docs(integration): capability + discovery contract surface (audit #31, P3)

[hyperpolymath]

Summary

Audit issue: #31 (priority 3 — estate capability + discovery integration).

Pure documentation. Adds docs/CAPABILITY-INTEGRATION.md describing the
contract surfaces by which the gateway connects (or, in v0.x, will
connect) to:

• the estate capability model (hyperpolymath/chimichanga capability
  attenuation, hyperpolymath/boj-server cartridges — partially wired
  today via PolicyLoader.load_from_boj_catalog/1)
• service discovery via hyperpolymath/groove-protocol

Documented as a contract, not a feature list, because:

1. The cross-repo contracts are still stabilising
2. The compiler-side schema change is in flight in feat(policy): capability field + opt-in fail-closed exposure (audit #31, P2) #33
3. The egress mode in feat(egress): draft EgressPolicy schema + decide/3 (audit #31, P1) #32 is the more urgent consumer of the same
   capability vocabulary

Scope

• New: docs/CAPABILITY-INTEGRATION.md (125 LoC)
• Modified: PROOFS_NEEDED.md — two open obligations + fresh echo-types
  audit (record-as-not-relevant)

Diff: 2 files, +149 LoC. No code change.

Test plan

• Read-through review by owner — is the proposed contract shape
  aligned with chimichanga's current direction?
• Confirm the doc cross-references (#32, #33, audit Self-audit: prioritised weakness list (2026-06-02) #31) are
  coherent with what those PRs actually deliver
• Status: DRAFT — please do not auto-merge. Owner review only.

Echo-types audit

record-as-not-relevant. Re-check when chimichanga attenuation lands;
the lattice may introduce an L3 obligation at that point.

Refs: #31, related to #32, #33

[github-actions]

🔍 Hypatia Security Scan

Findings: 65 issues detected

Severity	Count
🔴 Critical	6
🟠 High	17
🟡 Medium	42

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence