@anhcodo13/lattice 0.4.0 → 0.5.0

package/dist/cli.js

@@ -4,13 +4,13 @@
 import { writeFile as writeFile4 } from "fs/promises";
 import { realpathSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname5, join as join12, resolve as resolve11 } from "path";
+import { dirname as dirname6, join as join13, resolve as resolve11 } from "path";
 import { Command, CommanderError } from "commander";
 
 // package.json
 var package_default = {
   name: "@anhcodo13/lattice",
-  version: "0.4.0",
+  version: "0.5.0",
   private: false,
   packageManager: "pnpm@10.30.3",
   type: "module",
@@ -1159,7 +1159,9 @@ async function analyzeProject(projectRoot, options = {}) {
 }
 
 // src/governance/check.ts
-import { resolve as resolve5, relative as relative4, sep as sep3 } from "path";
+import { readFile as readFile7 } from "fs/promises";
+import { resolve as resolve5, relative as relative4, sep as sep3, join as join8, dirname as dirname3 } from "path";
+import fastGlob3 from "fast-glob";
 import { satisfies, subset, valid, validRange } from "semver";
 
 // src/governance/discover.ts
@@ -1343,11 +1345,36 @@ async function readResolution(app, workspaceRoot, name) {
 }
 
 // src/governance/check.ts
+var scanIgnore = ["**/node_modules/**", "**/.git/**", "**/.next/**", "**/dist/**", "**/build/**", "**/out/**", "**/coverage/**", "**/.turbo/**", "**/.vercel/**", "**/.astro/**", "**/.nklattice-report/**", "**/.nklattice-governance/**", "**/*.d.ts"];
+async function importedManagedPackages(app, managed) {
+  if (Object.keys(managed).length === 0) return /* @__PURE__ */ new Set();
+  const nestedManifests = await fastGlob3("**/package.json", { cwd: app.directory, onlyFiles: true, dot: true, followSymbolicLinks: false, ignore: scanIgnore });
+  const nestedIgnore = nestedManifests.filter((path) => path !== "package.json").map((path) => `${dirname3(path)}/**`);
+  const files = await fastGlob3("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
+    cwd: app.directory,
+    onlyFiles: true,
+    dot: true,
+    followSymbolicLinks: false,
+    ignore: [...scanIgnore, ...nestedIgnore]
+  });
+  const found = /* @__PURE__ */ new Set();
+  await Promise.all(files.map(async (path) => {
+    const module = parseModule(path, await readFile7(join8(app.directory, path), "utf8"));
+    for (const imported of module.imports) {
+      for (const name of Object.keys(managed)) {
+        if (imported.specifier === name || imported.specifier.startsWith(`${name}/`)) found.add(name);
+      }
+    }
+  }));
+  return found;
+}
 async function checkApp(app, workspaceRoot, policy) {
   const requirements = policy.profiles[app.profile];
   if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
   const findings2 = [];
-  for (const [packageName, expected] of Object.entries(requirements)) {
+  const imported = await importedManagedPackages(app, policy.managedPackages ?? {});
+  const managed = Object.fromEntries(Object.entries(policy.managedPackages ?? {}).filter(([packageName]) => app.dependencies[packageName] !== void 0 || imported.has(packageName)));
+  for (const [packageName, expected] of Object.entries({ ...requirements, ...managed })) {
     const declared = app.dependencies[packageName];
     const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
     const reasons = [];
@@ -1397,12 +1424,12 @@ async function checkGovernance(options) {
 
 // src/governance/assess.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { basename as basename2, join as join10, relative as relative7, resolve as resolve9, sep as sep6 } from "path";
+import { basename as basename2, join as join11, relative as relative7, resolve as resolve9, sep as sep6 } from "path";
 
 // src/governance/inventory.ts
 import { createHash } from "crypto";
-import { readFile as readFile7, realpath } from "fs/promises";
-import { isAbsolute, join as join8, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
+import { readFile as readFile8, realpath } from "fs/promises";
+import { isAbsolute, join as join9, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
 var profiles2 = /* @__PURE__ */ new Set(["next", "vite-react", "react"]);
 async function loadInventory(source, scanRoot) {
   const absolute = resolve6(source);
@@ -1410,7 +1437,7 @@ async function loadInventory(source, scanRoot) {
   const inventoryPath = await realpath(absolute);
   const inventoryRelative = relative5(root, inventoryPath);
   if (inventoryRelative === ".." || inventoryRelative.startsWith(`..${sep4}`)) throw new Error("Inventory must be inside scan root");
-  const raw = await readFile7(inventoryPath, "utf8");
+  const raw = await readFile8(inventoryPath, "utf8");
   let value;
   try {
     value = JSON.parse(raw);
@@ -1435,7 +1462,7 @@ async function loadInventory(source, scanRoot) {
     if (seen.has(path)) throw new Error(`Duplicate inventory app ${path}`);
     seen.add(path);
     try {
-      const actual = await realpath(join8(root, path));
+      const actual = await realpath(join9(root, path));
       const rel = relative5(root, actual);
       if (rel === ".." || rel.startsWith(`..${sep4}`)) throw new Error(`App path escapes scan root: ${path}`);
     } catch (error) {
@@ -1461,8 +1488,8 @@ function compareInventory(inventory, discovered, scanRoot) {
 import { createHash as createHash2 } from "crypto";
 import { execFile } from "child_process";
 import { createReadStream } from "fs";
-import { lstat, readFile as readFile8, realpath as realpath2 } from "fs/promises";
-import { dirname as dirname3, join as join9, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+import { lstat, readFile as readFile9, realpath as realpath2 } from "fs/promises";
+import { dirname as dirname4, join as join10, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
 import { promisify } from "util";
 import fg from "fast-glob";
 var execFileAsync = promisify(execFile);
@@ -1494,7 +1521,11 @@ function validateApp(value) {
   if (!object(quality) || !object(quality.lint) || !string(quality.lint.tool) || !string(quality.lint.version) || typeof quality.lint.complete !== "boolean" || !base(quality.typecheck) || !base(quality.tests) || !base(quality.coverage)) return false;
   if (!nonnegative(quality.lint.filesScanned) || !nonnegative(quality.lint.errorCount) || !nonnegative(quality.lint.warnings) || !errors(quality.lint.errorsDetail) || typeof quality.typecheck.passed !== "boolean" || quality.typecheck.applicable !== void 0 && typeof quality.typecheck.applicable !== "boolean" || !nonnegative(quality.tests.passed) || !nonnegative(quality.tests.failed) || typeof quality.coverage.linesPercent !== "number" || !Number.isFinite(quality.coverage.linesPercent) || quality.coverage.linesPercent < 0 || quality.coverage.linesPercent > 100) return false;
   if (!object(security) || !base(security.sast) || !base(security.secrets) || !nonnegative(security.sast.filesScanned) || !nonnegative(security.secrets.filesScanned) || !findings(security.sast.findings) || !findings(security.secrets.findings)) return false;
-  if (!base(compatibility2) || !Array.isArray(compatibility2.projects) || !compatibility2.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  if (!base(compatibility2) || !Array.isArray(compatibility2.projects) || !compatibility2.projects.every((project) => object(project) && string(project.name) && nonnegative(project.passed) && nonnegative(project.failed) && nonnegative(project.skipped) && (project.browserVersion === void 0 || string(project.browserVersion)) && (project.engine === void 0 || string(project.engine)) && (project.mobile === void 0 || typeof project.mobile === "boolean") && (project.device === void 0 || string(project.device)) && (project.emulatedOs === void 0 || string(project.emulatedOs)) && (project.emulatedOsVersion === void 0 || string(project.emulatedOsVersion)) && (project.viewportWidths === void 0 || Array.isArray(project.viewportWidths) && project.viewportWidths.every(nonnegative)))) return false;
+  if (value.accessibility !== void 0) {
+    const accessibility = value.accessibility;
+    if (!base(accessibility) || !Array.isArray(accessibility.scans) || !accessibility.scans.every((scan) => object(scan) && string(scan.project) && string(scan.route) && /^\/[^?#]*$/.test(scan.route) && string(scan.axeVersion) && /^\d+\.\d+\.\d+$/.test(scan.axeVersion) && Array.isArray(scan.tags) && scan.tags.length > 0 && scan.tags.every(string) && new Set(scan.tags).size === scan.tags.length && nonnegative(scan.checks) && scan.checks > 0 && nonnegative(scan.needsReview) && findings(scan.violations))) return false;
+  }
   return true;
 }
 async function hashFile(hash, path) {
@@ -1539,7 +1570,7 @@ async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
     hash.update("\0");
   }
   let ancestor = root;
-  while (ancestor === workspace || ancestor !== dirname3(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
+  while (ancestor === workspace || ancestor !== dirname4(ancestor) && !relative6(workspace, ancestor).startsWith("..")) {
     for (const name of [
       "package.json",
       "package-lock.json",
@@ -1564,7 +1595,7 @@ async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
       "semgrep.yml",
       "semgrep.yaml"
     ]) {
-      const path = join9(ancestor, name);
+      const path = join10(ancestor, name);
       try {
         const stat2 = await lstat(path);
         if (stat2.isSymbolicLink()) throw new Error(`Symlinked scanner configuration is unsupported: ${path}`);
@@ -1578,7 +1609,7 @@ async function hashAssessmentInputs(scanRoot, workspaceRoot = scanRoot) {
       }
     }
     if (ancestor === workspace) break;
-    ancestor = dirname3(ancestor);
+    ancestor = dirname4(ancestor);
   }
   return hash.digest("hex");
 }
@@ -1595,7 +1626,7 @@ async function loadScanEvidence(path, scanRoot, workspaceRoot, policySha256, max
   if (actualRelative !== ".." && !actualRelative.startsWith(`..${sep5}`)) throw new Error("Evidence file resolves inside the scan root");
   let parsed;
   try {
-    parsed = JSON.parse(await readFile8(source, "utf8"));
+    parsed = JSON.parse(await readFile9(source, "utf8"));
   } catch {
     throw new Error("Evidence is not valid JSON");
   }
@@ -1616,10 +1647,28 @@ async function validateScanEvidence(parsed, scanRoot, workspaceRoot, policySha25
   return parsed;
 }
 var incomplete = (issues, tool, version2, scanned) => ({ status: "incomplete", issues, tool, version: version2, scanned });
+function numericVersion(value) {
+  if (!value || !/^(0|[1-9]\d*)(?:\.(0|[1-9]\d*)){0,3}$/.test(value)) return void 0;
+  const parts = value.split(".").map(Number);
+  return parts.every(Number.isSafeInteger) ? parts : void 0;
+}
+function belowVersion(actual, minimum) {
+  for (let index = 0; index < Math.max(actual.length, minimum.length); index++) {
+    if ((actual[index] ?? 0) < (minimum[index] ?? 0)) return true;
+    if ((actual[index] ?? 0) > (minimum[index] ?? 0)) return false;
+  }
+  return false;
+}
 function evaluateAppEvidence(app, policy) {
   if (!app) {
     const missing = incomplete(["No fresh scan evidence for this app"]);
-    return { dependencySecurity: { ...missing }, codeQuality: { ...missing }, codeSecurity: { ...missing }, compatibility: { ...missing } };
+    return {
+      dependencySecurity: { ...missing },
+      codeQuality: { ...missing },
+      codeSecurity: { ...missing },
+      compatibility: { ...missing },
+      ...policy.accessibility ? { accessibility: { ...missing } } : {}
+    };
   }
   const dependency = app.dependencySecurity;
   let dependencySecurity;
@@ -1709,6 +1758,28 @@ function evaluateAppEvidence(app, policy) {
   const invalidEngines = compatibility2.projects.filter((project) => expectedEngines[project.name] && project.engine !== expectedEngines[project.name]);
   const invalidDevices = compatibility2.projects.filter((project) => (project.name === "android-chrome" || project.name === "iphone-safari") && (project.mobile !== true || !project.device));
   const missingViewports = compatibility2.projects.filter((project) => new Set(project.viewportWidths ?? []).size < 2);
+  const versionEvidenceMissing = [];
+  const versionFailures = [];
+  for (const [name, minimum] of Object.entries(policy.compatibility.minimumTestedBrowserVersions ?? {})) {
+    const project = compatibility2.projects.find((item) => item.name === name);
+    if (!project) continue;
+    const actual = numericVersion(project.browserVersion);
+    if (!actual) versionEvidenceMissing.push(`${name} did not record a valid measured browser version`);
+    else if (belowVersion(actual, numericVersion(minimum))) {
+      versionFailures.push(`${name} measured browser version ${project.browserVersion} is below minimum tested browser version ${minimum}`);
+    }
+  }
+  for (const [name, minimum] of Object.entries(policy.compatibility.minimumEmulatedOsVersions ?? {})) {
+    const project = compatibility2.projects.find((item) => item.name === name);
+    if (!project) continue;
+    const expectedOs = name === "android-chrome" ? "Android" : "iOS";
+    const actual = numericVersion(project.emulatedOsVersion);
+    if (project.emulatedOs !== expectedOs || !actual) {
+      versionEvidenceMissing.push(`${name} did not record a valid emulated ${expectedOs} version`);
+    } else if (belowVersion(actual, numericVersion(minimum))) {
+      versionFailures.push(`${name} emulated ${expectedOs} version ${project.emulatedOsVersion} is below minimum emulated ${expectedOs} version ${minimum}`);
+    }
+  }
   const compatibilityMissing = [
     ...!compatibility2.complete ? ["Compatibility test run did not complete", ...compatibility2.errors] : [],
     ...missingProjects.length ? [`Missing Playwright projects: ${missingProjects.join(", ")}`] : [],
@@ -1716,27 +1787,82 @@ function evaluateAppEvidence(app, policy) {
     ...missingBrowserVersions.map((project) => `${project.name} did not record its browser engine version`),
     ...invalidEngines.map((project) => `${project.name} used ${project.engine ?? "an unverified engine"} instead of ${expectedEngines[project.name]}`),
     ...invalidDevices.map((project) => `${project.name} did not verify mobile emulation settings`),
-    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`)
+    ...missingViewports.map((project) => `${project.name} did not test two viewport widths`),
+    ...versionEvidenceMissing
   ];
   const failedProjects = compatibility2.projects.filter((project) => project.failed > 0);
-  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`)], compatibility2.tool, compatibility2.version), matrix: compatibility2.projects } : {
-    status: failedProjects.length ? "fail" : "pass",
-    issues: failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`),
+  const testFailures = failedProjects.map((project) => `${project.name}: ${project.failed} tests failed`);
+  const matrix = compatibility2.projects.map((project) => ({
+    ...project,
+    minimumTestedBrowserVersion: policy.compatibility.minimumTestedBrowserVersions?.[project.name],
+    minimumEmulatedOsVersion: policy.compatibility.minimumEmulatedOsVersions?.[project.name]
+  }));
+  const compatibilityDomain = compatibilityMissing.length ? { ...incomplete([...compatibilityMissing, ...testFailures, ...versionFailures], compatibility2.tool, compatibility2.version), matrix } : {
+    status: testFailures.length || versionFailures.length ? "fail" : "pass",
+    issues: [...testFailures, ...versionFailures],
     tool: compatibility2.tool,
     version: compatibility2.version,
     scanned: compatibility2.projects.reduce((count, project) => count + project.passed + project.failed, 0),
-    matrix: compatibility2.projects
+    matrix
+  };
+  let accessibilityDomain;
+  if (policy.accessibility) {
+    const rules = policy.accessibility;
+    const result = app.accessibility;
+    if (!result) accessibilityDomain = incomplete(["Accessibility scan evidence is missing"]);
+    else {
+      const missing = [...!result.complete || result.errors.length ? ["Accessibility scan did not complete", ...result.errors] : []];
+      for (const project of rules.requiredProjects) {
+        const scans = result.scans.filter((scan) => scan.project === project);
+        if (scans.length < rules.minimumScansPerProject) missing.push(`${project} has fewer than ${rules.minimumScansPerProject} accessibility scans`);
+      }
+      for (const scan of result.scans) {
+        if (scan.checks < rules.minimumChecksPerScan) missing.push(`${scan.project} ${scan.route} checked fewer than ${rules.minimumChecksPerScan} axe rules`);
+        if (rules.requiredTags.some((tag) => !scan.tags.includes(tag))) missing.push(`${scan.project} ${scan.route} omitted required WCAG tags`);
+        const measuredVersion2 = numericVersion(scan.axeVersion);
+        if (!measuredVersion2) missing.push(`${scan.project} ${scan.route} did not record a valid axe-core version`);
+        else if (belowVersion(measuredVersion2, numericVersion(rules.minimumAxeVersion))) {
+          missing.push(`${scan.project} ${scan.route} used axe-core ${scan.axeVersion} below ${rules.minimumAxeVersion}`);
+        }
+      }
+      const findings2 = result.scans.flatMap((scan) => scan.violations);
+      const needsReview = result.scans.reduce((sum, scan) => sum + scan.needsReview, 0);
+      if (needsReview > rules.maximumNeedsReview) missing.push(`${needsReview} axe checks need manual review (maximum ${rules.maximumNeedsReview})`);
+      const failures = findings2.length > rules.maximumViolations ? [`${findings2.length} accessibility violations exceed ${rules.maximumViolations}`] : [];
+      const details = {
+        tool: result.tool,
+        version: result.version,
+        scanned: result.scans.length,
+        findings: findings2,
+        metrics: { scans: result.scans.length, axeChecks: result.scans.reduce((sum, scan) => sum + scan.checks, 0), needsReview },
+        routes: result.scans.map((scan) => ({
+          project: scan.project,
+          route: scan.route,
+          axeVersion: scan.axeVersion,
+          checks: scan.checks,
+          needsReview: scan.needsReview
+        }))
+      };
+      accessibilityDomain = failures.length ? { status: "fail", issues: [...failures, ...missing], ...details } : missing.length ? { ...incomplete(missing, result.tool, result.version, result.scans.length), ...details } : { status: "pass", issues: [], ...details };
+    }
+  }
+  return {
+    dependencySecurity,
+    codeQuality,
+    codeSecurity,
+    compatibility: compatibilityDomain,
+    ...accessibilityDomain ? { accessibility: accessibilityDomain } : {}
   };
-  return { dependencySecurity, codeQuality, codeSecurity, compatibility: compatibilityDomain };
 }
 
 // src/governance/policy.ts
 import { createHash as createHash3 } from "crypto";
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { resolve as resolve8 } from "path";
 import { valid as valid2 } from "semver";
 var exactVersion = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var minimumVersion = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var measuredVersion = /^(0|[1-9]\d*)(?:\.(0|[1-9]\d*)){0,3}$/;
 function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1805,6 +1931,51 @@ function parseAssessmentPolicy(value) {
     if (!Array.isArray(projects) || projects.length === 0 || !projects.every((item) => typeof item === "string" && item.length > 0) || new Set(projects).size !== projects.length) {
       throw new Error("assessment.evidence.compatibility.requiredProjects must be a unique nonempty string array");
     }
+    const versionFloors = (key) => {
+      const raw = compatibility2[key];
+      if (raw === void 0) return void 0;
+      if (!record3(raw)) throw new Error(`assessment.evidence.compatibility.${key} must be an object`);
+      for (const [project, version2] of Object.entries(raw)) {
+        if (!projects.includes(project)) throw new Error(`${key} references unknown required project ${project}`);
+        if (key === "minimumEmulatedOsVersions" && project !== "android-chrome" && project !== "iphone-safari") {
+          throw new Error(`${key} requires an Android Chrome or iPhone Safari project`);
+        }
+        if (typeof version2 !== "string" || !measuredVersion.test(version2) || !version2.split(".").map(Number).every(Number.isSafeInteger)) {
+          throw new Error(`${key}.${project} must be a numeric version with one to four components`);
+        }
+      }
+      return raw;
+    };
+    const minimumTestedBrowserVersions = versionFloors("minimumTestedBrowserVersions");
+    const minimumEmulatedOsVersions = versionFloors("minimumEmulatedOsVersions");
+    let accessibility;
+    if (gates.accessibility !== void 0) {
+      if (!record3(gates.accessibility)) throw new Error("assessment.evidence.accessibility must be an object");
+      const source = gates.accessibility;
+      const requiredProjects = source.requiredProjects;
+      if (!Array.isArray(requiredProjects) || requiredProjects.length === 0 || !requiredProjects.every((project) => typeof project === "string" && projects.includes(project)) || new Set(requiredProjects).size !== requiredProjects.length) {
+        throw new Error("assessment.evidence.accessibility projects must be unique members of compatibility.requiredProjects");
+      }
+      const requiredTags = source.requiredTags;
+      if (!Array.isArray(requiredTags) || requiredTags.length === 0 || !requiredTags.every((tag) => typeof tag === "string" && /^wcag(?:2|21|22)(?:a|aa)$/.test(tag)) || new Set(requiredTags).size !== requiredTags.length) {
+        throw new Error("assessment.evidence.accessibility.requiredTags must list unique supported WCAG A/AA tags");
+      }
+      if (typeof source.minimumAxeVersion !== "string" || !minimumVersion.test(`>=${source.minimumAxeVersion}`) || valid2(source.minimumAxeVersion) === null) {
+        throw new Error("assessment.evidence.accessibility.minimumAxeVersion must be an exact stable version");
+      }
+      accessibility = {
+        requiredProjects,
+        requiredTags,
+        minimumScansPerProject: nonnegative2(source, "minimumScansPerProject", "assessment.evidence.accessibility"),
+        minimumChecksPerScan: nonnegative2(source, "minimumChecksPerScan", "assessment.evidence.accessibility"),
+        minimumAxeVersion: source.minimumAxeVersion,
+        maximumViolations: nonnegative2(source, "maximumViolations", "assessment.evidence.accessibility"),
+        maximumNeedsReview: nonnegative2(source, "maximumNeedsReview", "assessment.evidence.accessibility")
+      };
+      if (accessibility.minimumScansPerProject === 0 || accessibility.minimumChecksPerScan === 0) {
+        throw new Error("assessment.evidence.accessibility minimum scans and checks must be positive");
+      }
+    }
     evidence = {
       maximumAgeHours: gates.maximumAgeHours,
       dependencySecurity: { maximumHigh: nonnegative2(dependencySecurity, "maximumHigh", "assessment.evidence.dependencySecurity"), maximumCritical: nonnegative2(dependencySecurity, "maximumCritical", "assessment.evidence.dependencySecurity") },
@@ -1815,7 +1986,13 @@ function parseAssessmentPolicy(value) {
         requireTests: codeQuality.requireTests
       },
       codeSecurity: { maximumHigh: nonnegative2(codeSecurity, "maximumHigh", "assessment.evidence.codeSecurity"), maximumCritical: nonnegative2(codeSecurity, "maximumCritical", "assessment.evidence.codeSecurity"), maximumSecrets: nonnegative2(codeSecurity, "maximumSecrets", "assessment.evidence.codeSecurity") },
-      compatibility: { requiredProjects: projects, minimumTestsPerProject: nonnegative2(compatibility2, "minimumTestsPerProject", "assessment.evidence.compatibility") }
+      compatibility: {
+        requiredProjects: projects,
+        minimumTestsPerProject: nonnegative2(compatibility2, "minimumTestsPerProject", "assessment.evidence.compatibility"),
+        ...minimumTestedBrowserVersions ? { minimumTestedBrowserVersions } : {},
+        ...minimumEmulatedOsVersions ? { minimumEmulatedOsVersions } : {}
+      },
+      ...accessibility ? { accessibility } : {}
     };
   }
   return { architecture: {
@@ -1855,10 +2032,25 @@ function parsePolicy(raw, source) {
     }
     profiles3[name] = versions;
   }
+  let managedPackages;
+  if (parsed.managedPackages !== void 0) {
+    if (!record3(parsed.managedPackages)) throw new Error("Policy managedPackages must be an object");
+    managedPackages = {};
+    for (const [packageName, version2] of Object.entries(parsed.managedPackages)) {
+      if (typeof version2 !== "string" || !minimumVersion.test(version2) || valid2(version2.slice(2)) === null) {
+        throw new Error(`Policy minimum version (>=X.Y.Z) required for managed package ${packageName}`);
+      }
+      if (Object.values(profiles3).some((profile) => packageName in profile)) {
+        throw new Error(`Package ${packageName} appears in both profiles and managedPackages`);
+      }
+      managedPackages[packageName] = version2;
+    }
+  }
   return {
     schemaVersion: 2,
     policyVersion: parsed.policyVersion,
     profiles: profiles3,
+    ...managedPackages ? { managedPackages } : {},
     ...parsed.assessment === void 0 ? {} : { assessment: parseAssessmentPolicy(parsed.assessment) },
     source,
     sha256: createHash3("sha256").update(raw).digest("hex")
@@ -1878,7 +2070,7 @@ async function loadPolicy(source) {
     }
     return parsePolicy(await response.text(), source);
   }
-  return parsePolicy(await readFile9(resolve8(source), "utf8"), source);
+  return parsePolicy(await readFile10(resolve8(source), "utf8"), source);
 }
 
 // src/governance/assess.ts
@@ -1908,7 +2100,8 @@ function renderAssessmentHtml(report) {
     dependencySecurity: "Dependency security",
     codeQuality: "Code quality",
     codeSecurity: "Code security",
-    compatibility: "Browser compatibility"
+    compatibility: "Browser compatibility",
+    accessibility: "Accessibility"
   };
   const domainNames = report.apps.length ? Object.keys(report.apps[0].domains) : [];
   const overview = domainNames.map((name) => {
@@ -1923,8 +2116,9 @@ function renderAssessmentHtml(report) {
       const identity = evidence.tool ? `<p><small>${escapeHtml2(evidence.tool)} ${escapeHtml2(evidence.version ?? "")} \xB7 scanned ${escapeHtml2(evidence.scanned ?? "unknown")}</small></p>` : "";
       const metrics = evidence.metrics ? `<p><small>${Object.entries(evidence.metrics).map(([key, value]) => `${escapeHtml2(key)}: ${escapeHtml2(value)}`).join(" \xB7 ")}</small></p>` : "";
       const findings3 = evidence.findings?.length ? `<details><summary>${evidence.findings.length} finding(s)</summary><ul>${evidence.findings.map((item) => `<li><strong>${escapeHtml2(item.severity)}</strong> ${escapeHtml2(item.id)} \xB7 <code>${escapeHtml2(item.subject)}</code> \u2014 ${escapeHtml2(item.message)}${item.remediation ? ` \xB7 ${escapeHtml2(item.remediation)}` : ""}</li>`).join("")}</ul></details>` : "";
-      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Browser / device</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml2(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml2([item.browserVersion, item.device].filter(Boolean).join(" \xB7 ") || "Not recorded")}</td><td>${escapeHtml2(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table></div>` : "";
-      return `<tr><th scope="row">${escapeHtml2(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml2(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml2(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}</td></tr>`;
+      const matrix = evidence.matrix?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Passed</th><th>Failed</th><th>Skipped</th><th>Measured browser / minimum test environment</th><th>Mobile UA emulation / minimum</th><th>Widths</th></tr></thead><tbody>${evidence.matrix.map((item) => `<tr><th scope="row">${escapeHtml2(item.name)}</th><td>${item.passed}</td><td>${item.failed}</td><td>${item.skipped}</td><td>${escapeHtml2(item.browserVersion ?? "Not recorded")} / ${escapeHtml2(item.minimumTestedBrowserVersion ?? "Not set")}</td><td>${escapeHtml2(item.device ?? "None")} / ${escapeHtml2(item.minimumEmulatedOsVersion ?? "Not set")}</td><td>${escapeHtml2(item.viewportWidths?.join(", ") ?? "Not recorded")}</td></tr>`).join("")}</tbody></table><p><small>Version floors check the tested environment. Mobile OS values come from user-agent emulation, not physical devices or a promise of support for older versions.</small></p></div>` : "";
+      const routes = evidence.routes?.length ? `<div class="scroll"><table><thead><tr><th>Project</th><th>Scanned route</th><th>axe-core</th><th>Checks</th><th>Needs review</th></tr></thead><tbody>${evidence.routes.map((item) => `<tr><th scope="row">${escapeHtml2(item.project)}</th><td><code>${escapeHtml2(item.route)}</code></td><td>${escapeHtml2(item.axeVersion)}</td><td>${item.checks}</td><td>${item.needsReview}</td></tr>`).join("")}</tbody></table><p><small>Only these visited routes were scanned automatically. Manual accessibility review remains outside this result.</small></p></div>` : "";
+      return `<tr><th scope="row">${escapeHtml2(labels[name] ?? name)}</th><td class="${domain.status}">${escapeHtml2(domain.status)}</td><td>${identity}${metrics}${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml2(issue)}</li>`).join("")}</ul>` : "No issues"}${findings3}${matrix}${routes}</td></tr>`;
     }).join("");
     const architecture = app.domains.architecture;
     const categoryRows = architecture.scoreBreakdown?.categories.map((category) => `<tr><th scope="row">${escapeHtml2(category.id)}</th><td>${escapeHtml2(category.weight)}%</td><td>${escapeHtml2(category.score)}</td><td>${escapeHtml2(category.findingCount)}</td></tr>`).join("") ?? "";
@@ -1943,8 +2137,8 @@ async function assessGovernance(options) {
   if (scanRelative === ".." || scanRelative.startsWith(`..${sep6}`)) throw new Error("Scan root must be inside workspace root");
   if (!options.policy.assessment) throw new Error("Policy assessment.architecture is required");
   const assessment = parseAssessmentPolicy(options.policy.assessment);
-  const outputDirectory = resolve9(options.outputDirectory ?? join10(scanRoot, ".nklattice-governance"));
-  const inventorySource = resolve9(options.inventory ?? join10(scanRoot, ".nklattice-apps.json"));
+  const outputDirectory = resolve9(options.outputDirectory ?? join11(scanRoot, ".nklattice-governance"));
+  const inventorySource = resolve9(options.inventory ?? join11(scanRoot, ".nklattice-apps.json"));
   let inventory;
   const issues = [];
   try {
@@ -2043,25 +2237,48 @@ async function assessGovernance(options) {
     ...evidence ? { evidence: { source: options.evidence ? resolve9(options.evidence) : "in-process collector", generatedAt: evidence.generatedAt, commit: evidence.commit, inputSha256: evidence.inputSha256 } } : {},
     inventory: { source: inventorySource, sha256: inventory?.sha256, expectedApps: inventory?.apps.length ?? 0, discoveredApps: apps.length },
     scope: {
-      domains: ["explicit app inventory", "dependency minimums", "source architecture", ...assessment.evidence ? ["known dependency advisories", "source quality", "source security", "browser and mobile emulation"] : []],
-      notEvaluated: assessment.evidence ? ["licenses", "physical Android/iOS devices", "runtime performance", "cryptographic evidence attestation", "branch protection", "repository access controls", "cross-repository rollout status"] : notEvaluated
+      domains: [
+        "explicit app inventory",
+        "dependency minimums",
+        ...options.policy.managedPackages ? ["conditional managed-library minimums"] : [],
+        "source architecture",
+        ...assessment.evidence ? [
+          "known dependency advisories",
+          "source quality",
+          "source security",
+          "browser and mobile emulation",
+          "tested browser and emulated OS version floors",
+          ...assessment.evidence.accessibility ? ["automated accessibility"] : []
+        ] : []
+      ],
+      notEvaluated: assessment.evidence ? [
+        "licenses",
+        "physical Android/iOS devices",
+        "older browser-version support",
+        "runtime performance",
+        ...assessment.evidence.accessibility ? ["manual accessibility review and unvisited routes"] : ["accessibility"],
+        "cryptographic evidence attestation",
+        "branch protection",
+        "repository access controls",
+        "cross-repository rollout status"
+      ] : notEvaluated
     },
     issues,
     apps: results
   };
   await mkdir3(outputDirectory, { recursive: true });
-  await writeFile2(join10(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
+  await writeFile2(join11(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
 `);
-  await writeFile2(join10(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  await writeFile2(join11(outputDirectory, "report.html"), renderAssessmentHtml(report));
   return report;
 }
 
 // src/governance/collect.ts
 import { execFile as execFile2 } from "child_process";
 import { createHash as createHash4 } from "crypto";
-import { mkdtemp, mkdir as mkdir4, readFile as readFile10, rm, writeFile as writeFile3 } from "fs/promises";
+import { mkdtemp, mkdir as mkdir4, readFile as readFile11, rm, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname4, join as join11, relative as relative8, resolve as resolve10, sep as sep7 } from "path";
+import { dirname as dirname5, join as join12, relative as relative8, resolve as resolve10, sep as sep7 } from "path";
 import { promisify as promisify2 } from "util";
 import fg2 from "fast-glob";
 import YAML2 from "yaml";
@@ -2088,14 +2305,14 @@ function inside(parent, child) {
 async function binary(name, app, workspaceRoot) {
   let directory = app;
   while (inside(workspaceRoot, directory)) {
-    const candidate = join11(directory, "node_modules", ".bin", name);
+    const candidate = join12(directory, "node_modules", ".bin", name);
     try {
-      await readFile10(candidate);
+      await readFile11(candidate);
       return candidate;
     } catch {
     }
     if (directory === workspaceRoot) break;
-    directory = dirname4(directory);
+    directory = dirname5(directory);
   }
   return name;
 }
@@ -2154,7 +2371,7 @@ async function dependencyAudit(app, workspaceRoot, cache) {
   }
   const cached = cache.get(lock.path);
   if (cached) return cached;
-  const raw = await readFile10(lock.path, "utf8");
+  const raw = await readFile11(lock.path, "utf8");
   const parsedLock = lock.kind === "npm" ? json(raw) : YAML2.parse(raw);
   const packages = obj(parsedLock) && obj(parsedLock.packages) ? Object.keys(parsedLock.packages).filter((key) => key !== "").length : 0;
   const executable = lock.kind === "npm" ? "npm" : "pnpm";
@@ -2263,7 +2480,7 @@ async function typecheck(app, workspaceRoot) {
   const file = await binary("tsc", app.directory, workspaceRoot);
   const toolVersion = await version(file, app.directory);
   if (!applicable) return { tool: "TypeScript", version: toolVersion, applicable: false, complete: true, passed: true, errors: [] };
-  const config = await readFile10(join11(app.directory, "tsconfig.json"), "utf8").catch(() => "");
+  const config = await readFile11(join12(app.directory, "tsconfig.json"), "utf8").catch(() => "");
   if (!config) return {
     tool: "TypeScript",
     version: toolVersion,
@@ -2285,8 +2502,8 @@ async function typecheck(app, workspaceRoot) {
 async function testAndCoverage(app, workspaceRoot, temp) {
   const file = await binary("vitest", app.directory, workspaceRoot);
   const toolVersion = await version(file, app.directory);
-  const resultPath = join11(temp, "vitest.json");
-  const coverageDirectory = join11(temp, "coverage");
+  const resultPath = join12(temp, "vitest.json");
+  const coverageDirectory = join12(temp, "coverage");
   const result = await run(file, [
     "run",
     "--reporter=json",
@@ -2297,9 +2514,9 @@ async function testAndCoverage(app, workspaceRoot, temp) {
     "--coverage.reportsDirectory",
     coverageDirectory
   ], app.directory);
-  const output = await readFile10(resultPath, "utf8").catch(() => "");
+  const output = await readFile11(resultPath, "utf8").catch(() => "");
   const parsed = json(output);
-  const summary = json(await readFile10(join11(coverageDirectory, "coverage-summary.json"), "utf8").catch(() => ""));
+  const summary = json(await readFile11(join12(coverageDirectory, "coverage-summary.json"), "utf8").catch(() => ""));
   const tests = obj(parsed) && typeof parsed.numPassedTests === "number" && typeof parsed.numFailedTests === "number";
   const lineCoverage = obj(summary) && obj(summary.total) && obj(summary.total.lines) ? summary.total.lines.pct : void 0;
   const expectedFiles = await productionSources(app.directory);
@@ -2330,7 +2547,7 @@ async function testAndCoverage(app, workspaceRoot, temp) {
 async function sast(app, temp) {
   const file = "semgrep";
   const toolVersion = await version(file, app.directory);
-  const outputPath = join11(temp, "semgrep.json");
+  const outputPath = join12(temp, "semgrep.json");
   const result = await run(file, [
     "scan",
     "--config",
@@ -2349,7 +2566,7 @@ async function sast(app, temp) {
     outputPath,
     app.directory
   ], app.directory);
-  const parsed = json(await readFile10(outputPath, "utf8").catch(() => result.stdout));
+  const parsed = json(await readFile11(outputPath, "utf8").catch(() => result.stdout));
   const expectedSources = await sourcePaths(app.directory);
   if (!obj(parsed) || !Array.isArray(parsed.results) || result.error) {
     return {
@@ -2385,8 +2602,8 @@ async function sast(app, temp) {
 async function secrets(app, temp) {
   const file = "gitleaks";
   const toolVersion = await version(file, app.directory);
-  const outputPath = join11(temp, "gitleaks.json");
-  const configPath = join11(temp, "gitleaks.toml");
+  const outputPath = join12(temp, "gitleaks.json");
+  const configPath = join12(temp, "gitleaks.toml");
   await writeFile3(configPath, '[extend]\nuseDefault = true\n\n[allowlist]\npaths = ["(^|/)(node_modules|\\\\.next|dist|build|coverage|test-results|playwright-report)/"]\n');
   const result = await run(file, [
     "dir",
@@ -2400,7 +2617,7 @@ async function secrets(app, temp) {
     "--redact",
     "--no-banner"
   ], app.directory);
-  const parsed = json(await readFile10(outputPath, "utf8").catch(() => ""));
+  const parsed = json(await readFile11(outputPath, "utf8").catch(() => ""));
   const count = await sourceCount(app.directory);
   if (!Array.isArray(parsed) || result.error) {
     return {
@@ -2462,12 +2679,59 @@ function playwrightProjects(value) {
   for (const suite of value.suites) visit(suite);
   return [...totals.values()].map((project) => ({ ...project, viewportWidths: [...project.viewportWidths].sort((a, b) => a - b) }));
 }
+function parsePlaywrightAccessibility(value) {
+  const scans = [];
+  const errors2 = [];
+  const visit = (suite) => {
+    if (!obj(suite)) return;
+    for (const spec of Array.isArray(suite.specs) ? suite.specs : []) {
+      if (!obj(spec) || !Array.isArray(spec.tests)) continue;
+      for (const test of spec.tests) {
+        if (!obj(test) || !str(test.projectName)) continue;
+        for (const annotation of Array.isArray(test.annotations) ? test.annotations : []) {
+          if (!obj(annotation) || annotation.type !== "lattice-axe") continue;
+          const measured = json(str(annotation.description));
+          const validFindings = obj(measured) && Array.isArray(measured.violations) && measured.violations.every((item) => obj(item) && str(item.id) && str(item.help) && str(item.selector) && ["minor", "moderate", "serious", "critical"].includes(str(item.impact)));
+          if (!obj(measured) || !/^\/[^?#]*$/.test(str(measured.route)) || !/^\d+\.\d+\.\d+$/.test(str(measured.axeVersion)) || !Array.isArray(measured.tags) || measured.tags.length === 0 || !measured.tags.every((item) => typeof item === "string" && item.length > 0) || new Set(measured.tags).size !== measured.tags.length || !Number.isSafeInteger(measured.checks) || measured.checks <= 0 || !Number.isSafeInteger(measured.needsReview) || measured.needsReview < 0 || !validFindings) {
+            errors2.push(`Malformed axe accessibility annotation for ${test.projectName}`);
+            continue;
+          }
+          scans.push({
+            project: str(test.projectName),
+            route: str(measured.route),
+            axeVersion: str(measured.axeVersion),
+            tags: measured.tags,
+            checks: measured.checks,
+            needsReview: measured.needsReview,
+            violations: measured.violations.map((item) => ({
+              id: str(item.id),
+              severity: str(item.impact),
+              subject: `${measured.route} ${item.selector}`,
+              message: str(item.help)
+            }))
+          });
+        }
+      }
+    }
+    for (const child of Array.isArray(suite.suites) ? suite.suites : []) visit(child);
+  };
+  if (obj(value) && Array.isArray(value.suites)) for (const suite of value.suites) visit(suite);
+  if (scans.length === 0 && errors2.length === 0) errors2.push("No axe accessibility annotations were recorded");
+  const versions = new Set(scans.map((scan) => scan.axeVersion));
+  return {
+    tool: "axe-core via Playwright",
+    version: versions.size === 1 ? scans[0].axeVersion : "mixed or unavailable",
+    complete: errors2.length === 0 && scans.length > 0,
+    scans,
+    errors: errors2
+  };
+}
 async function compatibility(app, workspaceRoot, temp) {
   const file = await binary("playwright", app.directory, workspaceRoot);
   const toolVersion = await version(file, app.directory);
-  const outputPath = join11(temp, "playwright.json");
-  const configPath = join11(temp, "playwright-projects.json");
-  const reporterPath = join11(temp, "lattice-playwright-reporter.cjs");
+  const outputPath = join12(temp, "playwright.json");
+  const configPath = join12(temp, "playwright-projects.json");
+  const reporterPath = join12(temp, "lattice-playwright-reporter.cjs");
   await writeFile3(reporterPath, 'module.exports=class { onBegin(config) { require("node:fs").writeFileSync(process.env.LATTICE_PLAYWRIGHT_CONFIG_OUT, JSON.stringify(config.projects.map(p => ({ name: p.name, engine: p.use.browserName || p.use.defaultBrowserType, mobile: p.use.isMobile === true, touch: p.use.hasTouch === true, userAgent: p.use.userAgent || "" })))); } };\n');
   const result = await run(
     file,
@@ -2475,9 +2739,9 @@ async function compatibility(app, workspaceRoot, temp) {
     app.directory,
     { ...process.env, PLAYWRIGHT_JSON_OUTPUT_FILE: outputPath, LATTICE_PLAYWRIGHT_CONFIG_OUT: configPath }
   );
-  const parsed = json(await readFile10(outputPath, "utf8").catch(() => result.stdout));
+  const parsed = json(await readFile11(outputPath, "utf8").catch(() => result.stdout));
   const projects = playwrightProjects(parsed);
-  const config = json(await readFile10(configPath, "utf8").catch(() => ""));
+  const config = json(await readFile11(configPath, "utf8").catch(() => ""));
   const configurations = Array.isArray(config) && config.every(obj) ? config : [];
   for (const project of projects) {
     const configured = configurations.find((item) => item.name === project.name);
@@ -2487,17 +2751,28 @@ async function compatibility(app, workspaceRoot, temp) {
     const agent = str(configured.userAgent);
     const android = agent.match(/Android\s+([\d.]+)/i);
     const iphone = agent.match(/iPhone OS\s+([\d_]+)/i);
-    if (project.name === "android-chrome" && android && project.mobile) project.device = `Android ${android[1]} UA emulation`;
-    if (project.name === "iphone-safari" && iphone && project.mobile) project.device = `iOS ${iphone[1].replaceAll("_", ".")} UA emulation`;
+    if (project.name === "android-chrome" && android && project.mobile) {
+      project.emulatedOs = "Android";
+      project.emulatedOsVersion = android[1];
+      project.device = `Android ${android[1]} UA emulation`;
+    }
+    if (project.name === "iphone-safari" && iphone && project.mobile) {
+      project.emulatedOs = "iOS";
+      project.emulatedOsVersion = iphone[1].replaceAll("_", ".");
+      project.device = `iOS ${project.emulatedOsVersion} UA emulation`;
+    }
   }
   const reportedErrors = obj(parsed) && Array.isArray(parsed.errors) ? parsed.errors : [];
   const infrastructureFailure = reportedErrors.length > 0 || configurations.length === 0 || typeof result.stderr === "string" && /browser executable.*doesn't exist|failed to launch browser|install playwright browsers/i.test(result.stderr);
   return {
-    tool: "Playwright",
-    version: toolVersion,
-    complete: Boolean(parsed) && !result.error && !infrastructureFailure && projects.length > 0,
-    projects,
-    errors: infrastructureFailure ? ["Playwright browser infrastructure or configuration failed"] : projects.length ? [] : [result.error ?? "Playwright JSON results are unavailable; configure required browser and mobile projects"]
+    compatibility: {
+      tool: "Playwright",
+      version: toolVersion,
+      complete: Boolean(parsed) && !result.error && !infrastructureFailure && projects.length > 0,
+      projects,
+      errors: infrastructureFailure ? ["Playwright browser infrastructure or configuration failed"] : projects.length ? [] : [result.error ?? "Playwright JSON results are unavailable; configure required browser and mobile projects"]
+    },
+    accessibility: parsePlaywrightAccessibility(parsed)
   };
 }
 async function collectGovernanceEvidence(options) {
@@ -2519,7 +2794,7 @@ async function collectGovernanceEvidence(options) {
   const auditCache = /* @__PURE__ */ new Map();
   const scans = [];
   for (const app of apps) {
-    const temp = await mkdtemp(join11(tmpdir(), "lattice-scanners-"));
+    const temp = await mkdtemp(join12(tmpdir(), "lattice-scanners-"));
     try {
       const dependencySecurity = await dependencyAudit(app, workspaceRoot, auditCache);
       await assertStableInputs("after dependency audit");
@@ -2541,7 +2816,7 @@ async function collectGovernanceEvidence(options) {
         dependencySecurity,
         codeQuality: { lint: qualityLint, typecheck: qualityTypecheck, ...qualityTests },
         codeSecurity: { sast: securitySast, secrets: securitySecrets },
-        compatibility: compatibilityResult
+        ...compatibilityResult
       });
     } finally {
       await rm(temp, { recursive: true, force: true });
@@ -2556,7 +2831,7 @@ async function collectGovernanceEvidence(options) {
     commit,
     apps: scans
   };
-  await mkdir4(dirname4(destination), { recursive: true });
+  await mkdir4(dirname5(destination), { recursive: true });
   await writeFile3(destination, `${JSON.stringify(report, null, 2)}
 `, { flag: "w" });
   return report;
@@ -2586,11 +2861,11 @@ async function runCli(arguments_, output = defaultOutput) {
   program.exitOverride();
   program.command("analyze [path]").description("Analyze local architecture and write offline reports").option("--output <directory>", "Output directory").action(async (path, flags) => {
     const root = resolve11(path ?? ".");
-    const destination = resolve11(flags.output ?? join12(root, ".nklattice-report"));
+    const destination = resolve11(flags.output ?? join13(root, ".nklattice-report"));
     const report = await analyzeProject(root, { outputDirectory: destination });
     output.out(`NKLattice analyzed ${report.graph.modules.length} modules. Score ${report.score.score} (${report.score.grade}); ${report.findings.length} findings.
 `);
-    output.out(`Reports: ${join12(destination, "report.html")} and ${join12(destination, "analysis.json")}
+    output.out(`Reports: ${join13(destination, "report.html")} and ${join13(destination, "analysis.json")}
 `);
   });
   program.command("doctor [path]").description("Check whether a directory contains supported source files").action(async (path) => {
@@ -2600,7 +2875,7 @@ async function runCli(arguments_, output = defaultOutput) {
 `);
   });
   program.command("init [path]").description("Create a project configuration file").action(async (path) => {
-    const destination = join12(resolve11(path ?? "."), ".nklattice.json");
+    const destination = join13(resolve11(path ?? "."), ".nklattice.json");
     await writeFile4(destination, '{\n  "analysis": {},\n  "policies": []\n}\n', { flag: "wx" });
     output.out(`Created ${destination}
 `);
@@ -2613,7 +2888,7 @@ async function runCli(arguments_, output = defaultOutput) {
       expectedApps = Number(flags.expectApps);
       if (!Number.isSafeInteger(expectedApps)) throw new Error("--expect-apps must be a positive integer");
     }
-    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const policyPath = flags.policy ?? resolve11(dirname6(fileURLToPath(import.meta.url)), "../governance/policy.json");
     const policy = await loadPolicy(policyPath);
     const result = await checkGovernance({
       scanRoot: path ?? ".",
@@ -2647,7 +2922,7 @@ async function runCli(arguments_, output = defaultOutput) {
       if (!Number.isSafeInteger(expectedApps)) throw new Error("--expect-apps must be a positive integer");
     }
     const scanRoot = resolve11(path ?? ".");
-    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const policyPath = flags.policy ?? resolve11(dirname6(fileURLToPath(import.meta.url)), "../governance/policy.json");
     const report = await assessGovernance({
       scanRoot,
       workspaceRoot: flags.workspaceRoot,
@@ -2670,14 +2945,14 @@ async function runCli(arguments_, output = defaultOutput) {
         for (const [name, domain] of Object.entries(app.domains)) for (const issue of domain.issues) output.out(`  ${name}: ${issue}
 `);
       }
-      output.out(`Reports: ${resolve11(flags.output ?? join12(scanRoot, ".nklattice-governance"))}
+      output.out(`Reports: ${resolve11(flags.output ?? join13(scanRoot, ".nklattice-governance"))}
 `);
     }
     exitCode = report.status === "pass" ? 0 : report.status === "fail" ? 7 : 3;
   });
   governance.command("collect [path]").description("Run project scanners and write fresh machine-readable evidence").requiredOption("--evidence <file>", "Evidence JSON outside the scan root").option("--policy <source>", "Local file or HTTPS policy URL").option("--workspace-root <path>", "Repository root containing a shared lockfile").action(async (path, flags) => {
     const scanRoot = resolve11(path ?? ".");
-    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const policyPath = flags.policy ?? resolve11(dirname6(fileURLToPath(import.meta.url)), "../governance/policy.json");
     const result = await collectGovernanceEvidence({ scanRoot, workspaceRoot: flags.workspaceRoot, evidence: flags.evidence, policy: await loadPolicy(policyPath) });
     output.out(`Collected scanner evidence for ${result.apps.length} app(s) at ${resolve11(flags.evidence)}.
 `);
@@ -2690,7 +2965,7 @@ async function runCli(arguments_, output = defaultOutput) {
       if (!Number.isSafeInteger(expectedApps)) throw new Error("--expect-apps must be a positive integer");
     }
     const scanRoot = resolve11(path ?? ".");
-    const policyPath = flags.policy ?? resolve11(dirname5(fileURLToPath(import.meta.url)), "../governance/policy.json");
+    const policyPath = flags.policy ?? resolve11(dirname6(fileURLToPath(import.meta.url)), "../governance/policy.json");
     const policy = await loadPolicy(policyPath);
     const collected = await collectGovernanceEvidence({ scanRoot, workspaceRoot: flags.workspaceRoot, evidence: flags.evidence, policy });
     const report = await assessGovernance({
@@ -2716,7 +2991,7 @@ async function runCli(arguments_, output = defaultOutput) {
         for (const [name, domain] of Object.entries(app.domains)) for (const issue of domain.issues) output.out(`  ${name}: ${issue}
 `);
       }
-      output.out(`Reports: ${resolve11(flags.output ?? join12(scanRoot, ".nklattice-governance"))}
+      output.out(`Reports: ${resolve11(flags.output ?? join13(scanRoot, ".nklattice-governance"))}
 `);
     }
     exitCode = report.status === "pass" ? 0 : report.status === "fail" ? 7 : 3;