a unary procedure served with no policy is advertised open, and the code never says so #21

Purpose (security): an app using macula-php cannot serve a unary procedure to any caller unless its own code says so — today Pool::serve() with no policy serves any caller, and no line in the app declares that.

This is macula-php#19's twin. #19 covers the streaming side; the unary serve has the same shape and no issue of its own.

Call site

src/Pool.php:304-310:

public function serve(
    string $realm,
    string $procedure,
    BytesOutput $bytes = BytesOutput::Hex,
    Confidentiality $confidential = Confidentiality::Preferred,
    ?ServePolicy $policy = null,
): Served {

?ServePolicy $policy = null reaches libmacula as nil, and macula-go's cabi/serve.go:121 reads what arrives: "serve serves procedure in realm under policy (nil: open)". So $pool->serve($realm, "name", $handler) advertises a procedure any caller can reach, and the call site says nothing about it.

Why it matters

The Erlang side already refuses this shape: macula-io/macula#150 removed the open default, so macula:advertise/3 with no auth is refused {error, {auth, required}} and an open procedure says auth => open in the source. A PHP app has no equivalent, so the gap the Erlang API closed silently exists here.

The mechanical check

• A serve with no policy is either refused at the call (ServePolicy required, an explicit ServePolicy::open() the way to say "any caller"), or it is accepted only when the source says so in that call. Either way the source names what the advertisement is.
• The same for serveStream, which macula-php#19 covers, so one shape closes both.
• A test that serving with no policy is refused (or that the explicit open policy is what makes it open), and that the refusal happens before anything reaches the station.

Found reviewing #20 (the 0.9.0 release note), which states the open default honestly rather than fixing it.