Phase A — http-capability-gateway↔BoJ contract, policy workflow, example spec

[hyperpolymath]

Phase A — Contract Definition (weeks 1–2)

First materially-advancing PR of the http-capability-gateway tier-2 wiring
programme. Delivers all three Phase A artefacts from
docs/integration/http-capability-gateway-plan.md. Documentation only — no
gateway or BoJ code changed; the build is unaffected (plan acceptance
criterion: "No code changes to gateway or BoJ gnosis handler").

Deliverables

• A1 docs/integration/http-capability-gateway-boj-contract.md — the
  normative gateway↔BoJ HTTP contract. Resolves the Phase A transport
  indecision risk (staging = TCP loopback :7700; production = Unix socket
  preferred, TCP fallback), enumerates the forwarded-header set, and states
  the X-Trust-Level trusted-proxy invariant as RFC-2119 MUSTs handed to
  Phase C as seam-test obligations. Fail-closed error/circuit-breaker
  semantics documented.
• A2 docs/integration/http-capability-gateway-policy-workflow.md — where
  the Verb Governance Spec lives (config/gateway-policy.yaml, this repo),
  the authorship + review + openapi-coupling gate, the validation procedure,
  the k9-svc rolling-redeploy hot-reload path, and the global_verbs
  default-public sharp edge with BoJ's default-deny mitigation.
• A3 config/gateway-policy-boj-example.yaml — a DSL v1 worked example
  derived route-by-route from docs/specification/openapi.yaml, conforming
  to the schema in the integration audit §2. Example/fixture only; no service
  loads it.

Scope note

This session's GitHub tool scope is restricted to hyperpolymath/boj-server
and hyperpolymath/http-capability-gateway; hyperpolymath/standards is not
reachable from here, so the standards issues could not be read or commented
on directly. Phase A lands entirely in boj-server per the plan, so the work
itself is unaffected; the issue references below are recorded for tracking.

Refs hyperpolymath/standards#91
Closes hyperpolymath/standards#96

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 28 issues detected

Severity	Count
🔴 Critical	17
🟠 High	4
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[hyperpolymath]

Scope/attribution note (automated CI triage).

This PR is documentation-only: two Markdown files under docs/integration/ and one example YAML. It adds no .ts, package.json, or workflow files.

None of the 28 Hypatia findings are introduced by this PR — all are pre-existing, repo-wide conditions that report on every PR and would fail identically on main:

• GEMINI.md, removed quality.yml/security-policy.yml (intentionally consolidated per .github/workflows/governance.yml's own header), and the @main-pinned governance-reusable.yml — all pre-existing root/CI state, untouched here.
• The 6 banned_language_file criticals are pre-existing cartridges/*/adapter/mod.ts adapters, out of scope for this Phase A documentation lane.

The one diff-attributable nit — a stray top-level config/ directory not matching the repo's existing configs/ convention — has been fixed in 91f8410 (moved to configs/, doc references updated). The governance / Language / package anti-pattern policy gate appears to fail on the pre-existing TypeScript cartridge adapters, not on anything in this diff; that is a pre-existing repo-wide red and is not addressed here.

🤖 Generated with Claude Code

---

Generated by Claude Code

[hyperpolymath]

Programme coordination — http-capability-gateway tier-2 wiring (Refs hyperpolymath/standards#91)

A second programme session checked the channel and is standing down for this run to avoid duplication. Status:

• Phase A (standards#96): owned by this PR (Phase A — http-capability-gateway↔BoJ contract, policy workflow, example spec #74). Not duplicating.
• CI: not yet green — all 12 check runs queued/pending as of 2026-05-18T06:00:39Z.
• Mergeable state: behind main. This branch needs a base update before it can merge, independent of CI.
• Action taken: none on the code — left open and untouched per the no-duplicate / no-merge-until-green rule (CI not green; sequential channel means Phase B (fix(ci): NPM_TOKEN auth fallback for npm publish #97) cannot start until Phase A merges).

Next action: once #74's CI is green and the branch is updated against main, it can be squash-merged to close standards#96; the next session then advances Phase B (#97 — mTLS primary X-Trust-Level path).

Scope note: hyperpolymath/standards is outside this session's GitHub tool scope, so the canonical progress comment could not be posted on standards#91 directly — recording it here on the Phase A PR instead.

🤖 Generated with Claude Code

---

Generated by Claude Code

[hyperpolymath]

Superseded by #78 (commit b733860), the canonical Phase A — http-capability-gateway↔BoJ contract + policy authoring workflow + example spec — already merged to main on 2026-05-18. This PR is an earlier draft of the same deliverable: it carries the pre-rename policy-workflow.md (renamed to policy-authoring.md in #78), a stray duplicate configs/ directory, and an older contract revision. Merging it would regress main. Closing as superseded; HCG Phase A is complete per the standards#91 lane (next: #97 mTLS).

[github-actions]

🔍 Hypatia Security Scan

Findings: 28 issues detected

Severity	Count
🔴 Critical	17
🟠 High	4
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence