Phase A — http-capability-gateway↔BoJ contract + policy authoring workflow + example spec

[hyperpolymath]

Phase A — http-capability-gateway tier-2 integration (ADR-0004)

Single-channel work item: standards#91 parent, standards#96 Phase A (the first of the strictly-sequential A–E). Specification-only — no gateway or BoJ HTTP code is changed (plan §Phase A acceptance criterion).

Deliverables (per docs/integration/http-capability-gateway-plan.md §Phase A)

• A1 docs/integration/http-capability-gateway-boj-contract.md — transport (TCP loopback staging / Unix socket prod, committed to resolve the plan's port/transport indecision risk), forwarded headers, gateway/BoJ trust vocabulary mapping, error semantics, stealth, deployment trust topology (Phase B input), and surface-drift handling (A3 input).
• A2 docs/integration/http-capability-gateway-policy-authoring.md — where the spec lives (BoJ repo, option 1), who writes it, POLICY_PATH load sequence, hot-reload triggers, and the co-change anti-drift discipline.
• A3 config/gateway-policy-boj-example.yaml — 27 rules grounded in docs/specification/openapi.yaml cross-checked against elixir/lib/boj_rest/router.ex; conforms to DSL v1 (audit §2); validated (YAML well-formed, regexes compile, all invariants hold, names unique).

Load-bearing finding

BojRest.Router bypasses trust enforcement for loopback callers. The gateway forwards from loopback, so BoJ will accept the gateway's X-Trust-Level verbatim. Inbound X-Trust-Level stripping + back-side network isolation are therefore mandatory security invariants (contract §3), not advisory — tested in Phase C, hardened in Phase B (mTLS).

Honesty notes (not papered over)

• The plan's "passes PolicyLoader+PolicyValidator" criterion is a manual check against a running gateway; no gateway runs in Phase A. The example is authored to conform exactly to the documented DSL v1 schema and validated structurally; the running-gateway check is a recorded carry-over (authoring-workflow §6), not a code deliverable, and does not block Phase A.
• Global-fallback exposure semantics flagged inline as a default-deny caveat to confirm in that manual step.
• .md (not .adoc) retained for the two docs deliberately — the plan normatively prescribes the contract path and the Phase C Trustfile [SEAMS] entry references it verbatim; rationale stated in-document.

Scope discipline

Phase A only. Phases B–E (#97–#100) are not started. This PR uses Refs and does not close standards#91/#96 — they are major,requirements-target (joint-close only, on explicit user agreement).

Refs hyperpolymath/standards#91
Refs hyperpolymath/standards#96

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 28 issues detected

Severity	Count
🔴 Critical	17
🟠 High	4
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence