docs(#239): replace broken policy source with local path in tutorial

[fullsend-ai-coder]

The "Validating arbitrary inputs" tutorial referenced a non-existent GitHub repository (github.com/acme/policy), causing users to get a "Repository not found" error when following the tutorial. Replace the git-based policy source with a local directory path to make the example self-contained and functional.

---

Closes #239

Post-script verification

• Branch is not main/master (agent/239-fix-invalid-policy-source)
• Secret scan passed (gitleaks — 38f47392e453bc90e8e2176be38bdeb44be4f3e1..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:29 AM UTC · Completed 10:33 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Verdict: Approve

Summary

Clean, well-scoped documentation fix that replaces a broken external policy source (git::https://github.com/acme/policy.git//policy?ref=prod) with a self-contained local directory path. The change directly addresses #239 where users following the "Validating arbitrary inputs" tutorial encountered a "Repository not found" error.

Changes reviewed

Dimension	Assessment
Correctness	✅ The local policy path in policy.yaml correctly corresponds to the policy/signoff.rego file the tutorial asks users to create. The expected CLI output is updated consistently. Section reordering (rego file before policy.yaml) improves the tutorial flow — users create the policy rules before the configuration that references them.
Security	✅ No concerns — documentation-only change with no executable code, secrets, or access control implications.
Intent & coherence	✅ Directly addresses #239. Appropriately scoped — only the broken reference and its surrounding context are modified.
Style & conventions	✅ AsciiDoc formatting follows existing patterns. The NOTE admonition and block titles are correctly formatted.
Documentation currency	✅ This is the documentation fix itself. The added instructional text ("Create the following files in a working directory.") and the explanatory NOTE improve clarity.

Notes

• The approach of using a local directory path makes the tutorial fully self-contained, which is a usability improvement over the original design (even if the git repo had existed).
• The NOTE explaining that remote git URLs are also supported preserves the teaching value of the original example while keeping it functional.

---

Labels: PR fixes a documentation bug in the CLI tutorial page

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:47 PM UTC · Completed 1:57 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

PR #241 on conforma/user-guide fixed a broken policy source URL in the CLI tutorial (issue #239). The pipeline worked end-to-end: triage ($0.51, 3 min), code agent ($5.70, 11 min), review agent ($0.42, 4 min), human approval 3 hours later with zero additional findings. The main inefficiency was in the code agent: its parent spawned a subagent with subagent_type 'code' which got an empty allowedTools array, wasting ~$2.50 and 80+ tool calls before the parent recovered by spawning with subagent_type 'claude'. This is tracked in fullsend-ai/fullsend#2098.

Proposals filed

• Evidence for #2098: code agent wasted ~$2.50 and 80+ tool calls spawning subagent without Bash on conforma/user-guide#241 (in fullsend-ai/fullsend)
• Evidence for #3068: human review added zero novel findings on agent-authored docs fix (conforma/user-guide#241) (in fullsend-ai/fullsend)
• Evidence for #766: duplicate code agent dispatch on conforma/user-guide#239 — one run cancelled after 30 seconds (in fullsend-ai/fullsend)