fix: regression in apply_policy on deepcopied objects

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

cpex/framework/hooks/policies.py

@@ -73,16 +73,23 @@ def apply_policy(
     original: BaseModel,
     modified: BaseModel,
     policy: HookPayloadPolicy,
+    *,
+    apply_to: Optional[BaseModel] = None,
 ) -> Optional[BaseModel]:
     """Apply policy-based controlled merge.
 
     Only fields listed in ``policy.writable_fields`` are accepted from
     *modified*; all other changes are silently discarded.
 
     Args:
-        original: The original (or current) payload.
+        original: The baseline payload to diff against (what the plugin received).
         modified: The payload returned by the plugin.
         policy: The policy defining which fields are writable.
+        apply_to: The target payload to apply accepted changes to.  When
+            ``None`` (the default), changes are applied to *original*.  This
+            is useful when the plugin receives an isolated (CoW / deepcopy)
+            snapshot but accepted changes should be merged back into the
+            canonical pipeline payload.
 
     Returns:
         An updated payload with only the allowed changes applied, or
@@ -103,6 +110,7 @@ def apply_policy(
         >>> result.secret
         's'
     """
+    target = apply_to if apply_to is not None else original
     updates: dict[str, Any] = {}
     rejected: list[str] = []
     for field in type(modified).model_fields:
@@ -123,4 +131,4 @@ def apply_policy(
             rejected.append(field)
     if rejected:
         logger.warning("Policy rejected modifications to non-writable fields: %s", rejected)
-    return original.model_copy(update=updates) if updates else None
+    return target.model_copy(update=updates) if updates else None

cpex/framework/manager.py

@@ -454,7 +454,14 @@ async def _run_serial_phase(
             if result.modified_payload is not None:
                 if apply_modifications:
                     current_payload, decision_plugin_name = self._apply_payload_modification(
-                        hook_ref, result, effective_payload, policy, hook_type, current_payload, decision_plugin_name
+                        hook_ref,
+                        result,
+                        plugin_input,
+                        policy,
+                        hook_type,
+                        current_payload,
+                        decision_plugin_name,
+                        apply_to=effective_payload,
                     )
                 else:
                     logger.debug(
@@ -510,9 +517,17 @@ def _apply_payload_modification(
         hook_type: str,
         current_payload: Optional[PluginPayload],
         decision_plugin_name: Optional[str],
+        *,
+        apply_to: Optional[PluginPayload] = None,
     ) -> tuple[Optional[PluginPayload], Optional[str]]:
         """Apply a plugin's payload modification, respecting the hook policy.
 
+        Args:
+            effective_payload: The baseline payload the plugin received (may be
+                an isolated/CoW copy).  Used for diffing to detect changes.
+            apply_to: The canonical pipeline payload to merge accepted changes
+                into.  When ``None``, changes are applied to *effective_payload*.
+
         Returns:
             Updated (current_payload, decision_plugin_name) tuple.
         """
@@ -521,7 +536,7 @@ def _apply_payload_modification(
                 effective_payload, BaseModel
             ):
                 # Same-type BaseModel payload — apply field-level policy filtering
-                filtered = apply_policy(effective_payload, result.modified_payload, policy)
+                filtered = apply_policy(effective_payload, result.modified_payload, policy, apply_to=apply_to)
                 if filtered is not None:
                     return filtered, hook_ref.plugin_ref.name
             else: