WithTimeoutGraceful fails open (induced latency = guardrail bypass)

[MitulShah1]

Priority: P3 · Nature: insecure default

Problem

guardrail/async.go:82-124 WithTimeoutGraceful returns a passing result on timeout:

case <-ctx.Done():
    return &Result{Passed: true, TripwireTriggered: false, ...}, nil

Impact

Wrapped around a network-backed guardrail (e.g. moderation.NewOpenAI), an attacker who induces latency (large payload, slow provider) bypasses the check — an availability problem becomes a security bypass.

Fix

Fail closed by default for security-classified guardrails, or make the choice explicit and clearly named (WithTimeoutFailOpen vs WithTimeoutFailClosed).

---

Filed from a full-repo audit (branch main). Verified against source; baseline go vet/staticcheck/go test -race pass on the default build.