feat(verify): verify_capabilities + verify_access_sites passes (proposal 0002 §Gate 4)

[hyperpolymath]

Summary

Closes proposal 0002 §Gate 4 (`verify_access_sites` cross-section pass) and the equivalent for proposal 0001's capabilities carrier. Both proposals are now ~95% through acceptance criteria.

New public API

• `CapabilitiesError` + `verify_capabilities_from_module` (gated `unstable-l15`)
• `AccessSiteError` + `verify_access_sites_from_module` (gated `unstable-l2`)
• Section-name constants for both

Checks performed

`verify_capabilities`

• Per-function `func_idx` is within module function count (import + locally-defined)
• Per-function `required` capability index is within capability-table bounds

`verify_access_sites`

• `MissingDependentRegions` (proposal 0002 §"Producer obligations" fix(rhodibot): automated RSR compliance fixes #2): access-sites without regions is a hard error. Also fires if regions present but unparseable (version mismatch).
• Per-entry `func_idx` in module function count
• Per-entry `region_id` in regions table
• Per-entry `field_id` in target region's field table (skipped if region_id was out of range)

Deliberately out of scope (deferred)

• DistinctCaps: codec parser already normalises `required` to sorted+deduped form. Verifying strictly-increasing wire emission would need pre-normalisation byte access. Defer as a producer-side property test.
• AccessSiteMisalignment: would require parsing function bodies to verify `instruction_byte_offset` lands on a typed access opcode. Proposal 0002 explicitly defers this.

Tests (+11)

5 capabilities + 6 access-sites verifier tests using `wasm-encoder` to build minimal valid modules with the relevant custom sections (and matching Function+Code sections — required for wasm validation).

features	tests passed
(default)	43
`unstable-l2`	65 (+6)
`unstable-l15`	55 (+5)
`unstable-l2,unstable-l15`	77 (+11)

Acceptance progress after this lands

Proposal 0001 (regions + capabilities):

• ✅ Criterion 1 — paired sign-off
• ⏳ Criterion 2 — wire-vs-Idris2-spec review (proof-side write-up)
• ✅ Criterion 3 — codec landed
• ✅ Criterion 4 — spec doc (docs(spec): document wire-level carrier sections (proposals 0001 §4 + 0002 §5) #108)
• ✅ Criterion 5 — cross-repo issues filed
• ✅ + capabilities verifier pass (this PR, not in criteria but completes the matching pair to regions parsing)

Proposal 0002 (access-sites):

• ✅ Gates 1, 2, 3, 5
• ✅ Gate 4 — this PR
• ⏳ Gate 6 — producer codegen issues for access-sites

Test plan

• `cargo build` (default features) succeeds
• `cargo test --lib` (4 feature combos): 43 / 65 / 55 / 77 pass / 0 fail
• No regression in integration suite

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 96 issues detected

Severity	Count
🔴 Critical	8
🟠 High	19
🟡 Medium	69

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "unknown",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in c5-regenerate.yml",
    "type": "unknown",
    "file": "c5-regenerate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cargo-audit.yml",
    "type": "unknown",
    "file": "cargo-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence