@anhcodo13/lattice 0.3.0 → 0.4.0

package/dist/index.js

@@ -139,12 +139,55 @@ function parseAssessmentPolicy(value) {
   for (const id of architecture.blockedRuleIds) {
     if (!known.has(id)) throw new Error(`Unknown blocked rule ID ${id}`);
   }
+  let evidence;
+  if (value.evidence !== void 0) {
+    if (!record2(value.evidence)) throw new Error("assessment.evidence must be an object");
+    const gates = value.evidence;
+    const nonnegative2 = (source, key, label) => {
+      const result = source[key];
+      if (!Number.isSafeInteger(result) || result < 0) throw new Error(`${label}.${key} must be a nonnegative integer`);
+      return result;
+    };
+    if (!Number.isFinite(gates.maximumAgeHours) || gates.maximumAgeHours <= 0 || gates.maximumAgeHours > 168) {
+      throw new Error("assessment.evidence.maximumAgeHours must be greater than 0 and at most 168");
+    }
+    for (const domain of ["dependencySecurity", "codeQuality", "codeSecurity", "compatibility"]) {
+      if (!record2(gates[domain])) throw new Error(`assessment.evidence.${domain} is required`);
+    }
+    const dependencySecurity = gates.dependencySecurity;
+    const codeQuality = gates.codeQuality;
+    const codeSecurity = gates.codeSecurity;
+    const compatibility = gates.compatibility;
+    const minimumLineCoverage = codeQuality.minimumLineCoverage;
+    if (typeof minimumLineCoverage !== "number" || !Number.isFinite(minimumLineCoverage) || minimumLineCoverage < 0 || minimumLineCoverage > 100) {
+      throw new Error("assessment.evidence.codeQuality.minimumLineCoverage must be 0\u2013100");
+    }
+    if (typeof codeQuality.requireTypecheck !== "boolean" || typeof codeQuality.requireTests !== "boolean") {
+      throw new Error("assessment.evidence.codeQuality requires boolean requireTypecheck and requireTests");
+    }
+    const projects = compatibility.requiredProjects;
+    if (!Array.isArray(projects) || projects.length === 0 || !projects.every((item) => typeof item === "string" && item.length > 0) || new Set(projects).size !== projects.length) {
+      throw new Error("assessment.evidence.compatibility.requiredProjects must be a unique nonempty string array");
+    }
+    evidence = {
+      maximumAgeHours: gates.maximumAgeHours,
+      dependencySecurity: { maximumHigh: nonnegative2(dependencySecurity, "maximumHigh", "assessment.evidence.dependencySecurity"), maximumCritical: nonnegative2(dependencySecurity, "maximumCritical", "assessment.evidence.dependencySecurity") },
+      codeQuality: {
+        maximumLintErrors: nonnegative2(codeQuality, "maximumLintErrors", "assessment.evidence.codeQuality"),
+        minimumLineCoverage,
+        requireTypecheck: codeQuality.requireTypecheck,
+        requireTests: codeQuality.requireTests
+      },
+      codeSecurity: { maximumHigh: nonnegative2(codeSecurity, "maximumHigh", "assessment.evidence.codeSecurity"), maximumCritical: nonnegative2(codeSecurity, "maximumCritical", "assessment.evidence.codeSecurity"), maximumSecrets: nonnegative2(codeSecurity, "maximumSecrets", "assessment.evidence.codeSecurity") },
+      compatibility: { requiredProjects: projects, minimumTestsPerProject: nonnegative2(compatibility, "minimumTestsPerProject", "assessment.evidence.compatibility") }
+    };
+  }
   return { architecture: {
     minimumScore: architecture.minimumScore,
     maximumErrors: architecture.maximumErrors,
     blockedRuleIds: architecture.blockedRuleIds,
     analysis
-  } };
+  }, ...evidence ? { evidence } : {} };
 }
 function parsePolicy(raw, source) {
   let parsed;
@@ -390,7 +433,7 @@ async function readResolution(app, workspaceRoot, name) {
 async function checkApp(app, workspaceRoot, policy) {
   const requirements = policy.profiles[app.profile];
   if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
-  const findings = [];
+  const findings2 = [];
   for (const [packageName, expected] of Object.entries(requirements)) {
     const declared = app.dependencies[packageName];
     const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
@@ -408,7 +451,7 @@ async function checkApp(app, workspaceRoot, policy) {
         reasons.push("lockfile resolution outside manifest range");
       }
     }
-    if (reasons.length) findings.push({
+    if (reasons.length) findings2.push({
       app: app.relativePath,
       packageName,
       expected,
@@ -418,7 +461,7 @@ async function checkApp(app, workspaceRoot, policy) {
       reason: reasons.join("; ")
     });
   }
-  return findings;
+  return findings2;
 }
 async function checkGovernance(options) {
   const scanRoot = resolve3(options.scanRoot);
@@ -429,10 +472,10 @@ async function checkGovernance(options) {
   }
   const apps = await discoverApps(scanRoot, workspaceRoot);
   if (apps.length === 0) throw new Error("No managed applications found");
-  const findings = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
+  const findings2 = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
   return {
     appsChecked: apps.length,
-    findings,
+    findings: findings2,
     policyVersion: options.policy.policyVersion,
     policySource: options.policy.source,
     policySha256: options.policy.sha256
@@ -441,7 +484,7 @@ async function checkGovernance(options) {
 
 // src/governance/assess.ts
 import { mkdir, writeFile } from "fs/promises";
-import { join as join7, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { basename, join as join8, relative as relative7, resolve as resolve8, sep as sep6 } from "path";
 
 // src/analysis/graph.ts
 function buildGraph(_modules) {
@@ -494,12 +537,12 @@ function findCycles(graph) {
 // src/analysis/rules.ts
 import { matchesGlob } from "path";
 function evaluateRules(graph, config) {
-  const findings = [];
+  const findings2 = [];
   const outgoing = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.from === module.path && !edge.isTypeOnly)]));
   const incoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path && !edge.isTypeOnly)]));
   const allIncoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path)]));
   for (const cycle of findCycles(graph)) {
-    findings.push({
+    findings2.push({
       ruleId: "module-cycle",
       category: "architecture",
       severity: "error",
@@ -516,7 +559,7 @@ function evaluateRules(graph, config) {
     for (const imported of module.imports) {
       if (imported.isTypeOnly) continue;
       if (seen.has(imported.specifier)) {
-        findings.push({
+        findings2.push({
           ruleId: "duplicate-import",
           category: "imports",
           severity: "warning",
@@ -529,7 +572,7 @@ function evaluateRules(graph, config) {
       seen.add(imported.specifier);
     }
     if (out.length > config.thresholds.maxFanOut) {
-      findings.push({
+      findings2.push({
         ruleId: "high-fan-out",
         category: "architecture",
         severity: "warning",
@@ -540,7 +583,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (into.length > config.thresholds.maxFanIn) {
-      findings.push({
+      findings2.push({
         ruleId: "high-fan-in",
         category: "architecture",
         severity: "warning",
@@ -551,7 +594,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (into.length === 0 && out.length === 0 && graph.modules.length > 1 && !module.isRoute) {
-      findings.push({
+      findings2.push({
         ruleId: "orphan-module",
         category: "architecture",
         severity: "info",
@@ -567,7 +610,7 @@ function evaluateRules(graph, config) {
         for (const name of module.exports) {
           if (name === "*" || module.typeExports.includes(name)) continue;
           if (!usedNames.has(name)) {
-            findings.push({
+            findings2.push({
               ruleId: "unused-export",
               category: "imports",
               severity: "info",
@@ -581,7 +624,7 @@ function evaluateRules(graph, config) {
       }
     }
     if (module.componentCount > 0 && module.lines > config.thresholds.maxComponentLines) {
-      findings.push({
+      findings2.push({
         ruleId: "large-component",
         category: "components",
         severity: "warning",
@@ -592,7 +635,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (module.jsxDepth > config.thresholds.maxJsxDepth) {
-      findings.push({
+      findings2.push({
         ruleId: "deep-jsx",
         category: "components",
         severity: "warning",
@@ -603,7 +646,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (module.complexity > config.thresholds.maxComplexity) {
-      findings.push({
+      findings2.push({
         ruleId: "high-complexity",
         category: "complexity",
         severity: "warning",
@@ -619,7 +662,7 @@ function evaluateRules(graph, config) {
         const allowed = policy.allow?.some((pattern) => matchesGlob(edge.to, pattern));
         const disallowed = policy.disallow?.some((pattern) => matchesGlob(edge.to, pattern));
         if (policy.allow && !allowed || policy.disallow && disallowed) {
-          findings.push({
+          findings2.push({
             ruleId: policy.id,
             category: "architecture",
             severity: policy.severity,
@@ -646,7 +689,7 @@ function evaluateRules(graph, config) {
       return false;
     };
     if (visit(module.path, /* @__PURE__ */ new Set([module.path]), 0)) {
-      findings.push({
+      findings2.push({
         ruleId: "deep-dependency-chain",
         category: "architecture",
         severity: "warning",
@@ -657,7 +700,7 @@ function evaluateRules(graph, config) {
       });
     }
   }
-  return findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+  return findings2.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
 }
 
 // src/analysis/scan.ts
@@ -986,10 +1029,10 @@ function grade(score) {
   if (score >= 55) return "D";
   return "F";
 }
-function scoreFindings(findings, config) {
+function scoreFindings(findings2, config) {
   const penalties = { error: 18, warning: 7, info: 2 };
   const categories = Object.entries(config.weights).map(([id, weight]) => {
-    const categoryFindings = findings.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
+    const categoryFindings = findings2.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
     const occurrences = /* @__PURE__ */ new Map();
     let deduction = 0;
     for (const finding of categoryFindings) {
@@ -1001,8 +1044,8 @@ function scoreFindings(findings, config) {
     return { id, weight, score: round(100 - deduction), deduction: round(deduction), findingCount: categoryFindings.length };
   });
   const weightedDeduction = round(categories.reduce((sum, category) => sum + category.deduction * category.weight / 100, 0));
-  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings.length - 10) * 0.15));
-  const criticalAdjustment = round(Math.min(10, findings.filter((finding) => finding.severity === "error").length * 1.5));
+  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings2.length - 10) * 0.15));
+  const criticalAdjustment = round(Math.min(10, findings2.filter((finding) => finding.severity === "error").length * 1.5));
   const score = round(Math.max(0, Math.min(100, 100 - weightedDeduction - maintenanceAdjustment - criticalAdjustment)));
   return { score, grade: grade(score), weightedDeduction, maintenanceAdjustment, criticalAdjustment, categories };
 }
@@ -1065,6 +1108,279 @@ function compareInventory(inventory, discovered, scanRoot) {
   return issues;
 }
 
+// src/governance/evidence.ts
+import { createHash as createHash3 } from "crypto";
+import { execFile } from "child_process";
+import { createReadStream } from "fs";
+import { lstat, readFile as readFile8, realpath as realpath2 } from "fs/promises";
+import { dirname as dirname3, join as join7, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { promisify } from "util";
+import fg from "fast-glob";
+var execFileAsync = promisify(execFile);
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function string(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function nonnegative(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function errors(value) {
+  return Array.isArray(value) && value.every(string);
+}
+function findings(value) {
+  return Array.isArray(value) && value.every((item) => object(item) && string(item.id) && string(item.severity) && string(item.subject) && string(item.message) && (item.remediation === void 0 || string(item.remediation)));
+}
+function base(value) {
+  return object(value) && string(value.tool) && string(value.version) && typeof value.complete === "boolean" && errors(value.errors);
+}
+function validateApp(value) {
+  if (!object(value) || !string(value.path) || !string(value.profile)) return false;
+  const dependency = value.dependencySecurity;
+  const quality = value.codeQuality;
+  const security = value.codeSecurity;
+  const compatibility = value.compatibility;
+  if (!base(dependency) || !nonnegative(dependency.packagesScanned) || !findings(dependency.advisories)) return false;
+  if (!object(quality) || !object(quality.lint) || !string(quality.lint.tool) || !string(quality.lint.version) || typeof quality.lint.complete !== "boolean" || !base(quality.typecheck) || !base(quality.tests) || !base(quality.coverage)) return false;
+  if (!nonnegative(quality.lint.filesScanned) || !nonnegative(quality.lint.errorCount) || !nonnegative(quality.lint.warnings) || !errors(quality.lint.errorsDetail) || typeof quality.typecheck.passed !== "boolean" || quality.typecheck.applicable !== void 0 && typeof quality.typecheck.applicable !== "boolean" || !nonnegative(quality.tests.passed) || !nonnegative(quality.tests.failed) || typeof quality.coverage.linesPercent !== "number" || !Number.isFinite(quality.coverage.linesPercent) || quality.coverage.linesPercent < 0 || quality.coverage.linesPercent > 100) return false;
+  if (!object(security) || !base(security.sast) || !base(security.secrets) || !nonnegative(security.sast.filesScanned) || !nonnegative(security.secrets.filesScanned) || !findings(security.sast.findings) || !findings(security.secrets.findings)) return false;
+  if (!base(compatibility) || !Array.isArray(compatibility.projects) || !compatibility.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  return true;
+}
+async function hashFile(hash, path) {
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+}
+async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
+  const root = resolve7(scanRoot);
+  const workspace = resolve7(workspaceRoot);
+  const scanRelative = relative6(workspace, root);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  const paths = await fg("**/*", {
+    cwd: root,
+    dot: true,
+    onlyFiles: true,
+    followSymbolicLinks: false,
+    ignore: [
+      "**/.git/**",
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.next/**",
+      "**/coverage/**",
+      "**/playwright-report/**",
+      "**/test-results/**",
+      "**/.nklattice-governance/**",
+      "**/.nklattice-report/**",
+      "**/AGENTS.md",
+      "**/*.tsbuildinfo",
+      "**/next-env.d.ts"
+    ]
+  });
+  paths.sort();
+  const hash = createHash3("sha256");
+  for (const path of paths) {
+    const absolute = resolve7(root, path);
+    const normalized = relative6(root, absolute);
+    if (normalized === ".." || normalized.startsWith(`..${sep5}`)) throw new Error("Input path escapes scan root");
+    if (!(await lstat(absolute)).isFile()) continue;
+    hash.update(path.replaceAll("\\", "/"));
+    hash.update("\0");
+    await hashFile(hash, absolute);
+    hash.update("\0");
+  }
+  let ancestor = root;
+  while (ancestor === workspace || ancestor !== dirname3(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
+    for (const name of [
+      "package.json",
+      "package-lock.json",
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "eslint.config.js",
+      "eslint.config.mjs",
+      "eslint.config.cjs",
+      "eslint.config.ts",
+      "eslint.config.mts",
+      "vitest.config.js",
+      "vitest.config.mjs",
+      "vitest.config.ts",
+      "vitest.config.mts",
+      "playwright.config.js",
+      "playwright.config.mjs",
+      "playwright.config.ts",
+      "playwright.config.mts",
+      ".semgrep.yml",
+      ".semgrep.yaml",
+      "semgrep.yml",
+      "semgrep.yaml"
+    ]) {
+      const path = join7(ancestor, name);
+      try {
+        const stat2 = await lstat(path);
+        if (stat2.isSymbolicLink()) throw new Error(`Symlinked scanner configuration is unsupported: ${path}`);
+        if (!stat2.isFile()) continue;
+        hash.update(relative6(workspace, path).replaceAll("\\", "/"));
+        hash.update("\0");
+        await hashFile(hash, path);
+        hash.update("\0");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    if (ancestor === workspace) break;
+    ancestor = dirname3(ancestor);
+  }
+  return hash.digest("hex");
+}
+async function loadScanEvidence(path, scanRoot, workspaceRoot, policySha256, maximumAgeHours) {
+  const source = resolve7(path);
+  const stat2 = await lstat(source);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 1e7) throw new Error("Evidence must be a regular JSON file under 10 MB");
+  const root = resolve7(scanRoot);
+  const relativePath = relative6(root, source);
+  if (relativePath !== ".." && !relativePath.startsWith(`..${sep5}`)) throw new Error("Evidence file must be outside the scan root");
+  const actualRoot = await realpath2(root);
+  const actualSource = await realpath2(source);
+  const actualRelative = relative6(actualRoot, actualSource);
+  if (actualRelative !== ".." && !actualRelative.startsWith(`..${sep5}`)) throw new Error("Evidence file resolves inside the scan root");
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile8(source, "utf8"));
+  } catch {
+    throw new Error("Evidence is not valid JSON");
+  }
+  return validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha256, maximumAgeHours);
+}
+async function validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha256, maximumAgeHours) {
+  if (!object(parsed) || parsed.schemaVersion !== 1 || !string(parsed.generatedAt) || !string(parsed.policySha256) || !string(parsed.inputSha256) || !string(parsed.commit) || !/^[0-9a-f]{40}$/.test(parsed.commit) || !Array.isArray(parsed.apps) || !parsed.apps.every(validateApp)) throw new Error("Evidence schema is invalid or incomplete");
+  if (parsed.policySha256 !== policySha256) throw new Error("Evidence was generated for another policy");
+  const generatedAt = Date.parse(parsed.generatedAt);
+  if (!Number.isFinite(generatedAt) || generatedAt > Date.now() + 6e4 || Date.now() - generatedAt > maximumAgeHours * 36e5) {
+    throw new Error("Evidence is stale or has an invalid timestamp");
+  }
+  if (parsed.inputSha256 !== await hashAssessmentInputs(scanRoot, workspaceRoot)) throw new Error("Evidence inputs changed after scanning");
+  const current = (await execFileAsync("git", ["rev-parse", "HEAD"], { cwd: workspaceRoot })).stdout.trim();
+  if (!/^[0-9a-f]{40}$/.test(current) || parsed.commit !== current) throw new Error("Evidence commit differs from the checked-out commit");
+  const appPaths = parsed.apps.map((app) => app.path);
+  if (new Set(appPaths).size !== appPaths.length) throw new Error("Evidence contains duplicate app paths");
+  return parsed;
+}
+var incomplete = (issues, tool, version, scanned) => ({ status: "incomplete", issues, tool, version, scanned });
+function evaluateAppEvidence(app, policy) {
+  if (!app) {
+    const missing = incomplete(["No fresh scan evidence for this app"]);
+    return { dependencySecurity: { ...missing }, codeQuality: { ...missing }, codeSecurity: { ...missing }, compatibility: { ...missing } };
+  }
+  const dependency = app.dependencySecurity;
+  let dependencySecurity;
+  if (!dependency.complete || dependency.packagesScanned === 0 || dependency.errors.length) {
+    dependencySecurity = { ...incomplete(["Dependency advisory scan did not cover the lockfile", ...dependency.errors], dependency.tool, dependency.version, dependency.packagesScanned), findings: dependency.advisories };
+  } else {
+    const high2 = dependency.advisories.filter((item) => item.severity.toLowerCase() === "high").length;
+    const critical2 = dependency.advisories.filter((item) => item.severity.toLowerCase() === "critical").length;
+    const unknown = dependency.advisories.filter((item) => !["low", "moderate", "medium", "high", "critical"].includes(item.severity.toLowerCase()));
+    dependencySecurity = unknown.length ? { ...incomplete([`${unknown.length} advisories have unknown severity`], dependency.tool, dependency.version, dependency.packagesScanned), findings: dependency.advisories } : {
+      status: high2 > policy.dependencySecurity.maximumHigh || critical2 > policy.dependencySecurity.maximumCritical ? "fail" : "pass",
+      issues: [
+        ...high2 > policy.dependencySecurity.maximumHigh ? [`${high2} high advisories exceed ${policy.dependencySecurity.maximumHigh}`] : [],
+        ...critical2 > policy.dependencySecurity.maximumCritical ? [`${critical2} critical advisories exceed ${policy.dependencySecurity.maximumCritical}`] : []
+      ],
+      tool: dependency.tool,
+      version: dependency.version,
+      scanned: dependency.packagesScanned,
+      findings: dependency.advisories
+    };
+  }
+  const quality = app.codeQuality;
+  const qualityMissing = [
+    ...!quality.lint.complete || quality.lint.filesScanned === 0 ? ["ESLint did not scan source files", ...quality.lint.errorsDetail] : [],
+    ...policy.codeQuality.requireTypecheck && !quality.typecheck.complete ? ["TypeScript typecheck did not complete", ...quality.typecheck.errors] : [],
+    ...policy.codeQuality.requireTests && (!quality.tests.complete || quality.tests.passed + quality.tests.failed === 0) ? ["Tests did not run", ...quality.tests.errors] : [],
+    ...!quality.coverage.complete ? ["Line coverage is unavailable", ...quality.coverage.errors] : []
+  ];
+  const qualityFailures = [
+    ...quality.lint.errorCount > policy.codeQuality.maximumLintErrors ? [`${quality.lint.errorCount} ESLint errors exceed ${policy.codeQuality.maximumLintErrors}`] : [],
+    ...policy.codeQuality.requireTypecheck && !quality.typecheck.passed ? ["TypeScript typecheck failed"] : [],
+    ...quality.tests.failed > 0 ? [`${quality.tests.failed} tests failed`] : [],
+    ...quality.coverage.linesPercent < policy.codeQuality.minimumLineCoverage ? [`Line coverage ${quality.coverage.linesPercent}% is below ${policy.codeQuality.minimumLineCoverage}%`] : []
+  ];
+  const qualityVersion = `ESLint ${quality.lint.version} \xB7 TypeScript ${quality.typecheck.version} \xB7 Vitest ${quality.tests.version}`;
+  const qualityMetrics = {
+    lintErrors: quality.lint.errorCount,
+    lintWarnings: quality.lint.warnings,
+    typecheck: quality.typecheck.applicable === false ? "not applicable" : quality.typecheck.passed ? "pass" : "fail",
+    testsPassed: quality.tests.passed,
+    testsFailed: quality.tests.failed,
+    lineCoveragePercent: quality.coverage.linesPercent
+  };
+  const codeQuality = qualityMissing.length ? { ...incomplete([...qualityMissing, ...qualityFailures], "ESLint / TypeScript / tests", qualityVersion, quality.lint.filesScanned), metrics: qualityMetrics } : {
+    status: qualityFailures.length ? "fail" : "pass",
+    issues: qualityFailures,
+    tool: "ESLint / TypeScript / tests",
+    version: qualityVersion,
+    scanned: quality.lint.filesScanned,
+    metrics: qualityMetrics
+  };
+  const security = app.codeSecurity;
+  const securityMissing = [
+    ...!security.sast.complete || security.sast.filesScanned === 0 ? ["SAST did not scan source files", ...security.sast.errors] : [],
+    ...!security.secrets.complete || security.secrets.filesScanned === 0 ? ["Secret scanner did not scan source files", ...security.secrets.errors] : []
+  ];
+  const high = security.sast.findings.filter((item) => item.severity.toLowerCase() === "high").length;
+  const critical = security.sast.findings.filter((item) => item.severity.toLowerCase() === "critical").length;
+  const unknownSecurity = security.sast.findings.filter((item) => !["low", "moderate", "medium", "high", "critical"].includes(item.severity.toLowerCase()));
+  if (unknownSecurity.length) securityMissing.push(`${unknownSecurity.length} SAST findings have unknown severity`);
+  const securityFailures = [
+    ...high > policy.codeSecurity.maximumHigh ? [`${high} high SAST findings exceed ${policy.codeSecurity.maximumHigh}`] : [],
+    ...critical > policy.codeSecurity.maximumCritical ? [`${critical} critical SAST findings exceed ${policy.codeSecurity.maximumCritical}`] : [],
+    ...security.secrets.findings.length > policy.codeSecurity.maximumSecrets ? [`${security.secrets.findings.length} detected secrets exceed ${policy.codeSecurity.maximumSecrets}`] : []
+  ];
+  const securityVersion = `Semgrep ${security.sast.version} \xB7 Gitleaks ${security.secrets.version}`;
+  const codeSecurity = securityMissing.length ? { ...incomplete([...securityMissing, ...securityFailures], "Semgrep / Gitleaks", securityVersion, security.sast.filesScanned), findings: [...security.sast.findings, ...security.secrets.findings] } : {
+    status: securityFailures.length ? "fail" : "pass",
+    issues: securityFailures,
+    tool: "Semgrep / Gitleaks",
+    version: securityVersion,
+    scanned: security.sast.filesScanned,
+    findings: [...security.sast.findings, ...security.secrets.findings]
+  };
+  const compatibility = app.compatibility;
+  const projectNames = new Set(compatibility.projects.map((project) => project.name));
+  const missingProjects = policy.compatibility.requiredProjects.filter((name) => !projectNames.has(name));
+  const incompleteProjects = compatibility.projects.filter((project) => project.passed + project.failed < policy.compatibility.minimumTestsPerProject);
+  const missingBrowserVersions = compatibility.projects.filter((project) => !project.browserVersion);
+  const expectedEngines = {
+    "chromium-desktop": "chromium",
+    "firefox-desktop": "firefox",
+    "webkit-desktop": "webkit",
+    "android-chrome": "chromium",
+    "iphone-safari": "webkit"
+  };
+  const invalidEngines = compatibility.projects.filter((project) => expectedEngines[project.name] && project.engine !== expectedEngines[project.name]);
+  const invalidDevices = compatibility.projects.filter((project) => (project.name === "android-chrome" || project.name === "iphone-safari") && (project.mobile !== true || !project.device));
+  const missingViewports = compatibility.projects.filter((project) => new Set(project.viewportWidths ?? []).size < 2);
+  const compatibilityMissing = [
+    ...!compatibility.complete ? ["Compatibility test run did not complete", ...compatibility.errors] : [],
+    ...missingProjects.length ? [`Missing Playwright projects: ${missingProjects.join(", ")}`] : [],
+    ...incompleteProjects.map((project) => `${project.name} ran fewer than ${policy.compatibility.minimumTestsPerProject} tests`),
+    ...missingBrowserVersions.map((project) => `${project.name} did not record its browser engine version`),
+    ...invalidEngines.map((project) => `${project.name} used ${project.engine ?? "an unverified engine"} instead of ${expectedEngines[project.name]}`),
+    ...invalidDevices.map((project) => `${project.name} did not verify mobile emulation settings`),
+    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`)
+  ];
+  const failedProjects = compatibility.projects.filter((project) => project.failed > 0);
+  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`)], compatibility.tool, compatibility.version), matrix: compatibility.projects } : {
+    status: failedProjects.length ? "fail" : "pass",
+    issues: failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`),
+    tool: compatibility.tool,
+    version: compatibility.version,
+    scanned: compatibility.projects.reduce((count, project) => count + project.passed + project.failed, 0),
+    matrix: compatibility.projects
+  };
+  return { dependencySecurity, codeQuality, codeSecurity, compatibility: compatibilityDomain };
+}
+
 // src/governance/assess.ts
 var notEvaluated = [
   "vulnerability databases",
@@ -1085,27 +1401,50 @@ function escapeHtml(value) {
   return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
 function renderAssessmentHtml(report) {
+  const labels = {
+    inventory: "App inventory",
+    dependencies: "Dependency policy",
+    architecture: "Architecture",
+    dependencySecurity: "Dependency security",
+    codeQuality: "Code quality",
+    codeSecurity: "Code security",
+    compatibility: "Browser compatibility"
+  };
+  const domainNames = report.apps.length ? Object.keys(report.apps[0].domains) : [];
+  const overview = domainNames.map((name) => {
+    const statuses = report.apps.map((app) => app.domains[name]?.status ?? "incomplete");
+    const status = statusOf(statuses);
+    const passed = statuses.filter((item) => item === "pass").length;
+    return `<li><span>${escapeHtml(labels[name] ?? name)}</span><strong class="${status}">${escapeHtml(status)}</strong><small>${passed}/${report.apps.length} apps passed</small></li>`;
+  }).join("");
   const apps = report.apps.map((app) => {
-    const domains = Object.entries(app.domains).map(([name, domain]) => `<tr><th scope="row">${escapeHtml(name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}</td></tr>`).join("");
+    const domains = Object.entries(app.domains).map(([name, domain]) => {
+      const evidence = domain;
+      const identity = evidence.tool ? `<p><small>${escapeHtml(evidence.tool)} ${escapeHtml(evidence.version ?? "")} \xB7 scanned ${escapeHtml(evidence.scanned ?? "unknown")}</small></p>` : "";
+      const metrics = evidence.metrics ? `<p><small>${Object.entries(evidence.metrics).map(([key, value]) => `${escapeHtml(key)}: ${escapeHtml(value)}`).join(" \xB7 ")}</small></p>` : "";
+      const findings3 = evidence.findings?.length ? `<details><summary>${evidence.findings.length} finding(s)</summary><ul>${evidence.findings.map((item) => `<li><strong>${escapeHtml(item.severity)}</strong> ${escapeHtml(item.id)} \xB7 <code>${escapeHtml(item.subject)}</code> \u2014 ${escapeHtml(item.message)}${item.remediation ? ` \xB7 ${escapeHtml(item.remediation)}` : ""}</li>`).join("")}</ul></details>` : "";
+      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Browser / device</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml([item.browserVersion, item.device].filter(Boolean).join(" \xB7 ") || "Not recorded")}</td><td>${escapeHtml(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table></div>` : "";
+      return `<tr><th scope="row">${escapeHtml(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}</td></tr>`;
+    }).join("");
     const architecture = app.domains.architecture;
     const categoryRows = architecture.scoreBreakdown?.categories.map((category) => `<tr><th scope="row">${escapeHtml(category.id)}</th><td>${escapeHtml(category.weight)}%</td><td>${escapeHtml(category.score)}</td><td>${escapeHtml(category.findingCount)}</td></tr>`).join("") ?? "";
-    const findings = architecture.findings.map((finding) => `<tr><td>${escapeHtml(finding.severity)}</td><td>${escapeHtml(finding.ruleId)}</td><td><code>${escapeHtml(finding.file)}:${finding.line}</code></td><td>${escapeHtml(finding.evidence)}</td></tr>`).join("");
-    return `<section class="app"><h2>${escapeHtml(app.path)} <span class="${app.status}">${escapeHtml(app.status)}</span></h2><p>Profile: ${escapeHtml(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings}</tbody></table></div></details>` : ""}</section>`;
+    const findings2 = architecture.findings.map((finding) => `<tr><td>${escapeHtml(finding.severity)}</td><td>${escapeHtml(finding.ruleId)}</td><td><code>${escapeHtml(finding.file)}:${finding.line}</code></td><td>${escapeHtml(finding.evidence)}</td></tr>`).join("");
+    return `<section class="app"><h2>${escapeHtml(app.path)} <span class="${app.status}">${escapeHtml(app.status)}</span></h2><p>Profile: ${escapeHtml(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings2 ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings2}</tbody></table></div></details>` : ""}</section>`;
   }).join("");
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>NKLattice governance assessment</title><style>
-  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f6f7f5;color:#1b2925}body{max-width:1100px;margin:auto;padding:2rem 1rem}header,.app,.meta{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:9rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}
-  </style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s)</p></header><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml(report.policy.version)} \xB7 <code>${escapeHtml(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml(report.inventory.source)}</code></p>${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml).join(", ")}.</p></section></body></html>
+  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f3f6f4;color:#1b2925}body{max-width:1160px;margin:auto;padding:2rem 1rem}header,.app,.meta,.overview{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}header{background:#13231d;color:#f5f8f4;padding:2rem}header small{color:#9de2bc;font-weight:700;letter-spacing:.12em}header p{color:#c8d6ce}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}header .pass{color:#9de2bc}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:12rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}.domain-overview{list-style:none;display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:.65rem;padding:0;margin:1rem 0 0}.domain-overview li{border:1px solid #d9e1dc;background:#f8faf8;border-radius:8px;padding:.9rem;display:grid;grid-template-columns:1fr auto;gap:.35rem}.domain-overview li small{grid-column:1/-1}.domain-overview li+li{margin:0}
+  @media(max-width:800px){.domain-overview{grid-template-columns:repeat(2,minmax(0,1fr))}}@media(max-width:480px){.domain-overview{grid-template-columns:1fr}}</style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s) \xB7 policy ${escapeHtml(report.policy.version)}</p></header><section class="overview"><h2>Assessment by domain</h2><p>Each status is based on the checked apps and fresh scanner evidence. Open an app below for findings and browser versions.</p><ul class="domain-overview">${overview}</ul></section><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml(report.policy.version)} \xB7 <code>${escapeHtml(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml(basename(report.inventory.source))}</code></p>${report.evidence ? `<p>Scanners: ${escapeHtml(report.evidence.generatedAt)} \xB7 commit <code>${escapeHtml(report.evidence.commit)}</code> \xB7 input <code>${escapeHtml(report.evidence.inputSha256)}</code></p>` : "<p>Scanner evidence unavailable.</p>"}${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml).join(", ")}.</p></section></body></html>
 `;
 }
 async function assessGovernance(options) {
-  const scanRoot = resolve7(options.scanRoot);
-  const workspaceRoot = resolve7(options.workspaceRoot ?? scanRoot);
-  const scanRelative = relative6(workspaceRoot, scanRoot);
-  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  const scanRoot = resolve8(options.scanRoot);
