fix(k8s): Service for BoJ to ClusterIP (HCG tier-2 E1 prereq)

[hyperpolymath]

Summary

Per ADR-0004 §1 (http-capability-gateway tier-2 placement) and the Phase E rollout-runbook §1.4 prereq #8, BoJ MUST NOT be externally addressable when fronted by HCG. Previously k8s/service.yaml declared type: LoadBalancer, exposing all four BoJ ports (REST 7700, gRPC 7701, GraphQL 7702, SSE 7703) externally — defeating the runbook §3.4 decommission invariant before Phase E even starts.

This is action item #8 from the Phase E consumer-side audit — companion to action #6 (boj-server#130 Cowboy bind tightening). The two layers together give defence in depth: BoJ binds loopback (#130) AND the k8s Service does not expose it externally (this PR).

Refs hyperpolymath/standards#100 (NOT Closes — joint-close is owner-only).
Refs hyperpolymath/standards#91.

What's in

File	Change
k8s/service.yaml	type: LoadBalancer → type: ClusterIP. Header comment explaining the Phase E posture. New annotations: hyperpolymath.dev/exposure: "internal-only", hyperpolymath.dev/external-via: "http-capability-gateway (tier-2)". Ports 7700–7703 retained forward-compatibly.
CHANGELOG.md	New ### Changed entry under [Unreleased].

Estate cross-check: hypatia/*, rsr-certifier, and opsm-service all use ClusterIP for backend Services. The estate's gateway-fronted-backend pattern is Service: ClusterIP. The only LoadBalancer in the estate's k8s manifests today (besides the BoJ Service this PR fixes) is svalinn-gateway — i.e. the gateway tier, not a backend. This PR brings BoJ's Service in line with the estate pattern.

Why DRAFT

Breaking for anyone running this manifest as-is with a LoadBalancer in production. I don't know whether a live LoadBalancer-fronted BoJ deployment exists. Marking draft so the owner gates merge on confirming no such deployment will break. If one exists, the migration path is HCG-in-front (per the rollout-runbook §2).

For ad-hoc / dev / non-HCG-fronted deployments that need BoJ exposed externally, the header comment in service.yaml shows the kustomize/helm overlay recipe rather than editing the canonical manifest:

- op: replace
  path: /spec/type
  value: LoadBalancer  # only valid for non-HCG-fronted deployments

Test plan

• YAML lints clean (manual review — single-document Service spec, valid v1 API).
• CI green — governance / a2ml / k9 / hypatia all pass.
• Owner: confirm no live LoadBalancer-fronted BoJ deployment will break, then flip from DRAFT to ready.
• Post-merge sanity: kubectl apply -f k8s/service.yaml --dry-run=client accepts the spec; kubectl describe svc/boj-server shows the new annotations.

Risk

Medium for the manifest, low for the codebase. The codebase is untouched — only k8s manifest. Breakage scope is limited to k8s operators relying on the LoadBalancer external IP for BoJ; they get a fixable Service-type override. No mix.exs / Elixir / Zig / Idris2 / cartridge changes; CI should not show any logic regressions.

Follow-ups not in this PR (audit residue)

• Action Add node operator tray app and browser extension #7 — stapeln.toml APP_HOST = "[::]" → loopback (separate concern: packager). Can pick up next.
• Optional: add a NetworkPolicy restricting BoJ pod ingress to only the HCG pod. Defence-in-depth beyond ClusterIP. Not strictly required for Phase E acceptance — Service-type is the controlling lever — but worth filing as a follow-up issue.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 30 issues detected

Severity	Count
🔴 Critical	18
🟠 High	5
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence