Enforcement-core hardening: fail-open & policy-widening fixes (#41)

[davidcrowe]

Fixes #41. Security-review hardening of the OSS enforcement packages. These are reputational/external-consumer correctness (prod's coding-agent hook path uses a private engine), but the repo is the trust artifact.

validatabl-core

• Schema fail-open (decision.ts): a configured inputSchema was skipped when input was undefined (GET, wrong content-type), so a schema meant to gate a route was a silent no-op. Now the schema always runs; missing input denies.
• hasScope regex injection (scopes.ts): built a RegExp from the raw scope, so tool.write matched toolXwrite and metachars threw 500s. Now an exact whitespace-delimited token match — no regex.
• Policy widening (policy.ts): matches was unanchored (search allowed unsafe-search-exec) → bare patterns anchored ^(?:…)$, author anchors honored; in used String() coercion (array field → "a,b" slipped past an allow-list) → strict string membership; empty-conditions rules matched every request → validatePolicySet() rejects them loudly and applyPolicies calls it.

limitabl-core / limitabl

• AgentGuard opt-out + unbounded: the guard only ran when the client supplied a workflow id — omitting it bypassed runaway protection. preflight() now denies when a guard is configured but no key resolves. The facade namespaces the client workflow id under the server-resolved principal (sub/tenant/ip) so it is not purely client-controlled, and AgentGuard gains a lazy TTL sweep (evict workflows past maxDurationMs) so id rotation can't grow the map unbounded.
• Singleton engine (facade): the module-level singleton ignored every config after the first (a stricter later mount reused the laxer engine). Now one engine per limitabl() invocation.

identifiabl-core

• exp not required: jwtVerify accepted a token minted without exp — valid forever. Added requiredClaims:["exp"]. The factory now rejects an empty issuer or audience (empty audience disables audience binding; empty issuer makes the post-verify issuer check pass for iss:"").

explicabl

• Audit events carried no identity: read res.locals.gatewayContext, which nothing sets — every line logged context: undefined. Now reads getGatewayContext() (ALS) with a captured-reference fallback, and warns once if absent.
• Dead webhook: /webhooks/auth0 mounted the handler factory as middleware → requests hung forever. Now calls auth0LogsWebhook().
• Aborted requests emitted no audit: only finish was hooked. Also hook close, with a fired-once guard so exactly one event emits.
• Added @gatewaystack/request-context dependency + tsconfig project reference.

Repo hygiene (unblocks the above)

Removed 16 stale compiled .js/.d.ts artifacts committed inside src/ dirs. They were already gitignored but tracked, and several — validatabl-core/src/scopes.js, explicabl/src/index.js, limitabl/src/index.js — contained the exact pre-fix code this PR removes, shadowing the source on .js imports (this actually broke the first run of the new hasScope test until removed). Overlaps the #42 hygiene theme; done here because it directly contradicts these fixes.

Tests (30 new, all real behavior)

decision denies on absent input · hasScope("a.b") ∌ "aXb" · empty-conditions rejected · matches anchored · in strict · JWT round-trips (real jose + local JWKS) reject alg:none/expired/missing-exp/wrong-aud + factory guards · two limitabl mounts enforce different limits · agent guard denies without a key + TTL evicts · client-abort emits exactly one audit event · webhook route responds (no hang).

Full suite 189 green · npm run build clean.

Notes

• Versions intentionally NOT bumped. Publish/versioning is your step, and explicabl also has a parallel bump in fix(explicabl): drop undeclared node-fetch import; use global fetch #37 — coordinate the final numbers at publish (packages needing republish: validatabl-core, limitabl-core, limitabl, identifiabl-core, explicabl).
• The redactPii-overlap test the issue lists lives in Release transformabl-core 0.4.1: ReDoS fix + redactPii overlap corruption + PII-scan truncation loudness #40/transformabl-core 0.4.1: redactPii overlap fix (H4) + scan-truncation flag (M2) #45 (transformabl), not here.

Not merged/published — that's yours.