+  const workspaceRoot = resolve8(options.workspaceRoot ?? scanRoot);
+  const scanRelative = relative7(workspaceRoot, scanRoot);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep6}`)) throw new Error("Scan root must be inside workspace root");
   if (!options.policy.assessment) throw new Error("Policy assessment.architecture is required");
   const assessment = parseAssessmentPolicy(options.policy.assessment);
-  const outputDirectory = resolve7(options.outputDirectory ?? join7(scanRoot, ".nklattice-governance"));
-  const inventorySource = resolve7(options.inventory ?? join7(scanRoot, ".nklattice-apps.json"));
+  const outputDirectory = resolve8(options.outputDirectory ?? join8(scanRoot, ".nklattice-governance"));
+  const inventorySource = resolve8(options.inventory ?? join8(scanRoot, ".nklattice-apps.json"));
   let inventory;
   const issues = [];
   try {
@@ -1124,9 +1463,22 @@ async function assessGovernance(options) {
   if (options.expectedApps !== void 0 && apps.length !== options.expectedApps) {
     issues.push(`Expected ${options.expectedApps} managed apps; discovered ${apps.length}`);
   }
+  let evidence;
+  if (assessment.evidence) {
+    if (!options.evidence && !options.trustedEvidence) issues.push("Scan evidence is required by the policy; run governance collect and pass --evidence");
+    else try {
+      evidence = options.trustedEvidence ? await validateScanEvidence(options.trustedEvidence, scanRoot, workspaceRoot, options.policy.sha256, assessment.evidence.maximumAgeHours) : await loadScanEvidence(options.evidence, scanRoot, workspaceRoot, options.policy.sha256, assessment.evidence.maximumAgeHours);
+    } catch (error) {
+      issues.push(`Scan evidence: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (evidence) {
+      const discovered = new Set(apps.map((app) => relative7(scanRoot, app.directory).replaceAll("\\", "/") || "."));
+      for (const item of evidence.apps) if (!discovered.has(item.path)) issues.push(`Scan evidence contains unrecognized app ${item.path}`);
+    }
+  }
   const results = [];
   for (const app of apps) {
-    const appPath = relative6(scanRoot, app.directory).replaceAll("\\", "/") || ".";
+    const appPath = relative7(scanRoot, app.directory).replaceAll("\\", "/") || ".";
     const inventoryIssues = issues.filter((issue) => issue.includes(appPath) || issue.startsWith("Inventory:") || issue.startsWith("Discovery:"));
     const inventoryDomain = { status: inventoryIssues.length ? "incomplete" : "pass", issues: inventoryIssues };
     const dependencyDomain = { status: "pass", issues: [], findings: [] };
@@ -1179,7 +1531,8 @@ async function assessGovernance(options) {
       architectureDomain.status = "incomplete";
       architectureDomain.issues.push(error instanceof Error ? error.message : String(error));
     }
-    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain };
+    const extra = assessment.evidence ? evaluateAppEvidence(evidence?.apps.find((item) => item.path === appPath && item.profile === app.profile), assessment.evidence) : {};
+    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain, ...extra };
     results.push({ path: appPath, profile: app.profile, status: statusOf(Object.values(domains).map((domain) => domain.status)), domains });
   }
   const report = {
@@ -1187,15 +1540,19 @@ async function assessGovernance(options) {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     status: issues.length ? "incomplete" : statusOf(results.map((app) => app.status)),
     policy: { version: options.policy.policyVersion, source: options.policy.source, sha256: options.policy.sha256 },
+    ...evidence ? { evidence: { source: options.evidence ? resolve8(options.evidence) : "in-process collector", generatedAt: evidence.generatedAt, commit: evidence.commit, inputSha256: evidence.inputSha256 } } : {},
     inventory: { source: inventorySource, sha256: inventory?.sha256, expectedApps: inventory?.apps.length ?? 0, discoveredApps: apps.length },
-    scope: { domains: ["explicit app inventory", "dependency minimums", "source architecture"], notEvaluated },
+    scope: {
+      domains: ["explicit app inventory", "dependency minimums", "source architecture", ...assessment.evidence ? ["known dependency advisories", "source quality", "source security", "browser and mobile emulation"] : []],
+      notEvaluated: assessment.evidence ? ["licenses", "physical Android/iOS devices", "runtime performance", "cryptographic evidence attestation", "branch protection", "repository access controls", "cross-repository rollout status"] : notEvaluated
+    },
     issues,
     apps: results
   };
   await mkdir(outputDirectory, { recursive: true });
-  await writeFile(join7(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
+  await writeFile(join8(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
 `);
-  await writeFile(join7(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  await writeFile(join8(outputDirectory, "report.html"), renderAssessmentHtml(report));
   return report;
 }
 export {