From 99049767eb5516e7ecd01a1447d32fc2b2d9e489 Mon Sep 17 00:00:00 2001
From: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Date: Fri, 29 Aug 2025 15:33:54 +0200
Subject: [PATCH 1/4] fix evaluation issues

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
---
 pkg/policies/engine/engine.go                 |  4 +-
 pkg/policies/engine/rego/rego.go              | 33 +++++++++++----
 pkg/policies/engine/rego/rego_test.go         | 42 ++++---------------
 .../rego/testfiles/matches_evaluation.rego    |  4 +-
 4 files changed, 36 insertions(+), 47 deletions(-)

diff --git a/pkg/policies/engine/engine.go b/pkg/policies/engine/engine.go
index e4b69db3e..d1f36c9c3 100644
--- a/pkg/policies/engine/engine.go
+++ b/pkg/policies/engine/engine.go
@@ -26,8 +26,8 @@ type PolicyEngine interface {
 	Verify(ctx context.Context, policy *Policy, input []byte, args map[string]any) (*EvaluationResult, error)
 	// MatchesParameters evaluates the matches_parameters rule to determine if evaluation parameters match expected parameters
 	MatchesParameters(ctx context.Context, policy *Policy, evaluationParams, expectedParams map[string]string) (bool, error)
-	// MatchesEvaluation evaluates the matches_evaluation rule using a PolicyEvaluation result and evaluation parameters
-	MatchesEvaluation(ctx context.Context, policy *Policy, evaluation *EvaluationResult, evaluationParams map[string]string) (bool, error)
+	// MatchesEvaluation evaluates the matches_evaluation rule using policy violations and expected parameters
+	MatchesEvaluation(ctx context.Context, policy *Policy, violations []string, expectedParams map[string]string) (bool, error)
 }
 
 type EvaluationResult struct {
diff --git a/pkg/policies/engine/rego/rego.go b/pkg/policies/engine/rego/rego.go
index 63d922b7b..7b827a3c7 100644
--- a/pkg/policies/engine/rego/rego.go
+++ b/pkg/policies/engine/rego/rego.go
@@ -112,7 +112,7 @@ const (
 	EnvironmentModePermissive EnvironmentMode = 1
 	inputArgs                                 = "args"
 	expectedArgs                              = "expected_args"
-	evalResult                                = "evaluation_result"
+	violationsResult                          = "violations"
 	inputElements                             = "elements"
 	deprecatedRule                            = "violations"
 	mainRule                                  = "result"
@@ -400,8 +400,16 @@ func (r *Engine) MatchesParameters(ctx context.Context, policy *engine.Policy, e
 
 	// Create input with policy and expected parameters
 	inputMap := make(map[string]interface{})
-	inputMap[inputArgs] = evaluationParams
-	inputMap[expectedArgs] = expectedParams
+	if evaluationParams == nil {
+		inputMap[inputArgs] = map[string]string{}
+	} else {
+		inputMap[inputArgs] = evaluationParams
+	}
+	if expectedParams == nil {
+		inputMap[expectedArgs] = map[string]string{}
+	} else {
+		inputMap[expectedArgs] = expectedParams
+	}
 
 	// Evaluate matches_parameters rule
 	matchesParameters, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesParametersRule), parsedModule, inputMap)
@@ -414,20 +422,27 @@ func (r *Engine) MatchesParameters(ctx context.Context, policy *engine.Policy, e
 }
 
 // MatchesEvaluation evaluates the matches_evaluation rule in a rego policy.
-// The function creates an input object with policy parameters and evaluation result.
+// The function creates an input object with expected parameters and policy violations.
 // Returns true if the policy's matches_evaluation rule evaluates to true, false otherwise.
-// If the rule is not found or evaluation fails, it defaults to false.
-func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, ev *engine.EvaluationResult, evaluationParams map[string]string) (bool, error) {
+func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, violations []string, expectedParams map[string]string) (bool, error) {
 	policyString := string(policy.Source)
 	parsedModule, err := ast.ParseModule(policy.Name, policyString)
 	if err != nil {
 		return false, fmt.Errorf("failed to parse rego policy: %w", err)
 	}
 
-	// Create input with the policy evaluation data
+	// Create input expected parameters and policy violations
 	inputMap := make(map[string]interface{})
-	inputMap[inputArgs] = evaluationParams
-	inputMap[evalResult] = ev
+	if expectedParams == nil {
+		inputMap[expectedArgs] = map[string]string{}
+	} else {
+		inputMap[expectedArgs] = expectedParams
+	}
+	if violations == nil {
+		inputMap[violationsResult] = []string{}
+	} else {
+		inputMap[violationsResult] = violations
+	}
 
 	// Evaluate matches_parameters rule
 	matchesEvaluation, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesEvaluationRule), parsedModule, inputMap)
diff --git a/pkg/policies/engine/rego/rego_test.go b/pkg/policies/engine/rego/rego_test.go
index 03f19aa86..0b9c7dcb5 100644
--- a/pkg/policies/engine/rego/rego_test.go
+++ b/pkg/policies/engine/rego/rego_test.go
@@ -393,44 +393,25 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 	}
 
 	t.Run("evaluation with violations and high severity matches", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{
-				{Subject: "test", Violation: "test violation"},
-			},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{"test violation"}
 		evaluationParams := map[string]string{"severity": "high"}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.True(t, matches)
 	})
 
 	t.Run("evaluation without violations does not match", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{}
 		evaluationParams := map[string]string{"severity": "high"}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.False(t, matches)
 	})
 
 	t.Run("evaluation with violations but wrong severity does not match", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{
-				{Subject: "test", Violation: "test violation"},
-			},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{"test violation"}
 		evaluationParams := map[string]string{"severity": "low"}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.False(t, matches)
 	})
@@ -443,16 +424,9 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 	})
 
 	t.Run("empty evaluation params", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{
-				{Subject: "test", Violation: "test violation"},
-			},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{"test violation"}
 		evaluationParams := map[string]string{}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.False(t, matches)
 	})
diff --git a/pkg/policies/engine/rego/testfiles/matches_evaluation.rego b/pkg/policies/engine/rego/testfiles/matches_evaluation.rego
index a2f3c1652..757cad874 100644
--- a/pkg/policies/engine/rego/testfiles/matches_evaluation.rego
+++ b/pkg/policies/engine/rego/testfiles/matches_evaluation.rego
@@ -2,10 +2,10 @@ package test_matches_evaluation
 
 matches_evaluation := result {
     # Check if the evaluation contains violations 
-    count(input.evaluation_result.violations) > 0
+    count(input.violations) > 0
     
     # Check if we have the expected parameter
-    input.args.severity == "high"
+    input.expected_args.severity == "high"
     
     # If both conditions are met, return true
     result := true

From 29eb0c7705aa27328870337110ddd0f3b8f73cff Mon Sep 17 00:00:00 2001
From: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Date: Wed, 3 Sep 2025 14:18:10 +0200
Subject: [PATCH 2/4] update policy schema

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
---
 .../workflowcontract/v1/crafting_schema.ts    | 100 +++-
 ...kflowcontract.v1.AutoMatch.jsonschema.json |  18 +
 .../workflowcontract.v1.AutoMatch.schema.json |  18 +
 ...flowcontract.v1.PolicySpec.jsonschema.json |   8 +
 ...workflowcontract.v1.PolicySpec.schema.json |   8 +
 .../workflowcontract/v1/crafting_schema.pb.go | 479 +++++++++++-------
 .../workflowcontract/v1/crafting_schema.proto |  15 +
 7 files changed, 465 insertions(+), 181 deletions(-)
 create mode 100644 app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.jsonschema.json
 create mode 100644 app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.schema.json

diff --git a/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts b/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts
index 9431dfdbc..8f2267c29 100644
--- a/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts
+++ b/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts
@@ -418,6 +418,7 @@ export interface PolicySpec {
   policies: PolicySpecV2[];
   /** Describe the supported inputs */
   inputs: PolicyInput[];
+  autoMatch?: AutoMatch;
 }
 
 export interface PolicyInput {
@@ -440,6 +441,16 @@ export interface PolicySpecV2 {
   kind: CraftingSchema_Material_MaterialType;
 }
 
+/** Auto-matching policy specification */
+export interface AutoMatch {
+  /** path to a policy script. It might consist of a URI reference */
+  path?:
+    | string
+    | undefined;
+  /** embedded source code (only Rego supported currently) */
+  embedded?: string | undefined;
+}
+
 /** Represents a group attachment in a contract */
 export interface PolicyGroupAttachment {
   /** Group reference, it might be an URL or a provider reference */
@@ -1528,7 +1539,7 @@ export const Metadata_AnnotationsEntry = {
 };
 
 function createBasePolicySpec(): PolicySpec {
-  return { path: undefined, embedded: undefined, type: 0, policies: [], inputs: [] };
+  return { path: undefined, embedded: undefined, type: 0, policies: [], inputs: [], autoMatch: undefined };
 }
 
 export const PolicySpec = {
@@ -1548,6 +1559,9 @@ export const PolicySpec = {
     for (const v of message.inputs) {
       PolicyInput.encode(v!, writer.uint32(42).fork()).ldelim();
     }
+    if (message.autoMatch !== undefined) {
+      AutoMatch.encode(message.autoMatch, writer.uint32(50).fork()).ldelim();
+    }
     return writer;
   },
 
@@ -1593,6 +1607,13 @@ export const PolicySpec = {
 
           message.inputs.push(PolicyInput.decode(reader, reader.uint32()));
           continue;
+        case 6:
+          if (tag !== 50) {
+            break;
+          }
+
+          message.autoMatch = AutoMatch.decode(reader, reader.uint32());
+          continue;
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -1609,6 +1630,7 @@ export const PolicySpec = {
       type: isSet(object.type) ? craftingSchema_Material_MaterialTypeFromJSON(object.type) : 0,
       policies: Array.isArray(object?.policies) ? object.policies.map((e: any) => PolicySpecV2.fromJSON(e)) : [],
       inputs: Array.isArray(object?.inputs) ? object.inputs.map((e: any) => PolicyInput.fromJSON(e)) : [],
+      autoMatch: isSet(object.autoMatch) ? AutoMatch.fromJSON(object.autoMatch) : undefined,
     };
   },
 
@@ -1627,6 +1649,8 @@ export const PolicySpec = {
     } else {
       obj.inputs = [];
     }
+    message.autoMatch !== undefined &&
+      (obj.autoMatch = message.autoMatch ? AutoMatch.toJSON(message.autoMatch) : undefined);
     return obj;
   },
 
@@ -1641,6 +1665,9 @@ export const PolicySpec = {
     message.type = object.type ?? 0;
     message.policies = object.policies?.map((e) => PolicySpecV2.fromPartial(e)) || [];
     message.inputs = object.inputs?.map((e) => PolicyInput.fromPartial(e)) || [];
+    message.autoMatch = (object.autoMatch !== undefined && object.autoMatch !== null)
+      ? AutoMatch.fromPartial(object.autoMatch)
+      : undefined;
     return message;
   },
 };
@@ -1826,6 +1853,77 @@ export const PolicySpecV2 = {
   },
 };
 
+function createBaseAutoMatch(): AutoMatch {
+  return { path: undefined, embedded: undefined };
+}
+
+export const AutoMatch = {
+  encode(message: AutoMatch, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
+    if (message.path !== undefined) {
+      writer.uint32(10).string(message.path);
+    }
+    if (message.embedded !== undefined) {
+      writer.uint32(18).string(message.embedded);
+    }
+    return writer;
+  },
+
+  decode(input: _m0.Reader | Uint8Array, length?: number): AutoMatch {
+    const reader = input instanceof _m0.Reader ? input : _m0.Reader.create(input);
+    let end = length === undefined ? reader.len : reader.pos + length;
+    const message = createBaseAutoMatch();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1:
+          if (tag !== 10) {
+            break;
+          }
+
+          message.path = reader.string();
+          continue;
+        case 2:
+          if (tag !== 18) {
+            break;
+          }
+
+          message.embedded = reader.string();
+          continue;
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skipType(tag & 7);
+    }
+    return message;
+  },
+
+  fromJSON(object: any): AutoMatch {
+    return {
+      path: isSet(object.path) ? String(object.path) : undefined,
+      embedded: isSet(object.embedded) ? String(object.embedded) : undefined,
+    };
+  },
+
+  toJSON(message: AutoMatch): unknown {
+    const obj: any = {};
+    message.path !== undefined && (obj.path = message.path);
+    message.embedded !== undefined && (obj.embedded = message.embedded);
+    return obj;
+  },
+
+  create<I extends Exact<DeepPartial<AutoMatch>, I>>(base?: I): AutoMatch {
+    return AutoMatch.fromPartial(base ?? {});
+  },
+
+  fromPartial<I extends Exact<DeepPartial<AutoMatch>, I>>(object: I): AutoMatch {
+    const message = createBaseAutoMatch();
+    message.path = object.path ?? undefined;
+    message.embedded = object.embedded ?? undefined;
+    return message;
+  },
+};
+
 function createBasePolicyGroupAttachment(): PolicyGroupAttachment {
   return { ref: "", with: {} };
 }
diff --git a/app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.jsonschema.json b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.jsonschema.json
new file mode 100644
index 000000000..6cbf4b11d
--- /dev/null
+++ b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.jsonschema.json
@@ -0,0 +1,18 @@
+{
+  "$id": "workflowcontract.v1.AutoMatch.jsonschema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "description": "Auto-matching policy specification",
+  "properties": {
+    "embedded": {
+      "description": "embedded source code (only Rego supported currently)",
+      "type": "string"
+    },
+    "path": {
+      "description": "path to a policy script. It might consist of a URI reference",
+      "type": "string"
+    }
+  },
+  "title": "Auto Match",
+  "type": "object"
+}
diff --git a/app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.schema.json b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.schema.json
new file mode 100644
index 000000000..6e2a2391e
--- /dev/null
+++ b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.AutoMatch.schema.json
@@ -0,0 +1,18 @@
+{
+  "$id": "workflowcontract.v1.AutoMatch.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "description": "Auto-matching policy specification",
+  "properties": {
+    "embedded": {
+      "description": "embedded source code (only Rego supported currently)",
+      "type": "string"
+    },
+    "path": {
+      "description": "path to a policy script. It might consist of a URI reference",
+      "type": "string"
+    }
+  },
+  "title": "Auto Match",
+  "type": "object"
+}
diff --git a/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.jsonschema.json b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.jsonschema.json
index e19d9bd4b..366110fef 100644
--- a/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.jsonschema.json
+++ b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.jsonschema.json
@@ -2,7 +2,15 @@
   "$id": "workflowcontract.v1.PolicySpec.jsonschema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "additionalProperties": false,
+  "patternProperties": {
+    "^(auto_match)$": {
+      "$ref": "workflowcontract.v1.AutoMatch.jsonschema.json"
+    }
+  },
   "properties": {
+    "autoMatch": {
+      "$ref": "workflowcontract.v1.AutoMatch.jsonschema.json"
+    },
     "embedded": {
       "description": "embedded source code (only Rego supported currently)",
       "type": "string"
diff --git a/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.schema.json b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.schema.json
index efdfee897..3e4d82706 100644
--- a/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.schema.json
+++ b/app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpec.schema.json
@@ -2,7 +2,15 @@
   "$id": "workflowcontract.v1.PolicySpec.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "additionalProperties": false,
+  "patternProperties": {
+    "^(autoMatch)$": {
+      "$ref": "workflowcontract.v1.AutoMatch.schema.json"
+    }
+  },
   "properties": {
+    "auto_match": {
+      "$ref": "workflowcontract.v1.AutoMatch.schema.json"
+    },
     "embedded": {
       "description": "embedded source code (only Rego supported currently)",
       "type": "string"
diff --git a/app/controlplane/api/workflowcontract/v1/crafting_schema.pb.go b/app/controlplane/api/workflowcontract/v1/crafting_schema.pb.go
index 33ba3f03f..80a7e6eba 100644
--- a/app/controlplane/api/workflowcontract/v1/crafting_schema.pb.go
+++ b/app/controlplane/api/workflowcontract/v1/crafting_schema.pb.go
@@ -735,7 +735,8 @@ type PolicySpec struct {
 	Type     CraftingSchema_Material_MaterialType `protobuf:"varint,3,opt,name=type,proto3,enum=workflowcontract.v1.CraftingSchema_Material_MaterialType" json:"type,omitempty"`
 	Policies []*PolicySpecV2                      `protobuf:"bytes,4,rep,name=policies,proto3" json:"policies,omitempty"`
 	// Describe the supported inputs
-	Inputs []*PolicyInput `protobuf:"bytes,5,rep,name=inputs,proto3" json:"inputs,omitempty"`
+	Inputs    []*PolicyInput `protobuf:"bytes,5,rep,name=inputs,proto3" json:"inputs,omitempty"`
+	AutoMatch *AutoMatch     `protobuf:"bytes,6,opt,name=auto_match,json=autoMatch,proto3" json:"auto_match,omitempty"`
 }
 
