security/governance: fail closed instead of replaying stale cached integration authority

[reprewindai-dev]

Finding

Current main commit 63783a0ee789cfeb2c3de075e01ccaa2bff9292d changed src/lib/covenant/integrations.ts so successful postIntegration() responses are cached in Redis for 1 hour and, on timeout/network/5xx/invalid-response failure, the cached response is returned with _stale = true.

That generic helper is used on governance-sensitive integrations, including CAPPO authorization. A previously successful APPROVED/authority-bearing response can therefore be replayed when the live authority service is unavailable. Marking the object _stale does not make downstream callers reject it; callers can continue to consume the original decision fields.

This violates the fail-closed governance boundary. Availability failure must not promote previously observed authority into current authority.

Required remediation

• Never return cached/stale responses from authorization, execution-governance, settlement verification, evidence certification, or other authority-bearing POST integrations.
• Treat CAPPO timeout/network/5xx/invalid response as INTEGRATION_UNAVAILABLE / fail closed.
• If caching is retained for explicitly read-only, non-authoritative discovery/metadata calls, separate that API from postIntegration() and make stale semantics explicit in the type/contract.
• Do not silently default production Redis to redis://localhost:6379; absence/misconfiguration should not create ambiguous governance behavior.
• Add negative tests proving a previously cached APPROVED CAPPO response cannot authorize MCP/native execution after CAPPO becomes unavailable.
• Add tests proving 401/403 remain AuthorityDenied and cannot be replaced by cached success.
• Add a test covering timeout/5xx/invalid JSON with a cached prior success and require fail-closed behavior.

Source truth

Observed current responsibility: cAPI is canonical Interlink and mediates CAPPO integration.
Target responsibility: cAPI may transport authority decisions but must not synthesize, extend, or replay authority across authority-service failure.
Runtime remains NOT_VERIFIED; this is a source-level finding only.