@aifabrix/builder 2.51.0 → 2.52.0

package/lib/commands/upload-sidecar-followups.js

@@ -12,22 +12,123 @@ const { unwrapPublicationResult, isPublicationUnchanged } = require('../utils/ex
 const { logUploadReadinessSummary } = require('../utils/external-system-readiness-display');
 const { isQuietMinimalSync } = require('../utils/upload-sync-options');
 
+function buildRoleAssistantModel(payload) {
+  return {
+    application: payload?.application,
+    dataSources: payload?.dataSources || []
+  };
+}
+
+function buildRoleAssistantSyncContext(ctx, model) {
+  // Controller deploy env (e.g. miso) ≠ role-assistant.yaml section (dev|tst|pro).
+  const { resolveRoleAssistantSettingsEnvKey } = require('../role-assistant/knowledge-sync');
+  const raEnv = resolveRoleAssistantSettingsEnvKey(
+    (ctx.options && (ctx.options.env || ctx.options.roleAssistantEnv)) || 'dev'
+  );
+  return {
+    systemKey: ctx.systemKey,
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    model,
+    environment: raEnv,
+    pathOptions: ctx.options.pathOptions || {},
+    dryRun: ctx.options.dryRun === true
+  };
+}
+
+async function runGovernanceSidecar(ctx, sidecar, quietSidecar) {
+  try {
+    const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
+    const uploaded = await uploadGovernanceScenarioPacks(ctx.systemKey, ctx.dataplaneUrl, ctx.authConfig, {
+      silent: quietSidecar
+    });
+    sidecar.governance = { uploaded: Number(uploaded || 0) };
+  } catch (err) {
+    sidecar.governance = { skipped: true, reason: err.message || String(err) };
+    if (!quietSidecar) {
+      logger.log(formatWarningLine(`Governance scenario upload skipped: ${err.message}`));
+    }
+  }
+}
+
+async function runEvidenceSidecar(ctx, model, sidecar, quietSidecar) {
+  const { importRoleAssistantEvidence, logRoleAssistantEvidenceImportSummary } = require('../role-assistant/evidence-sync');
+  const result = await importRoleAssistantEvidence(buildRoleAssistantSyncContext(ctx, model));
+  sidecar.evidence = result;
+  if (!quietSidecar) {
+    logRoleAssistantEvidenceImportSummary(ctx.systemKey, result, { verbose: ctx.options.verbose === true });
+  }
+}
+
+async function runKnowledgeSidecar(ctx, model, sidecar, quietSidecar) {
+  const {
+    importRoleAssistantKnowledge,
+    logKnowledgeImportSummary,
+    pushRoleAssistantDocumentStorageSettings,
+    logDocumentStorageSettingsPushSummary
+  } = require('../role-assistant/knowledge-sync');
+  const syncCtx = buildRoleAssistantSyncContext(ctx, model);
+  try {
+    const settingsResult = await pushRoleAssistantDocumentStorageSettings(syncCtx);
+    sidecar.documentStorageSettings = settingsResult;
+    if (!quietSidecar) {
+      logDocumentStorageSettingsPushSummary(ctx.systemKey, settingsResult, {
+        verbose: ctx.options.verbose === true
+      });
+    }
+  } catch (err) {
+    sidecar.documentStorageSettings = {
+      skipped: true,
+      reason: err.message || String(err)
+    };
+    if (!quietSidecar) {
+      logger.log(
+        formatWarningLine(
+          `Knowledge document storage settings update failed: ${err.message}`
+        )
+      );
+    }
+    throw err;
+  }
+  try {
+    const result = await importRoleAssistantKnowledge(syncCtx);
+    sidecar.knowledge = result;
+    if (!quietSidecar) {
+      logKnowledgeImportSummary(ctx.systemKey, result, { verbose: ctx.options.verbose === true });
+    }
+  } catch (err) {
+    sidecar.knowledge = { skipped: true, reason: err.message || String(err) };
+    if (!quietSidecar) {
+      logger.log(formatWarningLine(`Role assistant knowledge sync skipped: ${err.message}`));
+    }
+  }
+}
+
 /**
  * Sidecar follow-ups that are independent of pipeline publish hash (scenario packs).
  * @param {Object} ctx
  * @returns {Promise<void>}
  */
 async function runUploadSidecarFollowups(ctx) {
-  const { systemKey, options, dataplaneUrl, authConfig } = ctx;
-  const quietSidecar = isQuietMinimalSync(options);
+  const sidecar = {
+    governance: null,
+    evidence: null,
+    knowledge: null,
+    documentStorageSettings: null
+  };
+  const quietSidecar = isQuietMinimalSync(ctx.options);
+  const model = buildRoleAssistantModel(ctx.payload);
+  await runGovernanceSidecar(ctx, sidecar, quietSidecar);
   try {
-    const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
-    await uploadGovernanceScenarioPacks(systemKey, dataplaneUrl, authConfig, { silent: quietSidecar });
+    await runEvidenceSidecar(ctx, model, sidecar, quietSidecar);
   } catch (err) {
-    if (!quietSidecar) {
-      logger.log(formatWarningLine(`Governance scenario upload skipped: ${err.message}`));
+    if (err && err.evidenceSummary) {
+      sidecar.evidence = err.evidenceSummary;
     }
+    throw err;
   }
+  await runKnowledgeSidecar(ctx, model, sidecar, quietSidecar);
+  return sidecar;
 }
 
 /**
@@ -54,61 +155,57 @@ async function resolveUploadProbeData(ctx, maybeRunUploadProbeFn) {
   return { probeData: null, compact };
 }
 
+function logUploadSummary(ctx, publication, probeData) {
+  if (ctx.options.suppressSummary === true) {
+    return;
+  }
+  logUploadReadinessSummary({
+    environment: ctx.environment,
+    dataplaneUrl: ctx.dataplaneUrl,
+    systemKey: ctx.systemKey,
+    publication,
+    manifest: ctx.manifest,
+    minimal: !!ctx.options.minimal,
+    willProbe: false,
+    credentialPush: ctx.credentialPush,
+    configPush: ctx.configPush,
+    forcePublish: ctx.options.force === true,
+    probeData
+  });
+}
+
+async function runProbeAfterSummary(ctx, maybeRunUploadProbe, compact) {
+  if (ctx.options.probe && !compact) {
+    await maybeRunUploadProbe(ctx.dataplaneUrl, ctx.systemKey, ctx.authConfig, ctx.options.probeTimeout, {
+      compact: false
+    });
+  }
+}
+
+async function runSidecarAndWrap(ctx) {
+  const sidecar = await runUploadSidecarFollowups(ctx);
+  return { sidecar };
+}
+
 /**
  * @param {Object} ctx
  * @param {Function} maybeRunUploadProbe
  * @returns {Promise<void>}
  */
 async function handlePublicationAndFollowups(ctx, maybeRunUploadProbe) {
-  const {
-    systemKey,
-    options,
-    manifest,
-    payload,
-    environment,
-    dataplaneUrl,
-    authConfig,
-    rawRes,
-    credentialPush,
-    configPush
-  } = ctx;
-  const publication = unwrapPublicationResult(rawRes);
+  const publication = unwrapPublicationResult(ctx.rawRes);
   if (!publication) {
     throw new Error(
       'Unexpected response from dataplane upload: missing publication result (uploadId/system/datasources).'
     );
   }
   if (isPublicationUnchanged(publication)) {
-    await runUploadSidecarFollowups({ systemKey, options, payload, dataplaneUrl, authConfig });
-    return;
+    return runSidecarAndWrap(ctx);
   }
-
-  const suppressSummary = options.suppressSummary === true;
   const { probeData, compact } = await resolveUploadProbeData(ctx, maybeRunUploadProbe);
-
-  if (!suppressSummary) {
-    logUploadReadinessSummary({
-      environment,
-      dataplaneUrl,
-      systemKey,
-      publication,
-      manifest,
-      minimal: !!options.minimal,
-      willProbe: false,
-      credentialPush,
-      configPush,
-      forcePublish: options.force === true,
-      probeData
-    });
-  }
-
-  if (options.probe && !compact) {
-    await maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, options.probeTimeout, {
-      compact: false
-    });
-  }
-
-  await runUploadSidecarFollowups({ systemKey, options, payload, dataplaneUrl, authConfig });
+  logUploadSummary(ctx, publication, probeData);
+  await runProbeAfterSummary(ctx, maybeRunUploadProbe, compact);
+  return runSidecarAndWrap(ctx);
 }
 
 module.exports = {

package/lib/commands/upload.js

@@ -47,6 +47,12 @@ const { syncDeployJsonFromSources } = require('../external-system/sync-deploy-ma
 const { handlePublicationAndFollowups } = require('./upload-sidecar-followups');
 const { finalizeUploadPublishResult, finishUnchangedUploadPublication } = require('./upload-data-sync-finalize');
 const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
+const {
+  SYSTEM_KIND_DIGITAL_WORKER,
+  readRoleAssistantSettings,
+  resolveRoleAssistantSettingsVersion,
+  resolveRoleAssistantEnvironmentSettings
+} = require('../role-assistant/settings');
 
 /**
  * Validates system-key format (same as download).
@@ -123,14 +129,24 @@ async function resolveDataplaneAndAuth(systemKey, opts = {}) {
  * @param {string} dataplaneUrl - Dataplane base URL
  * @param {Object} authConfig - Auth config
  * @param {Object} payload - { version, application, dataSources, status: "draft" }
+ * @param {string} systemKey
+ * @param {Object} [options]
+ * @param {number|string} [options.timeoutMs]
  * @returns {Promise<Object>} Raw API response envelope
  */
-async function runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey) {
+async function runUploadValidatePublish(
+  dataplaneUrl,
+  authConfig,
+  payload,
+  systemKey,
+  options = {}
+) {
   const res = await uploadApplicationViaPipelineWithAuthRetry(
     dataplaneUrl,
     authConfig,
     payload,
-    systemKey
+    systemKey,
+    { timeoutMs: options.timeoutMs }
   );
   if (res?.success === false) {
     throw new Error(formatApiError(res, dataplaneUrl));
@@ -231,6 +247,14 @@ async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
     force: opts.force === true,
     status: opts.uploadStatus === 'published' ? 'published' : 'draft'
   });
+  if (String(manifest?.system?.systemKind || '').trim() === SYSTEM_KIND_DIGITAL_WORKER) {
+    const settings = readRoleAssistantSettings(systemKey, { required: true, pathOptions });
+    resolveRoleAssistantEnvironmentSettings(settings, opts.env || 'dev', { required: true });
+    const settingsVersion = resolveRoleAssistantSettingsVersion(settings);
+    if (settingsVersion) {
+      payload.version = settingsVersion;
+    }
+  }
   await resolvePayloadConfiguration(systemKey, payload, pathOptions);
   return { manifest, payload };
 }
@@ -264,7 +288,10 @@ async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContex
     systemKey,
     datasourceFiles,
     dataplaneUrl: uploadContext.dataplaneUrl,
-    authConfig: uploadContext.authConfig
+    authConfig: uploadContext.authConfig,
+    // Always replace SpecFile rows keyed by openapi.documentKey so vendor/full
+    // specs are not left missing while only thin internal:* slices remain.
+    force: true
   });
   if (!uploadContext.quiet) {
     for (const line of openapiSyncLines) {
@@ -293,7 +320,7 @@ async function completeUploadAfterPublish(systemKey, options, manifest, payload,
     pathOptions: options.pathOptions,
     quiet: quietCompact
   });
-  await handlePublicationAndFollowups(
+  const followupResult = await handlePublicationAndFollowups(
     {
       systemKey,
       options,
@@ -309,7 +336,13 @@ async function completeUploadAfterPublish(systemKey, options, manifest, payload,
     maybeRunUploadProbe
   );
   return finalizeUploadPublishResult(
-    { dataplaneUrl: ctx.dataplaneUrl, authConfig: ctx.authConfig, environment: ctx.environment, uploadSkipped: false },
+    {
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      environment: ctx.environment,
+      uploadSkipped: false,
+      sidecar: followupResult?.sidecar || null
+    },
     payload,
     options
   );
@@ -331,7 +364,10 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
     payload
   );
   const rawRes = await runWithUploadPipelineSpinner(
-    async() => runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey),
+    async() =>
+      runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey, {
+        timeoutMs: options.timeoutMs
+      }),
     {
       systemKey,
       json: options.json === true,
@@ -367,6 +403,7 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
  * @param {boolean} [options.verbose] - Expanded summary and server-side pipeline validate warnings
  * @param {boolean} [options.probe] - POST validation/run after publish
  * @param {number} [options.probeTimeout] - Probe timeout ms (default 120000)
+ * @param {number} [options.timeoutMs] - Pipeline publish timeout ms (HTTP + dataplane; default 300000)
  * @param {boolean} [options.minimal] - Short summary (default: compact unless --verbose)
  * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }|void>}
  * @throws {Error} If validation or API calls fail

package/lib/commands/verify-governance-combined-external.js

@@ -10,6 +10,56 @@ const {
   buildSubjectsFromOptions,
   resolveGovernanceIntegrationContext
 } = require('./governance-cli-shared');
+const { VERDICT } = require('../lifecycle/product-model');
+const {
+  allDatasourcesAbacNotApplicable,
+  filterAbacRequiredDatasourceKeys
+} = require('../lifecycle/access-control-abac');
+const { runSystemLifecycle } = require('../api/lifecycle.api');
+
+/**
+ * @param {string} resolvedKey
+ * @param {string[]} keys
+ * @param {Object} [extra]
+ * @returns {Object}
+ */
+function buildNotApplicableGovernanceResult(resolvedKey, keys, extra = {}) {
+  return {
+    systemKey: resolvedKey,
+    command: 'verify-governance',
+    verdict: VERDICT.NOT_APPLICABLE,
+    policyCoveragePercent: 100,
+    dimensionCoveragePercent: 100,
+    enforcementScenarios: { passed: 0, total: 0 },
+    datasourceRows: keys.map(datasourceKey => ({
+      datasourceKey,
+      verdict: VERDICT.NOT_APPLICABLE
+    })),
+    ...extra
+  };
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} resolvedKey
+ * @param {string[]} keys
+ * @param {Object} [extra]
+ * @returns {Promise<Object>}
+ */
+async function closeAllGovernanceAsNotApplicable(
+  dataplaneUrl,
+  authConfig,
+  resolvedKey,
+  keys,
+  extra = {}
+) {
+  await runSystemLifecycle(dataplaneUrl, authConfig, resolvedKey, {
+    steps: ['governance'],
+    datasourceKeys: keys
+  });
+  return buildNotApplicableGovernanceResult(resolvedKey, keys, extra);
+}
 
 /**
  * @async
@@ -23,22 +73,32 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
   }
 
   const subjects = buildSubjectsFromOptions(options);
+  const { resolvedKey, keys, authConfig, dataplaneUrl } =
+    await resolveGovernanceIntegrationContext(systemKey, options);
+
   if (subjects.length === 0) {
-    throw new Error(
-      'At least one --subject-user-id or --subject-email is required for verify-governance'
-    );
+    if (!allDatasourcesAbacNotApplicable(resolvedKey, keys)) {
+      throw new Error(
+        'At least one --subject-user-id or --subject-email is required for verify-governance'
+      );
+    }
+    return closeAllGovernanceAsNotApplicable(dataplaneUrl, authConfig, resolvedKey, keys);
   }
 
-  const { resolvedKey, authConfig, dataplaneUrl } = await resolveGovernanceIntegrationContext(
-    systemKey,
-    options
-  );
+  const requiredKeys = filterAbacRequiredDatasourceKeys(resolvedKey, keys);
+  if (requiredKeys.length === 0) {
+    return closeAllGovernanceAsNotApplicable(dataplaneUrl, authConfig, resolvedKey, keys, {
+      generated: 0,
+      generateResults: []
+    });
+  }
 
   const pipelineOpts = {
     ...options,
     noPublish: true,
     authConfig,
-    dataplaneUrl
+    dataplaneUrl,
+    datasourceKeys: requiredKeys
   };
 
   const generateResult = await runGovernanceGenerateForExternalSystem(
@@ -46,7 +106,11 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
     pipelineOpts
   );
 
-  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, pipelineOpts);
+  // Verify all datasources so notApplicable keys close as NOT_APPLICABLE.
+  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, {
+    ...pipelineOpts,
+    datasourceKeys: keys
+  });
 
   return {
     ...verifyResult,

package/lib/commands/verify-governance-db.js

@@ -27,6 +27,58 @@ function attachUploadAuthToOptions(options, uploadCtx) {
   options.silentResolve = true;
 }
 
+/**
+ * @param {string} key
+ * @param {Object|null} config
+ * @returns {Object}
+ */
+function buildNotApplicableGovernanceRow(key, config) {
+  const {
+    parseAccessControlAbac
+  } = require('../lifecycle/access-control-abac');
+  const abac = parseAccessControlAbac(config);
+  return {
+    datasourceKey: key,
+    verdict: VERDICT.NOT_APPLICABLE,
+    scenarios: { passed: 0, total: 0 },
+    policyCoveragePercent: 100,
+    dimensionCoveragePercent: 100,
+    rationale: abac.rationale
+  };
+}
+
+/**
+ * @param {string} key
+ * @param {Object} ctx
+ * @returns {Promise<Object|null>}
+ */
+async function runRequiredGovernanceDatasource(key, ctx) {
+  try {
+    const packRow = await getDatasourceGovernancePack(ctx.dataplaneUrl, ctx.authConfig, key);
+    if (!packRow || !packRow.pack) {
+      return null;
+    }
+    const result = await runDatasourceGovernanceScenarios(ctx.dataplaneUrl, ctx.authConfig, key);
+    const summary = result.summary || {};
+    return {
+      datasourceKey: key,
+      verdict: summary.failed > 0 ? VERDICT.FAILED : VERDICT.VERIFIED,
+      scenarios: { passed: summary.passed || 0, total: summary.total || 0 },
+      policyCoveragePercent: result.policyCoveragePercent ?? 100,
+      dimensionCoveragePercent: result.dimensionCoveragePercent ?? 100,
+      packDocument: packRow.pack,
+      result
+    };
+  } catch (err) {
+    return {
+      datasourceKey: key,
+      verdict: VERDICT.FAILED,
+      error: err.message,
+      scenarios: { passed: 0, total: 0 }
+    };
+  }
+}
+
 /**
  * @async
  * @param {string[]} keys
@@ -35,35 +87,27 @@ function attachUploadAuthToOptions(options, uploadCtx) {
  * @returns {Promise<Array>}
  */
 async function runGovernanceForDatasourceKeys(keys, ctx, progress = {}) {
+  const {
+    filterAbacRequiredDatasourceKeys,
+    loadDatasourceConfigsByKey
+  } = require('../lifecycle/access-control-abac');
+  const configs = loadDatasourceConfigsByKey(ctx.systemKey || '');
+  const required = new Set(
+    filterAbacRequiredDatasourceKeys(ctx.systemKey || '', keys)
+  );
   const rows = [];
   for (let index = 0; index < keys.length; index += 1) {
     const key = keys[index];
     if (typeof progress.setLabel === 'function') {
       progress.setLabel(`Running governance scenarios: ${key} (${index + 1}/${keys.length})`);
     }
-    try {
-      const packRow = await getDatasourceGovernancePack(ctx.dataplaneUrl, ctx.authConfig, key);
-      if (!packRow || !packRow.pack) {
-        continue;
-      }
-      const result = await runDatasourceGovernanceScenarios(ctx.dataplaneUrl, ctx.authConfig, key);
-      const summary = result.summary || {};
-      rows.push({
-        datasourceKey: key,
-        verdict: summary.failed > 0 ? VERDICT.FAILED : VERDICT.VERIFIED,
-        scenarios: { passed: summary.passed || 0, total: summary.total || 0 },
-        policyCoveragePercent: result.policyCoveragePercent ?? 100,
-        dimensionCoveragePercent: result.dimensionCoveragePercent ?? 100,
-        packDocument: packRow.pack,
-        result
-      });
-    } catch (err) {
-      rows.push({
-        datasourceKey: key,
-        verdict: VERDICT.FAILED,
-        error: err.message,
-        scenarios: { passed: 0, total: 0 }
-      });
+    if (!required.has(key)) {
+      rows.push(buildNotApplicableGovernanceRow(key, configs.get(key) || null));
+      continue;
+    }
+    const row = await runRequiredGovernanceDatasource(key, ctx);
+    if (row) {
+      rows.push(row);
     }
   }
   return rows;
@@ -76,7 +120,12 @@ async function runGovernanceForDatasourceKeys(keys, ctx, progress = {}) {
  * @returns {Promise<Object>}
  */
 async function runVerifyGovernanceFromDbPacks(systemKey, options) {
-  const { systemKey: resolvedKey, keys } = resolveExternalIntegrationContext(systemKey);
+  const { systemKey: resolvedKey, keys: discoveredKeys } =
+    resolveExternalIntegrationContext(systemKey);
+  const keys =
+    Array.isArray(options.datasourceKeys) && options.datasourceKeys.length
+      ? options.datasourceKeys
+      : discoveredKeys;
   if (keys.length === 0) {
     return { resolvedKey, datasourceRows: [] };
   }
@@ -87,10 +136,16 @@ async function runVerifyGovernanceFromDbPacks(systemKey, options) {
   }
 
   const { authConfig, dataplaneUrl } = await resolveIntegrationAuth(resolvedKey, options);
+  options.authConfig = authConfig;
+  options.dataplaneUrl = dataplaneUrl;
   const datasourceRows = await runWithVerifyStepProgress(
     'Running governance scenarios',
     async(progress) =>
-      runGovernanceForDatasourceKeys(keys, { authConfig, dataplaneUrl }, progress),
+      runGovernanceForDatasourceKeys(
+        keys,
+        { authConfig, dataplaneUrl, systemKey: resolvedKey },
+        progress
+      ),
     options
   );
   return { resolvedKey, datasourceRows };

package/lib/commands/verify-governance-external.js

@@ -8,7 +8,7 @@
 
 const { runTestGovernanceForExternalSystem } = require('./test-governance-external');
 const { runVerifyGovernanceFromDbPacks } = require('./verify-governance-db');
-const { VERDICT, verdictFromPassed } = require('../lifecycle/product-model');
+const { VERDICT } = require('../lifecycle/product-model');
 const {
   sumEnforcementScenarios,
   aggregateCoverage,
@@ -20,14 +20,26 @@ const {
  * @returns {{ passed: number, total: number }}
  */
 function buildDbPackResult(resolvedKey, datasourceRows) {
-  const allVerified = datasourceRows.every(r => r.verdict === VERDICT.VERIFIED);
+  const hasFailed = datasourceRows.some(r => r.verdict === VERDICT.FAILED);
+  const allNa =
+    datasourceRows.length > 0
+    && datasourceRows.every(r => r.verdict === VERDICT.NOT_APPLICABLE);
+  const allClosed = datasourceRows.every(
+    r => r.verdict === VERDICT.VERIFIED || r.verdict === VERDICT.NOT_APPLICABLE
+  );
+  let verdict = VERDICT.FAILED;
+  if (allNa) {
+    verdict = VERDICT.NOT_APPLICABLE;
+  } else if (allClosed && !hasFailed) {
+    verdict = VERDICT.VERIFIED;
+  }
   const coverage = aggregateCoverage(datasourceRows);
   return {
     systemKey: resolvedKey,
     command: 'verify-governance',
-    verdict: verdictFromPassed(allVerified),
-    policyCoveragePercent: coverage.policy ?? (allVerified ? 100 : 0),
-    dimensionCoveragePercent: coverage.dimension ?? (allVerified ? 100 : 0),
+    verdict,
+    policyCoveragePercent: coverage.policy ?? (allClosed ? 100 : 0),
+    dimensionCoveragePercent: coverage.dimension ?? (allClosed ? 100 : 0),
     enforcementScenarios: sumEnforcementScenarios(datasourceRows),
     datasourceRows
   };
@@ -41,12 +53,9 @@ function buildDbPackResult(resolvedKey, datasourceRows) {
  */
 async function runVerifyGovernanceForExternalSystem(systemKey, options = {}) {
   const pathsUtil = require('../utils/paths');
+  const { assertCertifyExternalWorkspace } = require('../utils/certify-external-workspace');
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'verify-governance applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
+  assertCertifyExternalWorkspace(appType && appType.baseDir, 'verify-governance');
 
   if (options.pack) {
     const runPayload = await runTestGovernanceForExternalSystem(systemKey, options);
@@ -66,6 +75,18 @@ async function runVerifyGovernanceForExternalSystem(systemKey, options = {}) {
     };
   }
 
+  const naKeys = datasourceRows
+    .filter(row => row.verdict === VERDICT.NOT_APPLICABLE)
+    .map(row => row.datasourceKey)
+    .filter(Boolean);
+  if (naKeys.length > 0 && options.authConfig && options.dataplaneUrl) {
+    const { runSystemLifecycle } = require('../api/lifecycle.api');
+    await runSystemLifecycle(options.dataplaneUrl, options.authConfig, resolvedKey, {
+      steps: ['governance'],
+      datasourceKeys: naKeys
+    });
+  }
+
   return buildDbPackResult(resolvedKey, datasourceRows);
 }
 

package/lib/commands/verify-operations-external.js

@@ -162,12 +162,9 @@ async function buildOperationsResult({
  */
 async function assertIntegrationExternalSystem(systemKey) {
   const pathsUtil = require('../utils/paths');
+  const { assertCertifyExternalWorkspace } = require('../utils/certify-external-workspace');
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'verify-operations applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
+  assertCertifyExternalWorkspace(appType && appType.baseDir, 'verify-operations');
 }
 
 /**