@anhcodo13/lattice 0.3.0 → 0.5.0

package/dist/index.js

@@ -101,6 +101,7 @@ function parseAnalysisConfig(value) {
 // src/governance/policy.ts
 var exactVersion = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var minimumVersion = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var measuredVersion = /^(0|[1-9]\d*)(?:\.(0|[1-9]\d*)){0,3}$/;
 function record2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -139,12 +140,106 @@ function parseAssessmentPolicy(value) {
   for (const id of architecture.blockedRuleIds) {
     if (!known.has(id)) throw new Error(`Unknown blocked rule ID ${id}`);
   }
+  let evidence;
+  if (value.evidence !== void 0) {
+    if (!record2(value.evidence)) throw new Error("assessment.evidence must be an object");
+    const gates = value.evidence;
+    const nonnegative2 = (source, key, label) => {
+      const result = source[key];
+      if (!Number.isSafeInteger(result) || result < 0) throw new Error(`${label}.${key} must be a nonnegative integer`);
+      return result;
+    };
+    if (!Number.isFinite(gates.maximumAgeHours) || gates.maximumAgeHours <= 0 || gates.maximumAgeHours > 168) {
+      throw new Error("assessment.evidence.maximumAgeHours must be greater than 0 and at most 168");
+    }
+    for (const domain of ["dependencySecurity", "codeQuality", "codeSecurity", "compatibility"]) {
+      if (!record2(gates[domain])) throw new Error(`assessment.evidence.${domain} is required`);
+    }
+    const dependencySecurity = gates.dependencySecurity;
+    const codeQuality = gates.codeQuality;
+    const codeSecurity = gates.codeSecurity;
+    const compatibility = gates.compatibility;
+    const minimumLineCoverage = codeQuality.minimumLineCoverage;
+    if (typeof minimumLineCoverage !== "number" || !Number.isFinite(minimumLineCoverage) || minimumLineCoverage < 0 || minimumLineCoverage > 100) {
+      throw new Error("assessment.evidence.codeQuality.minimumLineCoverage must be 0\u2013100");
+    }
+    if (typeof codeQuality.requireTypecheck !== "boolean" || typeof codeQuality.requireTests !== "boolean") {
+      throw new Error("assessment.evidence.codeQuality requires boolean requireTypecheck and requireTests");
+    }
+    const projects = compatibility.requiredProjects;
+    if (!Array.isArray(projects) || projects.length === 0 || !projects.every((item) => typeof item === "string" && item.length > 0) || new Set(projects).size !== projects.length) {
+      throw new Error("assessment.evidence.compatibility.requiredProjects must be a unique nonempty string array");
+    }
+    const versionFloors = (key) => {
+      const raw = compatibility[key];
+      if (raw === void 0) return void 0;
+      if (!record2(raw)) throw new Error(`assessment.evidence.compatibility.${key} must be an object`);
+      for (const [project, version] of Object.entries(raw)) {
+        if (!projects.includes(project)) throw new Error(`${key} references unknown required project ${project}`);
+        if (key === "minimumEmulatedOsVersions" && project !== "android-chrome" && project !== "iphone-safari") {
+          throw new Error(`${key} requires an Android Chrome or iPhone Safari project`);
+        }
+        if (typeof version !== "string" || !measuredVersion.test(version) || !version.split(".").map(Number).every(Number.isSafeInteger)) {
+          throw new Error(`${key}.${project} must be a numeric version with one to four components`);
+        }
+      }
+      return raw;
+    };
+    const minimumTestedBrowserVersions = versionFloors("minimumTestedBrowserVersions");
+    const minimumEmulatedOsVersions = versionFloors("minimumEmulatedOsVersions");
+    let accessibility;
+    if (gates.accessibility !== void 0) {
+      if (!record2(gates.accessibility)) throw new Error("assessment.evidence.accessibility must be an object");
+      const source = gates.accessibility;
+      const requiredProjects = source.requiredProjects;
+      if (!Array.isArray(requiredProjects) || requiredProjects.length === 0 || !requiredProjects.every((project) => typeof project === "string" && projects.includes(project)) || new Set(requiredProjects).size !== requiredProjects.length) {
+        throw new Error("assessment.evidence.accessibility projects must be unique members of compatibility.requiredProjects");
+      }
+      const requiredTags = source.requiredTags;
+      if (!Array.isArray(requiredTags) || requiredTags.length === 0 || !requiredTags.every((tag) => typeof tag === "string" && /^wcag(?:2|21|22)(?:a|aa)$/.test(tag)) || new Set(requiredTags).size !== requiredTags.length) {
+        throw new Error("assessment.evidence.accessibility.requiredTags must list unique supported WCAG A/AA tags");
+      }
+      if (typeof source.minimumAxeVersion !== "string" || !minimumVersion.test(`>=${source.minimumAxeVersion}`) || valid(source.minimumAxeVersion) === null) {
+        throw new Error("assessment.evidence.accessibility.minimumAxeVersion must be an exact stable version");
+      }
+      accessibility = {
+        requiredProjects,
+        requiredTags,
+        minimumScansPerProject: nonnegative2(source, "minimumScansPerProject", "assessment.evidence.accessibility"),
+        minimumChecksPerScan: nonnegative2(source, "minimumChecksPerScan", "assessment.evidence.accessibility"),
+        minimumAxeVersion: source.minimumAxeVersion,
+        maximumViolations: nonnegative2(source, "maximumViolations", "assessment.evidence.accessibility"),
+        maximumNeedsReview: nonnegative2(source, "maximumNeedsReview", "assessment.evidence.accessibility")
+      };
+      if (accessibility.minimumScansPerProject === 0 || accessibility.minimumChecksPerScan === 0) {
+        throw new Error("assessment.evidence.accessibility minimum scans and checks must be positive");
+      }
+    }
+    evidence = {
+      maximumAgeHours: gates.maximumAgeHours,
+      dependencySecurity: { maximumHigh: nonnegative2(dependencySecurity, "maximumHigh", "assessment.evidence.dependencySecurity"), maximumCritical: nonnegative2(dependencySecurity, "maximumCritical", "assessment.evidence.dependencySecurity") },
+      codeQuality: {
+        maximumLintErrors: nonnegative2(codeQuality, "maximumLintErrors", "assessment.evidence.codeQuality"),
+        minimumLineCoverage,
+        requireTypecheck: codeQuality.requireTypecheck,
+        requireTests: codeQuality.requireTests
+      },
+      codeSecurity: { maximumHigh: nonnegative2(codeSecurity, "maximumHigh", "assessment.evidence.codeSecurity"), maximumCritical: nonnegative2(codeSecurity, "maximumCritical", "assessment.evidence.codeSecurity"), maximumSecrets: nonnegative2(codeSecurity, "maximumSecrets", "assessment.evidence.codeSecurity") },
+      compatibility: {
+        requiredProjects: projects,
+        minimumTestsPerProject: nonnegative2(compatibility, "minimumTestsPerProject", "assessment.evidence.compatibility"),
+        ...minimumTestedBrowserVersions ? { minimumTestedBrowserVersions } : {},
+        ...minimumEmulatedOsVersions ? { minimumEmulatedOsVersions } : {}
+      },
+      ...accessibility ? { accessibility } : {}
+    };
+  }
   return { architecture: {
     minimumScore: architecture.minimumScore,
     maximumErrors: architecture.maximumErrors,
     blockedRuleIds: architecture.blockedRuleIds,
     analysis
-  } };
+  }, ...evidence ? { evidence } : {} };
 }
 function parsePolicy(raw, source) {
   let parsed;
@@ -176,10 +271,25 @@ function parsePolicy(raw, source) {
     }
     profiles3[name] = versions;
   }
+  let managedPackages;
+  if (parsed.managedPackages !== void 0) {
+    if (!record2(parsed.managedPackages)) throw new Error("Policy managedPackages must be an object");
+    managedPackages = {};
+    for (const [packageName, version] of Object.entries(parsed.managedPackages)) {
+      if (typeof version !== "string" || !minimumVersion.test(version) || valid(version.slice(2)) === null) {
+        throw new Error(`Policy minimum version (>=X.Y.Z) required for managed package ${packageName}`);
+      }
+      if (Object.values(profiles3).some((profile) => packageName in profile)) {
+        throw new Error(`Package ${packageName} appears in both profiles and managedPackages`);
+      }
+      managedPackages[packageName] = version;
+    }
+  }
   return {
     schemaVersion: 2,
     policyVersion: parsed.policyVersion,
     profiles: profiles3,
+    ...managedPackages ? { managedPackages } : {},
     ...parsed.assessment === void 0 ? {} : { assessment: parseAssessmentPolicy(parsed.assessment) },
     source,
     sha256: createHash("sha256").update(raw).digest("hex")
@@ -203,9 +313,145 @@ async function loadPolicy(source) {
 }
 
 // src/governance/check.ts
-import { resolve as resolve3, relative as relative3, sep as sep2 } from "path";
+import { readFile as readFile5 } from "fs/promises";
+import { resolve as resolve3, relative as relative3, sep as sep2, join as join4, dirname as dirname2 } from "path";
+import fastGlob2 from "fast-glob";
 import { satisfies, subset, valid as valid2, validRange } from "semver";
 
+// src/analysis/parse.ts
+import ts from "typescript";
+function hasModifier(node, kind) {
+  return ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) === true;
+}
+function containsJsx(node) {
+  if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)) return true;
+  return ts.forEachChild(node, containsJsx) === true;
+}
+function importNames(clause) {
+  if (!clause) return [];
+  const names = [];
+  if (clause.name) names.push("default");
+  if (clause.namedBindings) {
+    if (ts.isNamespaceImport(clause.namedBindings)) names.push("*");
+    else for (const item of clause.namedBindings.elements) names.push(item.propertyName?.text ?? item.name.text);
+  }
+  return names;
+}
+function sourceKind(path) {
+  if (path.endsWith(".tsx")) return ts.ScriptKind.TSX;
+  if (path.endsWith(".jsx")) return ts.ScriptKind.JSX;
+  if (path.endsWith(".js") || path.endsWith(".mjs") || path.endsWith(".cjs")) return ts.ScriptKind.JS;
+  return ts.ScriptKind.TS;
+}
+function parseModule(path, contents) {
+  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
+  const imports = [];
+  const exports = [];
+  const typeExports = [];
+  let jsxDepth = 0;
+  let complexity = 1;
+  let componentCount = 0;
+  for (const node of source.statements) {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      imports.push({
+        specifier: node.moduleSpecifier.text,
+        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+        importedNames: importNames(node.importClause),
+        isTypeOnly: node.importClause?.isTypeOnly ?? false
+      });
+    }
+    if (ts.isExportDeclaration(node)) {
+      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        imports.push({
+          specifier: node.moduleSpecifier.text,
+          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+          importedNames: node.exportClause && ts.isNamedExports(node.exportClause) ? node.exportClause.elements.map((item) => item.propertyName?.text ?? item.name.text) : ["*"],
+          isTypeOnly: node.isTypeOnly
+        });
+      }
+      if (node.exportClause && ts.isNamedExports(node.exportClause)) {
+        exports.push(...node.exportClause.elements.map((item) => item.name.text));
+        if (node.isTypeOnly) typeExports.push(...node.exportClause.elements.map((item) => item.name.text));
+      }
+    }
+    if (hasModifier(node, ts.SyntaxKind.ExportKeyword)) {
+      if (hasModifier(node, ts.SyntaxKind.DefaultKeyword)) exports.push("default");
+      else if (ts.isVariableStatement(node)) {
+        for (const declaration of node.declarationList.declarations) {
+          if (ts.isIdentifier(declaration.name)) exports.push(declaration.name.text);
+        }
+      } else if ("name" in node && node.name && ts.isIdentifier(node.name)) {
+        const name = node.name.text;
+        exports.push(name);
+        if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node)) typeExports.push(name);
+      }
+    }
+    if (ts.isFunctionDeclaration(node) && node.name && /^[A-Z]/.test(node.name.text) && containsJsx(node)) {
+      componentCount++;
+    }
+    if (ts.isVariableStatement(node)) {
+      for (const declaration of node.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name) && /^[A-Z]/.test(declaration.name.text) && declaration.initializer && containsJsx(declaration.initializer)) {
+          componentCount++;
+        }
+      }
+    }
+  }
+  function visit(node, depth) {
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+      const argument = node.arguments[0];
+      if (argument && ts.isStringLiteralLike(argument)) {
+        imports.push({
+          specifier: argument.text,
+          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+          importedNames: ["*"],
+          isTypeOnly: false
+        });
+      }
+    }
+    const isJsx = ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
+    const nextDepth = depth + (isJsx ? 1 : 0);
+    jsxDepth = Math.max(jsxDepth, nextDepth);
+    if (ts.isIfStatement(node) || ts.isForStatement(node) || ts.isForOfStatement(node) || ts.isForInStatement(node) || ts.isWhileStatement(node) || ts.isDoStatement(node) || ts.isCatchClause(node) || ts.isConditionalExpression(node) || ts.isCaseBlock(node)) complexity++;
+    if (ts.isBinaryExpression(node) && [ts.SyntaxKind.AmpersandAmpersandToken, ts.SyntaxKind.BarBarToken].includes(node.operatorToken.kind)) {
+      complexity++;
+    }
+    ts.forEachChild(node, (child) => visit(child, nextDepth));
+  }
+  visit(source, 0);
+  return {
+    path,
+    imports,
+    exports: [...new Set(exports)].sort(),
+    typeExports: [...new Set(typeExports)].sort(),
+    lines: contents.split(/\r?\n/).length,
+    jsxDepth,
+    componentCount,
+    complexity,
+    isRoute: /(^|\/)(app|pages)\/.+(page|layout|route|index)\.[cm]?[jt]sx?$/.test(path) || /(^|\/)app\/(page|layout|route)\.[cm]?[jt]sx?$/.test(path)
+  };
+}
+function moduleParseDiagnostics(path, contents) {
+  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
+  const diagnostics = source.parseDiagnostics ?? [];
+  const messages = diagnostics.map((diagnostic) => {
+    const line = source.getLineAndCharacterOfPosition(diagnostic.start ?? 0).line + 1;
+    return `${path}:${line}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")}`;
+  });
+  function visit(node) {
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+      const argument = node.arguments[0];
+      if (!argument || !ts.isStringLiteralLike(argument)) {
+        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+        messages.push(`${path}:${line}: nonliteral dynamic import or require cannot be analyzed`);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(source);
+  return messages;
+}
+
 // src/governance/discover.ts
 import { readFile as readFile3 } from "fs/promises";
 import { join as join2, relative } from "path";
@@ -387,11 +633,36 @@ async function readResolution(app, workspaceRoot, name) {
 }
 
 // src/governance/check.ts
+var scanIgnore = ["**/node_modules/**", "**/.git/**", "**/.next/**", "**/dist/**", "**/build/**", "**/out/**", "**/coverage/**", "**/.turbo/**", "**/.vercel/**", "**/.astro/**", "**/.nklattice-report/**", "**/.nklattice-governance/**", "**/*.d.ts"];
+async function importedManagedPackages(app, managed) {
+  if (Object.keys(managed).length === 0) return /* @__PURE__ */ new Set();
+  const nestedManifests = await fastGlob2("**/package.json", { cwd: app.directory, onlyFiles: true, dot: true, followSymbolicLinks: false, ignore: scanIgnore });
+  const nestedIgnore = nestedManifests.filter((path) => path !== "package.json").map((path) => `${dirname2(path)}/**`);
+  const files = await fastGlob2("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
+    cwd: app.directory,
+    onlyFiles: true,
+    dot: true,
+    followSymbolicLinks: false,
+    ignore: [...scanIgnore, ...nestedIgnore]
+  });
+  const found = /* @__PURE__ */ new Set();
+  await Promise.all(files.map(async (path) => {
+    const module = parseModule(path, await readFile5(join4(app.directory, path), "utf8"));
+    for (const imported of module.imports) {
+      for (const name of Object.keys(managed)) {
+        if (imported.specifier === name || imported.specifier.startsWith(`${name}/`)) found.add(name);
+      }
+    }
+  }));
+  return found;
+}
 async function checkApp(app, workspaceRoot, policy) {
   const requirements = policy.profiles[app.profile];
   if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
-  const findings = [];
-  for (const [packageName, expected] of Object.entries(requirements)) {
+  const findings2 = [];
+  const imported = await importedManagedPackages(app, policy.managedPackages ?? {});
+  const managed = Object.fromEntries(Object.entries(policy.managedPackages ?? {}).filter(([packageName]) => app.dependencies[packageName] !== void 0 || imported.has(packageName)));
+  for (const [packageName, expected] of Object.entries({ ...requirements, ...managed })) {
     const declared = app.dependencies[packageName];
     const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
     const reasons = [];
@@ -408,7 +679,7 @@ async function checkApp(app, workspaceRoot, policy) {
         reasons.push("lockfile resolution outside manifest range");
       }
     }
-    if (reasons.length) findings.push({
+    if (reasons.length) findings2.push({
       app: app.relativePath,
       packageName,
       expected,
@@ -418,7 +689,7 @@ async function checkApp(app, workspaceRoot, policy) {
       reason: reasons.join("; ")
     });
   }
-  return findings;
+  return findings2;
 }
 async function checkGovernance(options) {
   const scanRoot = resolve3(options.scanRoot);
@@ -429,10 +700,10 @@ async function checkGovernance(options) {
   }
   const apps = await discoverApps(scanRoot, workspaceRoot);
   if (apps.length === 0) throw new Error("No managed applications found");
-  const findings = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
+  const findings2 = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
   return {
     appsChecked: apps.length,
-    findings,
+    findings: findings2,
     policyVersion: options.policy.policyVersion,
     policySource: options.policy.source,
     policySha256: options.policy.sha256
@@ -441,7 +712,7 @@ async function checkGovernance(options) {
 
 // src/governance/assess.ts
 import { mkdir, writeFile } from "fs/promises";
-import { join as join7, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { basename, join as join9, relative as relative7, resolve as resolve8, sep as sep6 } from "path";
 
 // src/analysis/graph.ts
 function buildGraph(_modules) {
@@ -494,12 +765,12 @@ function findCycles(graph) {
 // src/analysis/rules.ts
 import { matchesGlob } from "path";
 function evaluateRules(graph, config) {
-  const findings = [];
+  const findings2 = [];
   const outgoing = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.from === module.path && !edge.isTypeOnly)]));
   const incoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path && !edge.isTypeOnly)]));
   const allIncoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path)]));
   for (const cycle of findCycles(graph)) {
-    findings.push({
+    findings2.push({
       ruleId: "module-cycle",
       category: "architecture",
       severity: "error",
@@ -516,7 +787,7 @@ function evaluateRules(graph, config) {
     for (const imported of module.imports) {
       if (imported.isTypeOnly) continue;
       if (seen.has(imported.specifier)) {
-        findings.push({
+        findings2.push({
           ruleId: "duplicate-import",
           category: "imports",
           severity: "warning",
@@ -529,7 +800,7 @@ function evaluateRules(graph, config) {
       seen.add(imported.specifier);
     }
     if (out.length > config.thresholds.maxFanOut) {
-      findings.push({
+      findings2.push({
         ruleId: "high-fan-out",
         category: "architecture",
         severity: "warning",
@@ -540,7 +811,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (into.length > config.thresholds.maxFanIn) {
-      findings.push({
+      findings2.push({
         ruleId: "high-fan-in",
         category: "architecture",
         severity: "warning",
@@ -551,7 +822,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (into.length === 0 && out.length === 0 && graph.modules.length > 1 && !module.isRoute) {
-      findings.push({
+      findings2.push({
         ruleId: "orphan-module",
         category: "architecture",
         severity: "info",
@@ -567,7 +838,7 @@ function evaluateRules(graph, config) {
         for (const name of module.exports) {
           if (name === "*" || module.typeExports.includes(name)) continue;
           if (!usedNames.has(name)) {
-            findings.push({
+            findings2.push({
               ruleId: "unused-export",
               category: "imports",
               severity: "info",
@@ -581,7 +852,7 @@ function evaluateRules(graph, config) {
       }
     }
     if (module.componentCount > 0 && module.lines > config.thresholds.maxComponentLines) {
-      findings.push({
+      findings2.push({
         ruleId: "large-component",
         category: "components",
         severity: "warning",
@@ -592,7 +863,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (module.jsxDepth > config.thresholds.maxJsxDepth) {
-      findings.push({
+      findings2.push({
         ruleId: "deep-jsx",
         category: "components",
         severity: "warning",
@@ -603,7 +874,7 @@ function evaluateRules(graph, config) {
       });
     }
     if (module.complexity > config.thresholds.maxComplexity) {
-      findings.push({
+      findings2.push({
         ruleId: "high-complexity",
         category: "complexity",
         severity: "warning",
@@ -619,7 +890,7 @@ function evaluateRules(graph, config) {
         const allowed = policy.allow?.some((pattern) => matchesGlob(edge.to, pattern));
         const disallowed = policy.disallow?.some((pattern) => matchesGlob(edge.to, pattern));
         if (policy.allow && !allowed || policy.disallow && disallowed) {
-          findings.push({
+          findings2.push({
             ruleId: policy.id,
             category: "architecture",
             severity: policy.severity,
@@ -646,7 +917,7 @@ function evaluateRules(graph, config) {
       return false;
     };
     if (visit(module.path, /* @__PURE__ */ new Set([module.path]), 0)) {
-      findings.push({
+      findings2.push({
         ruleId: "deep-dependency-chain",
         category: "architecture",
         severity: "warning",
@@ -657,157 +928,23 @@ function evaluateRules(graph, config) {
       });
     }
   }
-  return findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+  return findings2.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
 }
 
 // src/analysis/scan.ts
-import { readFile as readFile6 } from "fs/promises";
-import { join as join5, resolve as resolve5 } from "path";
-import fastGlob2 from "fast-glob";
-
-// src/analysis/parse.ts
-import ts from "typescript";
-function hasModifier(node, kind) {
-  return ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) === true;
-}
-function containsJsx(node) {
-  if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)) return true;
-  return ts.forEachChild(node, containsJsx) === true;
-}
-function importNames(clause) {
-  if (!clause) return [];
-  const names = [];
-  if (clause.name) names.push("default");
-  if (clause.namedBindings) {
-    if (ts.isNamespaceImport(clause.namedBindings)) names.push("*");
-    else for (const item of clause.namedBindings.elements) names.push(item.propertyName?.text ?? item.name.text);
-  }
-  return names;
-}
-function sourceKind(path) {
-  if (path.endsWith(".tsx")) return ts.ScriptKind.TSX;
-  if (path.endsWith(".jsx")) return ts.ScriptKind.JSX;
-  if (path.endsWith(".js") || path.endsWith(".mjs") || path.endsWith(".cjs")) return ts.ScriptKind.JS;
-  return ts.ScriptKind.TS;
-}
-function parseModule(path, contents) {
-  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
-  const imports = [];
-  const exports = [];
-  const typeExports = [];
-  let jsxDepth = 0;
-  let complexity = 1;
-  let componentCount = 0;
-  for (const node of source.statements) {
-    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
-      imports.push({
-        specifier: node.moduleSpecifier.text,
-        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
-        importedNames: importNames(node.importClause),
-        isTypeOnly: node.importClause?.isTypeOnly ?? false
-      });
-    }
-    if (ts.isExportDeclaration(node)) {
-      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
-        imports.push({
-          specifier: node.moduleSpecifier.text,
-          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
-          importedNames: node.exportClause && ts.isNamedExports(node.exportClause) ? node.exportClause.elements.map((item) => item.propertyName?.text ?? item.name.text) : ["*"],
-          isTypeOnly: node.isTypeOnly
-        });
-      }
-      if (node.exportClause && ts.isNamedExports(node.exportClause)) {
-        exports.push(...node.exportClause.elements.map((item) => item.name.text));
-        if (node.isTypeOnly) typeExports.push(...node.exportClause.elements.map((item) => item.name.text));
-      }
-    }
-    if (hasModifier(node, ts.SyntaxKind.ExportKeyword)) {
-      if (hasModifier(node, ts.SyntaxKind.DefaultKeyword)) exports.push("default");
-      else if (ts.isVariableStatement(node)) {
-        for (const declaration of node.declarationList.declarations) {
-          if (ts.isIdentifier(declaration.name)) exports.push(declaration.name.text);
-        }
-      } else if ("name" in node && node.name && ts.isIdentifier(node.name)) {
-        const name = node.name.text;
-        exports.push(name);
-        if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node)) typeExports.push(name);
-      }
-    }
-    if (ts.isFunctionDeclaration(node) && node.name && /^[A-Z]/.test(node.name.text) && containsJsx(node)) {
-      componentCount++;
-    }
-    if (ts.isVariableStatement(node)) {
-      for (const declaration of node.declarationList.declarations) {
-        if (ts.isIdentifier(declaration.name) && /^[A-Z]/.test(declaration.name.text) && declaration.initializer && containsJsx(declaration.initializer)) {
-          componentCount++;
-        }
-      }
-    }
-  }
-  function visit(node, depth) {
-    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
-      const argument = node.arguments[0];
-      if (argument && ts.isStringLiteralLike(argument)) {
-        imports.push({
-          specifier: argument.text,
-          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
-          importedNames: ["*"],
-          isTypeOnly: false
-        });
-      }
-    }
-    const isJsx = ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
-    const nextDepth = depth + (isJsx ? 1 : 0);
-    jsxDepth = Math.max(jsxDepth, nextDepth);
-    if (ts.isIfStatement(node) || ts.isForStatement(node) || ts.isForOfStatement(node) || ts.isForInStatement(node) || ts.isWhileStatement(node) || ts.isDoStatement(node) || ts.isCatchClause(node) || ts.isConditionalExpression(node) || ts.isCaseBlock(node)) complexity++;
-    if (ts.isBinaryExpression(node) && [ts.SyntaxKind.AmpersandAmpersandToken, ts.SyntaxKind.BarBarToken].includes(node.operatorToken.kind)) {
-      complexity++;
-    }
-    ts.forEachChild(node, (child) => visit(child, nextDepth));
-  }
-  visit(source, 0);
-  return {
-    path,
-    imports,
-    exports: [...new Set(exports)].sort(),
-    typeExports: [...new Set(typeExports)].sort(),
-    lines: contents.split(/\r?\n/).length,
-    jsxDepth,
-    componentCount,
-    complexity,
-    isRoute: /(^|\/)(app|pages)\/.+(page|layout|route|index)\.[cm]?[jt]sx?$/.test(path) || /(^|\/)app\/(page|layout|route)\.[cm]?[jt]sx?$/.test(path)
-  };
-}
-function moduleParseDiagnostics(path, contents) {
-  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
-  const diagnostics = source.parseDiagnostics ?? [];
-  const messages = diagnostics.map((diagnostic) => {
-    const line = source.getLineAndCharacterOfPosition(diagnostic.start ?? 0).line + 1;
-    return `${path}:${line}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")}`;
-  });
-  function visit(node) {
-    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
-      const argument = node.arguments[0];
-      if (!argument || !ts.isStringLiteralLike(argument)) {
-        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
-        messages.push(`${path}:${line}: nonliteral dynamic import or require cannot be analyzed`);
-      }
-    }
-    ts.forEachChild(node, visit);
-  }
-  visit(source);
-  return messages;
-}
+import { readFile as readFile7 } from "fs/promises";
+import { join as join6, resolve as resolve5 } from "path";
+import fastGlob3 from "fast-glob";
 
 // src/analysis/resolve.ts
-import { readFile as readFile5, stat } from "fs/promises";
-import { dirname as dirname2, extname, join as join4, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
+import { readFile as readFile6, stat } from "fs/promises";
+import { dirname as dirname3, extname, join as join5, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
 import ts2 from "typescript";
 async function compilerOptions(root) {
-  const path = join4(root, "tsconfig.json");
+  const path = join5(root, "tsconfig.json");
   let content;
   try {
-    content = await readFile5(path, "utf8");
+    content = await readFile6(path, "utf8");
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return { options: {}, diagnostics: [] };
     throw error;
@@ -884,7 +1021,7 @@ async function viteAliasDiagnostics(root, options, aliases) {
     var visit = visit2;
     let sourceText;
     try {
-      sourceText = await readFile5(join4(root, file), "utf8");
+      sourceText = await readFile6(join5(root, file), "utf8");
     } catch (error) {
       if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") continue;
       throw error;
@@ -915,12 +1052,12 @@ async function resolveImportsDetailed(root, modules, aliases = {}) {
   diagnostics.push(...await viteAliasDiagnostics(root, options, aliases));
   const files = new Set(modules.map((module) => module.path));
   for (const module of modules) {
-    const from = join4(root, module.path);
+    const from = join5(root, module.path);
     for (const imported of module.imports) {
       const specifier = imported.specifier.split("?")[0];
       const matchingAlias = Object.keys(aliases).sort((a, b) => b.length - a.length).find((prefix) => specifier.startsWith(prefix));
       const aliasTarget = matchingAlias ? resolve4(root, aliases[matchingAlias], specifier.slice(matchingAlias.length)) : void 0;
-      const candidate = aliasTarget ? relative4(dirname2(from), aliasTarget).replaceAll("\\", "/") : specifier;
+      const candidate = aliasTarget ? relative4(dirname3(from), aliasTarget).replaceAll("\\", "/") : specifier;
       const lookup = aliasTarget && !candidate.startsWith(".") ? `./${candidate}` : candidate;
       const result = ts2.resolveModuleName(lookup, from, options, ts2.sys).resolvedModule;
       const localAlias = Object.keys(options.paths ?? {}).some((pattern) => {
@@ -929,7 +1066,7 @@ async function resolveImportsDetailed(root, modules, aliases = {}) {
       });
       const isLocal = specifier.startsWith(".") || localAlias || aliasTarget !== void 0 || /^[~@#]\//.test(specifier);
       if (!result) {
-        const assetPath = aliasTarget ?? (specifier.startsWith(".") ? resolve4(dirname2(from), specifier) : void 0);
+        const assetPath = aliasTarget ?? (specifier.startsWith(".") ? resolve4(dirname3(from), specifier) : void 0);
         const assetRelative = assetPath ? relative4(root, assetPath) : void 0;
         if (assetRelative && (assetRelative === ".." || assetRelative.startsWith(`..${sep3}`))) {
           diagnostics.push(`${module.path}:${imported.line}: local import escapes app root ${imported.specifier}`);
@@ -955,7 +1092,7 @@ async function resolveImportsDetailed(root, modules, aliases = {}) {
 // src/analysis/scan.ts
 async function scanProjectDetailed(projectRoot, aliases = {}) {
   const root = resolve5(projectRoot);
-  const files = await fastGlob2("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
+  const files = await fastGlob3("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
     cwd: root,
     onlyFiles: true,
     unique: true,
@@ -965,7 +1102,7 @@ async function scanProjectDetailed(projectRoot, aliases = {}) {
   });
   const parsed = await Promise.all(files.sort().map(async (path) => {
     const normalized = path.replaceAll("\\", "/");
-    const contents = await readFile6(join5(root, path), "utf8");
+    const contents = await readFile7(join6(root, path), "utf8");
     return { module: parseModule(normalized, contents), diagnostics: moduleParseDiagnostics(normalized, contents) };
   }));
   const modules = parsed.map((item) => item.module);
@@ -986,10 +1123,10 @@ function grade(score) {
   if (score >= 55) return "D";
   return "F";
 }
-function scoreFindings(findings, config) {
+function scoreFindings(findings2, config) {
   const penalties = { error: 18, warning: 7, info: 2 };
   const categories = Object.entries(config.weights).map(([id, weight]) => {
-    const categoryFindings = findings.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
+    const categoryFindings = findings2.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
     const occurrences = /* @__PURE__ */ new Map();
     let deduction = 0;
     for (const finding of categoryFindings) {
@@ -1001,16 +1138,16 @@ function scoreFindings(findings, config) {
     return { id, weight, score: round(100 - deduction), deduction: round(deduction), findingCount: categoryFindings.length };
   });
   const weightedDeduction = round(categories.reduce((sum, category) => sum + category.deduction * category.weight / 100, 0));
-  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings.length - 10) * 0.15));
-  const criticalAdjustment = round(Math.min(10, findings.filter((finding) => finding.severity === "error").length * 1.5));
+  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings2.length - 10) * 0.15));
+  const criticalAdjustment = round(Math.min(10, findings2.filter((finding) => finding.severity === "error").length * 1.5));
   const score = round(Math.max(0, Math.min(100, 100 - weightedDeduction - maintenanceAdjustment - criticalAdjustment)));
   return { score, grade: grade(score), weightedDeduction, maintenanceAdjustment, criticalAdjustment, categories };
 }
 
 // src/governance/inventory.ts
 import { createHash as createHash2 } from "crypto";
-import { readFile as readFile7, realpath } from "fs/promises";
-import { isAbsolute, join as join6, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
+import { readFile as readFile8, realpath } from "fs/promises";
+import { isAbsolute, join as join7, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
 var profiles2 = /* @__PURE__ */ new Set(["next", "vite-react", "react"]);
 async function loadInventory(source, scanRoot) {
   const absolute = resolve6(source);
@@ -1018,7 +1155,7 @@ async function loadInventory(source, scanRoot) {
   const inventoryPath = await realpath(absolute);
   const inventoryRelative = relative5(root, inventoryPath);
   if (inventoryRelative === ".." || inventoryRelative.startsWith(`..${sep4}`)) throw new Error("Inventory must be inside scan root");
-  const raw = await readFile7(inventoryPath, "utf8");
+  const raw = await readFile8(inventoryPath, "utf8");
   let value;
   try {
     value = JSON.parse(raw);
@@ -1043,7 +1180,7 @@ async function loadInventory(source, scanRoot) {
     if (seen.has(path)) throw new Error(`Duplicate inventory app ${path}`);
     seen.add(path);
     try {
-      const actual = await realpath(join6(root, path));
+      const actual = await realpath(join7(root, path));
       const rel = relative5(root, actual);
       if (rel === ".." || rel.startsWith(`..${sep4}`)) throw new Error(`App path escapes scan root: ${path}`);
     } catch (error) {
@@ -1065,6 +1202,377 @@ function compareInventory(inventory, discovered, scanRoot) {
   return issues;
 }
 
+// src/governance/evidence.ts
+import { createHash as createHash3 } from "crypto";
+import { execFile } from "child_process";
+import { createReadStream } from "fs";
+import { lstat, readFile as readFile9, realpath as realpath2 } from "fs/promises";
+import { dirname as dirname4, join as join8, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { promisify } from "util";
+import fg from "fast-glob";
+var execFileAsync = promisify(execFile);
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function string(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function nonnegative(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function errors(value) {
+  return Array.isArray(value) && value.every(string);
+}
+function findings(value) {
+  return Array.isArray(value) && value.every((item) => object(item) && string(item.id) && string(item.severity) && string(item.subject) && string(item.message) && (item.remediation === void 0 || string(item.remediation)));
+}
+function base(value) {
+  return object(value) && string(value.tool) && string(value.version) && typeof value.complete === "boolean" && errors(value.errors);
+}
+function validateApp(value) {
+  if (!object(value) || !string(value.path) || !string(value.profile)) return false;
+  const dependency = value.dependencySecurity;
+  const quality = value.codeQuality;
+  const security = value.codeSecurity;
+  const compatibility = value.compatibility;
+  if (!base(dependency) || !nonnegative(dependency.packagesScanned) || !findings(dependency.advisories)) return false;
+  if (!object(quality) || !object(quality.lint) || !string(quality.lint.tool) || !string(quality.lint.version) || typeof quality.lint.complete !== "boolean" || !base(quality.typecheck) || !base(quality.tests) || !base(quality.coverage)) return false;
+  if (!nonnegative(quality.lint.filesScanned) || !nonnegative(quality.lint.errorCount) || !nonnegative(quality.lint.warnings) || !errors(quality.lint.errorsDetail) || typeof quality.typecheck.passed !== "boolean" || quality.typecheck.applicable !== void 0 && typeof quality.typecheck.applicable !== "boolean" || !nonnegative(quality.tests.passed) || !nonnegative(quality.tests.failed) || typeof quality.coverage.linesPercent !== "number" || !Number.isFinite(quality.coverage.linesPercent) || quality.coverage.linesPercent < 0 || quality.coverage.linesPercent > 100) return false;
+  if (!object(security) || !base(security.sast) || !base(security.secrets) || !nonnegative(security.sast.filesScanned) || !nonnegative(security.secrets.filesScanned) || !findings(security.sast.findings) || !findings(security.secrets.findings)) return false;
+  if (!base(compatibility) || !Array.isArray(compatibility.projects) || !compatibility.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.emulatedOs === void 0 || string(project.emulatedOs)) && (project.emulatedOsVersion === void 0 || string(project.emulatedOsVersion)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  if (value.accessibility !== void 0) {
+    const accessibility = value.accessibility;
+    if (!base(accessibility) || !Array.isArray(accessibility.scans) || !accessibility.scans.every((scan) => object(scan) && string(scan.project) && string(scan.route) && /^\/[^?#]*$/.test(scan.route) && string(scan.axeVersion) && /^\d+\.\d+\.\d+$/.test(scan.axeVersion) && Array.isArray(scan.tags) && scan.tags.length > 0 && scan.tags.every(string) && new Set(scan.tags).size === scan.tags.length && nonnegative(scan.checks) && scan.checks > 0 && nonnegative(scan.needsReview) && findings(scan.violations))) return false;
+  }
+  return true;
+}
+async function hashFile(hash, path) {
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+}
+async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
+  const root = resolve7(scanRoot);
+  const workspace = resolve7(workspaceRoot);
+  const scanRelative = relative6(workspace, root);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  const paths = await fg("**/*", {
+    cwd: root,
+    dot: true,
+    onlyFiles: true,
+    followSymbolicLinks: false,
+    ignore: [
+      "**/.git/**",
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.next/**",
+      "**/coverage/**",
+      "**/playwright-report/**",
+      "**/test-results/**",
+      "**/.nklattice-governance/**",
+      "**/.nklattice-report/**",
+      "**/AGENTS.md",
+      "**/*.tsbuildinfo",
+      "**/next-env.d.ts"
+    ]
+  });
+  paths.sort();
+  const hash = createHash3("sha256");
+  for (const path of paths) {
+    const absolute = resolve7(root, path);
+    const normalized = relative6(root, absolute);
+    if (normalized === ".." || normalized.startsWith(`..${sep5}`)) throw new Error("Input path escapes scan root");
+    if (!(await lstat(absolute)).isFile()) continue;
+    hash.update(path.replaceAll("\\", "/"));
+    hash.update("\0");
+    await hashFile(hash, absolute);
+    hash.update("\0");
+  }
+  let ancestor = root;
+  while (ancestor === workspace || ancestor !== dirname4(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
+    for (const name of [
+      "package.json",
+      "package-lock.json",
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "eslint.config.js",
+      "eslint.config.mjs",
+      "eslint.config.cjs",
+      "eslint.config.ts",
+      "eslint.config.mts",
+      "vitest.config.js",
+      "vitest.config.mjs",
+      "vitest.config.ts",
+      "vitest.config.mts",
+      "playwright.config.js",
+      "playwright.config.mjs",
+      "playwright.config.ts",
+      "playwright.config.mts",
+      ".semgrep.yml",
+      ".semgrep.yaml",
+      "semgrep.yml",
+      "semgrep.yaml"
+    ]) {
+      const path = join8(ancestor, name);
+      try {
+        const stat2 = await lstat(path);
+        if (stat2.isSymbolicLink()) throw new Error(`Symlinked scanner configuration is unsupported: ${path}`);
+        if (!stat2.isFile()) continue;
+        hash.update(relative6(workspace, path).replaceAll("\\", "/"));
+        hash.update("\0");
+        await hashFile(hash, path);
+        hash.update("\0");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    if (ancestor === workspace) break;
+    ancestor = dirname4(ancestor);
+  }
+  return hash.digest("hex");
+}
+async function loadScanEvidence(path, scanRoot, workspaceRoot, policySha256, maximumAgeHours) {
+  const source = resolve7(path);
+  const stat2 = await lstat(source);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.size > 1e7) throw new Error("Evidence must be a regular JSON file under 10 MB");
+  const root = resolve7(scanRoot);
+  const relativePath = relative6(root, source);
+  if (relativePath !== ".." && !relativePath.startsWith(`..${sep5}`)) throw new Error("Evidence file must be outside the scan root");
+  const actualRoot = await realpath2(root);
+  const actualSource = await realpath2(source);
+  const actualRelative = relative6(actualRoot, actualSource);
+  if (actualRelative !== ".." && !actualRelative.startsWith(`..${sep5}`)) throw new Error("Evidence file resolves inside the scan root");
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile9(source, "utf8"));
+  } catch {
+    throw new Error("Evidence is not valid JSON");
+  }
+  return validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha256, maximumAgeHours);
+}
+async function validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha256, maximumAgeHours) {
+  if (!object(parsed) || parsed.schemaVersion !== 1 || !string(parsed.generatedAt) || !string(parsed.policySha256) || !string(parsed.inputSha256) || !string(parsed.commit) || !/^[0-9a-f]{40}$/.test(parsed.commit) || !Array.isArray(parsed.apps) || !parsed.apps.every(validateApp)) throw new Error("Evidence schema is invalid or incomplete");
+  if (parsed.policySha256 !== policySha256) throw new Error("Evidence was generated for another policy");
+  const generatedAt = Date.parse(parsed.generatedAt);
+  if (!Number.isFinite(generatedAt) || generatedAt > Date.now() + 6e4 || Date.now() - generatedAt > maximumAgeHours * 36e5) {
+    throw new Error("Evidence is stale or has an invalid timestamp");
+  }
+  if (parsed.inputSha256 !== await hashAssessmentInputs(scanRoot, workspaceRoot)) throw new Error("Evidence inputs changed after scanning");
+  const current = (await execFileAsync("git", ["rev-parse", "HEAD"], { cwd: workspaceRoot })).stdout.trim();
+  if (!/^[0-9a-f]{40}$/.test(current) || parsed.commit !== current) throw new Error("Evidence commit differs from the checked-out commit");
+  const appPaths = parsed.apps.map((app) => app.path);
+  if (new Set(appPaths).size !== appPaths.length) throw new Error("Evidence contains duplicate app paths");
+  return parsed;
+}
+var incomplete = (issues, tool, version, scanned) => ({ status: "incomplete", issues, tool, version, scanned });
+function numericVersion(value) {
+  if (!value || !/^(0|[1-9]\d*)(?:\.(0|[1-9]\d*)){0,3}$/.test(value)) return void 0;
+  const parts = value.split(".").map(Number);
+  return parts.every(Number.isSafeInteger) ? parts : void 0;
+}
+function belowVersion(actual, minimum) {
+  for (let index = 0; index < Math.max(actual.length, minimum.length); index++) {
+    if ((actual[index] ?? 0) < (minimum[index] ?? 0)) return true;
+    if ((actual[index] ?? 0) > (minimum[index] ?? 0)) return false;
