Align capability taxonomy with REIR's authoritative categories

The Phase 1 taxonomy had invented names (fs.read, http.client, crypto.*,
time.now, random.secure, network.connect/listen) that diverge from REIR's
authoritative reir::CapabilityCategory. Such a category passes review here but
degrades to an unrecognized `Extension` in the REIR bundle, so the REIR policy
layer would misclassify it (e.g. filesystem access not seen as filesystem).

Mirror REIR's category names exactly (filesystem.*, time.read, random.read,
object_storage.*, queue.*, etc.), and add `taxonomy_is_subset_of_reir` which
fails if any canonical category isn't recognized by reir::CapabilityCategory —
so the two taxonomies can't drift again. Shipped packages already used aligned
names, so the gate and all REIR output are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

src/capability.rs

@@ -3,8 +3,13 @@
 //! Every `[[review.capability_bindings]]` `category` should be one of these
 //! `domain.action` names. A fixed taxonomy is what makes capability review
 //! meaningful and reproducible: reviewers (and the GitHub Action) can reason
-//! about a stable set of powers (fs / network / database / process / secret …)
+//! about a stable set of powers (filesystem / network / database / secret …)
 //! and assign each a default risk, instead of free-form strings that drift.
+//!
+//! These names mirror REIR's authoritative `reir::CapabilityCategory` so a
+//! category that passes review here is recognized by the REIR policy layer
+//! rather than degrading to an unrecognized `Extension`. The `taxonomy_is_subset_of_reir`
+//! test enforces that alignment.
 
 /// Risk a capability category carries by default, used to rank review effort and
 /// drive target policy (e.g. denying high-risk powers in a `prod` target).
@@ -21,49 +26,66 @@ pub enum CapabilityRisk {
 pub struct CapabilityCategory {
     /// `domain.action` name, e.g. `database.write`.
     pub name: &'static str,
-    /// Coarse domain (`network`, `fs`, …) for grouping.
-    pub domain: &'static str,
     pub risk: CapabilityRisk,
     pub description: &'static str,
 }
 
+impl CapabilityCategory {
+    /// Coarse domain (`network`, `filesystem`, …) for grouping.
+    pub fn domain(&self) -> &'static str {
+        self.name.split('.').next().unwrap_or(self.name)
+    }
+}
+
 use CapabilityRisk::{High, Low, Medium};
 
-/// The canonical capability categories. Add new powers here (and a fixture that
-/// uses them) rather than inventing free-form category strings.
+/// The canonical capability categories — a risk-annotated mirror of REIR's
+/// `CapabilityCategory`. Add new powers to REIR first, then here.
 pub const CAPABILITY_CATEGORIES: &[CapabilityCategory] = &[
-    cat("fs.read", "fs", Medium, "Read files or directory contents"),
-    cat("fs.write", "fs", High, "Create, modify, or delete files"),
-    cat("network.client", "network", High, "Make outbound network connections"),
-    cat("network.connect", "network", High, "Open an outbound socket"),
-    cat("network.listen", "network", High, "Bind and accept inbound connections"),
-    cat("network.server", "network", High, "Serve requests on a bound address"),
-    cat("http.client", "network", High, "Make outbound HTTP requests"),
-    cat("database.read", "database", Medium, "Query a database"),
-    cat("database.write", "database", High, "Mutate database state"),
-    cat("env.read", "env", Medium, "Read environment variables"),
-    cat("env.write", "env", High, "Set environment variables"),
-    cat("process.args", "process", Low, "Read process arguments"),
-    cat("process.spawn", "process", High, "Spawn or exec subprocesses"),
-    cat("compute.hash", "compute", Low, "Compute a (non-secret) hash"),
-    cat("crypto.sign", "crypto", High, "Produce cryptographic signatures/MACs"),
-    cat("crypto.verify", "crypto", Medium, "Verify cryptographic signatures/MACs"),
-    cat("secret.read", "secret", High, "Read secrets or credentials"),
-    cat("identity.assume", "identity", High, "Assume an identity / capability role"),
-    cat("time.now", "time", Low, "Read the wall clock"),
-    cat("random.secure", "random", Low, "Draw cryptographically secure randomness"),
-    cat("runtime.native", "runtime", High, "Cross an unclassified native boundary"),
+    cat("network.client", High, "Make outbound network connections"),
+    cat("network.server", High, "Serve requests on a bound address"),
+    cat("network.public_ingress", High, "Accept traffic from a public ingress"),
+    cat("network.egress", High, "Send traffic to an external destination"),
+    cat("filesystem.read", Medium, "Read files or directory contents"),
+    cat("filesystem.write", High, "Create, modify, or delete files"),
+    cat("object_storage.read", Medium, "Read from object storage"),
+    cat("object_storage.write", High, "Write to object storage"),
+    cat("object_storage.delete", High, "Delete from object storage"),
+    cat("database.read", Medium, "Query a database"),
+    cat("database.write", High, "Mutate database state"),
+    cat("queue.publish", Medium, "Publish to a message queue"),
+    cat("queue.consume", Medium, "Consume from a message queue"),
+    cat("secret.read", High, "Read secrets or credentials"),
+    cat("secret.write", High, "Write secrets or credentials"),
+    cat("env.read", Medium, "Read environment variables"),
+    cat("env.write", High, "Set environment variables"),
+    cat("time.read", Low, "Read the wall clock"),
+    cat("random.read", Low, "Draw randomness"),
+    cat("compute.hash", Low, "Compute a (non-secret) hash"),
+    cat("compute.regex", Low, "Evaluate a regular expression"),
+    cat("process.args", Low, "Read process arguments"),
+    cat("process.spawn", High, "Spawn or exec subprocesses"),
+    cat("identity.assume", High, "Assume an identity / capability role"),
+    cat("identity.grant", High, "Grant an identity / capability role"),
+    cat("runtime.native", High, "Cross an unclassified native boundary"),
+    cat("runtime.unsafe", High, "Execute unsafe runtime code"),
+    cat("build.execute", High, "Execute code at build time"),
+    cat("build.network", High, "Access the network at build time"),
+    cat("container.privileged", High, "Run a privileged container"),
+    cat("container.host_access", High, "Access the container host"),
+    cat("k8s.rbac.grant", High, "Grant Kubernetes RBAC permissions"),
+    cat("storage.persistent_read", Medium, "Read persistent storage"),
+    cat("storage.persistent_write", High, "Write persistent storage"),
+    cat("telemetry.emit", Low, "Emit telemetry"),
 ];
 
 const fn cat(
     name: &'static str,
-    domain: &'static str,
     risk: CapabilityRisk,
     description: &'static str,
 ) -> CapabilityCategory {
     CapabilityCategory {
         name,
-        domain,
         risk,
         description,
     }
@@ -102,7 +124,7 @@ mod tests {
     }
 
     #[test]
-    fn taxonomy_names_are_unique_and_dotted() {
+    fn taxonomy_names_are_unique_dotted_and_match_domain() {
         let mut seen = std::collections::BTreeSet::new();
         for category in CAPABILITY_CATEGORIES {
             assert!(
@@ -115,6 +137,24 @@ mod tests {
                 "category {} must be `domain.action`",
                 category.name
             );
+            assert!(category.name.starts_with(category.domain()));
+        }
+    }
+
+    /// Every canonical category must be recognized by REIR's authoritative
+    /// `CapabilityCategory` (i.e. not fall back to `Extension`), so a category
+    /// that passes review here is classified correctly by the REIR policy layer.
+    #[test]
+    fn taxonomy_is_subset_of_reir() {
+        for category in CAPABILITY_CATEGORIES {
+            let reir_category = reir::CapabilityCategory::try_from(category.name.to_string())
+                .expect("conversion is infallible");
+            assert!(
+                !matches!(reir_category, reir::CapabilityCategory::Extension(_)),
+                "capability category `{}` is not a canonical REIR category \
+                 (it would degrade to Extension); align it with reir::CapabilityCategory",
+                category.name
+            );
         }
     }
 }