When OPA's Bundle Loader Runs Past a `.manifest` Typo

In bundle mode, a one-character .manifest key typo (rego_verison for rego_version) draws no diagnostic that names the key; the failure can surface as rego_parse_error pointing at your .rego — OPA v1.20.1

When It Runs — Run Report #RR03 · Testing what infrastructure actually does.

Provider · Component: OPA (Open Policy Agent) · bundle .manifest loading — unknown top-level keys and rego_version

Versions tested: OPA v1.20.1 (official opa_linux_amd64_static release, Build 2026-08-28; measured on our lab VM — see §2). Documentation, published schema, and source facts checked against the live docs and the v1.20.1 source tag (2026-09-02).

Config profile: Single official opa binary; minimal two-file bundles (.manifest + one policy.rego, full contents in §2); one minimal config.yaml used only for the contrast check in §4.

Verified on: 2026-09-22 (desk sources re-checked; v1.20.2 is the current release) · lab measured 2026-09-11 on v1.20.1.

Affects: OPA bundles whose .manifest carries a mistyped or unknown top-level key — for example rego_verison instead of rego_version (measured on v1.20.1).

TL;DR: OPA's own docs state that the bundle loader "has always ignored unknown top-level keys" in .manifest, so when a bundle is loaded in bundle mode (opa build -b, or at runtime) a mistyped rego_version produces no diagnostic that names the key (measured on OPA v1.20.1) — the failure can surface instead as rego_parse_error: `if` keyword is required before rule body pointing at your .rego source file, while a mistyped key in the sibling config.yaml has drawn an explicit unknown configuration option warning since v1.19.0.

Full report: https://whenitruns.substack.com/p/when-opas-bundle-loader-runs-past