Summary

Renames the CPEX/APL authorization/authentication config keys for clarity. Breaking change (pre-1.0): old key names no longer parse.

The two authorization phases parse equivalently whether nested under an authorization: block or written flat on the section.

Closes #105.

Deliberately not renamed

The field-pipeline keys args: / result: stay as-is. They're aligned with the args.* / result.* attribute namespaces that predicates and interpolation read (require(args.include_ssn), ${args.repo_name}, args.ssn | redact) — renaming only the config block would have introduced a new inconsistency. (The issue originally proposed inputs/outputs; we tried it and rolled it back for exactly this reason.)

Internal APL IR (CompiledRoute, Phase) and the runtime attribute namespaces are unchanged.

Fail-closed by design

Legacy policy: / post_policy: / identity: keys are rejected loudly at parse/load time (in both the apl-core parser and cpex-core config loader) rather than silently ignored — a dropped authorization or authentication block would otherwise fail open.

Example

routes:
  - tool: get_employee
    authentication: [jwt-user, jwt-client]
    args:
      employee_id: "str"
    authorization:
      pre_invocation:
        - "require(authenticated)"
        - "delegation.depth > 2: deny"
      post_invocation:
        - "run(audit-log)"
    result:
      ssn: "str | redact(!perm.view_ssn)"

Also

• APL acronym spelled consistently as "Authorization Policy Language" (dropped the legacy "Attribute Policy Language").
• Docs, README, and CHANGELOG updated with the new surface and a BREAKING migration entry.

Testing

• cargo fmt --check, cargo clippy --workspace --all-targets, and full cargo test --workspace (all 55 suites) pass.
• Added coverage for nested-vs-flat equivalence and legacy-key rejection.
• Praxis regression: built praxis against this checkout (path dep) — compiles with no API/ABI break and its cpex policy integration test passes (401/200). The praxis-demos/demos/cpex configs were migrated to the new surface (separate PR in that repo) and verified to load through install_builtins + load_config_yaml.