 func (x *PolicySpec) Reset() {
@@ -815,6 +816,13 @@ func (x *PolicySpec) GetInputs() []*PolicyInput {
 	return nil
 }
 
+func (x *PolicySpec) GetAutoMatch() *AutoMatch {
+	if x != nil {
+		return x.AutoMatch
+	}
+	return nil
+}
+
 type isPolicySpec_Source interface {
 	isPolicySpec_Source()
 }
@@ -1000,6 +1008,90 @@ func (*PolicySpecV2_Path) isPolicySpecV2_Source() {}
 
 func (*PolicySpecV2_Embedded) isPolicySpecV2_Source() {}
 
+// Auto-matching policy specification
+type AutoMatch struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Source:
+	//
+	//	*AutoMatch_Path
+	//	*AutoMatch_Embedded
+	Source isAutoMatch_Source `protobuf_oneof:"source"`
+}
+
+func (x *AutoMatch) Reset() {
+	*x = AutoMatch{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AutoMatch) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AutoMatch) ProtoMessage() {}
+
+func (x *AutoMatch) ProtoReflect() protoreflect.Message {
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AutoMatch.ProtoReflect.Descriptor instead.
+func (*AutoMatch) Descriptor() ([]byte, []int) {
+	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{9}
+}
+
+func (m *AutoMatch) GetSource() isAutoMatch_Source {
+	if m != nil {
+		return m.Source
+	}
+	return nil
+}
+
+func (x *AutoMatch) GetPath() string {
+	if x, ok := x.GetSource().(*AutoMatch_Path); ok {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *AutoMatch) GetEmbedded() string {
+	if x, ok := x.GetSource().(*AutoMatch_Embedded); ok {
+		return x.Embedded
+	}
+	return ""
+}
+
+type isAutoMatch_Source interface {
+	isAutoMatch_Source()
+}
+
+type AutoMatch_Path struct {
+	// path to a policy script. It might consist of a URI reference
+	Path string `protobuf:"bytes,1,opt,name=path,proto3,oneof"`
+}
+
+type AutoMatch_Embedded struct {
+	// embedded source code (only Rego supported currently)
+	Embedded string `protobuf:"bytes,2,opt,name=embedded,proto3,oneof"`
+}
+
+func (*AutoMatch_Path) isAutoMatch_Source() {}
+
+func (*AutoMatch_Embedded) isAutoMatch_Source() {}
+
 // Represents a group attachment in a contract
 type PolicyGroupAttachment struct {
 	state         protoimpl.MessageState
@@ -1015,7 +1107,7 @@ type PolicyGroupAttachment struct {
 func (x *PolicyGroupAttachment) Reset() {
 	*x = PolicyGroupAttachment{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[9]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1028,7 +1120,7 @@ func (x *PolicyGroupAttachment) String() string {
 func (*PolicyGroupAttachment) ProtoMessage() {}
 
 func (x *PolicyGroupAttachment) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[9]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1041,7 +1133,7 @@ func (x *PolicyGroupAttachment) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyGroupAttachment.ProtoReflect.Descriptor instead.
 func (*PolicyGroupAttachment) Descriptor() ([]byte, []int) {
-	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{9}
+	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *PolicyGroupAttachment) GetRef() string {
@@ -1073,7 +1165,7 @@ type PolicyGroup struct {
 func (x *PolicyGroup) Reset() {
 	*x = PolicyGroup{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[10]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1086,7 +1178,7 @@ func (x *PolicyGroup) String() string {
 func (*PolicyGroup) ProtoMessage() {}
 
 func (x *PolicyGroup) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[10]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1099,7 +1191,7 @@ func (x *PolicyGroup) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyGroup.ProtoReflect.Descriptor instead.
 func (*PolicyGroup) Descriptor() ([]byte, []int) {
-	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{10}
+	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *PolicyGroup) GetApiVersion() string {
@@ -1141,7 +1233,7 @@ type CraftingSchema_Runner struct {
 func (x *CraftingSchema_Runner) Reset() {
 	*x = CraftingSchema_Runner{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[11]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1154,7 +1246,7 @@ func (x *CraftingSchema_Runner) String() string {
 func (*CraftingSchema_Runner) ProtoMessage() {}
 
 func (x *CraftingSchema_Runner) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[11]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1195,7 +1287,7 @@ type CraftingSchema_Material struct {
 func (x *CraftingSchema_Material) Reset() {
 	*x = CraftingSchema_Material{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[12]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1208,7 +1300,7 @@ func (x *CraftingSchema_Material) String() string {
 func (*CraftingSchema_Material) ProtoMessage() {}
 
 func (x *CraftingSchema_Material) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[12]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1271,7 +1363,7 @@ type PolicyAttachment_MaterialSelector struct {
 func (x *PolicyAttachment_MaterialSelector) Reset() {
 	*x = PolicyAttachment_MaterialSelector{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[14]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1284,7 +1376,7 @@ func (x *PolicyAttachment_MaterialSelector) String() string {
 func (*PolicyAttachment_MaterialSelector) ProtoMessage() {}
 
 func (x *PolicyAttachment_MaterialSelector) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[14]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1319,7 +1411,7 @@ type PolicyGroup_PolicyGroupSpec struct {
 func (x *PolicyGroup_PolicyGroupSpec) Reset() {
 	*x = PolicyGroup_PolicyGroupSpec{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[17]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1332,7 +1424,7 @@ func (x *PolicyGroup_PolicyGroupSpec) String() string {
 func (*PolicyGroup_PolicyGroupSpec) ProtoMessage() {}
 
 func (x *PolicyGroup_PolicyGroupSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[17]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1345,7 +1437,7 @@ func (x *PolicyGroup_PolicyGroupSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyGroup_PolicyGroupSpec.ProtoReflect.Descriptor instead.
 func (*PolicyGroup_PolicyGroupSpec) Descriptor() ([]byte, []int) {
-	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{10, 0}
+	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{11, 0}
 }
 
 func (x *PolicyGroup_PolicyGroupSpec) GetPolicies() *PolicyGroup_PolicyGroupPolicies {
@@ -1374,7 +1466,7 @@ type PolicyGroup_PolicyGroupPolicies struct {
 func (x *PolicyGroup_PolicyGroupPolicies) Reset() {
 	*x = PolicyGroup_PolicyGroupPolicies{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[18]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1387,7 +1479,7 @@ func (x *PolicyGroup_PolicyGroupPolicies) String() string {
 func (*PolicyGroup_PolicyGroupPolicies) ProtoMessage() {}
 
 func (x *PolicyGroup_PolicyGroupPolicies) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[18]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1400,7 +1492,7 @@ func (x *PolicyGroup_PolicyGroupPolicies) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyGroup_PolicyGroupPolicies.ProtoReflect.Descriptor instead.
 func (*PolicyGroup_PolicyGroupPolicies) Descriptor() ([]byte, []int) {
-	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{10, 1}
+	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{11, 1}
 }
 
 func (x *PolicyGroup_PolicyGroupPolicies) GetMaterials() []*PolicyGroup_Material {
@@ -1435,7 +1527,7 @@ type PolicyGroup_Material struct {
 func (x *PolicyGroup_Material) Reset() {
 	*x = PolicyGroup_Material{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[19]
+		mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1448,7 +1540,7 @@ func (x *PolicyGroup_Material) String() string {
 func (*PolicyGroup_Material) ProtoMessage() {}
 
 func (x *PolicyGroup_Material) ProtoReflect() protoreflect.Message {
-	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[19]
+	mi := &file_workflowcontract_v1_crafting_schema_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1461,7 +1553,7 @@ func (x *PolicyGroup_Material) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyGroup_Material.ProtoReflect.Descriptor instead.
 func (*PolicyGroup_Material) Descriptor() ([]byte, []int) {
-	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{10, 2}
+	return file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP(), []int{11, 2}
 }
 
