feat(policy-engine): implement organization security policy as code w…

[drah9991]

Closes #96

Objective

Introduces a deterministic Organization Security Policy Engine with layered enforcement. The implementation provides a strongly typed architecture that isolates domain logic from transport layers, ensuring strict policy evaluation without external network dependencies during CI execution.

Architecture

• Core Schema & Validation (packages/core): Integrated zod for strict runtime validation (policy.schema.ts). Supports hierarchical scopes (organization, repository, branch, contract) and defined CI gates (maxFindings, preventNewRegressions).
• Resolution Engine (PolicyResolver): Implements deterministic policy inheritance and merging. Includes hard conflict detection, preventing child scopes (e.g., repository) from downgrading severity levels mandated by parent scopes (e.g., organization).
• Tamper-Evident Exceptions (exception-signer.ts): Exception payloads are structurally sorted and cryptographically signed (SHA-256). Modifications to immutable fields (e.g., expiryTimestamp, justification) deterministically invalidate the signature, dropping the exception state.
• Adapters & Transport:
  • cli: Evaluates resolved policies against raw findings and enforces CI gates.
  • vscode-extension: Translates filtered findings into native DiagnosticSeverity mappings.
  • github-action: Generates sanitized Markdown reports for CI/PR feedback.

Security Considerations

• Air-gapped CI Execution: Policy evaluation operates entirely in-memory using local filesystem configurations.
• Adversarial Input Bounds: Schema parsing utilizes .strict() to reject malformed or injected configurations at the boundary.
• Path Sanitization: The markdown reporter strips absolute OS paths before emitting CI output to prevent environment structure leaks.
• Fail-Closed Design: Corrupted exception hashes, schema validation failures, or unresolvable conflicts force a non-zero exit code (1), preventing open-failure bypasses.

Test Coverage

• Unit test suites covering policy resolution, conflict scenarios, and cryptographic integrity.
• Included deterministic vulnerable and secure Solidity fixtures (VulnerableVault.sol, SecureVault.sol) for integration testing.
• Verified against monorepo CI gates (build, lint, test).