[Tracking] M8 declarative security audit framework

[cssbruno]

Umbrella for the M8 declarative, auditable security framework: a single machine- and human-readable security posture, a gowdk audit command that checks it against a baseline and declared policies, frontend audits, and an IR-driven integration-test runner. Designed to be auditable by a human or an LLM, and explicitly anti-magic (the audit never runs as part of gowdk build; every finding cites a code + file:line; severity lives only in the diagnostic registry).

Shipped (slice 1) — PR #360

• internal/securitymanifest: pure IR-derived posture → gowdk-security.json (routes, endpoints, contracts; guards, CSRF, body limit, public/default-deny, source).
• internal/auditspec: composable policy model (named policies, extends, route/endpoint/frontend selectors), evaluation engine, and a built-in baseline encoding the security.md production-readiness gates.
• gowdk audit command (human + --json, non-zero exit on error findings) and build-time emission of gowdk-security.json.
• Experimental audit_* / policy_* diagnostic codes, gowdk explain-able.

Remaining

• [Audit] Phase 2 — frontend security audits (secret leak, route-guard coverage, headers/CSP, raw-HTML sinks) #362 — Phase 2: frontend audits (secret/data-leak, client route-guard coverage, security headers/CSP, raw-HTML/XSS sinks).
• [Audit] Phase 3 — *.audit.gwdk file kind + declared composable policies #363 — Phase 3: *.audit.gwdk file kind + declared composable policies (parser → IR → engine).
• [Audit] Phase 4 — integration-test runner (testkit, --emit-tests/--run) + runtime/app security headers #364 — Phase 4: integration-test runner: runtime/testkit, generated _test.go, gowdk audit --emit-tests / --run, and a runtime/app security-header capability.
• Docs sweep (architecture, testing, roadmap, threat-model) and a docs/language/audit.md.

Design decisions (locked)

• Authoring surface: composable policy {} + separate test {} in a dedicated *.audit.gwdk file kind; baseline runs with zero config.
• Baseline is on when you run gowdk audit, never blocks gowdk build.
• Integration tests emit readable _test.go the user owns; --run is a convenience.
• One harness only (coordinate with feat: IR-driven test harness (testkit): generated httptest endpoint tests + contract registry doubles #179).

Related

PR #360. Refs #179 (testkit), #182 (features from IR metadata), #120 (CSRF tests), #119 (fail-closed secret). Spec: docs/product/security-audit-spec.md.