fix(authz): close fail-open engine gaps found in review

Coordinator review of Task 6's resolution engine (plan amendment
86b3dc1e) found two critical and four important defects, all inherited
from the brief's original engine snippet:

- C1: anonymous callers on a public permission returned allow before
  running bound policies, so the least-trusted caller got the weakest
  evaluation. Policies now run for anonymous subjects too.
- C2: the policy verdict check was a truthiness test (`!verdict.allowed`),
  so a policy returning `{allowed: "yes"}` granted access. Now requires
  `verdict?.allowed === true` exactly, and no longer spreads the raw
  verdict into the decision (which leaked arbitrary policy fields).
- I1: a binding naming a policy the catalog doesn't have was silently
  `continue`d, granting whatever the policy was meant to guard. Now
  denies with "Policy unavailable".
- I3: denies were checked by exact string equality, so a wildcard deny
  (e.g. "post:*") was accepted and silently did nothing. Denies now go
  through the same depth-aware wildcard matching as grants, via the new
  exported `deniedBy()`.
- I2: `permissionsFor` now subtracts denied entries so it agrees with
  `decide()` — needed for Task 7's UI gating to compose correctly.
- I4: non-string/empty `subject.id` (0, "", 123, {}) no longer silently
  falls back to anonymous; it denies with "Invalid subject". `subject:
  null` (no subject at all) remains genuinely anonymous.

Added six regression tests, each verified by reverting its fix and
confirming the test fails against the old code before restoring.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/authz/test/engine.test.ts

@@ -1,9 +1,11 @@
 import { describe, expect, test } from "bun:test";
+import type { DecisionPolicy } from "../src/advanced.ts";
 import { defineAuthz } from "../src/registry.ts";
 import { mergeCatalogs } from "../src/catalog.ts";
 import { memoryPermissionStore } from "../src/store.ts";
 import { memoryAuditSink } from "../src/audit.ts";
 import { createAuthzResolver, expandRoles, permissionMatches } from "../src/engine.ts";
+import type { AuthzCatalog } from "../src/types.ts";
 
 const catalog = mergeCatalogs([
   {
@@ -206,3 +208,98 @@ describe("createAuthzResolver.decide", () => {
     expect(outside.allowed).toBe(false);
   });
 });
+
+describe("createAuthzResolver fail-closed regressions", () => {
+  test("a public permission bound to an always-denying policy denies for an anonymous subject", async () => {
+    const publicPolicyCatalog = mergeCatalogs([
+      {
+        source: "pub.ts",
+        module: defineAuthz({
+          permissions: { "feed:view": { public: true } },
+          policies: {
+            neverAllow: async () => ({
+              allowed: false,
+              reason: "embargoed",
+              policy: "neverAllow",
+            }),
+          },
+          bindings: { "feed:view": ["neverAllow"] },
+        }),
+      },
+    ]);
+    const resolver = createAuthzResolver({
+      catalog: publicPolicyCatalog,
+      store: memoryPermissionStore(),
+      strict: false,
+    });
+    const result = await resolver.decide({ subject: null, permission: "feed:view" });
+    expect(result.allowed).toBe(false);
+    expect(result.policy).toBe("neverAllow");
+  });
+
+  test("a policy returning a truthy non-boolean 'allowed' denies", async () => {
+    const truthyCatalog = mergeCatalogs([
+      {
+        source: "truthy.ts",
+        module: defineAuthz({
+          permissions: { "x:truthy": {} },
+          policies: {
+            truthy: (async () => ({ allowed: "yes" })) as unknown as DecisionPolicy<never, never>,
+          },
+          bindings: { "x:truthy": ["truthy"] },
+        }),
+      },
+    ]);
+    const store = memoryPermissionStore();
+    await store.grant("u1", "x:truthy", "allow");
+    const resolver = createAuthzResolver({ catalog: truthyCatalog, store, strict: false });
+    const result = await resolver.decide({ subject: { id: "u1" }, permission: "x:truthy" });
+    expect(result.allowed).toBe(false);
+  });
+
+  test("a binding naming a policy the catalog lacks denies", async () => {
+    const missingPolicyCatalog: AuthzCatalog = {
+      permissions: new Map([["x:missing", {}]]),
+      roles: new Map(),
+      policies: new Map(),
+      attributes: new Map(),
+      bindings: new Map([["x:missing", ["ghostPolicy"]]]),
+    };
+    const store = memoryPermissionStore();
+    await store.grant("u1", "x:missing", "allow");
+    const resolver = createAuthzResolver({ catalog: missingPolicyCatalog, store, strict: false });
+    const result = await resolver.decide({ subject: { id: "u1" }, permission: "x:missing" });
+    expect(result.allowed).toBe(false);
+    expect(result.policy).toBe("ghostPolicy");
+  });
+
+  test("a wildcard deny blocks a permission the role explicitly grants", async () => {
+    const { store, resolver } = make();
+    await store.assignRole("u1", "admin");
+    await store.grant("u1", "post:*", "deny");
+    const result = await resolver.decide({ subject: { id: "u1" }, permission: "post:delete" });
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toMatch(/explicit deny/i);
+  });
+
+  test("permissionsFor subtracts permissions covered by a wildcard deny", async () => {
+    const { store, resolver } = make();
+    await store.assignRole("u1", "editor");
+    await store.grant("u1", "post:*", "deny");
+    const granted = await resolver.permissionsFor("u1");
+    expect(permissionMatches(granted, "post:delete")).toBe(false);
+  });
+
+  test("non-string subject ids deny rather than falling back to anonymous", async () => {
+    const { resolver } = make();
+    const invalidIds: unknown[] = [0, "", 123, {}];
+    for (const id of invalidIds) {
+      const result = await resolver.decide({
+        subject: { id } as unknown as { id?: string },
+        permission: "post:read",
+      });
+      expect(result.allowed).toBe(false);
+      expect(result.reason).toMatch(/invalid subject/i);
+    }
+  });
+});