feat: allow override of default_hook_policy via pm constructor

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

cpex/framework/manager.py

@@ -108,6 +108,7 @@ def __init__(
         timeout: int = DEFAULT_PLUGIN_TIMEOUT,
         observability: Optional[ObservabilityProvider] = None,
         hook_policies: Optional[dict[str, HookPayloadPolicy]] = None,
+        default_hook_policy: Optional[str] = None,
     ):
         """Initialize the plugin executor.
 
@@ -116,12 +117,16 @@ def __init__(
             timeout: Maximum execution time per plugin in seconds.
             observability: Optional observability provider implementing ObservabilityProvider protocol.
             hook_policies: Per-hook-type payload modification policies.
+            default_hook_policy: Fallback hook policy ("allow", "denied") when a policy is not specified
+                for a hook type (overrides `settings.default_hook_policy`).
         """
         self.timeout = timeout
         self.config = config
         self.observability = observability
         self.hook_policies: dict[str, HookPayloadPolicy] = hook_policies or {}
-        self.default_hook_policy = DefaultHookPolicy(settings.default_hook_policy)
+        self.default_hook_policy = DefaultHookPolicy(
+            default_hook_policy if default_hook_policy else settings.default_hook_policy
+        )
         self._runtime_disabled: set[str] = set()
 
     async def execute(
@@ -885,6 +890,7 @@ def __init__(
         timeout: int = DEFAULT_PLUGIN_TIMEOUT,
         observability: Optional[ObservabilityProvider] = None,
         hook_policies: Optional[dict[str, HookPayloadPolicy]] = None,
+        default_hook_policy: Optional[str] = None,
     ):
         """Initialize plugin manager.
 
@@ -903,6 +909,8 @@ def __init__(
             timeout: Maximum execution time per plugin in seconds.
             observability: Optional observability provider implementing ObservabilityProvider protocol.
             hook_policies: Per-hook-type payload modification policies (injected by gateway).
+            default_hook_policy: Fallback hook policy ("allow", "deny") when a policy is not specified
+                for a hook type (if set, takes precedence over `settings.default_hook_policy`).
 
         Examples:
             >>> # Initialize with configuration file
@@ -929,11 +937,10 @@ def __init__(
                         timeout=timeout,
                         observability=observability,
                         hook_policies=hook_policies,
+                        default_hook_policy=default_hook_policy,
                     )
-        elif hook_policies:
-            # Allow hook policies to be injected after initial Borg creation.
-            # This handles the case where the first PluginManager instantiation
-            # (e.g. from a service) didn't have policies, but a later one does.
+        elif hook_policies or default_hook_policy or observability:
+            # Allow optional arguments to be injected after initial Borg creation.
             with self.__lock:
                 executor = self._get_executor()
                 # Only update timeout if caller provided a non-default value
@@ -945,13 +952,10 @@ def __init__(
                     logger.warning(
                         "PluginManager: hook_policies already set; ignoring new policies (call reset() first to replace them)"
                     )
+                if default_hook_policy:
+                    executor.default_hook_policy = DefaultHookPolicy(default_hook_policy)
                 if observability and not executor.observability:
                     executor.observability = observability
-        elif self._executor is None:
-            # Defensive initialization for unusual state transitions in tests.
-            with self.__lock:
-                if self._executor is None:
-                    self._executor = PluginExecutor(config=self._config, timeout=timeout, observability=observability)
 
     def _get_executor(self) -> PluginExecutor:
         """Get plugin executor, creating it lazily if necessary.

tests/unit/cpex/framework/test_manager_coverage.py

@@ -468,18 +468,6 @@ def test_second_instantiation_injects_observability(self):
 
         assert pm2._executor.observability is mock_obs
 
-    def test_defensive_executor_init_when_none(self):
-        """When shared state exists but _executor is None (unusual test
-        scenario), the defensive path creates a new PluginExecutor."""
-        pm = PluginManager()
-        # Simulate unusual state: shared state populated but executor nulled
-        pm._executor = None
-
-        # Re-instantiate without hook_policies — triggers defensive path
-        pm2 = PluginManager()
-        assert pm2._executor is not None
-        assert isinstance(pm2._executor, PluginExecutor)
-
 
 # ===========================================================================
 # PluginManager executor property and setter (lines 605, 615, 620)