docs: publish PROTOCOL.md — discoverable wire surface (refs #106)

[hyperpolymath]

DRAFT — please do not auto-merge.

Addresses concern 1 of #106 (self-audit, 2026-06-02).

Summary

Adds docs/PROTOCOL.md — a single, versioned, discoverable index of
Burble's external wire surface so estate sibling apps (neurophone,
idaptik, gossamer) can pin against a known document instead of reading
router.ex directly.

Indexes:

• HTTP REST surface (/api/v1/*) — public + authenticated tables built
  from server/lib/burble_web/router.ex.
• Realtime — Phoenix channel topics (signaling:*, room:*).
• Wire schemas — Bebop modules in server/lib/burble/protocol/.
• Auth model — Guardian JWT + PAKE/SAS per ADR-0003.
• groove-protocol cross-link so sister repos can discover this surface.

Scope discipline

• Pure docs. No functional change. ~145 LoC, single new file.
• SPDX-License-Identifier: MPL-2.0 per estate policy.
• Did NOT touch the existing docs/INDEX.adoc linkage — its SPDX
  header pre-dates the current Owner-line policy and per estate rules
  we don't bulk-edit existing SPDX headers. Owner can add the
  PROTOCOL.md link manually when sweeping headers.

Test plan

• Spot-check the route tables against server/lib/burble_web/router.ex.
• Confirm Bebop module references match server/lib/burble/protocol/.
• Decide whether to add PROTOCOL.md link to docs/INDEX.adoc in
  the next owner-directed header sweep.

Echo-types audit

Not relevant at this surface (no L3 echo obligation).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 95 issues detected

Severity	Count
🔴 Critical	3
🟠 High	7
🟡 Medium	85

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-canary.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-canary.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-canary.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-canary.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 95 issues detected

Severity	Count
🔴 Critical	3
🟠 High	7
🟡 Medium	85

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-canary.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-canary.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-canary.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-canary.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence