feat(agentos-api): stub policy endpoints to avoid /policies 404

The Policies tab in the obs-branch UI calls /api/policies + /opa-policies
+ /agents/:name/policy. In the upstream design these proxy to an external
SRS (Security/Runtime/Safety) service; we don't run SRS in this
deployment so the UI was showing "/policies → 404".

Add minimal stubs so the UI gets empty list responses + can render its
clean EmptyState components:

  GET    /policies                  → {policies: []}      200
  GET    /policies/:id              → {error: NOT_FOUND}  404
  POST   /policies                  → {error: SRS_NOT_CONFIGURED} 503
  PUT    /policies/:id              → 503
  DELETE /policies/:id              → 503
  GET    /agents/:name/policy       → {binding: null}     200
  PUT    /agents/:name/policy       → {binding: null}     200
  GET    /opa-policies              → {policies: []}      200
  GET    /opa-policies/:id          → 404
  POST/PUT/DELETE /opa-policies     → 503

When the SRS proxy lands, drop these stubs and replace with a reverse-
proxy to the SRS service (existing pattern uses a Caddy header injection
for the x-api-key).

Deployed to prod (enterprise.clawagent.sh). Policies tab now shows
empty states instead of an error toast.

Author: kapaleshreyas

examples/agentos-api.ts

@@ -832,5 +832,26 @@ export function createAgentOSApp(opts: AgentOSOptions): Hono {
 
   app.get("/agentos/api/health", (c) => c.json({ ok: true, agents: opts.agents.map((a) => a.name) }));
 
+  // ── Policies stubs ─────────────────────────────────────────────────────────
+  // The Policies tab is wired against an external SRS (Security/Runtime/Safety)
+  // service in the upstream design. In this deployment SRS isn't running, so
+  // every endpoint returns an empty list / not-found so the UI shows clean
+  // EmptyState components instead of a "404" error toast.
+  //
+  // When the SRS proxy lands, drop this block — agentos-api should reverse
+  // proxy the policy paths instead of stubbing.
+  app.get("/agentos/api/policies", (c) => c.json({ policies: [] }));
+  app.get("/agentos/api/policies/:id", (c) => c.json({ error: { code: "NOT_FOUND" } }, 404));
+  app.post("/agentos/api/policies", (c) => c.json({ error: { code: "SRS_NOT_CONFIGURED", message: "Policy service (SRS) is not deployed in this environment." } }, 503));
+  app.put("/agentos/api/policies/:id", (c) => c.json({ error: { code: "SRS_NOT_CONFIGURED" } }, 503));
+  app.delete("/agentos/api/policies/:id", (c) => c.json({ error: { code: "SRS_NOT_CONFIGURED" } }, 503));
+  app.get("/agentos/api/agents/:name/policy", (c) => c.json({ binding: null }));
+  app.put("/agentos/api/agents/:name/policy", (c) => c.json({ binding: null }));
+  app.get("/agentos/api/opa-policies", (c) => c.json({ policies: [] }));
+  app.get("/agentos/api/opa-policies/:id", (c) => c.json({ error: { code: "NOT_FOUND" } }, 404));
+  app.post("/agentos/api/opa-policies", (c) => c.json({ error: { code: "SRS_NOT_CONFIGURED" } }, 503));
+  app.put("/agentos/api/opa-policies/:id", (c) => c.json({ error: { code: "SRS_NOT_CONFIGURED" } }, 503));
+  app.delete("/agentos/api/opa-policies/:id", (c) => c.json({ error: { code: "SRS_NOT_CONFIGURED" } }, 503));
+
   return app;
 }