fix(sec): a derived policy inherits what the child leaves unsaid

[jlgore]

Closes five MEDIUM triage findings that share one root cause: attenuation validated only the rules a child stated, so an untrusted child could widen its authority purely by omission.

The hole

Every downstream layer reads absence as "nothing to enforce":

Child omits	Consequence
[policy.network]	FLAG_NET_ENFORCED stays clear — egress unrestricted (f012)
[policy.exec]	no EXEC_ALLOW entries installed — any binary runs (f014)
a parent deny rule	unmatched reads are allowed — the denial evaporates (f001)
any write grant	FLAG_FS_WRITE_DEFAULT_DENY never set (f001)
a ! inode pin	degrades to path matching, TOCTOU back on the table (f025)

Intentional for a root policy the operator authored. Fatal for a derived one.

Separately (f002): the FR-008 protected defaults (.git, .bee, ~/.ssh, ~/.aws) are injected during compilation — after attenuation — and a more-specific rule out-ranks them at load. A child under a broad parent grant could name ~/.ssh precisely and out-rank the protection.

The fix

Silence inherits, it does not reset. Policy::derive now returns the effective child policy rather than the request:

• an omitted filesystem / exec.allow / network.allow is copied from the parent;
• a non-empty child filesystem map re-absorbs every parent deny;
• a child exec entry whose parent counterpart is inode-pinned is re-pinned.

Inheritance is trivially ⊆ the parent — every inherited rule is a parent rule — so the FR-005 containment property is preserved by construction, and the whole fix lives in the core validator where the property tests already run. It also keeps a child usable: a subagent narrowing only the filesystem does not silently lose its toolchain.

For f002, the protected-defaults table moves to a shared PROTECTED_DEFAULTS const held in authoring tokens (one table, one truth — the compiler resolves it, attenuation reasons over it), and attenuation refuses any child grant landing inside a protected region unless the parent named a containing region explicitly.

Rejected alternative: treating an empty child list as deny-all. The backend cannot express "enforced but zero destinations" today (plan.rs derives the enforcement flags from rule presence), so it would need a backend change to mean anything, and it makes exec unusable for a partial child. Recorded in full as research R15.

Verification

• 7 new regression tests in crates/core/tests/attenuation.rs; with the source change stashed, exactly those 7 fail and the 11 pre-existing pass.
• cargo test --workspace --no-fail-fast: green except repl_command::no_provider_at_all_reports_what_is_missing, which fails identically on main (this build lacks --features enforce) — pre-existing and unrelated.
• cargo clippy --workspace --all-targets -- -D warnings clean, also with --features mcp; cargo fmt applied.

Docs updated: research R15, contracts/library-api.md, contracts/policy.schema.md, and a remediation log in TRIAGE.md / TRIAGE.json (which also records the six HIGHs already closed by 8e2cdbb + 3225d44).

🤖 Generated with Claude Code