feat(policy): capability field + opt-in fail-closed exposure (audit #31, P2)

[hyperpolymath]

Summary

Audit issue: #31 (priority 2 — policy schema is allowlist-shaped but shallow).

Two structural weaknesses in the policy DSL, fixed without breaking
back-compat:

1. No first-class capability label. Today the only capability binding
   is via the implicit trust-level total order in SafeTrust. Adds an
   optional capability field at the route level and propagates it onto
   PolicyCompiler.CompiledRule so downstream consumers (audit log,
   future chimichanga-style attenuation, the new EgressPolicy seam in
   feat(egress): draft EgressPolicy schema + decide/3 (audit #31, P1) #32) can read it.

2. parse_exposure is unconditionally fail-open. Documented as
   intentional but combined with the Map.get(route, \"exposure\", \"public\")
   compiler default this means a typoed or omitted exposure silently makes
   the route public. Adds an opt-in :exposure_fail_closed = true flag
   that flips unknown values to :internal (most restrictive level).
   Default remains fail-open for back-compat; this is opt-in for
   environments where confidentiality is weighted above availability
   (e.g., neurophone egress).

Diff: 4 files, +173 / -5 LoC (under the 300-LoC PR ceiling).

Test plan

• mix test test/policy_capability_test.exs
• mix test — confirm no existing tests broke (capability defaults to
  nil so all existing CompiledRule callers continue to work)
• Confirm parse_exposure(\"typo\") returns :public by default and
  :internal when :exposure_fail_closed is set
• Status: DRAFT — please do not auto-merge. Owner review only.

Echo-types audit

record-as-not-relevant. Capability label is a passive string in v1; it
does not interact with echo types. Re-check when chimichanga attenuation
attaches to it.

Refs: #31, related to #32

[github-actions]

🔍 Hypatia Security Scan

Findings: 65 issues detected

Severity	Count
🔴 Critical	6
🟠 High	17
🟡 Medium	42

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence