Currently, female in law is about the only condition of relevance in IAAF (rule #141).
To compete in the men's competition, you need to be legally male and meet subsidiary rules (anti-doping, etc.).
To Compete in the women's competition, you need to be legally female and meet subsidiary rules (hyperandrogenism is not currently one of them, after the CAS interim award in the Dutee Chand case).
That's why the CAS decided as they did (they just applied IAAF rules, and noted there is no "third group", so no chance for intersex persons who are legally female to compete in "men's" ), so that's where the solution has to come from.
Currently, there is no consideration of transgender athletes per se by the IAAF, but they require that transsexual athletes meet "IAAF Regulations Governing Eligibility of Athletes Who Have Undergone Sex Reassignment to Compete in Women's Competitions." These say "These Regulations (1.4) do not apply to cases of female to male sex reassignment." So if female-to-male transgenders do not legally change their female status to male status (independent of whether they have sex reassigned), they can still compete in the women's competition, regardless of hormones.
Similarly, in the male-to-female case, if you don't undergo sex reassignment (so transgender rather than transsexual), and just get a legal document saying you are female, then you can compete in the women's, as these regulations do not apply to you (alternatively, you can retain a male legal document, and compete in the men's).
The loophole appears to be that IAAF thinks that legal documents regarding "male" and "female" will have something to do with sex assignment, when in today's society that is increasingly a non-sure bet. So I agree with you two that "legal" is not the best condition to uphold for eligibility, but if you want to ensure the integrity of women's competitions, probably more exclusionary clauses is better (less loopholes).
The Preface to the Sex Reassignment regulations starts by talking about transsexuals and their legal rights, but don't consider transgender-nontranssexuals (people who don't have sex reassignment, but do associate with a gender other their sex). Those interested in solutions (like tighter language) should probably study the example of Iranian's women's football team, which had/has some large number (8?) of transgender folks, none of whom had undergone sex reassignment (at least per media reports).
What does "XX female" mean? XX chromosomes, and (solely) female biologically? Namely female sexual/reproductive organs and no male analogues? When you write regulations, you have to more specific, or corner-cases will bite you.