feat(platform): a hipaa platform must choose its guardrail

[stxkxs]

What

platform audit now reports a hipaa Platform whose model routes name no guardrail and therefore fall back to the cluster baseline.

Why

compliance.hipaa declared a posture and checked nothing particular to it. Its only invariant was the generic one it shares with soc2 — a Platform must declare at least what its Tenant declares — so the flag was strictly weaker than its sibling, which additionally requires the budget kill-switch.

Every model route resolves to a guardrail, in this order:

1. the route's own guardrailRef
2. the gateway's defaultGuardrailRef
3. the cluster baseline the operator reads from SSM

That fallback is deliberate and is the right default for a general workload. It is also a general-purpose guardrail — it anonymizes EMAIL, PHONE and CREDIT_DEBIT_CARD_NUMBER, blocks US_SOCIAL_SECURITY_NUMBER, and covers no other entity — and a route reaches it by omission rather than by anyone choosing it.

What the rule asserts, and what it doesn't

It asserts a decision was made, not what the decision was.

Whether a named guardrail carries the right entities, and blocks rather than anonymizes on output, is a question about Bedrock state this audit does not read — it would need a new AWS reader port. Declaring HIPAA and silently inheriting a default is answerable from the CRs alone, so that is what this checks.

Details

• Gateways are matched to their Platform by spec.platformRef, so a peer tenant's gateway in the same namespace is never attributed here.
• A defaultGuardrailRef on the gateway satisfies every route on it.
• A list that fails reports rather than returning clean — an unread gateway is not a cleared one.
• The finding type ships with its SARIF rule, which the rule-coverage test requires.

Mutation-tested

mutation	result
drop the hipaa gate so the rule never fires	caught
fire for every platform	caught
remove the platformRef filter	caught
ignore the gateway defaultGuardrailRef	caught
ignore the per-route guardrailRef	caught

Verification

task build, task test, task lint (0 issues), scripts/check-context.sh, scripts/coverage.sh — all green, every floor met.

One incidental change

gofmt -w realigned a const block in audit_test.go that was already unformatted on main. Kept rather than reverted — re-introducing it would leave the file gofmt-dirty. Worth noting separately that nothing in this repo gates Go formatting, which is how it got there.