Confirmed policy-bundle tampering only ever warns, never blocks the build

[N-thnI]

Description

Promote confirmed policy-bundle tampering from observational (WARNING) to blocking (NON_COMPLIANT).

Problem Statement

Even a confirmed BundleTampered/SignatureInvalid/UntrustedSigner result in applyPolicyBundleVerification() (src/audit-guard/src/policy-engine.ts, ~lines 183-211) only downgrades status to "WARNING", never "NON_COMPLIANT". This was intentionally scoped as observational-only in an earlier issue (VAG-003) to avoid false-positive breakage while the detection was new. Now that the observational version has shipped and had time to prove itself, this is worth promoting to actually block the build on a confirmed tamper signal — the only defense against a compromised CI runner rewriting Rego policy is currently non-blocking.

Proposed Changes

• Once bundle-verification has run cleanly for a reasonable bake-in period, change confirmed tamper signals to set status "NON_COMPLIANT" rather than "WARNING"
• Add a test asserting a confirmed tamper signal blocks rather than warns

Technical Implementation Scaffolding

• Target Repository: vero-audit-guard
• Target Path: src/audit-guard/src/policy-engine.ts
• Branch Naming: fix/issue--promote-bundle-tamper-to-blocking
• Authority Context: Security-sensitive — CI policy integrity

Acceptance Criteria

• Confirmed policy-bundle tampering blocks the build (NON_COMPLIANT), not just warns
• Test added

Definition of Done

• Reviewed by lead maintainer
• Pull request merged via verified status check

[Naajih09]

Hi, I'd like to work on this issue. I've gone through the description and acceptance criteria and I'm confident I can deliver it. I'll make sure every acceptance criterion is met and submit a clean, tested PR. Please assign it to me.

[Naajih09]

Hi, I'd like to work on this issue. I've gone through the description and acceptance criteria and I'm confident I can deliver it. I'll make sure every acceptance criterion is met and submit a clean, tested PR. Please assign it to me.

[grantfox-oss]

🦊 GrantFox — @Naajih09 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #311)
2. Your PR will be reviewed by the Vero-protocol maintainers

Good luck! Track your progress on GrantFox.