Summary

Wave B of the governance waveplan — a new top-level rocky compliance verb that reports on column classification + masking coverage across a project. Thin rollup over what Wave A (#240/#241) shipped.

Answers the question: Are all classified columns masked wherever policy says they should be?

CLI surface

rocky compliance                       # full report (text or --output json)
rocky compliance --env prod            # scope to one env
rocky compliance --exceptions-only     # only emit the unmasked-where-expected list
rocky compliance --fail-on exception   # CI gate: exit 1 if any exception

Output (typed + codegen-backed)

ComplianceOutput with summary / per_column / exceptions. EnvMaskingStatus reports strategy + enforced per (model, column, env). Derives JsonSchema; Pydantic + TypeScript bindings regenerated and re-exported.

Resolver semantics (design decisions from the PR body)

• total_masked is counted over (model, column, env) triples — same granularity as total_exceptions.
• MaskStrategy::None counts as masked (explicit-identity is a policy decision, not a gap).
• [classifications.allow_unmasked] suppresses ComplianceException emission; per_column rows still report the truth (enforced: false, masking_strategy: "unresolved").
• Env enumeration: without --env, iterates None (labeled "default") ∪ every [mask.<env>] override key. With --env X, a single Some(X) pass — defaults fallback if [mask.X] is absent.
• --exceptions-only filters per_column to columns that triggered an exception; exceptions list itself is unfiltered.
• --fail-on exception exit = 1 if !exceptions.is_empty(), else 0. Default run never fails on report content.

Files touched

• engine/crates/rocky-cli/src/commands/compliance.rs (new, ~491 LOC incl. 10 unit tests)
• engine/crates/rocky-cli/src/output.rs — 5 new output types
• engine/crates/rocky-cli/src/commands/{mod.rs,export_schemas.rs}
• engine/rocky/src/main.rs — clap Compliance variant + ComplianceFailOn enum
• schemas/compliance.schema.json (codegen)
• integrations/dagster/src/dagster_rocky/types_generated/compliance_schema.py (codegen)
• integrations/dagster/src/dagster_rocky/types_generated/__init__.py + types.py — re-exports + parse_rocky_output route
• editors/vscode/src/types/generated/{compliance.ts,index.ts} (codegen)

Test plan

• cargo test --workspace — 2481 passed, 0 failed
• cargo clippy --workspace --all-targets -- -D warnings — green
• cargo fmt --check — green
• uv run pytest tests/test_types.py (dagster) — 23 passed
• npm run test:unit (vscode) — 20 passed
• just codegen idempotent (no drift on re-run)
• Manual CLI smoke tests: all four flag combinations, both output modes, --fail-on exception exit-1 semantics