@anhcodo13/lattice 0.3.0 → 0.4.0

package/dist/cli.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { writeFile as writeFile3 } from "fs/promises";
+import { writeFile as writeFile4 } from "fs/promises";
 import { realpathSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname3, join as join10, resolve as resolve9 } from "path";
+import { dirname as dirname5, join as join12, resolve as resolve11 } from "path";
 import { Command, CommanderError } from "commander";
 
 // package.json
 var package_default = {
   name: "@anhcodo13/lattice",
-  version: "0.3.0",
+  version: "0.4.0",
   private: false,
   packageManager: "pnpm@10.30.3",
   type: "module",
@@ -223,28 +223,28 @@ async function exists(path) {
   }
 }
 async function archivePrevious(outputDirectory) {
-  const json = join2(outputDirectory, "analysis.json");
+  const json2 = join2(outputDirectory, "analysis.json");
   const html = join2(outputDirectory, "report.html");
-  if (!await exists(json) && !await exists(html)) return;
+  if (!await exists(json2) && !await exists(html)) return;
   const name = `${(/* @__PURE__ */ new Date()).toISOString().replaceAll(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
   const destination = join2(outputDirectory, "history", name);
   await mkdir(destination, { recursive: true });
-  if (await exists(json)) await rename(json, join2(destination, "analysis.json"));
+  if (await exists(json2)) await rename(json2, join2(destination, "analysis.json"));
   if (await exists(html)) await rename(html, join2(destination, "report.html"));
 }
 
 // src/analysis/recommend.ts
-function recommendActions(findings) {
+function recommendActions(findings2) {
   const points = { error: 5, warning: 2, info: 1 };
   const grouped = /* @__PURE__ */ new Map();
-  for (const finding of findings) grouped.set(finding.file, [...grouped.get(finding.file) ?? [], finding]);
+  for (const finding of findings2) grouped.set(finding.file, [...grouped.get(finding.file) ?? [], finding]);
   const ranked = [...grouped.entries()].map(([file, items]) => ({ file, items, priority: items.reduce((sum, item) => sum + points[item.severity], 0) })).sort((a, b) => b.priority - a.priority || a.file.localeCompare(b.file));
   const hotspots = ranked.slice(0, 8).map(({ file, items, priority }) => ({
     file,
     findingCount: items.length,
     estimatedRecovery: `Estimate: up to ${Math.min(15, priority)} points if these findings are resolved`
   }));
-  const quickWins = findings.filter((finding) => finding.severity === "info" || finding.ruleId === "duplicate-import").slice(0, 8).map((finding) => ({ file: finding.file, ruleId: finding.ruleId, recommendation: finding.recommendation }));
+  const quickWins = findings2.filter((finding) => finding.severity === "info" || finding.ruleId === "duplicate-import").slice(0, 8).map((finding) => ({ file: finding.file, ruleId: finding.ruleId, recommendation: finding.recommendation }));
   const roadmap = ranked.slice(0, 8).map(({ file, items, priority }) => ({
     file,
     priority,
@@ -610,12 +610,12 @@ function renderHtml(report) {
 // src/analysis/rules.ts
 import { matchesGlob } from "path";
 function evaluateRules(graph, config) {
-  const findings = [];
+  const findings2 = [];
   const outgoing = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.from === module.path && !edge.isTypeOnly)]));
   const incoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path && !edge.isTypeOnly)]));
   const allIncoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path)]));
   for (const cycle of findCycles(graph)) {
-    findings.push({
+    findings2.push({
       ruleId: "module-cycle",
       category: "architecture",
       severity: "error",
@@ -632,7 +632,7 @@ function evaluateRules(graph, config) {
     for (const imported of module.imports) {
       if (imported.isTypeOnly) continue;
       if (seen.has(imported.specifier)) {
-        findings.push({
+        findings2.push({
           ruleId: "duplicate-import",
           category: "imports",
           severity: "warning",
@@ -645,7 +645,7 @@ function evaluateRules(graph, config) {
       seen.add(imported.specifier);
     }
     if (out.length > config.thresholds.maxFanOut) {
-      findings.push({
+      findings2.push({
         ruleId: "high-fan-out",
         category: "architecture",
         severity: "warning",
@@ -656,7 +656,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (into.length > config.thresholds.maxFanIn) {
-      findings.push({
+      findings2.push({
         ruleId: "high-fan-in",
         category: "architecture",
         severity: "warning",
@@ -667,7 +667,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (into.length === 0 && out.length === 0 && graph.modules.length > 1 && !module.isRoute) {
-      findings.push({
+      findings2.push({
         ruleId: "orphan-module",
         category: "architecture",
         severity: "info",
@@ -683,7 +683,7 @@ function evaluateRules(graph, config) {
         for (const name of module.exports) {
           if (name === "*" || module.typeExports.includes(name)) continue;
           if (!usedNames.has(name)) {
-            findings.push({
+            findings2.push({
               ruleId: "unused-export",
               category: "imports",
               severity: "info",
@@ -697,7 +697,7 @@ function evaluateRules(graph, config) {
       }
     }
     if (module.componentCount > 0 && module.lines > config.thresholds.maxComponentLines) {
-      findings.push({
+      findings2.push({
         ruleId: "large-component",
         category: "components",
         severity: "warning",
@@ -708,7 +708,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (module.jsxDepth > config.thresholds.maxJsxDepth) {
-      findings.push({
+      findings2.push({
         ruleId: "deep-jsx",
         category: "components",
         severity: "warning",
@@ -719,7 +719,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (module.complexity > config.thresholds.maxComplexity) {
-      findings.push({
+      findings2.push({
         ruleId: "high-complexity",
         category: "complexity",
         severity: "warning",
@@ -735,7 +735,7 @@ function evaluateRules(graph, config) {
         const allowed = policy.allow?.some((pattern) => matchesGlob(edge.to, pattern));
         const disallowed = policy.disallow?.some((pattern) => matchesGlob(edge.to, pattern));
         if (policy.allow && !allowed || policy.disallow && disallowed) {
-          findings.push({
+          findings2.push({
             ruleId: policy.id,
             category: "architecture",
             severity: policy.severity,
@@ -762,7 +762,7 @@ function evaluateRules(graph, config) {
       return false;
     };
     if (visit(module.path, /* @__PURE__ */ new Set([module.path]), 0)) {
-      findings.push({
+      findings2.push({
         ruleId: "deep-dependency-chain",
         category: "architecture",
         severity: "warning",
@@ -773,7 +773,7 @@ function evaluateRules(graph, config) {
       });
     }
   }
-  return findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+  return findings2.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
 }
 
 // src/analysis/scan.ts
@@ -929,9 +929,9 @@ async function compilerOptions(root) {
     throw error;
   }
   try {
-    const json = ts2.parseConfigFileTextToJson(path, content);
-    if (json.error) return { options: {}, diagnostics: [`tsconfig.json: ${ts2.flattenDiagnosticMessageText(json.error.messageText, " ")}`] };
-    const parsed = ts2.parseJsonConfigFileContent(json.config, ts2.sys, root);
+    const json2 = ts2.parseConfigFileTextToJson(path, content);
+    if (json2.error) return { options: {}, diagnostics: [`tsconfig.json: ${ts2.flattenDiagnosticMessageText(json2.error.messageText, " ")}`] };
+    const parsed = ts2.parseJsonConfigFileContent(json2.config, ts2.sys, root);
     return { options: parsed.options, diagnostics: parsed.errors.map((error) => `tsconfig.json: ${ts2.flattenDiagnosticMessageText(error.messageText, " ")}`) };
   } catch (error) {
     return { options: {}, diagnostics: [`tsconfig.json: ${error instanceof Error ? error.message : String(error)}`] };
@@ -1105,10 +1105,10 @@ function grade(score) {
   if (score >= 55) return "D";
   return "F";
 }
-function scoreFindings(findings, config) {
+function scoreFindings(findings2, config) {
   const penalties = { error: 18, warning: 7, info: 2 };
   const categories = Object.entries(config.weights).map(([id, weight]) => {
-    const categoryFindings = findings.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
+    const categoryFindings = findings2.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
     const occurrences = /* @__PURE__ */ new Map();
     let deduction = 0;
     for (const finding of categoryFindings) {
@@ -1120,8 +1120,8 @@ function scoreFindings(findings, config) {
     return { id, weight, score: round(100 - deduction), deduction: round(deduction), findingCount: categoryFindings.length };
   });
   const weightedDeduction = round(categories.reduce((sum, category) => sum + category.deduction * category.weight / 100, 0));
-  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings.length - 10) * 0.15));
-  const criticalAdjustment = round(Math.min(10, findings.filter((finding) => finding.severity === "error").length * 1.5));
+  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings2.length - 10) * 0.15));
+  const criticalAdjustment = round(Math.min(10, findings2.filter((finding) => finding.severity === "error").length * 1.5));
   const score = round(Math.max(0, Math.min(100, 100 - weightedDeduction - maintenanceAdjustment - criticalAdjustment)));
   return { score, grade: grade(score), weightedDeduction, maintenanceAdjustment, criticalAdjustment, categories };
 }
@@ -1133,7 +1133,7 @@ async function analyzeProject(projectRoot, options = {}) {
   const modules = await scanProject(root, config.aliases);
   if (modules.length === 0) throw new Error("No supported source files found");
   const graph = buildGraph(modules);
-  const findings = evaluateRules(graph, config);
+  const findings2 = evaluateRules(graph, config);
   let name = basename(root);
   try {
     const manifest = JSON.parse(await readFile4(join5(root, "package.json"), "utf8"));
@@ -1145,9 +1145,9 @@ async function analyzeProject(projectRoot, options = {}) {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     project: { name },
     graph,
-    findings,
-    score: scoreFindings(findings, config),
-    actions: recommendActions(findings)
+    findings: findings2,
+    score: scoreFindings(findings2, config),
+    actions: recommendActions(findings2)
   };
   const outputDirectory = resolve3(options.outputDirectory ?? join5(root, ".nklattice-report"));
   await mkdir2(outputDirectory, { recursive: true });
@@ -1176,12 +1176,12 @@ function dependencyMap(manifest) {
     const entries = manifest[section2];
     if (entries === void 0) continue;
     if (!isRecord(entries)) throw new Error(`Invalid ${section2} in package.json`);
-    for (const [name, version] of Object.entries(entries)) {
-      if (typeof version !== "string") throw new Error(`Invalid version for ${name}`);
-      if (result[name] !== void 0 && result[name] !== version) {
+    for (const [name, version2] of Object.entries(entries)) {
+      if (typeof version2 !== "string") throw new Error(`Invalid version for ${name}`);
+      if (result[name] !== void 0 && result[name] !== version2) {
         throw new Error(`Conflicting declarations for ${name}`);
       }
-      result[name] = version;
+      result[name] = version2;
     }
   }
   return result;
@@ -1324,17 +1324,17 @@ function readPnpm(raw, root, app, name) {
   if (!record2(entry) || typeof entry.specifier !== "string" || typeof entry.version !== "string") {
     throw new Error(`Malformed pnpm lockfile dependency for ${name}`);
   }
-  const version = entry.version.match(/^(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/)?.[1];
-  if (!version) throw new Error(`Unsupported pnpm resolution for ${name}`);
-  const packageKeys = [`${name}@${version}`, `/${name}@${version}`];
+  const version2 = entry.version.match(/^(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/)?.[1];
+  if (!version2) throw new Error(`Unsupported pnpm resolution for ${name}`);
+  const packageKeys = [`${name}@${version2}`, `/${name}@${version2}`];
   if (!packageKeys.some((key) => record2(lock.packages) && Object.hasOwn(lock.packages, key))) {
-    throw new Error(`Missing pnpm package entry for ${name}@${version}`);
+    throw new Error(`Missing pnpm package entry for ${name}@${version2}`);
   }
   const snapshotKeys = [`${name}@${entry.version}`, `/${name}@${entry.version}`, ...packageKeys];
   if (!snapshotKeys.some((key) => Object.hasOwn(lock.snapshots, key))) {
     throw new Error(`Missing pnpm snapshot for ${name}@${entry.version}`);
   }
-  return { specifier: entry.specifier, version };
+  return { specifier: entry.specifier, version: version2 };
 }
 async function readResolution(app, workspaceRoot, name) {
   const lockfile = await findLockfile(app.directory, workspaceRoot);
@@ -1346,7 +1346,7 @@ async function readResolution(app, workspaceRoot, name) {
 async function checkApp(app, workspaceRoot, policy) {
   const requirements = policy.profiles[app.profile];
   if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
-  const findings = [];
+  const findings2 = [];
   for (const [packageName, expected] of Object.entries(requirements)) {
     const declared = app.dependencies[packageName];
     const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
@@ -1364,7 +1364,7 @@ async function checkApp(app, workspaceRoot, policy) {
         reasons.push("lockfile resolution outside manifest range");
       }
     }
-    if (reasons.length) findings.push({
+    if (reasons.length) findings2.push({
       app: app.relativePath,
       packageName,
       expected,
@@ -1374,7 +1374,7 @@ async function checkApp(app, workspaceRoot, policy) {
       reason: reasons.join("; ")
     });
   }
-  return findings;
+  return findings2;
 }
 async function checkGovernance(options) {
   const scanRoot = resolve5(options.scanRoot);
@@ -1385,10 +1385,10 @@ async function checkGovernance(options) {
   }
   const apps = await discoverApps(scanRoot, workspaceRoot);
   if (apps.length === 0) throw new Error("No managed applications found");
-  const findings = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
+  const findings2 = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
   return {
     appsChecked: apps.length,
-    findings,
+    findings: findings2,
     policyVersion: options.policy.policyVersion,
     policySource: options.policy.source,
     policySha256: options.policy.sha256
@@ -1397,7 +1397,7 @@ async function checkGovernance(options) {
 
 // src/governance/assess.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { join as join9, relative as relative6, resolve as resolve8, sep as sep5 } from "path";
+import { basename as basename2, join as join10, relative as relative7, resolve as resolve9, sep as sep6 } from "path";
 
 // src/governance/inventory.ts
 import { createHash } from "crypto";
@@ -1457,10 +1457,283 @@ function compareInventory(inventory, discovered, scanRoot) {
   return issues;
 }
 
-// src/governance/policy.ts
+// src/governance/evidence.ts
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile8 } from "fs/promises";
-import { resolve as resolve7 } from "path";
+import { execFile } from "child_process";
+import { createReadStream } from "fs";
+import { lstat, readFile as readFile8, realpath as realpath2 } from "fs/promises";
+import { dirname as dirname3, join as join9, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { promisify } from "util";
+import fg from "fast-glob";
+var execFileAsync = promisify(execFile);
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function string(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function nonnegative(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function errors(value) {
+  return Array.isArray(value) && value.every(string);
+}
+function findings(value) {
+  return Array.isArray(value) && value.every((item) => object(item) && string(item.id) && string(item.severity) && string(item.subject) && string(item.message) && (item.remediation === void 0 || string(item.remediation)));
+}
+function base(value) {
+  return object(value) && string(value.tool) && string(value.version) && typeof value.complete === "boolean" && errors(value.errors);
+}
+function validateApp(value) {
+  if (!object(value) || !string(value.path) || !string(value.profile)) return false;
+  const dependency = value.dependencySecurity;
+  const quality = value.codeQuality;
+  const security = value.codeSecurity;
+  const compatibility2 = value.compatibility;
+  if (!base(dependency) || !nonnegative(dependency.packagesScanned) || !findings(dependency.advisories)) return false;
+  if (!object(quality) || !object(quality.lint) || !string(quality.lint.tool) || !string(quality.lint.version) || typeof quality.lint.complete !== "boolean" || !base(quality.typecheck) || !base(quality.tests) || !base(quality.coverage)) return false;
+  if (!nonnegative(quality.lint.filesScanned) || !nonnegative(quality.lint.errorCount) || !nonnegative(quality.lint.warnings) || !errors(quality.lint.errorsDetail) || typeof quality.typecheck.passed !== "boolean" || quality.typecheck.applicable !== void 0 && typeof quality.typecheck.applicable !== "boolean" || !nonnegative(quality.tests.passed) || !nonnegative(quality.tests.failed) || typeof quality.coverage.linesPercent !== "number" || !Number.isFinite(quality.coverage.linesPercent) || quality.coverage.linesPercent < 0 || quality.coverage.linesPercent > 100) return false;
+  if (!object(security) || !base(security.sast) || !base(security.secrets) || !nonnegative(security.sast.filesScanned) || !nonnegative(security.secrets.filesScanned) || !findings(security.sast.findings) || !findings(security.secrets.findings)) return false;
+  if (!base(compatibility2) || !Array.isArray(compatibility2.projects) || !compatibility2.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  return true;
+}
+async function hashFile(hash, path) {
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+}
+async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
+  const root = resolve7(scanRoot);
+  const workspace = resolve7(workspaceRoot);
+  const scanRelative = relative6(workspace, root);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  const paths = await fg("**/*", {
+    cwd: root,
+    dot: true,
+    onlyFiles: true,
+    followSymbolicLinks: false,
+    ignore: [
+      "**/.git/**",
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.next/**",
+      "**/coverage/**",
+      "**/playwright-report/**",
+      "**/test-results/**",
+      "**/.nklattice-governance/**",
+      "**/.nklattice-report/**",
+      "**/AGENTS.md",
+      "**/*.tsbuildinfo",
+      "**/next-env.d.ts"
+    ]
+  });
+  paths.sort();
+  const hash = createHash2("sha256");
+  for (const path of paths) {
+    const absolute = resolve7(root, path);
+    const normalized = relative6(root, absolute);
+    if (normalized === ".." || normalized.startsWith(`..${sep5}`)) throw new Error("Input path escapes scan root");
+    if (!(await lstat(absolute)).isFile()) continue;
+    hash.update(path.replaceAll("\\", "/"));
+    hash.update("\0");
+    await hashFile(hash, absolute);
+    hash.update("\0");
+  }
+  let ancestor = root;
+  while (ancestor === workspace || ancestor !== dirname3(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
+    for (const name of [
+      "package.json",
+      "package-lock.json",
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "eslint.config.js",
+      "eslint.config.mjs",
+      "eslint.config.cjs",
+      "eslint.config.ts",
+      "eslint.config.mts",
+      "vitest.config.js",
+      "vitest.config.mjs",
+      "vitest.config.ts",
+      "vitest.config.mts",
+      "playwright.config.js",
+      "playwright.config.mjs",
+      "playwright.config.ts",
+      "playwright.config.mts",
+      ".semgrep.yml",
+      ".semgrep.yaml",
+      "semgrep.yml",
+      "semgrep.yaml"
+    ]) {
+      const path = join9(ancestor, name);
+      try {
+        const stat2 = await lstat(path);
+        if (stat2.isSymbolicLink()) throw new Error(`Symlinked scanner configuration is unsupported: ${path}`);
+        if (!stat2.isFile()) continue;
+        hash.update(relative6(workspace, path).replaceAll("\\", "/"));
+        hash.update("\0");
+        await hashFile(hash, path);
+        hash.update("\0");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    if (ancestor === workspace) break;
+    ancestor = dirname3(ancestor);
+  }
+  return hash.digest("hex");
+}
+async function loadScanEvidence(path, scanRoot, workspaceRoot, policySha256, maximumAgeHours) {
+  const source = resolve7(path);
+  const stat2 = await lstat(source);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 1e7) throw new Error("Evidence must be a regular JSON file under 10 MB");
+  const root = resolve7(scanRoot);
+  const relativePath = relative6(root, source);
+  if (relativePath !== ".." && !relativePath.startsWith(`..${sep5}`)) throw new Error("Evidence file must be outside the scan root");
+  const actualRoot = await realpath2(root);
+  const actualSource = await realpath2(source);
+  const actualRelative = relative6(actualRoot, actualSource);
+  if (actualRelative !== ".." && !actualRelative.startsWith(`..${sep5}`)) throw new Error("Evidence file resolves inside the scan root");
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile8(source, "utf8"));
+  } catch {
+    throw new Error("Evidence is not valid JSON");
+  }
+  return validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha256, maximumAgeHours);
+}
+async function validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha256, maximumAgeHours) {
+  if (!object(parsed) || parsed.schemaVersion !== 1 || !string(parsed.generatedAt) || !string(parsed.policySha256) || !string(parsed.inputSha256) || !string(parsed.commit) || !/^[0-9a-f]{40}$/.test(parsed.commit) || !Array.isArray(parsed.apps) || !parsed.apps.every(validateApp)) throw new Error("Evidence schema is invalid or incomplete");
+  if (parsed.policySha256 !== policySha256) throw new Error("Evidence was generated for another policy");
+  const generatedAt = Date.parse(parsed.generatedAt);
+  if (!Number.isFinite(generatedAt) || generatedAt > Date.now() + 6e4 || Date.now() - generatedAt > maximumAgeHours * 36e5) {
+    throw new Error("Evidence is stale or has an invalid timestamp");
+  }
+  if (parsed.inputSha256 !== await hashAssessmentInputs(scanRoot, workspaceRoot)) throw new Error("Evidence inputs changed after scanning");
+  const current = (await execFileAsync("git", ["rev-parse", "HEAD"], { cwd: workspaceRoot })).stdout.trim();
+  if (!/^[0-9a-f]{40}$/.test(current) || parsed.commit !== current) throw new Error("Evidence commit differs from the checked-out commit");
+  const appPaths = parsed.apps.map((app) => app.path);
+  if (new Set(appPaths).size !== appPaths.length) throw new Error("Evidence contains duplicate app paths");
+  return parsed;
+}
+var incomplete = (issues, tool, version2, scanned) => ({ status: "incomplete", issues, tool, version: version2, scanned });
+function evaluateAppEvidence(app, policy) {
+  if (!app) {
+    const missing = incomplete(["No fresh scan evidence for this app"]);
+    return { dependencySecurity: { ...missing }, codeQuality: { ...missing }, codeSecurity: { ...missing }, compatibility: { ...missing } };
+  }
+  const dependency = app.dependencySecurity;
+  let dependencySecurity;
+  if (!dependency.complete || dependency.packagesScanned === 0 || dependency.errors.length) {
+    dependencySecurity = { ...incomplete(["Dependency advisory scan did not cover the lockfile", ...dependency.errors], dependency.tool, dependency.version, dependency.packagesScanned), findings: dependency.advisories };
+  } else {
+    const high2 = dependency.advisories.filter((item) => item.severity.toLowerCase() === "high").length;
+    const critical2 = dependency.advisories.filter((item) => item.severity.toLowerCase() === "critical").length;
+    const unknown = dependency.advisories.filter((item) => !["low", "moderate", "medium", "high", "critical"].includes(item.severity.toLowerCase()));
+    dependencySecurity = unknown.length ? { ...incomplete([`${unknown.length} advisories have unknown severity`], dependency.tool, dependency.version, dependency.packagesScanned), findings: dependency.advisories } : {
+      status: high2 > policy.dependencySecurity.maximumHigh || critical2 > policy.dependencySecurity.maximumCritical ? "fail" : "pass",
+      issues: [
+        ...high2 > policy.dependencySecurity.maximumHigh ? [`${high2} high advisories exceed ${policy.dependencySecurity.maximumHigh}`] : [],
+        ...critical2 > policy.dependencySecurity.maximumCritical ? [`${critical2} critical advisories exceed ${policy.dependencySecurity.maximumCritical}`] : []
+      ],
+      tool: dependency.tool,
+      version: dependency.version,
+      scanned: dependency.packagesScanned,
+      findings: dependency.advisories
+    };
+  }
+  const quality = app.codeQuality;
+  const qualityMissing = [
+    ...!quality.lint.complete || quality.lint.filesScanned === 0 ? ["ESLint did not scan source files", ...quality.lint.errorsDetail] : [],
+    ...policy.codeQuality.requireTypecheck && !quality.typecheck.complete ? ["TypeScript typecheck did not complete", ...quality.typecheck.errors] : [],
+    ...policy.codeQuality.requireTests && (!quality.tests.complete || quality.tests.passed + quality.tests.failed === 0) ? ["Tests did not run", ...quality.tests.errors] : [],
+    ...!quality.coverage.complete ? ["Line coverage is unavailable", ...quality.coverage.errors] : []
+  ];
+  const qualityFailures = [
+    ...quality.lint.errorCount > policy.codeQuality.maximumLintErrors ? [`${quality.lint.errorCount} ESLint errors exceed ${policy.codeQuality.maximumLintErrors}`] : [],
+    ...policy.codeQuality.requireTypecheck && !quality.typecheck.passed ? ["TypeScript typecheck failed"] : [],
+    ...quality.tests.failed > 0 ? [`${quality.tests.failed} tests failed`] : [],
+    ...quality.coverage.linesPercent < policy.codeQuality.minimumLineCoverage ? [`Line coverage ${quality.coverage.linesPercent}% is below ${policy.codeQuality.minimumLineCoverage}%`] : []
+  ];
+  const qualityVersion = `ESLint ${quality.lint.version} \xB7 TypeScript ${quality.typecheck.version} \xB7 Vitest ${quality.tests.version}`;
+  const qualityMetrics = {
+    lintErrors: quality.lint.errorCount,
+    lintWarnings: quality.lint.warnings,
+    typecheck: quality.typecheck.applicable === false ? "not applicable" : quality.typecheck.passed ? "pass" : "fail",
+    testsPassed: quality.tests.passed,
+    testsFailed: quality.tests.failed,
+    lineCoveragePercent: quality.coverage.linesPercent
+  };
+  const codeQuality = qualityMissing.length ? { ...incomplete([...qualityMissing, ...qualityFailures], "ESLint / TypeScript / tests", qualityVersion, quality.lint.filesScanned), metrics: qualityMetrics } : {
+    status: qualityFailures.length ? "fail" : "pass",
+    issues: qualityFailures,
+    tool: "ESLint / TypeScript / tests",
+    version: qualityVersion,
+    scanned: quality.lint.filesScanned,
+    metrics: qualityMetrics
+  };
+  const security = app.codeSecurity;
+  const securityMissing = [
+    ...!security.sast.complete || security.sast.filesScanned === 0 ? ["SAST did not scan source files", ...security.sast.errors] : [],
+    ...!security.secrets.complete || security.secrets.filesScanned === 0 ? ["Secret scanner did not scan source files", ...security.secrets.errors] : []
+  ];
+  const high = security.sast.findings.filter((item) => item.severity.toLowerCase() === "high").length;
+  const critical = security.sast.findings.filter((item) => item.severity.toLowerCase() === "critical").length;
+  const unknownSecurity = security.sast.findings.filter((item) => !["low", "moderate", "medium", "high", "critical"].includes(item.severity.toLowerCase()));
+  if (unknownSecurity.length) securityMissing.push(`${unknownSecurity.length} SAST findings have unknown severity`);
+  const securityFailures = [
+    ...high > policy.codeSecurity.maximumHigh ? [`${high} high SAST findings exceed ${policy.codeSecurity.maximumHigh}`] : [],
+    ...critical > policy.codeSecurity.maximumCritical ? [`${critical} critical SAST findings exceed ${policy.codeSecurity.maximumCritical}`] : [],
+    ...security.secrets.findings.length > policy.codeSecurity.maximumSecrets ? [`${security.secrets.findings.length} detected secrets exceed ${policy.codeSecurity.maximumSecrets}`] : []
+  ];
+  const securityVersion = `Semgrep ${security.sast.version} \xB7 Gitleaks ${security.secrets.version}`;
+  const codeSecurity = securityMissing.length ? { ...incomplete([...securityMissing, ...securityFailures], "Semgrep / Gitleaks", securityVersion, security.sast.filesScanned), findings: [...security.sast.findings, ...security.secrets.findings] } : {
+    status: securityFailures.length ? "fail" : "pass",
+    issues: securityFailures,
+    tool: "Semgrep / Gitleaks",
+    version: securityVersion,
+    scanned: security.sast.filesScanned,
+    findings: [...security.sast.findings, ...security.secrets.findings]
+  };
+  const compatibility2 = app.compatibility;
+  const projectNames = new Set(compatibility2.projects.map((project) => project.name));
+  const missingProjects = policy.compatibility.requiredProjects.filter((name) => !projectNames.has(name));
+  const incompleteProjects = compatibility2.projects.filter((project) => project.passed + project.failed < policy.compatibility.minimumTestsPerProject);
+  const missingBrowserVersions = compatibility2.projects.filter((project) => !project.browserVersion);
+  const expectedEngines = {
+    "chromium-desktop": "chromium",
+    "firefox-desktop": "firefox",
+    "webkit-desktop": "webkit",
+    "android-chrome": "chromium",
+    "iphone-safari": "webkit"
+  };
+  const invalidEngines = compatibility2.projects.filter((project) => expectedEngines[project.name] && project.engine !== expectedEngines[project.name]);
+  const invalidDevices = compatibility2.projects.filter((project) => (project.name === "android-chrome" || project.name === "iphone-safari") && (project.mobile !== true || !project.device));
+  const missingViewports = compatibility2.projects.filter((project) => new Set(project.viewportWidths ?? []).size < 2);
+  const compatibilityMissing = [
+    ...!compatibility2.complete ? ["Compatibility test run did not complete", ...compatibility2.errors] : [],
+    ...missingProjects.length ? [`Missing Playwright projects: ${missingProjects.join(", ")}`] : [],
+    ...incompleteProjects.map((project) => `${project.name} ran fewer than ${policy.compatibility.minimumTestsPerProject} tests`),
+    ...missingBrowserVersions.map((project) => `${project.name} did not record its browser engine version`),
+    ...invalidEngines.map((project) => `${project.name} used ${project.engine ?? "an unverified engine"} instead of ${expectedEngines[project.name]}`),
+    ...invalidDevices.map((project) => `${project.name} did not verify mobile emulation settings`),
+    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`)
+  ];
+  const failedProjects = compatibility2.projects.filter((project) => project.failed > 0);
+  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`)], compatibility2.tool, compatibility2.version), matrix: compatibility2.projects } : {
+    status: failedProjects.length ? "fail" : "pass",
+    issues: failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`),
+    tool: compatibility2.tool,
+    version: compatibility2.version,
+    scanned: compatibility2.projects.reduce((count, project) => count + project.passed + project.failed, 0),
+    matrix: compatibility2.projects
+  };
+  return { dependencySecurity, codeQuality, codeSecurity, compatibility: compatibilityDomain };
+}
+
+// src/governance/policy.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile9 } from "fs/promises";
+import { resolve as resolve8 } from "path";
 import { valid as valid2 } from "semver";
 var exactVersion = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var minimumVersion = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
@@ -1502,12 +1775,55 @@ function parseAssessmentPolicy(value) {
   for (const id of architecture.blockedRuleIds) {
     if (!known.has(id)) throw new Error(`Unknown blocked rule ID ${id}`);
   }
+  let evidence;
+  if (value.evidence !== void 0) {
+    if (!record3(value.evidence)) throw new Error("assessment.evidence must be an object");
+    const gates = value.evidence;
+    const nonnegative2 = (source, key, label) => {
+      const result = source[key];
+      if (!Number.isSafeInteger(result) || result < 0) throw new Error(`${label}.${key} must be a nonnegative integer`);
+      return result;
+    };
+    if (!Number.isFinite(gates.maximumAgeHours) || gates.maximumAgeHours <= 0 || gates.maximumAgeHours > 168) {
+      throw new Error("assessment.evidence.maximumAgeHours must be greater than 0 and at most 168");
+    }
+    for (const domain of ["dependencySecurity", "codeQuality", "codeSecurity", "compatibility"]) {
+      if (!record3(gates[domain])) throw new Error(`assessment.evidence.${domain} is required`);
+    }
+    const dependencySecurity = gates.dependencySecurity;
+    const codeQuality = gates.codeQuality;
+    const codeSecurity = gates.codeSecurity;
+    const compatibility2 = gates.compatibility;
+    const minimumLineCoverage = codeQuality.minimumLineCoverage;
+    if (typeof minimumLineCoverage !== "number" || !Number.isFinite(minimumLineCoverage) || minimumLineCoverage < 0 || minimumLineCoverage > 100) {
+      throw new Error("assessment.evidence.codeQuality.minimumLineCoverage must be 0\u2013100");
+    }
+    if (typeof codeQuality.requireTypecheck !== "boolean" || typeof codeQuality.requireTests !== "boolean") {
+      throw new Error("assessment.evidence.codeQuality requires boolean requireTypecheck and requireTests");
+    }
+    const projects = compatibility2.requiredProjects;
+    if (!Array.isArray(projects) || projects.length === 0 || !projects.every((item) => typeof item === "string" && item.length > 0) || new Set(projects).size !== projects.length) {
+      throw new Error("assessment.evidence.compatibility.requiredProjects must be a unique nonempty string array");
+    }
+    evidence = {
+      maximumAgeHours: gates.maximumAgeHours,
+      dependencySecurity: { maximumHigh: nonnegative2(dependencySecurity, "maximumHigh", "assessment.evidence.dependencySecurity"), maximumCritical: nonnegative2(dependencySecurity, "maximumCritical", "assessment.evidence.dependencySecurity") },
+      codeQuality: {
+        maximumLintErrors: nonnegative2(codeQuality, "maximumLintErrors", "assessment.evidence.codeQuality"),
+        minimumLineCoverage,
+        requireTypecheck: codeQuality.requireTypecheck,
+        requireTests: codeQuality.requireTests
+      },
+      codeSecurity: { maximumHigh: nonnegative2(codeSecurity, "maximumHigh", "assessment.evidence.codeSecurity"), maximumCritical: nonnegative2(codeSecurity, "maximumCritical", "assessment.evidence.codeSecurity"), maximumSecrets: nonnegative2(codeSecurity, "maximumSecrets", "assessment.evidence.codeSecurity") },
+      compatibility: { requiredProjects: projects, minimumTestsPerProject: nonnegative2(compatibility2, "minimumTestsPerProject", "assessment.evidence.compatibility") }
+    };
+  }
   return { architecture: {
     minimumScore: architecture.minimumScore,
     maximumErrors: architecture.maximumErrors,
     blockedRuleIds: architecture.blockedRuleIds,
     analysis
-  } };
+  }, ...evidence ? { evidence } : {} };
 }
 function parsePolicy(raw, source) {
   let parsed;
@@ -1531,11 +1847,11 @@ function parsePolicy(raw, source) {
       throw new Error(`Policy profile ${name} must list packages`);
     }
     const versions = {};
-    for (const [packageName, version] of Object.entries(rules)) {
-      if (typeof version !== "string" || !minimumVersion.test(version) || valid2(version.slice(2)) === null) {
+    for (const [packageName, version2] of Object.entries(rules)) {
+      if (typeof version2 !== "string" || !minimumVersion.test(version2) || valid2(version2.slice(2)) === null) {
         throw new Error(`Policy minimum version (>=X.Y.Z) required for ${packageName} in ${name}`);
       }
-      versions[packageName] = version;
+      versions[packageName] = version2;
     }
     profiles3[name] = versions;
   }
@@ -1545,7 +1861,7 @@ function parsePolicy(raw, source) {
     profiles: profiles3,
     ...parsed.assessment === void 0 ? {} : { assessment: parseAssessmentPolicy(parsed.assessment) },
     source,
-    sha256: createHash2("sha256").update(raw).digest("hex")
+    sha256: createHash3("sha256").update(raw).digest("hex")
   };
 }
 async function loadPolicy(source) {
@@ -1562,7 +1878,7 @@ async function loadPolicy(source) {
     }
     return parsePolicy(await response.text(), source);
   }
-  return parsePolicy(await readFile8(resolve7(source), "utf8"), source);
+  return parsePolicy(await readFile9(resolve8(source), "utf8"), source);
 }
 
 // src/governance/assess.ts
@@ -1585,27 +1901,50 @@ function escapeHtml2(value) {
   return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
 function renderAssessmentHtml(report) {
+  const labels = {
+    inventory: "App inventory",
+    dependencies: "Dependency policy",
+    architecture: "Architecture",
+    dependencySecurity: "Dependency security",
+    codeQuality: "Code quality",
+    codeSecurity: "Code security",
+    compatibility: "Browser compatibility"
+  };
+  const domainNames = report.apps.length ? Object.keys(report.apps[0].domains) : [];
+  const overview = domainNames.map((name) => {
+    const statuses = report.apps.map((app) => app.domains[name]?.status ?? "incomplete");
+    const status = statusOf(statuses);
+    const passed = statuses.filter((item) => item === "pass").length;
+    return `<li><span>${escapeHtml2(labels[name] ?? name)}</span><strong class="${status}">${escapeHtml2(status)}</strong><small>${passed}/${report.apps.length} apps passed</small></li>`;
+  }).join("");
   const apps = report.apps.map((app) => {
-    const domains = Object.entries(app.domains).map(([name, domain]) => `<tr><th scope="row">${escapeHtml2(name)}</th><td class="${domain.status}">${escapeHtml2(domain.status)}</td><td>${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml2(issue)}</li>`).join("")}</ul>` : "No issues"}</td></tr>`).join("");
+    const domains = Object.entries(app.domains).map(([name, domain]) => {
+      const evidence = domain;
+      const identity = evidence.tool ? `<p><small>${escapeHtml2(evidence.tool)} ${escapeHtml2(evidence.version ?? "")} \xB7 scanned ${escapeHtml2(evidence.scanned ?? "unknown")}</small></p>` : "";
+      const metrics = evidence.metrics ? `<p><small>${Object.entries(evidence.metrics).map(([key, value]) => `${escapeHtml2(key)}: ${escapeHtml2(value)}`).join(" \xB7 ")}</small></p>` : "";
+      const findings3 = evidence.findings?.length ? `<details><summary>${evidence.findings.length} finding(s)</summary><ul>${evidence.findings.map((item) => `<li><strong>${escapeHtml2(item.severity)}</strong> ${escapeHtml2(item.id)} \xB7 <code>${escapeHtml2(item.subject)}</code> \u2014 ${escapeHtml2(item.message)}${item.remediation ? ` \xB7 ${escapeHtml2(item.remediation)}` : ""}</li>`).join("")}</ul></details>` : "";
+      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Browser / device</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml2(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml2([item.browserVersion, item.device].filter(Boolean).join(" \xB7 ") || "Not recorded")}</td><td>${escapeHtml2(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table></div>` : "";
+      return `<tr><th scope="row">${escapeHtml2(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml2(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml2(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}</td></tr>`;
+    }).join("");
     const architecture = app.domains.architecture;
     const categoryRows = architecture.scoreBreakdown?.categories.map((category) => `<tr><th scope="row">${escapeHtml2(category.id)}</th><td>${escapeHtml2(category.weight)}%</td><td>${escapeHtml2(category.score)}</td><td>${escapeHtml2(category.findingCount)}</td></tr>`).join("") ?? "";
-    const findings = architecture.findings.map((finding) => `<tr><td>${escapeHtml2(finding.severity)}</td><td>${escapeHtml2(finding.ruleId)}</td><td><code>${escapeHtml2(finding.file)}:${finding.line}</code></td><td>${escapeHtml2(finding.evidence)}</td></tr>`).join("");
-    return `<section class="app"><h2>${escapeHtml2(app.path)} <span class="${app.status}">${escapeHtml2(app.status)}</span></h2><p>Profile: ${escapeHtml2(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings}</tbody></table></div></details>` : ""}</section>`;
+    const findings2 = architecture.findings.map((finding) => `<tr><td>${escapeHtml2(finding.severity)}</td><td>${escapeHtml2(finding.ruleId)}</td><td><code>${escapeHtml2(finding.file)}:${finding.line}</code></td><td>${escapeHtml2(finding.evidence)}</td></tr>`).join("");
+    return `<section class="app"><h2>${escapeHtml2(app.path)} <span class="${app.status}">${escapeHtml2(app.status)}</span></h2><p>Profile: ${escapeHtml2(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings2 ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings2}</tbody></table></div></details>` : ""}</section>`;
   }).join("");
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>NKLattice governance assessment</title><style>
-  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f6f7f5;color:#1b2925}body{max-width:1100px;margin:auto;padding:2rem 1rem}header,.app,.meta{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:9rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}
-  </style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml2(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s)</p></header><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml2(report.policy.version)} \xB7 <code>${escapeHtml2(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml2(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml2(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml2(report.inventory.source)}</code></p>${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml2(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml2).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml2).join(", ")}.</p></section></body></html>
+  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f3f6f4;color:#1b2925}body{max-width:1160px;margin:auto;padding:2rem 1rem}header,.app,.meta,.overview{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}header{background:#13231d;color:#f5f8f4;padding:2rem}header small{color:#9de2bc;font-weight:700;letter-spacing:.12em}header p{color:#c8d6ce}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}header .pass{color:#9de2bc}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:12rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}.domain-overview{list-style:none;display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:.65rem;padding:0;margin:1rem 0 0}.domain-overview li{border:1px solid #d9e1dc;background:#f8faf8;border-radius:8px;padding:.9rem;display:grid;grid-template-columns:1fr auto;gap:.35rem}.domain-overview li small{grid-column:1/-1}.domain-overview li+li{margin:0}
+  @media(max-width:800px){.domain-overview{grid-template-columns:repeat(2,minmax(0,1fr))}}@media(max-width:480px){.domain-overview{grid-template-columns:1fr}}</style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml2(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s) \xB7 policy ${escapeHtml2(report.policy.version)}</p></header><section class="overview"><h2>Assessment by domain</h2><p>Each status is based on the checked apps and fresh scanner evidence. Open an app below for findings and browser versions.</p><ul class="domain-overview">${overview}</ul></section><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml2(report.policy.version)} \xB7 <code>${escapeHtml2(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml2(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml2(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml2(basename2(report.inventory.source))}</code></p>${report.evidence ? `<p>Scanners: ${escapeHtml2(report.evidence.generatedAt)} \xB7 commit <code>${escapeHtml2(report.evidence.commit)}</code> \xB7 input <code>${escapeHtml2(report.evidence.inputSha256)}</code></p>` : "<p>Scanner evidence unavailable.</p>"}${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml2(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml2).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml2).join(", ")}.</p></section></body></html>
 `;
 }
 async function assessGovernance(options) {
-  const scanRoot = resolve8(options.scanRoot);
-  const workspaceRoot = resolve8(options.workspaceRoot ?? scanRoot);
-  const scanRelative = relative6(workspaceRoot, scanRoot);
-  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  const scanRoot = resolve9(options.scanRoot);
+  const workspaceRoot = resolve9(options.workspaceRoot ?? scanRoot);
+  const scanRelative = relative7(workspaceRoot, scanRoot);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep6}`)) throw new Error("Scan root must be inside workspace root");
   if (!options.policy.assessment) throw new Error("Policy assessment.architecture is required");
   const assessment = parseAssessmentPolicy(options.policy.assessment);
-  const outputDirectory = resolve8(options.outputDirectory ?? join9(scanRoot, ".nklattice-governance"));
-  const inventorySource = resolve8(options.inventory ?? join9(scanRoot, ".nklattice-apps.json"));
+  const outputDirectory = resolve9(options.outputDirectory ?? join10(scanRoot, ".nklattice-governance"));
+  const inventorySource = resolve9(options.inventory ?? join10(scanRoot, ".nklattice-apps.json"));
   let inventory;
   const issues = [];
   try {
@@ -1624,9 +1963,22 @@ async function assessGovernance(options) {
   if (options.expectedApps !== void 0 && apps.length !== options.expectedApps) {
     issues.push(`Expected ${options.expectedApps} managed apps; discovered ${apps.length}`);
   }
+  let evidence;
+  if (assessment.evidence) {
+    if (!options.evidence && !options.trustedEvidence) issues.push("Scan evidence is required by the policy; run governance collect and pass --evidence");
+    else try {
+      evidence = options.trustedEvidence ? await validateScanEvidence(options.trustedEvidence, scanRoot, workspaceRoot, options.policy.sha256, assessment.evidence.maximumAgeHours) : await loadScanEvidence(options.evidence, scanRoot, workspaceRoot, options.policy.sha256, assessment.evidence.maximumAgeHours);
+    } catch (error) {
+      issues.push(`Scan evidence: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (evidence) {
+      const discovered = new Set(apps.map((app) => relative7(scanRoot, app.directory).replaceAll("\\", "/") || "."));
+      for (const item of evidence.apps) if (!discovered.has(item.path)) issues.push(`Scan evidence contains unrecognized app ${item.path}`);
+    }
+  }
   const results = [];
   for (const app of apps) {
-    const appPath = relative6(scanRoot, app.directory).replaceAll("\\", "/") || ".";
+    const appPath = relative7(scanRoot, app.directory).replaceAll("\\", "/") || ".";
     const inventoryIssues = issues.filter((issue) => issue.includes(appPath) || issue.startsWith("Inventory:") || issue.startsWith("Discovery:"));
     const inventoryDomain = { status: inventoryIssues.length ? "incomplete" : "pass", issues: inventoryIssues };
     const dependencyDomain = { status: "pass", issues: [], findings: [] };
@@ -1679,7 +2031,8 @@ async function assessGovernance(options) {
       architectureDomain.status = "incomplete";
       architectureDomain.issues.push(error instanceof Error ? error.message : String(error));
     }
-    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain };
+    const extra = assessment.evidence ? evaluateAppEvidence(evidence?.apps.find((item) => item.path === appPath && item.profile === app.profile), assessment.evidence) : {};
+    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain, ...extra };
     results.push({ path: appPath, profile: app.profile, status: statusOf(Object.values(domains).map((domain) => domain.status)), domains });
   }
   const report = {
@@ -1687,21 +2040,531 @@ async function assessGovernance(options) {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     status: issues.length ? "incomplete" : statusOf(results.map((app) => app.status)),
     policy: { version: options.policy.policyVersion, source: options.policy.source, sha256: options.policy.sha256 },
+    ...evidence ? { evidence: { source: options.evidence ? resolve9(options.evidence) : "in-process collector", generatedAt: evidence.generatedAt, commit: evidence.commit, inputSha256: evidence.inputSha256 } } : {},
     inventory: { source: inventorySource, sha256: inventory?.sha256, expectedApps: inventory?.apps.length ?? 0, discoveredApps: apps.length },
-    scope: { domains: ["explicit app inventory", "dependency minimums", "source architecture"], notEvaluated },
+    scope: {
+      domains: ["explicit app inventory", "dependency minimums", "source architecture", ...assessment.evidence ? ["known dependency advisories", "source quality", "source security", "browser and mobile emulation"] : []],
+      notEvaluated: assessment.evidence ? ["licenses", "physical Android/iOS devices", "runtime performance", "cryptographic evidence attestation", "branch protection", "repository access controls", "cross-repository rollout status"] : notEvaluated
+    },
     issues,
     apps: results
   };
   await mkdir3(outputDirectory, { recursive: true });
-  await writeFile2(join9(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
+  await writeFile2(join10(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
 `);
-  await writeFile2(join9(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  await writeFile2(join10(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  return report;
+}
+
+// src/governance/collect.ts
+import { execFile as execFile2 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { mkdtemp, mkdir as mkdir4, readFile as readFile10, rm, writeFile as writeFile3 } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname4, join as join11, relative as relative8, resolve as resolve10, sep as sep7 } from "path";
+import { promisify as promisify2 } from "util";
+import fg2 from "fast-glob";
+import YAML2 from "yaml";
+var execFileAsync2 = promisify2(execFile2);
+var cap = 16 * 1024 * 1024;
+async function run(file, args, cwd, env) {
+  try {
+    const result = await execFileAsync2(file, args, { cwd, env, timeout: 3e5, maxBuffer: cap });
+    return { code: 0, stdout: result.stdout, stderr: result.stderr };
+  } catch (error) {
+    const failure = error;
+    return {
+      code: typeof failure.code === "number" ? failure.code : -1,
+      stdout: failure.stdout ?? "",
+      stderr: failure.stderr ?? "",
+      ...typeof failure.code === "number" ? {} : { error: failure.killed ? "Scanner timed out" : failure.message }
+    };
+  }
+}
+function inside(parent, child) {
+  const path = relative8(parent, child);
+  return path === "" || path !== ".." && !path.startsWith(`..${sep7}`);
+}
+async function binary(name, app, workspaceRoot) {
+  let directory = app;
+  while (inside(workspaceRoot, directory)) {
+    const candidate = join11(directory, "node_modules", ".bin", name);
+    try {
+      await readFile10(candidate);
+      return candidate;
+    } catch {
+    }
+    if (directory === workspaceRoot) break;
+    directory = dirname4(directory);
+  }
+  return name;
+}
+async function version(file, cwd) {
+  const result = await run(file, ["--version"], cwd);
+  if (result.code !== 0) return "unavailable";
+  const reported = result.stdout.trim().slice(0, 120) || "unknown";
+  if (file === "gitleaks" && reported.includes("version is set by build process")) {
+    const located = await run("which", [file], cwd);
+    if (located.code === 0) {
+      const build = await run("go", ["version", "-m", located.stdout.trim()], cwd);
+      const match = build.stdout.match(/^\s*mod\s+\S+\/gitleaks\/v8\s+(v\d+\.\d+\.\d+)/m);
+      if (match) return match[1];
+    }
+  }
+  return reported;
+}
+function json(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function obj(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function num(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+async function sourcePaths(app) {
+  return fg2("**/*.{js,jsx,ts,tsx,mjs,cjs,mts,cts}", {
+    cwd: app,
+    dot: true,
+    onlyFiles: true,
+    followSymbolicLinks: false,
+    ignore: ["**/node_modules/**", "**/dist/**", "**/.next/**", "**/build/**", "**/coverage/**", "**/*.d.ts"]
+  });
+}
+async function sourceCount(app) {
+  return (await sourcePaths(app)).length;
+}
+async function productionSources(app) {
+  return (await sourcePaths(app)).filter((path) => !/(^|\/)(e2e|tests?|__tests__|fixtures)\//.test(path) && !/\.(test|spec|config)\.[cm]?[jt]sx?$/.test(path));
+}
+async function dependencyAudit(app, workspaceRoot, cache) {
+  const failure = (errors2, tool = "npm/pnpm audit") => ({ tool, version: "unavailable", complete: false, packagesScanned: 0, advisories: [], errors: errors2 });
+  let lock;
+  try {
+    lock = await findLockfile(app.directory, workspaceRoot);
+  } catch (error) {
+    return failure([error instanceof Error ? error.message : String(error)]);
+  }
+  const cached = cache.get(lock.path);
+  if (cached) return cached;
+  const raw = await readFile10(lock.path, "utf8");
+  const parsedLock = lock.kind === "npm" ? json(raw) : YAML2.parse(raw);
+  const packages = obj(parsedLock) && obj(parsedLock.packages) ? Object.keys(parsedLock.packages).filter((key) => key !== "").length : 0;
+  const executable = lock.kind === "npm" ? "npm" : "pnpm";
+  const toolVersion = await version(executable, lock.root);
+  const result = await run(executable, ["audit", "--json"], lock.root);
+  const report = json(result.stdout);
+  if (!obj(report)) {
+    const evidence2 = { ...failure([result.error ?? "Audit JSON output is unavailable"], `${executable} audit`), version: toolVersion, packagesScanned: packages };
+    cache.set(lock.path, evidence2);
+    return evidence2;
+  }
+  const auditMetadata = obj(report.metadata) ? report.metadata : void 0;
+  const auditedPackages = lock.kind === "npm" && auditMetadata && obj(auditMetadata.dependencies) ? num(auditMetadata.dependencies.total) : lock.kind === "pnpm" && auditMetadata ? num(auditMetadata.totalDependencies) : 0;
+  const supportedShape = lock.kind === "npm" ? report.auditReportVersion === 2 && obj(report.vulnerabilities) : obj(report.advisories);
+  if (!supportedShape || packages === 0 || auditedPackages < packages || result.error || result.code > 1) {
+    const evidence2 = { ...failure([result.error ?? "Audit output was unavailable or lockfile package inventory was empty"], `${executable} audit`), version: toolVersion, packagesScanned: packages };
+    evidence2.errors = [result.error ?? `Audit schema or package coverage is incomplete (${auditedPackages}/${packages})`];
+    cache.set(lock.path, evidence2);
+    return evidence2;
+  }
+  const advisories = [];
+  if (lock.kind === "npm" && obj(report.vulnerabilities)) {
+    for (const [name, value] of Object.entries(report.vulnerabilities)) {
+      if (!obj(value)) continue;
+      const via = Array.isArray(value.via) ? value.via.find(obj) : void 0;
+      advisories.push({
+        id: obj(via) ? str(via.url) || str(via.title) || `npm:${name}` : `npm:${name}`,
+        severity: str(value.severity) || "unknown",
+        subject: name,
+        message: "Known advisory affects a dependency",
+        remediation: "Upgrade the affected package or apply a reviewed exception"
+      });
+    }
+  } else if (lock.kind === "pnpm" && obj(report.advisories)) {
+    for (const [key, value] of Object.entries(report.advisories)) {
+      if (!obj(value)) continue;
+      advisories.push({
+        id: str(value.url) || str(value.id) || key,
+        severity: str(value.severity) || "unknown",
+        subject: str(value.module_name) || "workspace dependency",
+        message: "Known advisory affects a workspace dependency",
+        remediation: "Upgrade the affected package or apply a reviewed exception"
+      });
+    }
+  } else if (result.code !== 0) {
+    const evidence2 = { tool: `${executable} audit`, version: toolVersion, complete: false, packagesScanned: packages, advisories: [], errors: ["Audit returned an unsupported JSON shape"] };
+    cache.set(lock.path, evidence2);
+    return evidence2;
+  }
+  const registryErrors = [report.error, report.errors].filter(Boolean);
+  const evidence = {
+    tool: `${executable} audit${lock.root !== app.directory ? " (workspace-wide)" : ""}`,
+    version: toolVersion,
+    complete: registryErrors.length === 0,
+    packagesScanned: packages,
+    advisories,
+    errors: registryErrors.length ? ["Advisory service returned an error"] : []
+  };
+  cache.set(lock.path, evidence);
+  return evidence;
+}
+async function lint(app, workspaceRoot) {
+  const file = await binary("eslint", app.directory, workspaceRoot);
+  const toolVersion = await version(file, app.directory);
+  const result = await run(file, [".", "--format", "json"], app.directory);
+  const parsed = json(result.stdout);
+  if (!Array.isArray(parsed) || result.error || !parsed.every(obj)) {
+    return {
+      tool: "ESLint",
+      version: toolVersion,
+      complete: false,
+      filesScanned: 0,
+      errorCount: 0,
+      warnings: 0,
+      errorsDetail: [result.error ?? "ESLint JSON output is unavailable; install and configure ESLint"]
+    };
+  }
+  const files = parsed;
+  if (!files.every((item) => str(item.filePath) && Number.isSafeInteger(item.errorCount) && Number.isSafeInteger(item.warningCount))) {
+    return {
+      tool: "ESLint",
+      version: toolVersion,
+      complete: false,
+      filesScanned: 0,
+      errorCount: 0,
+      warnings: 0,
+      errorsDetail: ["ESLint JSON result did not contain reliable file paths or diagnostic counts"]
+    };
+  }
+  const expected = await sourcePaths(app.directory);
+  const analyzed = new Set(files.map((item) => str(item.filePath).replaceAll("\\", "/")));
+  const missing = expected.filter((path) => ![...analyzed].some((file2) => file2.endsWith(`/${path}`) || file2 === path));
+  return {
+    tool: "ESLint",
+    version: toolVersion,
+    complete: missing.length === 0,
+    filesScanned: expected.length - missing.length,
+    errorCount: files.reduce((sum, file2) => sum + num(file2.errorCount), 0),
+    warnings: files.reduce((sum, file2) => sum + num(file2.warningCount), 0),
+    errorsDetail: missing.length ? [`ESLint skipped ${missing.length} eligible source files`] : []
+  };
+}
+async function typecheck(app, workspaceRoot) {
+  const production = await productionSources(app.directory);
+  const applicable = production.some((path) => /\.(ts|tsx|mts|cts)$/.test(path));
+  const file = await binary("tsc", app.directory, workspaceRoot);
+  const toolVersion = await version(file, app.directory);
+  if (!applicable) return { tool: "TypeScript", version: toolVersion, applicable: false, complete: true, passed: true, errors: [] };
+  const config = await readFile10(join11(app.directory, "tsconfig.json"), "utf8").catch(() => "");
+  if (!config) return {
+    tool: "TypeScript",
+    version: toolVersion,
+    applicable: true,
+    complete: false,
+    passed: false,
+    errors: ["TypeScript source has no readable tsconfig.json"]
+  };
+  const result = await run(file, ["--project", app.directory, "--noEmit", "--pretty", "false"], app.directory);
+  return {
+    tool: "TypeScript",
+    version: toolVersion,
+    applicable: true,
+    complete: !result.error && toolVersion !== "unavailable",
+    passed: result.code === 0,
+    errors: result.error ? [result.error] : result.code === 0 ? [] : [result.stdout.trim().slice(0, 500) || "TypeScript typecheck failed"]
+  };
+}
+async function testAndCoverage(app, workspaceRoot, temp) {
+  const file = await binary("vitest", app.directory, workspaceRoot);
+  const toolVersion = await version(file, app.directory);
+  const resultPath = join11(temp, "vitest.json");
+  const coverageDirectory = join11(temp, "coverage");
+  const result = await run(file, [
+    "run",
+    "--reporter=json",
+    "--outputFile",
+    resultPath,
+    "--coverage",
+    "--coverage.reporter=json-summary",
+    "--coverage.reportsDirectory",
+    coverageDirectory
+  ], app.directory);
+  const output = await readFile10(resultPath, "utf8").catch(() => "");
+  const parsed = json(output);
+  const summary = json(await readFile10(join11(coverageDirectory, "coverage-summary.json"), "utf8").catch(() => ""));
+  const tests = obj(parsed) && typeof parsed.numPassedTests === "number" && typeof parsed.numFailedTests === "number";
+  const lineCoverage = obj(summary) && obj(summary.total) && obj(summary.total.lines) ? summary.total.lines.pct : void 0;
+  const expectedFiles = await productionSources(app.directory);
+  const coveredFiles = obj(summary) ? Object.keys(summary).filter((key) => key !== "total") : [];
+  const coveredPaths = new Set(coveredFiles.map((file2) => resolve10(app.directory, file2)));
+  const uncovered = expectedFiles.filter((path) => !coveredPaths.has(resolve10(app.directory, path)));
+  const coverage = typeof lineCoverage === "number" && expectedFiles.length > 0 && uncovered.length === 0;
+  const unhandled = obj(parsed) && Array.isArray(parsed.unhandledErrors) && parsed.unhandledErrors.length > 0;
+  const reporterFailedWithoutTests = tests && result.code !== 0 && num(parsed.numFailedTests) === 0;
+  return {
+    tests: {
+      tool: "Vitest",
+      version: toolVersion,
+      complete: tests && !result.error && !unhandled && !reporterFailedWithoutTests,
+      passed: tests ? num(parsed.numPassedTests) : 0,
+      failed: tests ? num(parsed.numFailedTests) : 0,
+      errors: tests && !unhandled && !reporterFailedWithoutTests ? [] : [result.error ?? "Vitest reporter recorded an unsuccessful run or unhandled error"]
+    },
+    coverage: {
+      tool: "Vitest coverage",
+      version: toolVersion,
+      complete: coverage,
+      linesPercent: coverage ? lineCoverage : 0,
+      errors: coverage ? [] : [uncovered.length ? `Coverage omitted ${uncovered.length} eligible source files` : "Vitest line coverage JSON summary is unavailable"]
+    }
+  };
+}
+async function sast(app, temp) {
+  const file = "semgrep";
+  const toolVersion = await version(file, app.directory);
+  const outputPath = join11(temp, "semgrep.json");
+  const result = await run(file, [
+    "scan",
+    "--config",
+    "p/ci",
+    "--no-git-ignore",
+    "--exclude",
+    "**/node_modules/**",
+    "--exclude",
+    "**/.next/**",
+    "--exclude",
+    "**/coverage/**",
+    "--exclude",
+    "**/dist/**",
+    "--json",
+    "--output",
+    outputPath,
+    app.directory
+  ], app.directory);
+  const parsed = json(await readFile10(outputPath, "utf8").catch(() => result.stdout));
+  const expectedSources = await sourcePaths(app.directory);
+  if (!obj(parsed) || !Array.isArray(parsed.results) || result.error) {
+    return {
+      tool: "Semgrep",
+      version: toolVersion,
+      complete: false,
+      filesScanned: 0,
+      findings: [],
+      errors: [result.error ?? "Semgrep JSON result is unavailable; install Semgrep and enable rule download"]
+    };
+  }
+  const findings2 = parsed.results.filter(obj).map((item) => {
+    const extra = obj(item.extra) ? item.extra : {};
+    const metadata = obj(extra.metadata) ? extra.metadata : {};
+    const impact = str(metadata.impact).toLowerCase();
+    const severity = impact === "high" || impact === "critical" ? impact : str(extra.severity).toLowerCase() === "error" ? "high" : "moderate";
+    return {
+      id: str(item.check_id) || "semgrep:unknown",
+      severity,
+      subject: `${relative8(app.directory, str(item.path) || app.directory)}:${obj(item.start) ? num(item.start.line) : 0}`,
+      message: "Static security rule matched; inspect the source location",
+      remediation: "Review and fix the matched rule"
+    };
+  });
+  const scannedPaths = obj(parsed.paths) && Array.isArray(parsed.paths.scanned) ? parsed.paths.scanned.filter((item) => typeof item === "string") : [];
+  const missing = expectedSources.filter((path) => !scannedPaths.some((scanned) => scanned.replaceAll("\\", "/").endsWith(`/${path}`) || scanned === path));
+  const scanErrors = [
+    ...Array.isArray(parsed.errors) && parsed.errors.length ? ["Semgrep reported scanner errors"] : [],
+    ...missing.length ? [`Semgrep skipped ${missing.length} eligible source files`] : []
+  ];
+  return { tool: "Semgrep", version: toolVersion, complete: scanErrors.length === 0, filesScanned: expectedSources.length - missing.length, findings: findings2, errors: scanErrors };
+}
+async function secrets(app, temp) {
+  const file = "gitleaks";
+  const toolVersion = await version(file, app.directory);
+  const outputPath = join11(temp, "gitleaks.json");
+  const configPath = join11(temp, "gitleaks.toml");
+  await writeFile3(configPath, '[extend]\nuseDefault = true\n\n[allowlist]\npaths = ["(^|/)(node_modules|\\\\.next|dist|build|coverage|test-results|playwright-report)/"]\n');
+  const result = await run(file, [
+    "dir",
+    app.directory,
+    "--config",
+    configPath,
+    "--report-format",
+    "json",
+    "--report-path",
+    outputPath,
+    "--redact",
+    "--no-banner"
+  ], app.directory);
+  const parsed = json(await readFile10(outputPath, "utf8").catch(() => ""));
+  const count = await sourceCount(app.directory);
+  if (!Array.isArray(parsed) || result.error) {
+    return {
+      tool: "Gitleaks",
+      version: toolVersion,
+      complete: false,
+      filesScanned: 0,
+      findings: [],
+      errors: [result.error ?? "Gitleaks JSON result is unavailable; install Gitleaks"]
+    };
+  }
+  const findings2 = parsed.filter(obj).map((item) => ({
+    id: str(item.RuleID) || "gitleaks:secret",
+    severity: "critical",
+    subject: `${str(item.File) ? relative8(app.directory, resolve10(app.directory, str(item.File))).replaceAll("\\", "/") : "source"}:${num(item.StartLine)}`,
+    message: `Potential secret detected (fingerprint ${createHash4("sha256").update(str(item.Fingerprint)).digest("hex").slice(0, 16)})`,
+    remediation: "Revoke the credential and remove it from source/history"
+  }));
+  return {
+    tool: "Gitleaks",
+    version: toolVersion,
+    complete: result.code === 0 || result.code === 1,
+    filesScanned: count,
+    findings: findings2,
+    errors: result.code > 1 ? ["Gitleaks scanner failed"] : []
+  };
+}
+function playwrightProjects(value) {
+  if (!obj(value) || !Array.isArray(value.suites)) return [];
+  const totals = /* @__PURE__ */ new Map();
+  const visit = (suite) => {
+    if (!obj(suite)) return;
+    for (const spec of Array.isArray(suite.specs) ? suite.specs : []) {
+      if (!obj(spec) || !Array.isArray(spec.tests)) continue;
+      for (const test of spec.tests) {
+        if (!obj(test) || !str(test.projectName)) continue;
+        const projectName = str(test.projectName);
+        const project = totals.get(projectName) ?? {
+          name: projectName,
+          passed: 0,
+          failed: 0,
+          skipped: 0,
+          viewportWidths: /* @__PURE__ */ new Set()
+        };
+        for (const annotation of Array.isArray(test.annotations) ? test.annotations : []) {
+          if (!obj(annotation)) continue;
+          if (annotation.type === "browser-version" && str(annotation.description)) project.browserVersion = str(annotation.description);
+          if (annotation.type === "viewport-width" && /^\d+$/.test(str(annotation.description))) project.viewportWidths.add(Number(annotation.description));
+        }
+        const status = str(test.status);
+        if (status === "expected") project.passed++;
+        else if (status === "skipped") project.skipped++;
+        else project.failed++;
+        totals.set(project.name, project);
+      }
+    }
+    for (const child of Array.isArray(suite.suites) ? suite.suites : []) visit(child);
+  };
+  for (const suite of value.suites) visit(suite);
+  return [...totals.values()].map((project) => ({ ...project, viewportWidths: [...project.viewportWidths].sort((a, b) => a - b) }));
+}
+async function compatibility(app, workspaceRoot, temp) {
+  const file = await binary("playwright", app.directory, workspaceRoot);
+  const toolVersion = await version(file, app.directory);
+  const outputPath = join11(temp, "playwright.json");
+  const configPath = join11(temp, "playwright-projects.json");
+  const reporterPath = join11(temp, "lattice-playwright-reporter.cjs");
+  await writeFile3(reporterPath, 'module.exports=class { onBegin(config) { require("node:fs").writeFileSync(process.env.LATTICE_PLAYWRIGHT_CONFIG_OUT, JSON.stringify(config.projects.map(p => ({ name: p.name, engine: p.use.browserName || p.use.defaultBrowserType, mobile: p.use.isMobile === true, touch: p.use.hasTouch === true, userAgent: p.use.userAgent || "" })))); } };\n');
+  const result = await run(
+    file,
+    ["test", `--reporter=json,${reporterPath}`],
+    app.directory,
+    { ...process.env, PLAYWRIGHT_JSON_OUTPUT_FILE: outputPath, LATTICE_PLAYWRIGHT_CONFIG_OUT: configPath }
+  );
+  const parsed = json(await readFile10(outputPath, "utf8").catch(() => result.stdout));
+  const projects = playwrightProjects(parsed);
+  const config = json(await readFile10(configPath, "utf8").catch(() => ""));
+  const configurations = Array.isArray(config) && config.every(obj) ? config : [];
+  for (const project of projects) {
+    const configured = configurations.find((item) => item.name === project.name);
+    if (!configured) continue;
+    project.engine = str(configured.engine);
+    project.mobile = configured.mobile === true && configured.touch === true;
+    const agent = str(configured.userAgent);
+    const android = agent.match(/Android\s+([\d.]+)/i);
+    const iphone = agent.match(/iPhone OS\s+([\d_]+)/i);
+    if (project.name === "android-chrome" && android && project.mobile) project.device = `Android ${android[1]} UA emulation`;
+    if (project.name === "iphone-safari" && iphone && project.mobile) project.device = `iOS ${iphone[1].replaceAll("_", ".")} UA emulation`;
+  }
+  const reportedErrors = obj(parsed) && Array.isArray(parsed.errors) ? parsed.errors : [];
+  const infrastructureFailure = reportedErrors.length > 0 || configurations.length === 0 || typeof result.stderr === "string" && /browser executable.*doesn't exist|failed to launch browser|install playwright browsers/i.test(result.stderr);
+  return {
+    tool: "Playwright",
+    version: toolVersion,
+    complete: Boolean(parsed) && !result.error && !infrastructureFailure && projects.length > 0,
+    projects,
+    errors: infrastructureFailure ? ["Playwright browser infrastructure or configuration failed"] : projects.length ? [] : [result.error ?? "Playwright JSON results are unavailable; configure required browser and mobile projects"]
+  };
+}
+async function collectGovernanceEvidence(options) {
+  const scanRoot = resolve10(options.scanRoot);
+  const workspaceRoot = resolve10(options.workspaceRoot ?? scanRoot);
+  const destination = resolve10(options.evidence);
+  if (!inside(workspaceRoot, scanRoot)) throw new Error("Scan root must be inside workspace root");
+  if (inside(scanRoot, destination)) throw new Error("Evidence file must be outside the scan root");
+  if (!options.policy.assessment?.evidence) throw new Error("Policy assessment.evidence is required for governance collect");
+  const inputSha256 = await hashAssessmentInputs(scanRoot, workspaceRoot);
+  const assertStableInputs = async (stage) => {
+    if (inputSha256 !== await hashAssessmentInputs(scanRoot, workspaceRoot)) {
+      throw new Error(`Assessment inputs changed ${stage}; rerun on a stable checkout`);
+    }
+  };
+  const git = await run("git", ["rev-parse", "HEAD"], workspaceRoot);
+  const commit = git.code === 0 && /^[0-9a-f]{40}$/.test(git.stdout.trim()) ? git.stdout.trim() : "unversioned";
+  const apps = await discoverApps(scanRoot, workspaceRoot);
+  const auditCache = /* @__PURE__ */ new Map();
+  const scans = [];
+  for (const app of apps) {
+    const temp = await mkdtemp(join11(tmpdir(), "lattice-scanners-"));
+    try {
+      const dependencySecurity = await dependencyAudit(app, workspaceRoot, auditCache);
+      await assertStableInputs("after dependency audit");
+      const qualityLint = await lint(app, workspaceRoot);
+      await assertStableInputs("after ESLint");
+      const qualityTypecheck = await typecheck(app, workspaceRoot);
+      await assertStableInputs("after TypeScript");
+      const qualityTests = await testAndCoverage(app, workspaceRoot, temp);
+      await assertStableInputs("after Vitest");
+      const securitySast = await sast(app, temp);
+      await assertStableInputs("after Semgrep");
+      const securitySecrets = await secrets(app, temp);
+      await assertStableInputs("after Gitleaks");
+      const compatibilityResult = await compatibility(app, workspaceRoot, temp);
+      await assertStableInputs("after Playwright");
+      scans.push({
+        path: relative8(scanRoot, app.directory).replaceAll("\\", "/") || ".",
+        profile: app.profile,
+        dependencySecurity,
+        codeQuality: { lint: qualityLint, typecheck: qualityTypecheck, ...qualityTests },
+        codeSecurity: { sast: securitySast, secrets: securitySecrets },
+        compatibility: compatibilityResult
+      });
+    } finally {
+      await rm(temp, { recursive: true, force: true });
+    }
+  }
+  await assertStableInputs("before evidence write");
+  const report = {
+    schemaVersion: 1,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    policySha256: options.policy.sha256,
+    inputSha256,
+    commit,
+    apps: scans
+  };
+  await mkdir4(dirname4(destination), { recursive: true });
+  await writeFile3(destination, `${JSON.stringify(report, null, 2)}
+`, { flag: "w" });
   return report;
 }
 
 // src/runtime.ts
-function isSupportedNodeVersion(version) {
-  const major = Number(version.split(".", 1)[0]);
+function isSupportedNodeVersion(version2) {
+  const major = Number(version2.split(".", 1)[0]);
   return Number.isInteger(major) && major >= 24;
 }
 
@@ -1722,12 +2585,12 @@ async function runCli(arguments_, output = defaultOutput) {
   program.configureOutput({ writeOut: output.out, writeErr: output.err });
   program.exitOverride();
   program.command("analyze [path]").description("Analyze local architecture and write offline reports").option("--output <directory>", "Output directory").action(async (path, flags) => {
-    const root = resolve9(path ?? ".");
-    const destination = resolve9(flags.output ?? join10(root, ".nklattice-report"));
+    const root = resolve11(path ?? ".");
+    const destination = resolve11(flags.output ?? join12(root, ".nklattice-report"));
     const report = await analyzeProject(root, { outputDirectory: destination });
     output.out(`NKLattice analyzed ${report.graph.modules.length} modules. Score ${report.score.score} (${report.score.grade}); ${report.findings.length} findings.
 `);
-    output.out(`Reports: ${join10(destination, "report.html")} and ${join10(destination, "analysis.json")}
+    output.out(`Reports: ${join12(destination, "report.html")} and ${join12(destination, "analysis.json")}
 `);
   });
   program.command("doctor [path]").description("Check whether a directory contains supported source files").action(async (path) => {
@@ -1737,8 +2600,8 @@ async function runCli(arguments_, output = defaultOutput) {
 `);
   });
   program.command("init [path]").description("Create a project configuration file").action(async (path) => {
-    const destination = join10(resolve9(path ?? "."), ".nklattice.json");
-    await writeFile3(destination, '{\n  "analysis": {},\n  "policies": []\n}\n', { flag: "wx" });
+    const destination = join12(resolve11(path ?? "."), ".nklattice.json");
+    await writeFile4(destination, '{\n  "analysis": {},\n  "policies": []\n}\n', { flag: "wx" });
     output.out(`Created ${destination}
 `);
   });
@@ -1750,7 +2613,7 @@ async function runCli(arguments_, output = defaultOutput) {
       expectedApps = Number(flags.expectApps);
       if (!Number.isSafeInteger(expectedApps)) throw new Error("--expect-apps must be a positive integer");
     }
-    const policyPath = flags.policy ?? resolve9(dirname3(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
     const policy = await loadPolicy(policyPath);
     const result = await checkGovernance({
       scanRoot: path ?? ".",
@@ -1776,21 +2639,22 @@ async function runCli(arguments_, output = defaultOutput) {
     }
     if (result.findings.length > 0) exitCode = 7;
   });
-  governance.command("assess [path]").description("Assess app inventory, dependencies, and source architecture").option("--policy <source>", "Local file or HTTPS policy URL").option("--inventory <path>", "Reviewed app inventory JSON").option("--workspace-root <path>", "Repository root containing a shared lockfile").option("--expect-apps <count>", "Additional expected managed application count").option("--output <directory>", "Assessment report directory").option("--json", "Print machine-readable assessment").action(async (path, flags) => {
+  governance.command("assess [path]").description("Assess app inventory, dependency, architecture, security, quality, and compatibility policy").option("--policy <source>", "Local file or HTTPS policy URL").option("--inventory <path>", "Reviewed app inventory JSON").option("--workspace-root <path>", "Repository root containing a shared lockfile").option("--expect-apps <count>", "Additional expected managed application count").option("--output <directory>", "Assessment report directory").option("--evidence <file>", "Fresh governance collect JSON outside the scan root").option("--json", "Print machine-readable assessment").action(async (path, flags) => {
     let expectedApps;
     if (flags.expectApps !== void 0) {
       if (!/^[1-9]\d*$/.test(flags.expectApps)) throw new Error("--expect-apps must be a positive integer");
       expectedApps = Number(flags.expectApps);
       if (!Number.isSafeInteger(expectedApps)) throw new Error("--expect-apps must be a positive integer");
     }
-    const scanRoot = resolve9(path ?? ".");
-    const policyPath = flags.policy ?? resolve9(dirname3(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const scanRoot = resolve11(path ?? ".");
+    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
     const report = await assessGovernance({
       scanRoot,
       workspaceRoot: flags.workspaceRoot,
       inventory: flags.inventory,
       expectedApps,
       outputDirectory: flags.output,
+      evidence: flags.evidence,
       policy: await loadPolicy(policyPath)
     });
     if (flags.json) output.out(`${JSON.stringify(report, null, 2)}
@@ -1801,12 +2665,58 @@ async function runCli(arguments_, output = defaultOutput) {
       for (const issue of report.issues) output.out(`Inventory: ${issue}
 `);
       for (const app of report.apps) {
-        output.out(`${app.path} (${app.profile}): ${app.status}; dependencies ${app.domains.dependencies.status}; architecture ${app.domains.architecture.status} (${app.domains.architecture.score ?? "unavailable"}).
+        output.out(`${app.path} (${app.profile}): ${app.status}; ${Object.entries(app.domains).map(([name, domain]) => `${name} ${domain.status}`).join("; ")}; architecture score ${app.domains.architecture.score ?? "unavailable"}.
+`);
+        for (const [name, domain] of Object.entries(app.domains)) for (const issue of domain.issues) output.out(`  ${name}: ${issue}
+`);
+      }
+      output.out(`Reports: ${resolve11(flags.output ?? join12(scanRoot, ".nklattice-governance"))}
+`);
+    }
+    exitCode = report.status === "pass" ? 0 : report.status === "fail" ? 7 : 3;
+  });
+  governance.command("collect [path]").description("Run project scanners and write fresh machine-readable evidence").requiredOption("--evidence <file>", "Evidence JSON outside the scan root").option("--policy <source>", "Local file or HTTPS policy URL").option("--workspace-root <path>", "Repository root containing a shared lockfile").action(async (path, flags) => {
+    const scanRoot = resolve11(path ?? ".");
+    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const result = await collectGovernanceEvidence({ scanRoot, workspaceRoot: flags.workspaceRoot, evidence: flags.evidence, policy: await loadPolicy(policyPath) });
+    output.out(`Collected scanner evidence for ${result.apps.length} app(s) at ${resolve11(flags.evidence)}.
+`);
+  });
+  governance.command("run [path]").description("Collect and assess all governance domains in one trusted process").requiredOption("--evidence <file>", "Evidence artifact outside the scan root").option("--policy <source>", "Local file or HTTPS policy URL").option("--inventory <path>", "Reviewed app inventory JSON").option("--workspace-root <path>", "Repository root containing a shared lockfile").option("--expect-apps <count>", "Additional expected managed application count").option("--output <directory>", "Assessment report directory").option("--json", "Print machine-readable assessment").action(async (path, flags) => {
+    let expectedApps;
+    if (flags.expectApps !== void 0) {
+      if (!/^[1-9]\d*$/.test(flags.expectApps)) throw new Error("--expect-apps must be a positive integer");
+      expectedApps = Number(flags.expectApps);
+      if (!Number.isSafeInteger(expectedApps)) throw new Error("--expect-apps must be a positive integer");
+    }
+    const scanRoot = resolve11(path ?? ".");
+    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const policy = await loadPolicy(policyPath);
+    const collected = await collectGovernanceEvidence({ scanRoot, workspaceRoot: flags.workspaceRoot, evidence: flags.evidence, policy });
+    const report = await assessGovernance({
+      scanRoot,
+      workspaceRoot: flags.workspaceRoot,
+      inventory: flags.inventory,
+      expectedApps,
+      outputDirectory: flags.output,
+      evidence: flags.evidence,
+      trustedEvidence: collected,
+      policy
+    });
+    if (flags.json) output.out(`${JSON.stringify(report, null, 2)}
+`);
+    else {
+      output.out(`Governance ${report.status}: ${report.apps.length} app(s); policy ${report.policy.version} (${report.policy.sha256}).
+`);
+      for (const issue of report.issues) output.out(`Assessment: ${issue}
+`);
+      for (const app of report.apps) {
+        output.out(`${app.path} (${app.profile}): ${app.status}; ${Object.entries(app.domains).map(([name, domain]) => `${name} ${domain.status}`).join("; ")}; architecture score ${app.domains.architecture.score ?? "unavailable"}.
 `);
         for (const [name, domain] of Object.entries(app.domains)) for (const issue of domain.issues) output.out(`  ${name}: ${issue}
 `);
       }
-      output.out(`Reports: ${resolve9(flags.output ?? join10(scanRoot, ".nklattice-governance"))}
+      output.out(`Reports: ${resolve11(flags.output ?? join12(scanRoot, ".nklattice-governance"))}
 `);
     }
     exitCode = report.status === "pass" ? 0 : report.status === "fail" ? 7 : 3;
@@ -1822,7 +2732,7 @@ async function runCli(arguments_, output = defaultOutput) {
   }
   return exitCode;
 }
-if (process.argv[1] && realpathSync(resolve9(process.argv[1])) === realpathSync(fileURLToPath(import.meta.url))) {
+if (process.argv[1] && realpathSync(resolve11(process.argv[1])) === realpathSync(fileURLToPath(import.meta.url))) {
   runCli(process.argv.slice(2)).then((code) => {
     process.exitCode = code;
   });