docs(conformance): add runtime-enforcement-mapping addendum (OWASP#802)

[pshkv]

Summary

Adds docs/conformance/runtime-enforcement-mapping.md — an invariant-level companion to owasp-asi-mapping.md that maps each of the 30 ASI fixture vectors to the four runtime integrity invariants converging in OWASP/www-project-top-10-for-large-language-model-applications#802.

Follow-through on the commitment made in the OWASP thread to contribute this addendum.

Structure

• Layer 1 (Transmission integrity) — 3 fixtures. Ed25519 + RFC 8785 JCS guarantees. Open gap tracked in Persistence round-trip: rowToToken drops 8 optional token fields (follow-up to #168) #175.
• Layer 2 (Authorization integrity at execution) — 10 fixtures. SINT's primary claim. request_authorized == request_executed.
• Layer 3 (Execution integrity) — 12 fixtures. Supply chain, history, circuit breaker.
• Layer 4 (Intent integrity) — 4 fixtures, explicitly scoped as advisory, not deterministic. Keeps heuristic detection separate from cryptographic enforcement so conformance claims can't overclaim.

Why this matters for conformance

Implementations claiming "ASI02 coverage" should specify the invariant (authorization-integrity-at-execution, fixtures X/Y/Z) rather than just the control ID. Intent-layer coverage should be explicitly scoped as heuristic and fail-open. This doc gives that level of granularity without changing any existing owasp-asi-mapping.md content.

Files changed

• docs/conformance/runtime-enforcement-mapping.md (new, 130 lines)
• docs/conformance/owasp-asi-mapping.md (+1 line — header link to new doc)

Test plan

• Docs-only change; no test suite run required
• Verify invariant-level counts (3 + 10 + 12 + 4 = 29) against fixture pack (30 vectors — ASI07-safe-valid-delegation-chain is non-vector-enforced, delegation allow case)
• Verify links resolve (./runtime-enforcement-mapping.md from owasp-asi-mapping.md)

Refs

• OWASP#802 — inbound thread that drove this
• fix(capability-tokens): canonical signing payload survives JSONB round-trip #168 — canonical signing payload PR (Layer 1 invariant foundation)
• Persistence round-trip: rowToToken drops 8 optional token fields (follow-up to #168) #175 — transmission-integrity fixture gap tracked separately
• Integration: system prompt defense scanning (prompt-defense-audit) HeadyZhang/agent-audit#5 — intent-layer calibration data source