@enwithai/product-check 0.1.0 → 0.3.0

package/dist/cli/run.js

@@ -12,16 +12,21 @@ import { decidePermissions } from "../contract/safety.js";
 import { buildPops, popCoverage } from "../discovery/pops.js";
 import { snapshotRepo } from "../discovery/repo.js";
 import { renderDashboard } from "../dashboard/render.js";
+import { EvidenceCollector } from "../evidence/collector.js";
 import { ExitCode, ProductCheckError, inputError, usageError } from "../errors.js";
 import { deriveFacts } from "../inspectors/source/facts.js";
+import { deriveSurface } from "../inspectors/source/surface.js";
 import { renderBlueprint, renderPacket, renderReport } from "../reporting/markdown.js";
-import { runAssessment } from "../run.js";
+import { renderAsBuiltSpec } from "../reporting/spec-markdown.js";
+import { makeRunId, runAssessment } from "../run.js";
 import { formatErrors, KIND_SCHEMA, schemaFiles, schemaText, validateAgainst } from "../schema/registry.js";
+import { buildAsBuiltSpec, specFromResults } from "../spec/build.js";
 import { sha256 } from "../util/hash.js";
 import { relativize } from "../util/paths.js";
 import { CONTROLS } from "../validation/catalog.js";
 import { checkResults } from "../validation/integrity.js";
 import { STAGES, TIER_INFO } from "../validation/tiers.js";
+import { ASSURANCE_COMMANDS, ASSURANCE_HELP, runAssurance } from "../assurance/cli.js";
 import { TOOL_VERSION } from "../version.js";
 /** Text printed by `product-check --help`. */
 export const HELP = `Product Check ${TOOL_VERSION} — does this software work, can it be trusted, and what needs to improve?
@@ -37,6 +42,9 @@ Usage:
                                        Discovery only: what could be inspected (no requests, no checks)
   product-check init [--repo <dir>] [--url <url>] [--stage <stage>] [--output <file>]
                                        Write a scan contract to edit (default product-check.contract.json)
+  product-check spec --repo <dir> [--contract <file>] [--out-dir <dir>] [--format md|json|both]
+                                       Reverse-engineer an as-built spec (Spec Kit spec.md + JSON) from the
+                                       repository's structure; nothing is executed
   product-check validate <file>...     Validate artifacts against the schemas (+ integrity for results)
   product-check report <results.json>  Markdown report        product-check blueprint <results.json>
   product-check dashboard <results.json> [--output dashboard.html]
@@ -55,7 +63,11 @@ Inputs (run/retest):
   --npm-audit <file>        Output of \`npm audit --json\`
   --har <file>              Browser HAR export (offline application evidence)
   --observations <file>     Recorded observations (from --record-observations)
-  --spec-check/--impact-check/--outcome-check <file>   Optional Engineering Commons reports
+  --spec-check/--impact-check/--outcome-check/--architecture-check <file>
+                            Optional Engineering Commons reports
+  --openslo <file>          OpenSLO v1 YAML/JSON (SLO, SLI, AlertPolicy; repeatable)
+  --alert-rules <file>      Prometheus/Mimir rules, PrometheusRule, or /api/v1/rules JSON (repeatable)
+  --service-graph <file>    Jaeger /api/dependencies or traces_service_graph_request_total query JSON
   --baseline <file>         Previous results to compare with (retest)
 Output:
   --out-dir <dir>           Default .product-check   --json   Print results JSON to stdout, write nothing
@@ -63,6 +75,8 @@ Output:
   --fail-on <verdicts>      Exit 6 when the verdict is one of these (e.g. NOT_READY,INCONCLUSIVE)
   --no-dashboard  --no-branding  --quiet
 
+${ASSURANCE_HELP}
+
 Exit codes: 0 ok · 1 internal error · 2 usage/config · 3 input · 4 safety refusal · 5 invalid artifact · 6 --fail-on matched
 Local-first: no telemetry, no account, no model calls. Network only to an authorized origin with passive GETs.
 `;
@@ -130,6 +144,10 @@ const OPTIONS = {
     "spec-check": { type: "string" },
     "impact-check": { type: "string" },
     "outcome-check": { type: "string" },
+    "architecture-check": { type: "string" },
+    openslo: { type: "string", multiple: true },
+    "alert-rules": { type: "string", multiple: true },
+    "service-graph": { type: "string" },
     baseline: { type: "string" },
     "out-dir": { type: "string" },
     output: { type: "string" },
@@ -173,6 +191,10 @@ function buildContract(values, io) {
         specCheck: values["spec-check"],
         impactCheck: values["impact-check"],
         outcomeCheck: values["outcome-check"],
+        architectureCheck: values["architecture-check"],
+        openslo: values.openslo,
+        alertRules: values["alert-rules"],
+        serviceGraph: values["service-graph"],
     }, io.cwd, today);
     if (values["authorized-by"] !== undefined && contract.authorization.attestation)
         contract.authorization.attestation.authorized_by = values["authorized-by"];
@@ -181,6 +203,15 @@ function buildContract(values, io) {
     }
     return { contract, fromFile };
 }
+/** Writes the as-built spec (JSON + Spec Kit Markdown) carried by a results document, if any. */
+function writeSpec(results, dir) {
+    const spec = specFromResults(results);
+    if (!spec)
+        return [];
+    writeFile(join(dir, "as-built-spec.json"), `${JSON.stringify(spec, null, 2)}\n`);
+    writeFile(join(dir, "specs", "000-as-built", "spec.md"), renderAsBuiltSpec(spec));
+    return ["as-built-spec.json", "specs/000-as-built/spec.md"];
+}
 /** Writes all renderings of a results document into a directory. */
 function writeOutputs(results, dir, branding, dashboard) {
     const written = [];
@@ -193,6 +224,7 @@ function writeOutputs(results, dir, branding, dashboard) {
     put("blueprint.md", renderBlueprint(results, { branding }));
     for (const p of results.blueprint.work_packets)
         put(`work-packets/${p.id}.md`, renderPacket(results, p));
+    written.push(...writeSpec(results, dir));
     if (dashboard)
         put("dashboard.html", renderDashboard(results, { branding }));
     return written;
@@ -289,6 +321,9 @@ function commandScan(values, io) {
         auditImported: contract.imports.npm_audit !== null,
         specImported: contract.imports.spec_check !== null,
         outcomeImported: contract.imports.outcome_check !== null,
+        operationalImported: contract.imports.openslo.length > 0 ||
+            contract.imports.alert_rules.length > 0 ||
+            contract.imports.service_graph !== null,
         aiInScope: contract.product.uses_ai === true || (repo?.aiDeps.length ?? 0) > 0,
         tier,
         now: (io.now?.() ?? new Date()).toISOString(),
@@ -319,6 +354,60 @@ function commandScan(values, io) {
     io.stdout(lines.join("\n"));
     return ExitCode.Ok;
 }
+/** spec: reverse-engineer an as-built specification from the repository (source only, no requests). */
+function commandSpec(values, io) {
+    const { contract } = buildContract(values, io);
+    if (!contract.target.repository)
+        throw usageError("spec reads a repository: pass --repo <dir>.", "Example: product-check spec --repo .");
+    const format = values.format ?? "both";
+    if (!["md", "json", "both"].includes(format))
+        throw usageError("--format must be md, json or both.");
+    const repoPath = contract.target.repository.path;
+    const facts = deriveFacts(snapshotRepo(repoPath, contract.constraints.max_files, contract.target.name));
+    const started = io.now?.() ?? new Date();
+    const now = started.toISOString();
+    const ev = new EvidenceCollector(makeRunId(started, relativize(contract, io.cwd)), now);
+    const spec = buildAsBuiltSpec({
+        contract,
+        facts,
+        surface: deriveSurface(facts),
+        ev,
+        repository: display(io.cwd, repoPath),
+        generatedAt: now,
+    });
+    if (values.json) {
+        io.stdout(`${JSON.stringify(spec, null, 2)}\n`);
+        return ExitCode.Ok;
+    }
+    const outDir = isAbsolute(values["out-dir"] ?? "")
+        ? values["out-dir"]
+        : resolve(io.cwd, values["out-dir"] ?? ".product-check");
+    const written = [];
+    if (format !== "md") {
+        writeFile(join(outDir, "as-built-spec.json"), `${JSON.stringify(spec, null, 2)}\n`);
+        written.push("as-built-spec.json");
+    }
+    if (format !== "json") {
+        writeFile(join(outDir, "specs", "000-as-built", "spec.md"), renderAsBuiltSpec(spec));
+        written.push("specs/000-as-built/spec.md");
+    }
+    if (!values.quiet) {
+        const count = (k) => spec.surface.filter((s) => s.kind === k).length;
+        io.stdout([
+            `As-built spec for ${contract.target.name} (source only; nothing executed, no requests sent)`,
+            `  ${count("page")} page(s), ${count("endpoint")} endpoint(s), ${count("entity")} entit(y/ies), ${count("integration")} integration(s), ${count("config")} config name(s), ${count("test")} test title(s)`,
+            `  ${spec.requirements.length} functional requirement(s), ${spec.non_functional.length} non-functional, ${spec.clarifications.length} clarification(s) for a person to answer`,
+            `Wrote ${display(io.cwd, outDir)}/: ${written.join(", ")}`,
+            format !== "json"
+                ? `Next: answer the NEEDS CLARIFICATION markers, then lint it: spec-check check ${display(io.cwd, join(outDir, "specs", "000-as-built", "spec.md"))}`
+                : "",
+            "",
+        ]
+            .filter((l, i, a) => l !== "" || i === a.length - 1)
+            .join("\n"));
+    }
+    return ExitCode.Ok;
+}
 /** init: write a contract. */
 function commandInit(values, io) {
     const out = isAbsolute(values.output ?? "")
@@ -386,6 +475,10 @@ function commandValidate(files, io) {
 }
 /** Parses arguments and runs one command. */
 async function main(argv, io) {
+    const first = argv[0] ?? "";
+    if (ASSURANCE_COMMANDS.includes(first) ||
+        ((first === "dashboard" || first === "blueprint") && argv.includes("--from")))
+        return runAssurance(first, argv.slice(1), io);
     const { values, positionals } = (() => {
         try {
             return parseArgs({ args: argv, allowPositionals: true, strict: true, options: OPTIONS });
@@ -424,6 +517,10 @@ async function main(argv, io) {
             if (rest.length > 0)
                 throw usageError(`Unexpected argument: ${rest[0]}`);
             return commandScan(values, io);
+        case "spec":
+            if (rest.length > 0)
+                throw usageError(`Unexpected argument: ${rest[0]}`);
+            return commandSpec(values, io);
         case "init":
             return commandInit(values, io);
         case "validate":
@@ -447,7 +544,8 @@ async function main(argv, io) {
                 writeFile(join(dir, "blueprint.md"), renderBlueprint(results, { branding }));
                 for (const p of results.blueprint.work_packets)
                     writeFile(join(dir, "work-packets", `${p.id}.md`), renderPacket(results, p));
-                io.stdout(`Wrote blueprint.json, blueprint.md and ${results.blueprint.work_packets.length} work packet(s) to ${display(io.cwd, dir)}\n`);
+                const spec = writeSpec(results, dir);
+                io.stdout(`Wrote blueprint.json, blueprint.md${spec.length ? ", the as-built spec" : ""} and ${results.blueprint.work_packets.length} work packet(s) to ${display(io.cwd, dir)}\n`);
             }
             else
                 io.stdout(values.format === "json"
@@ -468,7 +566,7 @@ async function main(argv, io) {
                 io.stdout(`${JSON.stringify(CONTROLS.map(({ remediation: _r, ...c }) => c), null, 2)}\n`);
             else {
                 const lines = [
-                    "Control catalog (rubric pc-rubric-0.1). Tiers carry forward: a tier applies its own and all earlier controls.",
+                    "Control catalog (rubric pc-rubric-0.2). Tiers carry forward: a tier applies its own and all earlier controls.",
                     "",
                 ];
                 for (const c of CONTROLS)
@@ -490,7 +588,7 @@ async function main(argv, io) {
             return ExitCode.Ok;
         }
         default:
-            throw usageError(`Unknown command: ${command}`, "Commands: run, retest, scan, init, validate, report, blueprint, dashboard, controls, schema.");
+            throw usageError(`Unknown command: ${command}`, `Commands: run, retest, scan, spec, init, validate, report, blueprint, dashboard, controls, schema, ${ASSURANCE_COMMANDS.join(", ")}.`);
     }
 }
 /** Runs the CLI and returns the process exit code. Never throws. */

package/dist/contract/contract.d.ts

@@ -27,6 +27,10 @@ export interface ContractFlags {
     specCheck?: string | undefined;
     impactCheck?: string | undefined;
     outcomeCheck?: string | undefined;
+    architectureCheck?: string | undefined;
+    openslo?: string[] | undefined;
+    alertRules?: string[] | undefined;
+    serviceGraph?: string | undefined;
 }
 /** Applies CLI flags over a contract (flags win). Paths are resolved against cwd. */
 export declare function applyFlags(base: ScanContract, flags: ContractFlags, cwd: string, today: string): ScanContract;

package/dist/contract/contract.js

@@ -56,6 +56,10 @@ export function defaultContract() {
             spec_check: null,
             impact_check: null,
             outcome_check: null,
+            architecture_check: null,
+            openslo: [],
+            alert_rules: [],
+            service_graph: null,
         },
         control_mappings: [],
         risk_acceptances: [],
@@ -110,6 +114,8 @@ export function loadContract(path) {
         contract.target.repository.path = abs(contract.target.repository.path);
     const i = contract.imports;
     i.test_results = i.test_results.map(abs);
+    i.openslo = i.openslo.map(abs);
+    i.alert_rules = i.alert_rules.map(abs);
     for (const key of [
         "npm_audit",
         "har",
@@ -117,6 +123,8 @@ export function loadContract(path) {
         "spec_check",
         "impact_check",
         "outcome_check",
+        "architecture_check",
+        "service_graph",
     ]) {
         const value = i[key];
         if (value !== null)
@@ -173,6 +181,14 @@ export function applyFlags(base, flags, cwd, today) {
         c.imports.impact_check = abs(flags.impactCheck);
     if (flags.outcomeCheck !== undefined)
         c.imports.outcome_check = abs(flags.outcomeCheck);
+    if (flags.architectureCheck !== undefined)
+        c.imports.architecture_check = abs(flags.architectureCheck);
+    if (flags.openslo)
+        c.imports.openslo = [...c.imports.openslo, ...flags.openslo.map(abs)];
+    if (flags.alertRules)
+        c.imports.alert_rules = [...c.imports.alert_rules, ...flags.alertRules.map(abs)];
+    if (flags.serviceGraph !== undefined)
+        c.imports.service_graph = abs(flags.serviceGraph);
     if (c.target.name === "unnamed product") {
         c.target.name = c.target.repository
             ? (c.target.repository.path.split(/[\\/]/).filter(Boolean).at(-1) ?? "product")

package/dist/dashboard/render.d.ts

@@ -1,4 +1,9 @@
 import type { Results } from "../types.js";
+/**
+ * Converts an as-built statement (Markdown built in src/spec/build.ts: code spans for repository-derived names,
+ * backslash escapes elsewhere) to HTML. Every segment is HTML-escaped; only `<code>` is produced.
+ */
+export declare function statementHtml(statement: string): string;
 /** Renders the dashboard HTML. */
 export declare function renderDashboard(r: Results, options: {
     branding: boolean;

package/dist/dashboard/render.js

@@ -3,8 +3,8 @@
 /**
  * Renders the local dashboard: one self-contained HTML file generated entirely from a results document. Every
  * number is read from (or recomputed from) the JSON; the integrity check runs first and a failure is shown as a
- * banner. Views: Executive Readiness, Scan Explorer, Validation Workbench, Blueprint & Remediation, Assurance
- * History. A small inline script (allowed by a hash-based CSP) adds tabs, filters and a theme toggle; without it
+ * banner. Views: Executive Readiness, Scan Explorer, Validation Workbench, Blueprint & Remediation, As-built Spec,
+ * Assurance History. A small inline script (allowed by a hash-based CSP) adds tabs, filters and a theme toggle; without it
  * every view is still readable. No external requests.
  */
 import { createHash } from "node:crypto";
@@ -176,6 +176,109 @@ function evidenceList(r, ids) {
     })
         .join("")}</ul></details>`;
 }
+/**
+ * Converts an as-built statement (Markdown built in src/spec/build.ts: code spans for repository-derived names,
+ * backslash escapes elsewhere) to HTML. Every segment is HTML-escaped; only `<code>` is produced.
+ */
+export function statementHtml(statement) {
+    const out = [];
+    let rest = statement;
+    for (;;) {
+        const m = /(`+)( ?)([\s\S]*?)\2\1(?!`)/.exec(rest);
+        if (!m)
+            break;
+        out.push(html(unescapeMd(rest.slice(0, m.index))));
+        out.push(`<code>${html((m[3] ?? "").replace(/\\\|/g, "|"))}</code>`);
+        rest = rest.slice(m.index + m[0].length);
+    }
+    out.push(html(unescapeMd(rest)));
+    return out.join("");
+}
+/** Undoes the Markdown escaping of `md()` for plain-text display (the result is HTML-escaped afterwards). */
+function unescapeMd(text) {
+    return text
+        .replace(/\\([\\`*_[\]<>|~#+=-])/g, "$1")
+        .replace(/&amp;/g, "&")
+        .replace(/@\u200b/g, "@");
+}
+const CERTAINTY_TONE = { observed: "good", inferred: "warning", hypothesis: "unknown" };
+const CERTAINTY_LABEL = {
+    observed: "observed",
+    inferred: "inferred",
+    hypothesis: "needs confirmation",
+};
+/** The As-built Spec view: the reverse-engineered specification carried in the blueprint. */
+function asBuiltView(r) {
+    const head = `<section class="view" id="as-built" aria-labelledby="h-as-built"><h2 id="h-as-built">As-built spec</h2>`;
+    const built = r.blueprint.as_is.as_built;
+    if (!built)
+        return `${head}<p class="muted">No as-built spec: the repository was not inspected in this run.</p></section>`;
+    const byId = new Map(built.surface.map((s) => [s.id, s]));
+    const count = (k) => built.surface.filter((s) => s.kind === k).length;
+    const where = (s) => `<code>${html(`${s.location.path}${s.location.line ? `:${s.location.line}` : ""}`)}</code>`;
+    // Findings whose traceability names an as-built requirement ("As-built FR-001, FR-007; requirement …").
+    const findingsFor = new Map();
+    for (const t of r.blueprint.traceability) {
+        const ids = /^As-built ([^;]+);/.exec(t.journey_or_requirement)?.[1]?.split(", ") ?? [];
+        for (const id of ids)
+            findingsFor.set(id, [...(findingsFor.get(id) ?? []), t.finding_id]);
+    }
+    const openIds = new Set(r.findings.filter((f) => f.status === "OPEN" || f.status === "UNVERIFIED").map((f) => f.id));
+    const reqRow = (q, kind) => {
+        const sources = q.surface_ids.map((id) => byId.get(id)).filter((s) => s !== undefined);
+        const linked = findingsFor.get(q.id) ?? [];
+        const open = linked.filter((id) => openIds.has(id));
+        return `<tr data-kind="${kind}" data-certainty="${q.certainty}"><td class="id"><code>${html(q.id)}</code></td><td>${statementHtml(q.statement)}</td><td>${chip(CERTAINTY_LABEL[q.certainty] ?? q.certainty, CERTAINTY_TONE[q.certainty] ?? "neutral")}</td><td class="small">${sources.slice(0, 4).map(where).join("<br>") || "—"}${sources.length > 4 ? `<br><span class="muted">and ${sources.length - 4} more</span>` : ""}</td><td class="small">${linked.length ? `${open.length ? chip(`${open.length} open`, "critical") : chip("none open", "good")}<br>${linked.length > 3 ? `<details><summary>${linked.length} finding(s)</summary><code>${html(linked.join(", "))}</code></details>` : `<code>${html(linked.join(", "))}</code>`}` : "—"}</td><td class="small">${evidenceList(r, q.evidence_ids)}</td></tr>`;
+    };
+    const surfaceTable = (title, kind, cols, cells) => {
+        const rows = built.surface.filter((s) => s.kind === kind);
+        if (rows.length === 0)
+            return "";
+        return `<details class="card" style="margin-bottom:8px"><summary>${html(title)} (${rows.length})</summary><div class="scroll"><table><thead><tr>${cols.map((c) => `<th>${html(c)}</th>`).join("")}</tr></thead><tbody>${rows
+            .map((s) => `<tr>${cells(s)
+            .map((c) => `<td class="small">${c}</td>`)
+            .join("")}</tr>`)
+            .join("")}</tbody></table></div></details>`;
+    };
+    const auth = (s) => (s.auth_hint ? chip("auth helper (inferred)", "warning") : "—");
+    return `${head}
+<p class="muted small">Reverse-engineered from the repository's structure; nothing was executed. <em>Observed</em> statements point at a file and line, <em>inferred</em> ones interpret what was found, and anything the code cannot tell us needs a person to confirm. The same spec is written as <code>specs/000-as-built/spec.md</code> (Spec Kit layout, lint it with Spec Check) and <code>as-built-spec.json</code>.</p>
+<div class="grid kpis">${[
+        ["Pages", count("page")],
+        ["Endpoints", count("endpoint")],
+        ["Data entities", count("entity")],
+        ["Integrations", count("integration")],
+        ["Config names", count("config")],
+        ["Open questions", built.clarifications.length],
+    ]
+        .map(([k, v]) => `<div class="card kpi"><div class="label">${html(k)}</div><div class="value">${v}</div></div>`)
+        .join("")}</div>
+${built.clarifications.length ? `<h3>Questions only a person can answer</h3><ul>${built.clarifications.map((c) => `<li>${html(c)}</li>`).join("")}</ul>` : ""}
+<h3>User stories</h3>${built.stories
+        .map((s) => `<details class="card" style="margin-bottom:8px"><summary>${html(s.id)} ${html(s.title)} ${s.critical_journey ? chip(`critical journey: ${s.critical_journey}`, "neutral") : ""}</summary><p class="small"><strong>Requirements:</strong> <code>${html(s.requirement_ids.join(", ") || "—")}</code></p>${s.test_behaviours.length ? `<p class="small"><strong>Behaviour described by tests</strong> (inferred)</p><ul class="small">${s.test_behaviours.map((t) => `<li>${html(t)}</li>`).join("")}</ul>` : `<p class="small muted">No test titles mention this area.</p>`}</details>`)
+        .join("") ||
+        `<p class="muted">No pages or endpoints were recognised, so no user stories could be derived.</p>`}
+<h3>Requirements</h3>
+<div class="filters" data-filter-table="as-built-table"><label>Type<select data-key="kind"><option value="">All</option><option value="functional">Functional</option><option value="non-functional">Non-functional</option><option value="success">Success criteria</option><option value="edge">Edge cases</option></select></label>
+<label>Certainty<select data-key="certainty"><option value="">All</option><option value="observed">Observed</option><option value="inferred">Inferred</option><option value="hypothesis">Needs confirmation</option></select></label>
+<label>Search<input type="search" data-key="text" placeholder="ID, route, entity, path"></label><span class="small muted" data-count style="align-self:end"></span></div>
+<div class="scroll"><table id="as-built-table"><thead><tr><th>ID</th><th>Statement</th><th>Certainty</th><th>Source</th><th>Linked findings</th><th>Evidence</th></tr></thead><tbody>${[
+        ...built.requirements.map((q) => reqRow(q, "functional")),
+        ...built.non_functional.map((q) => reqRow(q, "non-functional")),
+        ...built.success_criteria.map((q) => reqRow(q, "success")),
+        ...built.edge_cases.map((q) => reqRow(q, "edge")),
+    ].join("")}</tbody></table></div>
+<h3>Discovered surface</h3>
+${surfaceTable("Pages", "page", ["Route", "Kind", "Source", "Auth"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s), auth(s)])}
+${surfaceTable("Endpoints", "endpoint", ["Method", "Path", "Kind", "Source", "Auth"], (s) => [`<code>${html(s.method ?? "ANY")}</code>`, `<code>${html(s.name)}</code>`, html(s.detail), where(s), auth(s)])}
+${surfaceTable("Data entities", "entity", ["Entity", "Detail", "Source"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Integrations", "integration", ["Package", "Category", "Declared in"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Configuration (names only; values never read)", "config", ["Variable", "Use", "First reference"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Authentication boundaries", "auth-boundary", ["Boundary", "Detail", "Source"], (s) => [`<code>${html(s.name)}</code>`, html(s.detail), where(s)])}
+${surfaceTable("Test titles", "test", ["Title", "Area", "Source"], (s) => [html(s.name), html(s.area), where(s)])}
+<h3>Uncertainties</h3><ul class="small">${built.uncertainties.map((u) => `<li>${html(u)}</li>`).join("")}</ul>
+</section>`;
+}
 /** Validation table row. */
 function validationRow(r, v) {
     return `<tr data-pillar="${v.pillar}" data-status="${v.status}">
@@ -328,12 +431,13 @@ ${c
 <div class="wrap">
 <header class="top"><div><h1>Product Check: ${html(r.contract.target.name)}</h1><div class="meta">Run ${html(r.run.run_id)} · ${html(r.run.finished_at)} · ${html(r.run.status)}</div></div><button class="theme-toggle" type="button" hidden>Theme: auto</button></header>
 ${banners}
-<nav class="tabs" aria-label="Dashboard views"><a href="#readiness" aria-current="page">Executive readiness</a><a href="#scan">Scan explorer</a><a href="#workbench">Validation workbench</a><a href="#blueprint">Blueprint &amp; remediation</a><a href="#history">Assurance history</a></nav>
+<nav class="tabs" aria-label="Dashboard views"><a href="#readiness" aria-current="page">Executive readiness</a><a href="#scan">Scan explorer</a><a href="#workbench">Validation workbench</a><a href="#blueprint">Blueprint &amp; remediation</a><a href="#as-built">As-built spec</a><a href="#history">Assurance history</a></nav>
 <main>
 ${exec}
 ${scan}
 ${work}
 ${bp}
+${asBuiltView(r)}
 ${hist}
 </main>
 <footer>Generated from <code>product-check-results.json</code> (schema ${html(r.schema_version)}); every figure is derived from that file${integrity.errors.length === 0 ? " and its scorecard and verdict recompute from the validations" : ""}. Evidence-bounded readiness, not a penetration test, certification or guarantee.${options.branding ? " Product Check is an EnWithAI Engineering Commons tool." : ""}</footer>

package/dist/discovery/pops.d.ts

@@ -16,6 +16,8 @@ export interface PopInput {
     auditImported: boolean;
     specImported: boolean;
     outcomeImported: boolean;
+    /** OpenSLO, alert rules or a service graph was imported (CT-T4). */
+    operationalImported: boolean;
     aiInScope: boolean;
     tier: Tier;
     now: string;

package/dist/discovery/pops.js

@@ -217,14 +217,16 @@ export function buildPops(input) {
         id: "observability",
         category: "operations",
         name: "Production telemetry (logs, metrics, traces, alerts)",
-        status: postLaunch ? "BLOCKED" : "NOT_APPLICABLE",
+        status: postLaunch ? (input.operationalImported ? "AVAILABLE" : "BLOCKED") : "NOT_APPLICABLE",
         relevant: postLaunch,
         scope: null,
-        provenance: "none",
+        provenance: postLaunch && input.operationalImported ? "imported" : "none",
         limitations: [
-            postLaunch
-                ? "No telemetry adapter in this release; production signals were not read."
-                : "Not required before launch tiers (CT-T4+).",
+            !postLaunch
+                ? "Not required before launch tiers (CT-T4+)."
+                : input.operationalImported
+                    ? "Read from exported files (OpenSLO, alert rules, service graph); nothing was queried live, and a service graph covers only its time window."
+                    : "No operational files were imported (--openslo, --alert-rules, --service-graph); production signals were not read.",
         ],
     }));
     pops.push(input.aiInScope

package/dist/exec/process.d.ts

@@ -0,0 +1,27 @@
+import type { CommandExecution, CommandSpec } from "../assurance/types.js";
+/** Result of a git read. */
+export interface GitResult {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+}
+/** Runs a read-only git subcommand in `repo`. */
+export declare function gitRead(repo: string, args: string[], maxBuffer?: number): GitResult;
+/** Authorization for command execution, decided once per CLI invocation. */
+export interface ExecPermission {
+    allowed: boolean;
+    reason: string;
+}
+/** Inputs to one execution. */
+export interface ExecInput {
+    spec: CommandSpec;
+    repo: string;
+    permission: ExecPermission;
+    envAllowlist: readonly string[];
+    maxOutputBytes: number;
+    environmentId: string;
+    commitSha: string | null;
+    now: () => Date;
+}
+/** Executes one declared command (argv, no shell). Never throws for command failures. */
+export declare function execCommand(input: ExecInput): CommandExecution;