "key"])] if {
-          true
-        }
-    query: data.test.p
-    want_result:
-      edge-key: true
-
-  - note: partial_object_duplicate_computed_key_same_value_merges
-    data: {}
-    input:
-      items:
-        A: 0
-        a: 0
-    modules:
-      - |
-        package test
-
-        p[lower(k)] := 1 if {
-          some k, _ in input.items
-        }
-    query: data.test.p
-    want_result:
-      a: 1
-
-  - note: partial_object_function_key_and_object_value
-    data: {}
-    input:
-      items:
-        a: 1
-        b: 2
-    modules:
-      - |
-        package test
-
-        f(x) := concat(":", [x, "suffix"])
-
-        p[f(k)] := {"nested": v + 1} if {
-          some k, v in input.items
-        }
-    query: data.test.p
-    want_result:
-      "a:suffix":
-        nested: 2
-      "b:suffix":
-        nested: 3
-
-  - note: partial_object_array_index_key_uses_selected_elements
-    data: {}
-    input:
-      keys: ["alpha", "beta"]
-      values: [10, 20]
-    modules:
-      - |
-        package test
-
-        p[input.keys[i]] := v if {
-          some i, v in input.values
-        }
-    query: data.test.p
-    want_result:
-      alpha: 10
-      beta: 20
-
-  - note: partial_object_computed_empty_and_special_string_keys
-    data: {}
-    modules:
-      - |
-        package test
-
-        p[concat("", [""])] := "empty" if {
-          true
-        }
-
-        p[concat("", ["a/b?c#d"])] := "special" if {
-          true
-        }
-    query: data.test.p
-    want_result:
-      "": "empty"
-      a/b?c#d: "special"
-
-  - note: partial_object_not_filters_blocked_entries
-    data: {}
-    input:
-      items:
-        allowed: true
-        blocked: true
-      blocked:
-        blocked: true
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, _ in input.items
-          not input.blocked[k]
-        }
-    query: data.test.p
-    want_result:
-      allowed: true
-
-  - note: partial_object_dot_bracket_object_value_collects_all_bindings
-    data: {}
-    input:
-      items:
-        a: 1
-        b: 2
-    modules:
-      - |
-        package test
-
-        p.config[k] := {"nested": v} if {
-          some k, v in input.items
-        }
-    query: data.test.p.config
-    want_result:
-      a:
-        nested: 1
-      b:
-        nested: 2
-
-  - note: partial_object_dynamic_prefix_static_suffix_unsupported_in_rvm
-    data: {}
-    input:
-      items:
-        a: 1
-        b: 2
-    modules:
-      - |
-        package test
-
-        p[k]["fixed"] := upper(k) if {
-          some k, _ in input.items
-        }
-
-        main := p
-    query: data.test.main
-    want_error: "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_literal_prefix_nested_unsupported_in_rvm
-    data: {}
-    input:
-      items:
-        a: 1
-        b: 2
-    modules:
-      - |
-        package test
-
-        p[1][k] := v if {
-          some k, v in input.items
-        }
-
-        main := p
-    query: data.test.main
-    want_error: "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_three_level_nested_dynamic_unsupported_in_rvm
-    data: {}
-    input:
-      nested:
-        app:
-          read: 1
-          write: 2
-        ops:
-          deploy: 3
-    modules:
-      - |
-        package test
-
-        p["root"][a][b] := v if {
-          some a, obj in input.nested
-          some b, v in obj
-        }
-
-        main := p
-    query: data.test.main
-    want_error: "partial object rules with nested bracket keys are not yet supported by the RVM compiler"
-    allow_interpreter_success: true
-
-  - note: partial_object_with_body_unsupported_in_rvm
-    data: {}
-    input:
-      enabled: false
-      items:
-        a: 1
-    modules:
-      - |
-        package test
-
-        gate if {
-          input.enabled
-        }
-
-        p[k] := v if {
-          some k, v in input.items
-          data.test.gate with input as {"enabled": true}
-        }
-    query: data.test.p
-    want_error: "the `with` keyword is not supported by the compiler yet"
-    allow_interpreter_success: true
-
-  - note: partial_object_every_vacuous_truth_collects_empty_arrays
-    # TODO(#719): RVM currently includes the failing `bad` group here, while the
-    # interpreter returns only `empty` and `ok` (expected per vacuous truth
-    # semantics).
-    skip: true
-    data: {}
-    input:
-      groups:
-        ok: [1, 2]
-        bad: [1, 0]
-        empty: []
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          some k, arr in input.groups
-          every v in arr {
-            v > 0
-          }
-        }
-    query: data.test.p
-    want_result:
-      empty: true
-      ok: true
-
-  - note: partial_object_join_var_multiple_bindings
-    data:
-      a: ["1", "2", "3", "4"]
-      g:
-        a: ["1", "0", "0", "0"]
-        b: ["0", "2", "0", "0"]
-        c: ["0", "0", "0", "4"]
-    modules:
-      - |
-        package test
-
-        p[k] := v if {
-          data.a[i] = v
-          data.g[k][i] = v
-        }
-    query: data.test.p
-    want_result:
-      a: "1"
-      b: "2"
-      c: "4"
-
-  - note: partial_object_composite_value
-    data:
-      g:
-        a: [1, 0, 0, 0]
-        b: [0, 2, 0, 0]
-        c: [0, 0, 0, 4]
-    modules:
-      - |
-        package test
-
-        p[k] := [i, {"v2": v}] if {
-          data.g[k] = x
-          x[i] = v
-          v != 0
-        }
-    query: data.test.p
-    want_result:
-      a: [0, {v2: 1}]
-      b: [1, {v2: 2}]
-      c: [3, {v2: 4}]
-
-  - note: partial_object_true_semantics_dedupes_duplicate_keys
-    data: {}
-    modules:
-      - |
-        package test
-
-        p[k] if {
-          ks := ["a", "b", "c", "a"]
-          ks[_] = k
-        }
-    query: data.test.p
-    want_result:
-      a: true
-      b: true
-      c: true
Author	SHA1	Message	Date
copilot-swe-agent[bot]	639bfe3246	Fix deep-review findings for prepare/closed-handle safety Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/c2c0f3ef-f641-4d83-94f8-a3cd3ede6db8 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>	2026-05-15 12:04:40 +00:00
copilot-swe-agent[bot]	4cc82e2fda	Address review nits after validation feedback Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/f964122b-5af3-41a7-bc51-d87b7271a455 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>	2026-05-14 20:11:51 +00:00
copilot-swe-agent[bot]	196b6d68aa	Fix target-aware prepare path and add regression test Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/f964122b-5af3-41a7-bc51-d87b7271a455 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>	2026-05-14 20:07:11 +00:00
copilot-swe-agent[bot]	c65e844f63	Strengthen Java clone test coverage Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/49ba4462-95d3-42c0-a302-db1b81df4f65 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>	2026-05-14 13:18:27 +00:00
copilot-swe-agent[bot]	730e6de75a	Extend prepare API/docs across bindings Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/49ba4462-95d3-42c0-a302-db1b81df4f65 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>	2026-05-14 13:13:43 +00:00
copilot-swe-agent[bot]	72515f6d4c	Expose wasm engine clone and add prepare API Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/58419b20-1586-4a23-85fb-5aed5f5d5961 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com>	2026-05-13 20:16:02 +00:00
copilot-swe-agent[bot]	839933c933	Initial plan	2026-05-13 20:10:08 +00:00