 func (x *PolicyGroup_Material) GetType() CraftingSchema_Material_MaterialType {
@@ -1689,7 +1781,7 @@ var file_workflowcontract_v1_crafting_schema_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61,
 	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x22, 0xb8, 0x03, 0x0a, 0x0a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53,
+	0x3a, 0x02, 0x38, 0x01, 0x22, 0xf7, 0x03, 0x0a, 0x0a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53,
 	0x70, 0x65, 0x63, 0x12, 0x18, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x09, 0x42, 0x02, 0x18, 0x01, 0x48, 0x00, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x20, 0x0a,
 	0x08, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42,
@@ -1707,120 +1799,129 @@ var file_workflowcontract_v1_crafting_schema_proto_rawDesc = []byte{
 	0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x77,
 	0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e,
 	0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x52, 0x06,
-	0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x3a, 0x8c, 0x01, 0xba, 0x48, 0x88, 0x01, 0x1a, 0x85, 0x01,
-	0x0a, 0x0a, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x73, 0x70, 0x65, 0x63, 0x12, 0x36, 0x65, 0x69,
-	0x74, 0x68, 0x65, 0x72, 0x20, 0x73, 0x70, 0x65, 0x63, 0x20, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x20, 0x6f, 0x72, 0x20, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x20, 0x66, 0x69, 0x65,
-	0x6c, 0x64, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x64, 0x1a, 0x3f, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x70,
-	0x61, 0x74, 0x68, 0x29, 0x20, 0x7c, 0x7c, 0x20, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73,
-	0x2e, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x29, 0x20, 0x7c, 0x7c, 0x20, 0x73, 0x69,
-	0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
-	0x29, 0x20, 0x3e, 0x20, 0x30, 0x42, 0x08, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22,
-	0xfe, 0x01, 0x0a, 0x0b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12,
-	0x96, 0x01, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x81,
-	0x01, 0xba, 0x48, 0x7e, 0xba, 0x01, 0x7b, 0x0a, 0x14, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x67, 0x6f,
-	0x5f, 0x6d, 0x61, 0x70, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x3a, 0x6d,
-	0x75, 0x73, 0x74, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x6f, 0x6e, 0x6c, 0x79,
-	0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x63, 0x61, 0x73, 0x65, 0x20, 0x6c, 0x65, 0x74, 0x74, 0x65,
-	0x72, 0x73, 0x2c, 0x20, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64,
-	0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2e, 0x1a, 0x27, 0x74, 0x68, 0x69, 0x73, 0x2e,
-	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
-	0x5a, 0x5d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x5d, 0x2a, 0x24,
-	0x27, 0x29, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63,
-	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65,
-	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x72, 0x65,
-	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c,
-	0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
-	0x22, 0xad, 0x01, 0x0a, 0x0c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53, 0x70, 0x65, 0x63, 0x56,
-	0x32, 0x12, 0x14, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x00, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1c, 0x0a, 0x08, 0x65, 0x6d, 0x62, 0x65, 0x64,
-	0x64, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x65, 0x6d, 0x62,
-	0x65, 0x64, 0x64, 0x65, 0x64, 0x12, 0x58, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x39, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x61, 0x66, 0x74, 0x69,
-	0x6e, 0x67, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61,
-	0x6c, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x42, 0x09,
-	0xba, 0x48, 0x06, 0x82, 0x01, 0x03, 0x22, 0x01, 0x03, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x42,
-	0x0f, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01,
-	0x22, 0xb5, 0x01, 0x0a, 0x15, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x41, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x19, 0x0a, 0x03, 0x72, 0x65,
-	0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x10, 0x01,
-	0x52, 0x03, 0x72, 0x65, 0x66, 0x12, 0x48, 0x0a, 0x04, 0x77, 0x69, 0x74, 0x68, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x41, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x57, 0x69, 0x74, 0x68, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x77, 0x69, 0x74, 0x68, 0x1a,
-	0x37, 0x0a, 0x09, 0x57, 0x69, 0x74, 0x68, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xb5, 0x07, 0x0a, 0x0b, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x49, 0x0a, 0x0b, 0x61, 0x70, 0x69, 0x5f,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x28, 0xba,
-	0x48, 0x25, 0x72, 0x23, 0x0a, 0x21, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70,
-	0x2e, 0x64, 0x65, 0x76, 0x2f, 0x76, 0x31, 0x52, 0x0a, 0x61, 0x70, 0x69, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x26, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0x12, 0xba, 0x48, 0x0f, 0x72, 0x0d, 0x0a, 0x0b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x41, 0x0a, 0x08, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74,
-	0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x42, 0x06, 0xba, 0x48,
-	0x03, 0xc8, 0x01, 0x01, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x4c,
-	0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x77,
-	0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e,
-	0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x70, 0x65, 0x63, 0x42, 0x06,
-	0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x1a, 0x9d, 0x01, 0x0a,
-	0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x70, 0x65, 0x63,
-	0x12, 0x50, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x34, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69,
-	0x65, 0x73, 0x12, 0x38, 0x0a, 0x06, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49,
-	0x6e, 0x70, 0x75, 0x74, 0x52, 0x06, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x1a, 0xa7, 0x01, 0x0a,
-	0x13, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x69, 0x65, 0x73, 0x12, 0x47, 0x0a, 0x09, 0x6d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c,
-	0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69,
-	0x61, 0x6c, 0x52, 0x09, 0x6d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x47, 0x0a,
-	0x0b, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x25, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x41,
-	0x74, 0x74, 0x61, 0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x0b, 0x61, 0x74, 0x74, 0x65, 0x73,
-	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xd7, 0x02, 0x0a, 0x08, 0x4d, 0x61, 0x74, 0x65, 0x72,
-	0x69, 0x61, 0x6c, 0x12, 0x57, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x39, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74,
-	0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x61, 0x66, 0x74, 0x69, 0x6e, 0x67,
-	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x2e,
-	0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x42, 0x08, 0xba, 0x48,
-	0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x1a, 0x0a, 0x08, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x08, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x41, 0x0a, 0x08,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25,
+	0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x12, 0x3d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x77, 0x6f, 0x72,
+	0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31,
+	0x2e, 0x41, 0x75, 0x74, 0x6f, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x09, 0x61, 0x75, 0x74, 0x6f,
+	0x4d, 0x61, 0x74, 0x63, 0x68, 0x3a, 0x8c, 0x01, 0xba, 0x48, 0x88, 0x01, 0x1a, 0x85, 0x01, 0x0a,
+	0x0a, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x73, 0x70, 0x65, 0x63, 0x12, 0x36, 0x65, 0x69, 0x74,
+	0x68, 0x65, 0x72, 0x20, 0x73, 0x70, 0x65, 0x63, 0x20, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x20,
+	0x6f, 0x72, 0x20, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x20, 0x66, 0x69, 0x65, 0x6c,
+	0x64, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x64, 0x1a, 0x3f, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x70, 0x61,
+	0x74, 0x68, 0x29, 0x20, 0x7c, 0x7c, 0x20, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e,
+	0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x29, 0x20, 0x7c, 0x7c, 0x20, 0x73, 0x69, 0x7a,
+	0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x29,
+	0x20, 0x3e, 0x20, 0x30, 0x42, 0x08, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xfe,
+	0x01, 0x0a, 0x0b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x96,
+	0x01, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x81, 0x01,
+	0xba, 0x48, 0x7e, 0xba, 0x01, 0x7b, 0x0a, 0x14, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x67, 0x6f, 0x5f,
+	0x6d, 0x61, 0x70, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x3a, 0x6d, 0x75,
+	0x73, 0x74, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x6f, 0x6e, 0x6c, 0x79, 0x20,
+	0x6c, 0x6f, 0x77, 0x65, 0x72, 0x63, 0x61, 0x73, 0x65, 0x20, 0x6c, 0x65, 0x74, 0x74, 0x65, 0x72,
+	0x73, 0x2c, 0x20, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20,
+	0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2e, 0x1a, 0x27, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
+	0x5d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x5d, 0x2a, 0x24, 0x27,
+	0x29, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x71,
+	0x75, 0x69, 0x72, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x72, 0x65, 0x71,
+	0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x22,
+	0xad, 0x01, 0x0a, 0x0c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53, 0x70, 0x65, 0x63, 0x56, 0x32,
+	0x12, 0x14, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
+	0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1c, 0x0a, 0x08, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64,
+	0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x65, 0x6d, 0x62, 0x65,
+	0x64, 0x64, 0x65, 0x64, 0x12, 0x58, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x39, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x61, 0x66, 0x74, 0x69, 0x6e,
+	0x67, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c,
+	0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x42, 0x09, 0xba,
+	0x48, 0x06, 0x82, 0x01, 0x03, 0x22, 0x01, 0x03, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x42, 0x0f,
+	0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22,
+	0x50, 0x0a, 0x09, 0x41, 0x75, 0x74, 0x6f, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x14, 0x0a, 0x04,
+	0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x70, 0x61,
+	0x74, 0x68, 0x12, 0x1c, 0x0a, 0x08, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64,
+	0x42, 0x0f, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08,
+	0x01, 0x22, 0xb5, 0x01, 0x0a, 0x15, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x41, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x19, 0x0a, 0x03, 0x72,
+	0x65, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x10,
+	0x01, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12, 0x48, 0x0a, 0x04, 0x77, 0x69, 0x74, 0x68, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63,
+	0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x41, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x57, 0x69, 0x74, 0x68, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x77, 0x69, 0x74, 0x68,
+	0x1a, 0x37, 0x0a, 0x09, 0x57, 0x69, 0x74, 0x68, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xb5, 0x07, 0x0a, 0x0b, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x49, 0x0a, 0x0b, 0x61, 0x70, 0x69,
+	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x28,
+	0xba, 0x48, 0x25, 0x72, 0x23, 0x0a, 0x21, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63,
+	0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f,
+	0x70, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x76, 0x31, 0x52, 0x0a, 0x61, 0x70, 0x69, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x26, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x12, 0xba, 0x48, 0x0f, 0x72, 0x0d, 0x0a, 0x0b, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x41, 0x0a, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
 	0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63,
-	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x41, 0x74, 0x74, 0x61, 0x63,
-	0x68, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x3a,
-	0x7f, 0xba, 0x48, 0x7c, 0x1a, 0x7a, 0x0a, 0x0e, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6d, 0x61,
-	0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x33, 0x69, 0x66, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
-	0x69, 0x73, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x74, 0x79, 0x70,
-	0x65, 0x20, 0x73, 0x68, 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x68, 0x61, 0x76, 0x65, 0x20, 0x61, 0x20,
-	0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x1a, 0x33, 0x21, 0x68, 0x61,
-	0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x20, 0x7c, 0x7c, 0x20,
-	0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x20, 0x26,
-	0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x20, 0x21, 0x3d, 0x20, 0x30,
-	0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63,
-	0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2d, 0x64, 0x65, 0x76, 0x2f, 0x63, 0x68, 0x61,
-	0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x77, 0x6f, 0x72, 0x6b,
-	0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2f, 0x76, 0x31, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x42, 0x06, 0xba,
+	0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x4c, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e,
+	0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74,
+	0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x70, 0x65, 0x63, 0x42,
+	0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x1a, 0x9d, 0x01,
+	0x0a, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x50, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x69, 0x65, 0x73, 0x12, 0x38, 0x0a, 0x06, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x49, 0x6e, 0x70, 0x75, 0x74, 0x52, 0x06, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x1a, 0xa7, 0x01,
+	0x0a, 0x13, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x69, 0x65, 0x73, 0x12, 0x47, 0x0a, 0x09, 0x6d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61,
+	0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66,
+	0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72,
+	0x69, 0x61, 0x6c, 0x52, 0x09, 0x6d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x47,
+	0x0a, 0x0b, 0x61, 0x74, 0x74, 0x65, 0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x41, 0x74, 0x74, 0x61, 0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x0b, 0x61, 0x74, 0x74, 0x65,
+	0x73, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xd7, 0x02, 0x0a, 0x08, 0x4d, 0x61, 0x74, 0x65,
+	0x72, 0x69, 0x61, 0x6c, 0x12, 0x57, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x39, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x61, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x61, 0x66, 0x74, 0x69, 0x6e,
+	0x67, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c,
+	0x2e, 0x4d, 0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x42, 0x08, 0xba,
+	0x48, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x08, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x41, 0x0a,
+	0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x25, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61,
+	0x63, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x41, 0x74, 0x74, 0x61,
+	0x63, 0x68, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73,
+	0x3a, 0x7f, 0xba, 0x48, 0x7c, 0x1a, 0x7a, 0x0a, 0x0e, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6d,
+	0x61, 0x74, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x33, 0x69, 0x66, 0x20, 0x6e, 0x61, 0x6d, 0x65,
+	0x20, 0x69, 0x73, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x74, 0x79,
+	0x70, 0x65, 0x20, 0x73, 0x68, 0x6f, 0x75, 0x6c, 0x64, 0x20, 0x68, 0x61, 0x76, 0x65, 0x20, 0x61,
+	0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x1a, 0x33, 0x21, 0x68,
+	0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x20, 0x7c, 0x7c,
+	0x20, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x20,
+	0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x20, 0x21, 0x3d, 0x20,
+	0x30, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2d, 0x64, 0x65, 0x76, 0x2f, 0x63, 0x68,
+	0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x77, 0x6f, 0x72,
+	0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x61, 0x63, 0x74, 0x2f, 0x76, 0x31,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1836,7 +1937,7 @@ func file_workflowcontract_v1_crafting_schema_proto_rawDescGZIP() []byte {
 }
 