+  }
+  return false;
+}
+function evaluateAppEvidence(app, policy) {
+  if (!app) {
+    const missing = incomplete(["No fresh scan evidence for this app"]);
+    return {
+      dependencySecurity: { ...missing },
+      codeQuality: { ...missing },
+      codeSecurity: { ...missing },
+      compatibility: { ...missing },
+      ...policy.accessibility ? { accessibility: { ...missing } } : {}
+    };
+  }
+  const dependency = app.dependencySecurity;
+  let dependencySecurity;
+  if (!dependency.complete || dependency.packagesScanned === 0 || dependency.errors.length) {
+    dependencySecurity = { ...incomplete(["Dependency advisory scan did not cover the lockfile", ...dependency.errors], dependency.tool, dependency.version, dependency.packagesScanned), findings: dependency.advisories };
+  } else {
+    const high2 = dependency.advisories.filter((item) => item.severity.toLowerCase() === "high").length;
+    const critical2 = dependency.advisories.filter((item) => item.severity.toLowerCase() === "critical").length;
+    const unknown = dependency.advisories.filter((item) => !["low", "moderate", "medium", "high", "critical"].includes(item.severity.toLowerCase()));
+    dependencySecurity = unknown.length ? { ...incomplete([`${unknown.length} advisories have unknown severity`], dependency.tool, dependency.version, dependency.packagesScanned), findings: dependency.advisories } : {
+      status: high2 > policy.dependencySecurity.maximumHigh || critical2 > policy.dependencySecurity.maximumCritical ? "fail" : "pass",
+      issues: [
+        ...high2 > policy.dependencySecurity.maximumHigh ? [`${high2} high advisories exceed ${policy.dependencySecurity.maximumHigh}`] : [],
+        ...critical2 > policy.dependencySecurity.maximumCritical ? [`${critical2} critical advisories exceed ${policy.dependencySecurity.maximumCritical}`] : []
+      ],
+      tool: dependency.tool,
+      version: dependency.version,
+      scanned: dependency.packagesScanned,
+      findings: dependency.advisories
+    };
+  }
+  const quality = app.codeQuality;
+  const qualityMissing = [
+    ...!quality.lint.complete || quality.lint.filesScanned === 0 ? ["ESLint did not scan source files", ...quality.lint.errorsDetail] : [],
+    ...policy.codeQuality.requireTypecheck && !quality.typecheck.complete ? ["TypeScript typecheck did not complete", ...quality.typecheck.errors] : [],
+    ...policy.codeQuality.requireTests && (!quality.tests.complete || quality.tests.passed + quality.tests.failed === 0) ? ["Tests did not run", ...quality.tests.errors] : [],
+    ...!quality.coverage.complete ? ["Line coverage is unavailable", ...quality.coverage.errors] : []
+  ];
+  const qualityFailures = [
+    ...quality.lint.errorCount > policy.codeQuality.maximumLintErrors ? [`${quality.lint.errorCount} ESLint errors exceed ${policy.codeQuality.maximumLintErrors}`] : [],
+    ...policy.codeQuality.requireTypecheck && !quality.typecheck.passed ? ["TypeScript typecheck failed"] : [],
+    ...quality.tests.failed > 0 ? [`${quality.tests.failed} tests failed`] : [],
+    ...quality.coverage.linesPercent < policy.codeQuality.minimumLineCoverage ? [`Line coverage ${quality.coverage.linesPercent}% is below ${policy.codeQuality.minimumLineCoverage}%`] : []
+  ];
+  const qualityVersion = `ESLint ${quality.lint.version} \xB7 TypeScript ${quality.typecheck.version} \xB7 Vitest ${quality.tests.version}`;
+  const qualityMetrics = {
+    lintErrors: quality.lint.errorCount,
+    lintWarnings: quality.lint.warnings,
+    typecheck: quality.typecheck.applicable === false ? "not applicable" : quality.typecheck.passed ? "pass" : "fail",
+    testsPassed: quality.tests.passed,
+    testsFailed: quality.tests.failed,
+    lineCoveragePercent: quality.coverage.linesPercent
+  };
+  const codeQuality = qualityMissing.length ? { ...incomplete([...qualityMissing, ...qualityFailures], "ESLint / TypeScript / tests", qualityVersion, quality.lint.filesScanned), metrics: qualityMetrics } : {
+    status: qualityFailures.length ? "fail" : "pass",
+    issues: qualityFailures,
+    tool: "ESLint / TypeScript / tests",
+    version: qualityVersion,
+    scanned: quality.lint.filesScanned,
+    metrics: qualityMetrics
+  };
+  const security = app.codeSecurity;
+  const securityMissing = [
+    ...!security.sast.complete || security.sast.filesScanned === 0 ? ["SAST did not scan source files", ...security.sast.errors] : [],
+    ...!security.secrets.complete || security.secrets.filesScanned === 0 ? ["Secret scanner did not scan source files", ...security.secrets.errors] : []
+  ];
+  const high = security.sast.findings.filter((item) => item.severity.toLowerCase() === "high").length;
+  const critical = security.sast.findings.filter((item) => item.severity.toLowerCase() === "critical").length;
+  const unknownSecurity = security.sast.findings.filter((item) => !["low", "moderate", "medium", "high", "critical"].includes(item.severity.toLowerCase()));
+  if (unknownSecurity.length) securityMissing.push(`${unknownSecurity.length} SAST findings have unknown severity`);
+  const securityFailures = [
+    ...high > policy.codeSecurity.maximumHigh ? [`${high} high SAST findings exceed ${policy.codeSecurity.maximumHigh}`] : [],
+    ...critical > policy.codeSecurity.maximumCritical ? [`${critical} critical SAST findings exceed ${policy.codeSecurity.maximumCritical}`] : [],
+    ...security.secrets.findings.length > policy.codeSecurity.maximumSecrets ? [`${security.secrets.findings.length} detected secrets exceed ${policy.codeSecurity.maximumSecrets}`] : []
+  ];
+  const securityVersion = `Semgrep ${security.sast.version} \xB7 Gitleaks ${security.secrets.version}`;
+  const codeSecurity = securityMissing.length ? { ...incomplete([...securityMissing, ...securityFailures], "Semgrep / Gitleaks", securityVersion, security.sast.filesScanned), findings: [...security.sast.findings, ...security.secrets.findings] } : {
+    status: securityFailures.length ? "fail" : "pass",
+    issues: securityFailures,
+    tool: "Semgrep / Gitleaks",
+    version: securityVersion,
+    scanned: security.sast.filesScanned,
+    findings: [...security.sast.findings, ...security.secrets.findings]
+  };
+  const compatibility = app.compatibility;
+  const projectNames = new Set(compatibility.projects.map((project) => project.name));
+  const missingProjects = policy.compatibility.requiredProjects.filter((name) => !projectNames.has(name));
+  const incompleteProjects = compatibility.projects.filter((project) => project.passed + project.failed < policy.compatibility.minimumTestsPerProject);
+  const missingBrowserVersions = compatibility.projects.filter((project) => !project.browserVersion);
+  const expectedEngines = {
+    "chromium-desktop": "chromium",
+    "firefox-desktop": "firefox",
+    "webkit-desktop": "webkit",
+    "android-chrome": "chromium",
+    "iphone-safari": "webkit"
+  };
+  const invalidEngines = compatibility.projects.filter((project) => expectedEngines[project.name] && project.engine !== expectedEngines[project.name]);
+  const invalidDevices = compatibility.projects.filter((project) => (project.name === "android-chrome" || project.name === "iphone-safari") && (project.mobile !== true || !project.device));
+  const missingViewports = compatibility.projects.filter((project) => new Set(project.viewportWidths ?? []).size < 2);
+  const versionEvidenceMissing = [];
+  const versionFailures = [];
+  for (const [name, minimum] of Object.entries(policy.compatibility.minimumTestedBrowserVersions ?? {})) {
+    const project = compatibility.projects.find((item) => item.name === name);
+    if (!project) continue;
+    const actual = numericVersion(project.browserVersion);
+    if (!actual) versionEvidenceMissing.push(`${name} did not record a valid measured browser version`);
+    else if (belowVersion(actual, numericVersion(minimum))) {
+      versionFailures.push(`${name} measured browser version ${project.browserVersion} is below minimum tested browser version ${minimum}`);
+    }
+  }
+  for (const [name, minimum] of Object.entries(policy.compatibility.minimumEmulatedOsVersions ?? {})) {
+    const project = compatibility.projects.find((item) => item.name === name);
+    if (!project) continue;
+    const expectedOs = name === "android-chrome" ? "Android" : "iOS";
+    const actual = numericVersion(project.emulatedOsVersion);
+    if (project.emulatedOs !== expectedOs || !actual) {
+      versionEvidenceMissing.push(`${name} did not record a valid emulated ${expectedOs} version`);
+    } else if (belowVersion(actual, numericVersion(minimum))) {
+      versionFailures.push(`${name} emulated ${expectedOs} version ${project.emulatedOsVersion} is below minimum emulated ${expectedOs} version ${minimum}`);
+    }
+  }
+  const compatibilityMissing = [
+    ...!compatibility.complete ? ["Compatibility test run did not complete", ...compatibility.errors] : [],
+    ...missingProjects.length ? [`Missing Playwright projects: ${missingProjects.join(", ")}`] : [],
+    ...incompleteProjects.map((project) => `${project.name} ran fewer than ${policy.compatibility.minimumTestsPerProject} tests`),
+    ...missingBrowserVersions.map((project) => `${project.name} did not record its browser engine version`),
+    ...invalidEngines.map((project) => `${project.name} used ${project.engine ?? "an unverified engine"} instead of ${expectedEngines[project.name]}`),
+    ...invalidDevices.map((project) => `${project.name} did not verify mobile emulation settings`),
+    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`),
+    ...versionEvidenceMissing
+  ];
+  const failedProjects = compatibility.projects.filter((project) => project.failed > 0);
+  const testFailures = failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`);
+  const matrix = compatibility.projects.map((project) => ({
+    ...project,
+    minimumTestedBrowserVersion: policy.compatibility.minimumTestedBrowserVersions?.[project.name],
+    minimumEmulatedOsVersion: policy.compatibility.minimumEmulatedOsVersions?.[project.name]
+  }));
+  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...testFailures, ...versionFailures], compatibility.tool, compatibility.version), matrix } : {
+    status: testFailures.length || versionFailures.length ? "fail" : "pass",
+    issues: [...testFailures, ...versionFailures],
+    tool: compatibility.tool,
+    version: compatibility.version,
+    scanned: compatibility.projects.reduce((count, project) => count + project.passed + project.failed, 0),
+    matrix
+  };
+  let accessibilityDomain;
+  if (policy.accessibility) {
+    const rules = policy.accessibility;
+    const result = app.accessibility;
+    if (!result) accessibilityDomain = incomplete(["Accessibility scan evidence is missing"]);
+    else {
+      const missing = [...!result.complete || result.errors.length ? ["Accessibility scan did not complete", ...result.errors] : []];
+      for (const project of rules.requiredProjects) {
+        const scans = result.scans.filter((scan) => scan.project === project);
+        if (scans.length < rules.minimumScansPerProject) missing.push(`${project} has fewer than ${rules.minimumScansPerProject} accessibility scans`);
+      }
+      for (const scan of result.scans) {
+        if (scan.checks < rules.minimumChecksPerScan) missing.push(`${scan.project} ${scan.route} checked fewer than ${rules.minimumChecksPerScan} axe rules`);
+        if (rules.requiredTags.some((tag) => !scan.tags.includes(tag))) missing.push(`${scan.project} ${scan.route} omitted required WCAG tags`);
+        const measuredVersion2 = numericVersion(scan.axeVersion);
+        if (!measuredVersion2) missing.push(`${scan.project} ${scan.route} did not record a valid axe-core version`);
+        else if (belowVersion(measuredVersion2, numericVersion(rules.minimumAxeVersion))) {
+          missing.push(`${scan.project} ${scan.route} used axe-core ${scan.axeVersion} below ${rules.minimumAxeVersion}`);
+        }
+      }
+      const findings2 = result.scans.flatMap((scan) => scan.violations);
+      const needsReview = result.scans.reduce((sum, scan) => sum + scan.needsReview, 0);
+      if (needsReview > rules.maximumNeedsReview) missing.push(`${needsReview} axe checks need manual review (maximum ${rules.maximumNeedsReview})`);
+      const failures = findings2.length > rules.maximumViolations ? [`${findings2.length} accessibility violations exceed ${rules.maximumViolations}`] : [];
+      const details = {
+        tool: result.tool,
+        version: result.version,
+        scanned: result.scans.length,
+        findings: findings2,
+        metrics: { scans: result.scans.length, axeChecks: result.scans.reduce((sum, scan) => sum + scan.checks, 0), needsReview },
+        routes: result.scans.map((scan) => ({
+          project: scan.project,
+          route: scan.route,
+          axeVersion: scan.axeVersion,
+          checks: scan.checks,
+          needsReview: scan.needsReview
+        }))
+      };
+      accessibilityDomain = failures.length ? { status: "fail", issues: [...failures, ...missing], ...details } : missing.length ? { ...incomplete(missing, result.tool, result.version, result.scans.length), ...details } : { status: "pass", issues: [], ...details };
+    }
+  }
+  return {
+    dependencySecurity,
+    codeQuality,
+    codeSecurity,
+    compatibility: compatibilityDomain,
+    ...accessibilityDomain ? { accessibility: accessibilityDomain } : {}
+  };
+}
+
 // src/governance/assess.ts
 var notEvaluated = [
   "vulnerability databases",
@@ -1085,27 +1593,52 @@ function escapeHtml(value) {
   return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
 function renderAssessmentHtml(report) {
+  const labels = {
+    inventory: "App inventory",
+    dependencies: "Dependency policy",
+    architecture: "Architecture",
+    dependencySecurity: "Dependency security",
+    codeQuality: "Code quality",
+    codeSecurity: "Code security",
+    compatibility: "Browser compatibility",
+    accessibility: "Accessibility"
+  };
+  const domainNames = report.apps.length ? Object.keys(report.apps[0].domains) : [];
+  const overview = domainNames.map((name) => {
+    const statuses = report.apps.map((app) => app.domains[name]?.status ?? "incomplete");
+    const status = statusOf(statuses);
+    const passed = statuses.filter((item) => item === "pass").length;
+    return `<li><span>${escapeHtml(labels[name] ?? name)}</span><strong class="${status}">${escapeHtml(status)}</strong><small>${passed}/${report.apps.length} apps passed</small></li>`;
+  }).join("");
   const apps = report.apps.map((app) => {
-    const domains = Object.entries(app.domains).map(([name, domain]) => `<tr><th scope="row">${escapeHtml(name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}</td></tr>`).join("");
+    const domains = Object.entries(app.domains).map(([name, domain]) => {
+      const evidence = domain;
+      const identity = evidence.tool ? `<p><small>${escapeHtml(evidence.tool)} ${escapeHtml(evidence.version ?? "")} \xB7 scanned ${escapeHtml(evidence.scanned ?? "unknown")}</small></p>` : "";
+      const metrics = evidence.metrics ? `<p><small>${Object.entries(evidence.metrics).map(([key, value]) => `${escapeHtml(key)}: ${escapeHtml(value)}`).join(" \xB7 ")}</small></p>` : "";
+      const findings3 = evidence.findings?.length ? `<details><summary>${evidence.findings.length} finding(s)</summary><ul>${evidence.findings.map((item) => `<li><strong>${escapeHtml(item.severity)}</strong> ${escapeHtml(item.id)} \xB7 <code>${escapeHtml(item.subject)}</code> \u2014 ${escapeHtml(item.message)}${item.remediation ? ` \xB7 ${escapeHtml(item.remediation)}` : ""}</li>`).join("")}</ul></details>` : "";
+      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Measured browser / minimum test environment</th><th>Mobile UA emulation / minimum</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml(item.browserVersion ?? "Not recorded")} / ${escapeHtml(item.minimumTestedBrowserVersion ?? "Not set")}</td><td>${escapeHtml(item.device ?? "None")} / ${escapeHtml(item.minimumEmulatedOsVersion ?? "Not set")}</td><td>${escapeHtml(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table><p><small>Version floors check the tested environment. Mobile OS values come from user-agent emulation, not physical devices or a promise of support for older versions.</small></p></div>` : "";
+      const routes = evidence.routes?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Scanned route</th><th>axe-core</th><th>Checks</th><th>Needs review</th></tr></thead><tbody>${evidence.routes.map((item) => `<tr><th scope="row">${escapeHtml(item.project)}</th><td><code>${escapeHtml(item.route)}</code></td><td>${escapeHtml(item.axeVersion)}</td><td>${item.checks}</td><td>${item.needsReview}</td></tr>`).join("")}</tbody></table><p><small>Only these visited routes were scanned automatically. Manual accessibility review remains outside this result.</small></p></div>` : "";
+      return `<tr><th scope="row">${escapeHtml(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}${routes}</td></tr>`;
+    }).join("");
     const architecture = app.domains.architecture;
     const categoryRows = architecture.scoreBreakdown?.categories.map((category) => `<tr><th scope="row">${escapeHtml(category.id)}</th><td>${escapeHtml(category.weight)}%</td><td>${escapeHtml(category.score)}</td><td>${escapeHtml(category.findingCount)}</td></tr>`).join("") ?? "";
-    const findings = architecture.findings.map((finding) => `<tr><td>${escapeHtml(finding.severity)}</td><td>${escapeHtml(finding.ruleId)}</td><td><code>${escapeHtml(finding.file)}:${finding.line}</code></td><td>${escapeHtml(finding.evidence)}</td></tr>`).join("");
-    return `<section class="app"><h2>${escapeHtml(app.path)} <span class="${app.status}">${escapeHtml(app.status)}</span></h2><p>Profile: ${escapeHtml(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings}</tbody></table></div></details>` : ""}</section>`;
+    const findings2 = architecture.findings.map((finding) => `<tr><td>${escapeHtml(finding.severity)}</td><td>${escapeHtml(finding.ruleId)}</td><td><code>${escapeHtml(finding.file)}:${finding.line}</code></td><td>${escapeHtml(finding.evidence)}</td></tr>`).join("");
+    return `<section class="app"><h2>${escapeHtml(app.path)} <span class="${app.status}">${escapeHtml(app.status)}</span></h2><p>Profile: ${escapeHtml(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings2 ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings2}</tbody></table></div></details>` : ""}</section>`;
   }).join("");
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>NKLattice governance assessment</title><style>
-  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f6f7f5;color:#1b2925}body{max-width:1100px;margin:auto;padding:2rem 1rem}header,.app,.meta{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:9rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}
-  </style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s)</p></header><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml(report.policy.version)} \xB7 <code>${escapeHtml(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml(report.inventory.source)}</code></p>${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml).join(", ")}.</p></section></body></html>
+  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f3f6f4;color:#1b2925}body{max-width:1160px;margin:auto;padding:2rem 1rem}header,.app,.meta,.overview{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}header{background:#13231d;color:#f5f8f4;padding:2rem}header small{color:#9de2bc;font-weight:700;letter-spacing:.12em}header p{color:#c8d6ce}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}header .pass{color:#9de2bc}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:12rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}.domain-overview{list-style:none;display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:.65rem;padding:0;margin:1rem 0 0}.domain-overview li{border:1px solid #d9e1dc;background:#f8faf8;border-radius:8px;padding:.9rem;display:grid;grid-template-columns:1fr auto;gap:.35rem}.domain-overview li small{grid-column:1/-1}.domain-overview li+li{margin:0}
+  @media(max-width:800px){.domain-overview{grid-template-columns:repeat(2,minmax(0,1fr))}}@media(max-width:480px){.domain-overview{grid-template-columns:1fr}}</style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s) \xB7 policy ${escapeHtml(report.policy.version)}</p></header><section class="overview"><h2>Assessment by domain</h2><p>Each status is based on the checked apps and fresh scanner evidence. Open an app below for findings and browser versions.</p><ul class="domain-overview">${overview}</ul></section><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml(report.policy.version)} \xB7 <code>${escapeHtml(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml(basename(report.inventory.source))}</code></p>${report.evidence ? `<p>Scanners: ${escapeHtml(report.evidence.generatedAt)} \xB7 commit <code>${escapeHtml(report.evidence.commit)}</code> \xB7 input <code>${escapeHtml(report.evidence.inputSha256)}</code></p>` : "<p>Scanner evidence unavailable.</p>"}${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml).join(", ")}.</p></section></body></html>
 `;
 }
 async function assessGovernance(options) {
-  const scanRoot = resolve7(options.scanRoot);
-  const workspaceRoot = resolve7(options.workspaceRoot ?? scanRoot);
-  const scanRelative = relative6(workspaceRoot, scanRoot);
-  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  const scanRoot = resolve8(options.scanRoot);
+  const workspaceRoot = resolve8(options.workspaceRoot ?? scanRoot);
+  const scanRelative = relative7(workspaceRoot, scanRoot);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep6}`)) throw new Error("Scan root must be inside workspace root");
   if (!options.policy.assessment) throw new Error("Policy assessment.architecture is required");
   const assessment = parseAssessmentPolicy(options.policy.assessment);
-  const outputDirectory = resolve7(options.outputDirectory ?? join7(scanRoot, ".nklattice-governance"));
-  const inventorySource = resolve7(options.inventory ?? join7(scanRoot, ".nklattice-apps.json"));
+  const outputDirectory = resolve8(options.outputDirectory ?? join9(scanRoot, ".nklattice-governance"));
+  const inventorySource = resolve8(options.inventory ?? join9(scanRoot, ".nklattice-apps.json"));
   let inventory;
   const issues = [];
   try {
@@ -1124,9 +1657,22 @@ async function assessGovernance(options) {
   if (options.expectedApps !== void 0 && apps.length !== options.expectedApps) {
     issues.push(`Expected ${options.expectedApps} managed apps; discovered ${apps.length}`);
   }
+  let evidence;
+  if (assessment.evidence) {
+    if (!options.evidence && !options.trustedEvidence) issues.push("Scan evidence is required by the policy; run governance collect and pass --evidence");
+    else try {
+      evidence = options.trustedEvidence ? await validateScanEvidence(options.trustedEvidence, scanRoot, workspaceRoot, options.policy.sha256, assessment.evidence.maximumAgeHours) : await loadScanEvidence(options.evidence, scanRoot, workspaceRoot, options.policy.sha256, assessment.evidence.maximumAgeHours);
+    } catch (error) {
+      issues.push(`Scan evidence: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (evidence) {
+      const discovered = new Set(apps.map((app) => relative7(scanRoot, app.directory).replaceAll("\\", "/") || "."));
+      for (const item of evidence.apps) if (!discovered.has(item.path)) issues.push(`Scan evidence contains unrecognized app ${item.path}`);
+    }
+  }
   const results = [];
   for (const app of apps) {
-    const appPath = relative6(scanRoot, app.directory).replaceAll("\\", "/") || ".";
+    const appPath = relative7(scanRoot, app.directory).replaceAll("\\", "/") || ".";
     const inventoryIssues = issues.filter((issue) => issue.includes(appPath) || issue.startsWith("Inventory:") || issue.startsWith("Discovery:"));
     const inventoryDomain = { status: inventoryIssues.length ? "incomplete" : "pass", issues: inventoryIssues };
     const dependencyDomain = { status: "pass", issues: [], findings: [] };
@@ -1179,7 +1725,8 @@ async function assessGovernance(options) {
       architectureDomain.status = "incomplete";
       architectureDomain.issues.push(error instanceof Error ? error.message : String(error));
     }
-    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain };
+    const extra = assessment.evidence ? evaluateAppEvidence(evidence?.apps.find((item) => item.path === appPath && item.profile === app.profile), assessment.evidence) : {};
+    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain, ...extra };
     results.push({ path: appPath, profile: app.profile, status: statusOf(Object.values(domains).map((domain) => domain.status)), domains });
   }
   const report = {
@@ -1187,15 +1734,42 @@ async function assessGovernance(options) {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     status: issues.length ? "incomplete" : statusOf(results.map((app) => app.status)),
     policy: { version: options.policy.policyVersion, source: options.policy.source, sha256: options.policy.sha256 },
+    ...evidence ? { evidence: { source: options.evidence ? resolve8(options.evidence) : "in-process collector", generatedAt: evidence.generatedAt, commit: evidence.commit, inputSha256: evidence.inputSha256 } } : {},
     inventory: { source: inventorySource, sha256: inventory?.sha256, expectedApps: inventory?.apps.length ?? 0, discoveredApps: apps.length },
-    scope: { domains: ["explicit app inventory", "dependency minimums", "source architecture"], notEvaluated },
+    scope: {
+      domains: [
+        "explicit app inventory",
+        "dependency minimums",
+        ...options.policy.managedPackages ? ["conditional managed-library minimums"] : [],
+        "source architecture",
+        ...assessment.evidence ? [
+          "known dependency advisories",
+          "source quality",
+          "source security",
+          "browser and mobile emulation",
+          "tested browser and emulated OS version floors",
+          ...assessment.evidence.accessibility ? ["automated accessibility"] : []
+        ] : []
+      ],
+      notEvaluated: assessment.evidence ? [
+        "licenses",
+        "physical Android/iOS devices",
+        "older browser-version support",
+        "runtime performance",
+        ...assessment.evidence.accessibility ? ["manual accessibility review and unvisited routes"] : ["accessibility"],
+        "cryptographic evidence attestation",
+        "branch protection",
+        "repository access controls",
+        "cross-repository rollout status"
+      ] : notEvaluated
+    },
     issues,
     apps: results
   };
   await mkdir(outputDirectory, { recursive: true });
-  await writeFile(join7(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
+  await writeFile(join9(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
 `);
-  await writeFile(join7(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  await writeFile(join9(outputDirectory, "report.html"), renderAssessmentHtml(report));
   return report;
 }
 export {