P4.8: Consolidated category-audit decision

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P4
Depends on: every classifier issue in P1-P4, P3.1

Goal

Roll up every new P1-P4 check's category mapping into one decision, decide whether a new cryptographic_trust_violation category (or any other) is justified, and ship the consolidated schema increment if it is.

Acceptance criteria

• New SS-DEC-* entry in docs/DESIGN_DECISIONS.md summarising the per-check category mapping for every new P1-P4 check ID.
• Explicit decision on:
  • the P2.3 algorithm-confusion candidate for cryptographic_trust_violation
  • the P2.4 header-trust candidate for the same
  • the P3.1 artifact-type candidate (oauth_auth_code_flow vs reuse)
• If a new category is added:
  • docs/SCHEMA.md updated with the new category enum value
  • docs/SARIF_RULES.md updated with the new rule ID and severity
  • JSON schema bump documented (v0.6.0 or whatever is appropriate at the time)
  • Existing 33 fixtures' expected.json regenerated only if their categories shifted (they should not — backwards-compat-preserving)
• If no new category is added: existing five categories absorb every new check, and the issue's resolution comment documents the mapping.

Files touched

• docs/DESIGN_DECISIONS.md
• docs/SCHEMA.md (conditional)
• docs/SARIF_RULES.md (conditional)
• crates/sessionscope-model/src/finding.rs (conditional — only if new category)
• crates/sessionscope-reporters/src/sarif.rs (conditional — only if new rule)

Audit-then-decide

• This issue IS the audit. Resolution comment must state the final mapping for every new check.

Doc-update checklist

• docs/DESIGN_DECISIONS.md new SS-DEC entry.
• docs/SCHEMA.md (conditional).
• docs/SARIF_RULES.md (conditional).
• CHANGELOG.md unreleased entry covers the schema increment.

[bjcorder]

Implemented in c498fef.

Summary:

• Added SS-DEC-011 documenting the consolidated P1-P4 category mapping.
• Explicitly decided not to add cryptographic_trust_violation: P2.3 and P2.4 map to existing deterministic-misconfiguration, missing-validation, or dynamic-review categories.
• Explicitly kept the dedicated oauth_auth_code_flow artifact type for P3.1 instead of reusing token artifact types.
• Documented that no schema, SARIF rule, model enum, reporter, or fixture category-regeneration change is required.

Validation:

• cargo fmt --check — passed
• rg -n "SS-DEC-011|cryptographic_trust_violation|oauth_auth_code_flow|jwt_alg_confusion_signal" docs/DESIGN_DECISIONS.md CHANGELOG.md — passed

Notes / follow-ups:

• None