 var file_workflowcontract_v1_crafting_schema_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_workflowcontract_v1_crafting_schema_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
+var file_workflowcontract_v1_crafting_schema_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
 var file_workflowcontract_v1_crafting_schema_proto_goTypes = []interface{}{
 	(CraftingSchema_Runner_RunnerType)(0),     // 0: workflowcontract.v1.CraftingSchema.Runner.RunnerType
 	(CraftingSchema_Material_MaterialType)(0), // 1: workflowcontract.v1.CraftingSchema.Material.MaterialType
@@ -1849,53 +1950,55 @@ var file_workflowcontract_v1_crafting_schema_proto_goTypes = []interface{}{
 	(*PolicySpec)(nil),                        // 8: workflowcontract.v1.PolicySpec
 	(*PolicyInput)(nil),                       // 9: workflowcontract.v1.PolicyInput
 	(*PolicySpecV2)(nil),                      // 10: workflowcontract.v1.PolicySpecV2
-	(*PolicyGroupAttachment)(nil),             // 11: workflowcontract.v1.PolicyGroupAttachment
-	(*PolicyGroup)(nil),                       // 12: workflowcontract.v1.PolicyGroup
-	(*CraftingSchema_Runner)(nil),             // 13: workflowcontract.v1.CraftingSchema.Runner
-	(*CraftingSchema_Material)(nil),           // 14: workflowcontract.v1.CraftingSchema.Material
-	nil,                                       // 15: workflowcontract.v1.PolicyAttachment.WithEntry
-	(*PolicyAttachment_MaterialSelector)(nil), // 16: workflowcontract.v1.PolicyAttachment.MaterialSelector
-	nil,                                     // 17: workflowcontract.v1.Metadata.AnnotationsEntry
-	nil,                                     // 18: workflowcontract.v1.PolicyGroupAttachment.WithEntry
-	(*PolicyGroup_PolicyGroupSpec)(nil),     // 19: workflowcontract.v1.PolicyGroup.PolicyGroupSpec
-	(*PolicyGroup_PolicyGroupPolicies)(nil), // 20: workflowcontract.v1.PolicyGroup.PolicyGroupPolicies
-	(*PolicyGroup_Material)(nil),            // 21: workflowcontract.v1.PolicyGroup.Material
+	(*AutoMatch)(nil),                         // 11: workflowcontract.v1.AutoMatch
+	(*PolicyGroupAttachment)(nil),             // 12: workflowcontract.v1.PolicyGroupAttachment
+	(*PolicyGroup)(nil),                       // 13: workflowcontract.v1.PolicyGroup
+	(*CraftingSchema_Runner)(nil),             // 14: workflowcontract.v1.CraftingSchema.Runner
+	(*CraftingSchema_Material)(nil),           // 15: workflowcontract.v1.CraftingSchema.Material
+	nil,                                       // 16: workflowcontract.v1.PolicyAttachment.WithEntry
+	(*PolicyAttachment_MaterialSelector)(nil), // 17: workflowcontract.v1.PolicyAttachment.MaterialSelector
+	nil,                                     // 18: workflowcontract.v1.Metadata.AnnotationsEntry
+	nil,                                     // 19: workflowcontract.v1.PolicyGroupAttachment.WithEntry
+	(*PolicyGroup_PolicyGroupSpec)(nil),     // 20: workflowcontract.v1.PolicyGroup.PolicyGroupSpec
+	(*PolicyGroup_PolicyGroupPolicies)(nil), // 21: workflowcontract.v1.PolicyGroup.PolicyGroupPolicies
+	(*PolicyGroup_Material)(nil),            // 22: workflowcontract.v1.PolicyGroup.Material
 }
 var file_workflowcontract_v1_crafting_schema_proto_depIdxs = []int32{
-	14, // 0: workflowcontract.v1.CraftingSchema.materials:type_name -> workflowcontract.v1.CraftingSchema.Material
-	13, // 1: workflowcontract.v1.CraftingSchema.runner:type_name -> workflowcontract.v1.CraftingSchema.Runner
+	15, // 0: workflowcontract.v1.CraftingSchema.materials:type_name -> workflowcontract.v1.CraftingSchema.Material
+	14, // 1: workflowcontract.v1.CraftingSchema.runner:type_name -> workflowcontract.v1.CraftingSchema.Runner
 	3,  // 2: workflowcontract.v1.CraftingSchema.annotations:type_name -> workflowcontract.v1.Annotation
 	4,  // 3: workflowcontract.v1.CraftingSchema.policies:type_name -> workflowcontract.v1.Policies
-	11, // 4: workflowcontract.v1.CraftingSchema.policy_groups:type_name -> workflowcontract.v1.PolicyGroupAttachment
+	12, // 4: workflowcontract.v1.CraftingSchema.policy_groups:type_name -> workflowcontract.v1.PolicyGroupAttachment
 	5,  // 5: workflowcontract.v1.Policies.materials:type_name -> workflowcontract.v1.PolicyAttachment
 	5,  // 6: workflowcontract.v1.Policies.attestation:type_name -> workflowcontract.v1.PolicyAttachment
 	6,  // 7: workflowcontract.v1.PolicyAttachment.embedded:type_name -> workflowcontract.v1.Policy
-	16, // 8: workflowcontract.v1.PolicyAttachment.selector:type_name -> workflowcontract.v1.PolicyAttachment.MaterialSelector
-	15, // 9: workflowcontract.v1.PolicyAttachment.with:type_name -> workflowcontract.v1.PolicyAttachment.WithEntry
+	17, // 8: workflowcontract.v1.PolicyAttachment.selector:type_name -> workflowcontract.v1.PolicyAttachment.MaterialSelector
+	16, // 9: workflowcontract.v1.PolicyAttachment.with:type_name -> workflowcontract.v1.PolicyAttachment.WithEntry
 	7,  // 10: workflowcontract.v1.Policy.metadata:type_name -> workflowcontract.v1.Metadata
 	8,  // 11: workflowcontract.v1.Policy.spec:type_name -> workflowcontract.v1.PolicySpec
-	17, // 12: workflowcontract.v1.Metadata.annotations:type_name -> workflowcontract.v1.Metadata.AnnotationsEntry
+	18, // 12: workflowcontract.v1.Metadata.annotations:type_name -> workflowcontract.v1.Metadata.AnnotationsEntry
 	1,  // 13: workflowcontract.v1.PolicySpec.type:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
 	10, // 14: workflowcontract.v1.PolicySpec.policies:type_name -> workflowcontract.v1.PolicySpecV2
 	9,  // 15: workflowcontract.v1.PolicySpec.inputs:type_name -> workflowcontract.v1.PolicyInput
-	1,  // 16: workflowcontract.v1.PolicySpecV2.kind:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
-	18, // 17: workflowcontract.v1.PolicyGroupAttachment.with:type_name -> workflowcontract.v1.PolicyGroupAttachment.WithEntry
-	7,  // 18: workflowcontract.v1.PolicyGroup.metadata:type_name -> workflowcontract.v1.Metadata
-	19, // 19: workflowcontract.v1.PolicyGroup.spec:type_name -> workflowcontract.v1.PolicyGroup.PolicyGroupSpec
-	0,  // 20: workflowcontract.v1.CraftingSchema.Runner.type:type_name -> workflowcontract.v1.CraftingSchema.Runner.RunnerType
-	1,  // 21: workflowcontract.v1.CraftingSchema.Material.type:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
-	3,  // 22: workflowcontract.v1.CraftingSchema.Material.annotations:type_name -> workflowcontract.v1.Annotation
-	20, // 23: workflowcontract.v1.PolicyGroup.PolicyGroupSpec.policies:type_name -> workflowcontract.v1.PolicyGroup.PolicyGroupPolicies
-	9,  // 24: workflowcontract.v1.PolicyGroup.PolicyGroupSpec.inputs:type_name -> workflowcontract.v1.PolicyInput
-	21, // 25: workflowcontract.v1.PolicyGroup.PolicyGroupPolicies.materials:type_name -> workflowcontract.v1.PolicyGroup.Material
-	5,  // 26: workflowcontract.v1.PolicyGroup.PolicyGroupPolicies.attestation:type_name -> workflowcontract.v1.PolicyAttachment
-	1,  // 27: workflowcontract.v1.PolicyGroup.Material.type:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
-	5,  // 28: workflowcontract.v1.PolicyGroup.Material.policies:type_name -> workflowcontract.v1.PolicyAttachment
-	29, // [29:29] is the sub-list for method output_type
-	29, // [29:29] is the sub-list for method input_type
-	29, // [29:29] is the sub-list for extension type_name
-	29, // [29:29] is the sub-list for extension extendee
-	0,  // [0:29] is the sub-list for field type_name
+	11, // 16: workflowcontract.v1.PolicySpec.auto_match:type_name -> workflowcontract.v1.AutoMatch
+	1,  // 17: workflowcontract.v1.PolicySpecV2.kind:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
+	19, // 18: workflowcontract.v1.PolicyGroupAttachment.with:type_name -> workflowcontract.v1.PolicyGroupAttachment.WithEntry
+	7,  // 19: workflowcontract.v1.PolicyGroup.metadata:type_name -> workflowcontract.v1.Metadata
+	20, // 20: workflowcontract.v1.PolicyGroup.spec:type_name -> workflowcontract.v1.PolicyGroup.PolicyGroupSpec
+	0,  // 21: workflowcontract.v1.CraftingSchema.Runner.type:type_name -> workflowcontract.v1.CraftingSchema.Runner.RunnerType
+	1,  // 22: workflowcontract.v1.CraftingSchema.Material.type:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
+	3,  // 23: workflowcontract.v1.CraftingSchema.Material.annotations:type_name -> workflowcontract.v1.Annotation
+	21, // 24: workflowcontract.v1.PolicyGroup.PolicyGroupSpec.policies:type_name -> workflowcontract.v1.PolicyGroup.PolicyGroupPolicies
+	9,  // 25: workflowcontract.v1.PolicyGroup.PolicyGroupSpec.inputs:type_name -> workflowcontract.v1.PolicyInput
+	22, // 26: workflowcontract.v1.PolicyGroup.PolicyGroupPolicies.materials:type_name -> workflowcontract.v1.PolicyGroup.Material
+	5,  // 27: workflowcontract.v1.PolicyGroup.PolicyGroupPolicies.attestation:type_name -> workflowcontract.v1.PolicyAttachment
+	1,  // 28: workflowcontract.v1.PolicyGroup.Material.type:type_name -> workflowcontract.v1.CraftingSchema.Material.MaterialType
+	5,  // 29: workflowcontract.v1.PolicyGroup.Material.policies:type_name -> workflowcontract.v1.PolicyAttachment
+	30, // [30:30] is the sub-list for method output_type
+	30, // [30:30] is the sub-list for method input_type
+	30, // [30:30] is the sub-list for extension type_name
+	30, // [30:30] is the sub-list for extension extendee
+	0,  // [0:30] is the sub-list for field type_name
 }
 
 func init() { file_workflowcontract_v1_crafting_schema_proto_init() }
@@ -2013,7 +2116,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 			}
 		}
 		file_workflowcontract_v1_crafting_schema_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PolicyGroupAttachment); i {
+			switch v := v.(*AutoMatch); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2025,7 +2128,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 			}
 		}
 		file_workflowcontract_v1_crafting_schema_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PolicyGroup); i {
+			switch v := v.(*PolicyGroupAttachment); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2037,7 +2140,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 			}
 		}
 		file_workflowcontract_v1_crafting_schema_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CraftingSchema_Runner); i {
+			switch v := v.(*PolicyGroup); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2049,6 +2152,18 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 			}
 		}
 		file_workflowcontract_v1_crafting_schema_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CraftingSchema_Runner); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_workflowcontract_v1_crafting_schema_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CraftingSchema_Material); i {
 			case 0:
 				return &v.state
@@ -2060,7 +2175,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 				return nil
 			}
 		}
-		file_workflowcontract_v1_crafting_schema_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+		file_workflowcontract_v1_crafting_schema_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PolicyAttachment_MaterialSelector); i {
 			case 0:
 				return &v.state
@@ -2072,7 +2187,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 				return nil
 			}
 		}
-		file_workflowcontract_v1_crafting_schema_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+		file_workflowcontract_v1_crafting_schema_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PolicyGroup_PolicyGroupSpec); i {
 			case 0:
 				return &v.state
@@ -2084,7 +2199,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 				return nil
 			}
 		}
-		file_workflowcontract_v1_crafting_schema_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+		file_workflowcontract_v1_crafting_schema_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PolicyGroup_PolicyGroupPolicies); i {
 			case 0:
 				return &v.state
@@ -2096,7 +2211,7 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 				return nil
 			}
 		}
-		file_workflowcontract_v1_crafting_schema_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+		file_workflowcontract_v1_crafting_schema_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PolicyGroup_Material); i {
 			case 0:
 				return &v.state
@@ -2121,13 +2236,17 @@ func file_workflowcontract_v1_crafting_schema_proto_init() {
 		(*PolicySpecV2_Path)(nil),
 		(*PolicySpecV2_Embedded)(nil),
 	}
+	file_workflowcontract_v1_crafting_schema_proto_msgTypes[9].OneofWrappers = []interface{}{
+		(*AutoMatch_Path)(nil),
+		(*AutoMatch_Embedded)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_workflowcontract_v1_crafting_schema_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   20,
+			NumMessages:   21,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/app/controlplane/api/workflowcontract/v1/crafting_schema.proto b/app/controlplane/api/workflowcontract/v1/crafting_schema.proto
index 71fff99eb..91b27ca2f 100644
--- a/app/controlplane/api/workflowcontract/v1/crafting_schema.proto
+++ b/app/controlplane/api/workflowcontract/v1/crafting_schema.proto
@@ -247,6 +247,8 @@ message PolicySpec {
   // Describe the supported inputs
   repeated PolicyInput inputs = 5;
 
+  AutoMatch auto_match = 6;
+
   option (buf.validate.message).cel = {
     id: "policyspec"
     message: "either spec source or policies fields must be provided"
@@ -285,6 +287,19 @@ message PolicySpecV2 {
   }];
 }
 
+// Auto-matching policy specification
+message AutoMatch {
+  oneof source {
+    // path to a policy script. It might consist of a URI reference
+    string path = 1;
+
+    // embedded source code (only Rego supported currently)
+    string embedded = 2;
+
+    option (buf.validate.oneof).required = true;
+  }
+}
+
 // Represents a group attachment in a contract
 message PolicyGroupAttachment {
   // Group reference, it might be an URL or a provider reference

From febf62630bd6547d1bbddf92228f817886893b37 Mon Sep 17 00:00:00 2001
From: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Date: Thu, 4 Sep 2025 00:04:46 +0200
Subject: [PATCH 3/4] fix non existent rule defaults

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
---
 pkg/policies/engine/rego/rego.go | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/pkg/policies/engine/rego/rego.go b/pkg/policies/engine/rego/rego.go
index 7b827a3c7..2e94bb9fc 100644
--- a/pkg/policies/engine/rego/rego.go
+++ b/pkg/policies/engine/rego/rego.go
@@ -390,7 +390,6 @@ func getRuleName(packagePath ast.Ref, rule string) string {
 
 // MatchesParameters evaluates the matches_parameters rule in a rego policy.
 // The function creates an input object with policy parameters and expected parameters.
-// Returns true if the policy's matches_parameters rule evaluates to true, false otherwise.
 func (r *Engine) MatchesParameters(ctx context.Context, policy *engine.Policy, evaluationParams, expectedParams map[string]string) (bool, error) {
 	policyString := string(policy.Source)
 	parsedModule, err := ast.ParseModule(policy.Name, policyString)
@@ -412,18 +411,20 @@ func (r *Engine) MatchesParameters(ctx context.Context, policy *engine.Policy, e
 	}
 
 	// Evaluate matches_parameters rule
-	matchesParameters, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesParametersRule), parsedModule, inputMap)
+	matchesParameters, found, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesParametersRule), parsedModule, inputMap)
 	if err != nil {
-		// Defaults to false
 		return false, err
 	}
+	if !found {
+		// Rule not found, defaults to false
+		return false, nil
+	}
 
 	return matchesParameters, nil
 }
 
 // MatchesEvaluation evaluates the matches_evaluation rule in a rego policy.
-// The function creates an input object with expected parameters and policy violations.
-// Returns true if the policy's matches_evaluation rule evaluates to true, false otherwise.
+// Creates an input object with expected parameters and policy violations.
 func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, violations []string, expectedParams map[string]string) (bool, error) {
 	policyString := string(policy.Source)
 	parsedModule, err := ast.ParseModule(policy.Name, policyString)
@@ -444,18 +445,21 @@ func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, v
 		inputMap[violationsResult] = violations
 	}
 
-	// Evaluate matches_parameters rule
-	matchesEvaluation, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesEvaluationRule), parsedModule, inputMap)
+	// Evaluate matches_evaluation rule
+	matchesEvaluation, found, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesEvaluationRule), parsedModule, inputMap)
 	if err != nil {
-		// Defaults to false
 		return false, err
 	}
+	if !found {
+		// Rule not found, defaults to true
+		return true, nil
+	}
 
 	return matchesEvaluation, nil
 }
 
 // Evaluates a single rule and returns its boolean result
-func (r *Engine) evaluateMatchingRule(ctx context.Context, ruleName string, parsedModule *ast.Module, decodedInput interface{}) (bool, error) {
+func (r *Engine) evaluateMatchingRule(ctx context.Context, ruleName string, parsedModule *ast.Module, decodedInput interface{}) (result bool, found bool, err error) {
 	// Add input
 	regoInput := rego.Input(decodedInput)
 
@@ -469,18 +473,18 @@ func (r *Engine) evaluateMatchingRule(ctx context.Context, ruleName string, pars
 
 	res, err := queryRego(ctx, ruleName, options...)
 	if err != nil {
-		return false, err
+		return false, false, err
 	}
 
 	// Parse the boolean result
 	for _, exp := range res {
 		for _, val := range exp.Expressions {
 			if boolResult, ok := val.Value.(bool); ok {
-				return boolResult, nil
+				return boolResult, true, nil
 			}
 		}
 	}
 
-	// No valid boolean result found
-	return false, nil
+	// Rule not found or returns non bool value
+	return false, false, nil
 }

From fb3609dcc8a9c64eba65ffdfff30c269465202e9 Mon Sep 17 00:00:00 2001
From: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Date: Thu, 4 Sep 2025 00:51:03 +0200
Subject: [PATCH 4/4] fix tests

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
---
 pkg/policies/engine/rego/rego_test.go                  | 10 +++++-----
 .../engine/rego/testfiles/matches_evaluation.rego      |  7 +++----
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/pkg/policies/engine/rego/rego_test.go b/pkg/policies/engine/rego/rego_test.go
index 0b9c7dcb5..78cea5056 100644
--- a/pkg/policies/engine/rego/rego_test.go
+++ b/pkg/policies/engine/rego/rego_test.go
@@ -392,15 +392,15 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 		Source: regoContent,
 	}
 
-	t.Run("evaluation with violations and high severity matches", func(t *testing.T) {
+	t.Run("evaluation with violations and high severity does not match", func(t *testing.T) {
 		violations := []string{"test violation"}
 		evaluationParams := map[string]string{"severity": "high"}
 		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
-		assert.True(t, matches)
+		assert.False(t, matches)
 	})
 
-	t.Run("evaluation without violations does not match", func(t *testing.T) {
+	t.Run("evaluation without violations does matches", func(t *testing.T) {
 		violations := []string{}
 		evaluationParams := map[string]string{"severity": "high"}
 		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
@@ -408,7 +408,7 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 		assert.False(t, matches)
 	})
 
-	t.Run("evaluation with violations but wrong severity does not match", func(t *testing.T) {
+	t.Run("evaluation with violations but wrong severity does match", func(t *testing.T) {
 		violations := []string{"test violation"}
 		evaluationParams := map[string]string{"severity": "low"}
 		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
@@ -416,7 +416,7 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 		assert.False(t, matches)
 	})
 
-	t.Run("nil evaluation does not match", func(t *testing.T) {
+	t.Run("nil evaluation matches", func(t *testing.T) {
 		evaluationParams := map[string]string{"severity": "high"}
 		matches, err := r.MatchesEvaluation(context.TODO(), policy, nil, evaluationParams)
 		require.NoError(t, err)
diff --git a/pkg/policies/engine/rego/testfiles/matches_evaluation.rego b/pkg/policies/engine/rego/testfiles/matches_evaluation.rego
index 757cad874..1eef427ed 100644
--- a/pkg/policies/engine/rego/testfiles/matches_evaluation.rego
+++ b/pkg/policies/engine/rego/testfiles/matches_evaluation.rego
@@ -1,12 +1,11 @@
 package test_matches_evaluation
 
-matches_evaluation := result {
+default matches_evaluation := true
+
+matches_evaluation := false if {
     # Check if the evaluation contains violations 
     count(input.violations) > 0
     
     # Check if we have the expected parameter
     input.expected_args.severity == "high"
-    
-    # If both conditions are met, return true
-    result := true
 }
\ No newline at end of file