rfc: ADR-0007 trust-tier policy DSL + ADR-0008 cartridge marketplace (epic #87 items 4 + 10)

[hyperpolymath]

Summary

Two coupled RFCs for epic #87 Tier B. Coupled because they share trust-tier vocabulary — ADR-0008's submission protocol requires every cartridge to ship a default policy bundle in the schema ADR-0007 defines.

No code in this PR. Pure design docs. Implementation tracked separately in epic #87 (items 4 and 10).

ADR-0007 — Trust-tier policy DSL

Adopt Nickel as the policy DSL (extends the existing `coord-messages.ncl` investment), with a clean PEP/PDP split:

• PEP stays in `mcp-bridge/main.js` (where the existing `hardeningGate` lives)
• PDP is a new `policy-mcp` cartridge that the bridge consults per `tools/call`

Schema: per-cartridge × per-tool × `{tier, rate_limit, required_role, master_approval, allowed_args, side_effect}`. Verdicts: `allow` / `deny` / `rate_limit` / `require_approval` (the last routes through `coord_send_gated`-style quarantine).

Default policy bundle covers all 41 bridge tools out of the box. Migration sequence covered explicitly in the ADR's "Open questions" section.

ADR-0008 — Cartridge marketplace

Activates the Ayo tier, which currently has exactly one member and no protocol. New repo `hyperpolymath/cartridge-index` holds signed entries (ML-DSA-87 per EXHIBIT-B) pointing to source repos at content-pinned revs.

Promotion path: outside → Ayo → Shield → Teranga. Promotion is recorded in the index, not the source repo, so cartridges don't need to "know" their tier.

Critically: respects ADR-0002 (BoJ-only MCP). Community capabilities flow into BoJ as cartridges, never as standalone MCPs.

Default-safe posture: Ayo cartridges are visible via `boj_marketplace_search` but never auto-loaded; user must explicitly `boj_marketplace_install --accept-ayo-tier`.

Why this pair, this order

The epic specifies they ship together: "Items 4 + 10 RFCs together (they share the trust-tier vocabulary)." 0007 defines what a policy bundle looks like; 0008 requires every submission to ship one. Either alone leaves a hole.

Review focus

The ADRs are formatted for substantive engagement, not rubber-stamp. Each has explicit:

• Consequences (positive + negative) — not just "this is good"
• Non-goals — what we deliberately won't do
• Open questions — decisions explicitly deferred to implementation

Recommend reading the Open questions sections — that's where the load-bearing choices that need your call live.

What this doesn't change

• No code touched.
• No existing cartridges affected.
• ADR-0002 stands; this RFC pair operates strictly within its constraints.

Sequencing

Per epic #87: this is Tier B step 1 of 3. Next pair (items 2 + 3: sandbox cartridge + cross-machine federation) follows in a sibling PR; the third pair (items 5 + 6: webhooks + sampling) after that. All three pairs are independent of each other and of the code PRs (#88/#89/#91).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 29 issues detected

Severity	Count
🔴 Critical	18
🟠 High	4
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/.github/scripts/validate-eclexiaiser.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence