feat(foundry): add the missing Configure stage; make the wizard fail closed

[hyperpolymath]

The gap

SPEC.adoc specifies mint → provision → configure → harness, but stage 3 of 4
in foundry.sh was a single say line — stages/configure.sh did not exist.
Several other paths could report success having done nothing.

What this adds

stages/configure.sh (new)

Applies endpoint and auth settings under the two rules Foundry.idr types as
configure : Artifact ds caps -> Artifact ds caps:

Rule	Meaning
PRESERVATION	the capabilities block is compared before/after and must be byte-identical — configure may never edit the grant
NO ESCALATION	a setting requiring a locked_down capability is refused

Setting	Requires
--api-base loopback (local://, 127.0.0.1, localhost, [::1])	—
--api-base remote	Net
--auth ≠ none	Cred
--auth-env / --auth-source	Cred, unconditionally

That last row is deliberate. Deciding it from the manifest's current
auth.method — which is what I wrote first — lets credential wiring land in a
freshly-minted cartridge (where method is none) and be activated by a later
--auth. A two-step escalation. The test suite caught it.

Fail-closed wizard — --strict / FOUNDRY_STRICT=1

Missing deno/idris2/jq is now a failure, not a skip. Previously, with
deno absent, the wizard scaffolded nothing, skipped provision/configure/harness,
printed "Foundry · done." and exited 0.

Four further defects found while wiring it up

1. foundry.sh bypassed stages/mint.sh — it called mint.ts directly then
   re-derived the path with find -name, a second copy of the logic.
2. mint.sh corrupted its own output contract — deno run … 2>&1 folded
   Deno's diagnostics into stdout, the channel carrying the cartridge path. Now >&2.
3. The interactive wizard could never mint. The minter requires protocols;
   the wizard never prompted for it or wrote it, so every interactively-produced
   descriptor was rejected at Mint.
4. typecheck-proofs.sh could pass vacuously — PASS=0 FAIL=0 exited 0, a
   green run having verified nothing.

Honest toolchain diagnostics

harness.sh reported a bare zig build failed where the real cause was a
version mismatch. It now compares zig version against the repo pin:

FAIL zig build failed under zig 0.16.0, but this repo pins zig 0.15.1
     TOOLCHAIN MISMATCH — this is very likely not a cartridge defect.
     first error: build.zig:35:8: error: no field or member function named 'linkLibC'

Verification (run locally, toolchains present)

• test-foundry.sh — 25/25 pass (was 12; 13 new Configure cases). Still pure
  bash+jq, so it runs anywhere CI has jq.
• typecheck-proofs.sh — 116 proofs typecheck, FAIL=0, under real Idris2.
• Vacuous-pass guard exits 1 on an empty tree.
• Full foundry.sh --strict --from <toml> run executes all four stages end-to-end.
• The escalation path was exercised for real: a descriptor granting only Net
  while requesting api-key auth was correctly refused at Configure.

Note

.tool-versions pins zig 0.15.1 while zig-test.yml uses 0.15.2. Not
addressed here, but worth reconciling.

[github-actions]

🔍 Hypatia Security Scan

Findings: 282 issues detected

Severity	Count
🔴 Critical	44
🟠 High	135
🟡 Medium	103

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence