@enwithai/product-check 0.1.0 → 0.3.0

package/dist/types.d.ts

@@ -3,7 +3,13 @@
  * schemas with both the built-in validator and Ajv.
  */
 export declare const SCHEMA_VERSION: "0.1.0";
-export declare const RUBRIC_VERSION: "pc-rubric-0.1";
+export declare const RUBRIC_VERSION: "pc-rubric-0.2";
+/**
+ * Rubric versions a stored scorecard may carry. pc-rubric-0.2 only adds control PC-T-17; the scoring rules are those
+ * of pc-rubric-0.1, so earlier results still recompute and load as baselines.
+ */
+export declare const RUBRIC_VERSIONS: readonly ["pc-rubric-0.1", "pc-rubric-0.2"];
+export type RubricVersion = (typeof RUBRIC_VERSIONS)[number];
 /** The three independent assessment pillars (CT3: Customer × Technology × Trust). */
 export type Pillar = "customer" | "technology" | "trust";
 export declare const PILLARS: readonly Pillar[];
@@ -101,6 +107,10 @@ export interface ScanContract {
         spec_check: string | null;
         impact_check: string | null;
         outcome_check: string | null;
+        architecture_check: string | null;
+        openslo: string[];
+        alert_rules: string[];
+        service_graph: string | null;
     };
     control_mappings: ControlMapping[];
     risk_acceptances: RiskAcceptance[];
@@ -250,7 +260,7 @@ export interface GateResult {
 export interface Scorecard {
     schema_version: typeof SCHEMA_VERSION;
     kind: "scorecard";
-    rubric_version: typeof RUBRIC_VERSION;
+    rubric_version: RubricVersion;
     pillars: Record<Pillar, PillarScore>;
     overall_coverage: number;
     gates: GateResult[];
@@ -346,6 +356,8 @@ export interface Blueprint {
     as_is: {
         components: ArchitectureComponent[];
         uncertainties: string[];
+        /** The as-built spec derived from the repository (absent when source was not inspected). */
+        as_built?: AsBuiltBody;
     };
     to_be: {
         changes: TargetChange[];
@@ -484,3 +496,67 @@ export interface Results {
     history: RunSummary[];
     limitations: Limitation[];
 }
+/** Certainty of a statement in an as-built specification. */
+export type SpecCertainty = "observed" | "inferred" | "hypothesis";
+/** One element of the discovered product surface, with its evidence. */
+export interface SurfaceEntry {
+    id: string;
+    kind: "page" | "endpoint" | "entity" | "config" | "integration" | "auth-boundary" | "test";
+    name: string;
+    method: string | null;
+    area: string;
+    detail: string;
+    location: {
+        path: string;
+        line: number | null;
+    };
+    certainty: "observed" | "inferred";
+    auth_hint: boolean;
+    evidence_ids: string[];
+}
+/** A requirement statement derived from the surface. */
+export interface SpecRequirement {
+    id: string;
+    statement: string;
+    certainty: SpecCertainty;
+    surface_ids: string[];
+    evidence_ids: string[];
+}
+/** A user story grouping one area of the surface. */
+export interface SpecStory {
+    id: string;
+    area: string;
+    title: string;
+    critical_journey: string | null;
+    surface_ids: string[];
+    requirement_ids: string[];
+    test_behaviours: string[];
+}
+/** The as-built specification document. */
+export interface AsBuiltSpec {
+    schema_version: typeof SCHEMA_VERSION;
+    kind: "as-built-spec";
+    generated_at: string;
+    tool: {
+        name: "product-check";
+        version: string;
+    };
+    target: {
+        name: string;
+        repository: string;
+        commit: string | null;
+        ref: string | null;
+    };
+    surface: SurfaceEntry[];
+    stories: SpecStory[];
+    requirements: SpecRequirement[];
+    non_functional: SpecRequirement[];
+    success_criteria: SpecRequirement[];
+    edge_cases: SpecRequirement[];
+    clarifications: string[];
+    uncertainties: string[];
+    evidence: Evidence[];
+    limitations: Limitation[];
+}
+/** The derived content of an as-built spec, as embedded in a blueprint. */
+export type AsBuiltBody = Pick<AsBuiltSpec, "surface" | "stories" | "requirements" | "non_functional" | "success_criteria" | "edge_cases" | "clarifications" | "uncertainties">;

package/dist/types.js

@@ -5,6 +5,11 @@
  * schemas with both the built-in validator and Ajv.
  */
 export const SCHEMA_VERSION = "0.1.0";
-export const RUBRIC_VERSION = "pc-rubric-0.1";
+export const RUBRIC_VERSION = "pc-rubric-0.2";
+/**
+ * Rubric versions a stored scorecard may carry. pc-rubric-0.2 only adds control PC-T-17; the scoring rules are those
+ * of pc-rubric-0.1, so earlier results still recompute and load as baselines.
+ */
+export const RUBRIC_VERSIONS = ["pc-rubric-0.1", RUBRIC_VERSION];
 export const PILLARS = ["customer", "technology", "trust"];
 export const TIERS = ["CT-T0", "CT-T1", "CT-T2", "CT-T3", "CT-T4", "CT-T5", "CT-T6"];

package/dist/validation/catalog.d.ts

@@ -1,5 +1,5 @@
 /**
- * The control catalog (rubric pc-rubric-0.1). Each control states what is expected, which pillar and lifecycle
+ * The control catalog (rubric pc-rubric-0.2). Each control states what is expected, which pillar and lifecycle
  * tier it belongs to, its weight, whether it backs a hard gate, and the remediation knowledge used by the
  * blueprint. Evaluation logic lives in evaluators; this file is data only.
  */

package/dist/validation/catalog.js

@@ -739,10 +739,13 @@ export const CONTROLS = [
         },
         root_cause: "No production telemetry is connected to the assessment.",
         remediation: rem({
-            change: "Connect production metrics, logs and alerts; this release of Product Check has no telemetry adapter, so record evidence manually.",
+            change: "Connect production metrics, logs and alerts, then export the alert rules (or OpenSLO alert policies) and a service graph and import them (--alert-rules, --openslo, --service-graph).",
             why: "Launch watch depends on detection speed.",
             to_be: "Alerts on error rate, latency and journey success.",
-            acceptance: ["Alerting is configured for critical signals."],
+            acceptance: [
+                "Alerting is configured for critical signals.",
+                "Control PC-T-14 evaluates PASS on retest with alert configuration and a service graph imported.",
+            ],
             regression: "Alert test on deployment.",
             effort: "M",
         }),
@@ -805,6 +808,126 @@ export const CONTROLS = [
         }),
     },
     // ------------------------------------------------------------------------------------------------- Trust
+    {
+        id: "PC-T-17",
+        pillar: "technology",
+        tier: "CT-T3",
+        title: "Architecture model matches the code",
+        expected: "An imported Architecture Check report shows no verified drift of medium severity or above between the declared architecture model and the code.",
+        category: "architecture",
+        weight: 1,
+        gate: null,
+        severity: "P2",
+        ux: null,
+        pops: ["repository"],
+        impact: {
+            customer: null,
+            technology: "Reviews, onboarding and risk decisions rely on an architecture model that no longer describes the system.",
+            trust: null,
+        },
+        root_cause: "The code changed (or the model was edited) without the other being updated.",
+        remediation: rem({
+            change: "Resolve each verified Architecture Check finding: update the model where the code is right, or change the code where it breaks a declared boundary.",
+            why: "A launch decision about the architecture is only as good as the model it is made against.",
+            to_be: "The declared model and the code agree, and Architecture Check runs on every pull request.",
+            acceptance: [
+                "The Architecture Check report has no verified finding of medium severity or above.",
+                "Control PC-T-17 evaluates PASS on retest.",
+            ],
+            regression: "Architecture Check in pull-request CI.",
+            effort: "S",
+        }),
+    },
+    {
+        id: "PC-T-18",
+        pillar: "technology",
+        tier: "CT-T4",
+        title: "SLOs define an objective, a time window and an indicator",
+        expected: "Imported OpenSLO v1 files define at least one SLO, and every SLO has a service, one time window, an objective target and an indicator.",
+        category: "launch-watch",
+        weight: 1,
+        gate: null,
+        severity: "P2",
+        ux: null,
+        pops: ["observability"],
+        impact: {
+            customer: null,
+            technology: "Without complete SLOs nobody can tell whether the launched service meets its reliability target.",
+            trust: null,
+        },
+        root_cause: "SLOs are missing or were written without a measurable objective, window or indicator.",
+        remediation: rem({
+            change: "Define an OpenSLO v1 SLO per critical service with a target, one time window and an indicator (inline or an SLI reference).",
+            why: "A launch watch needs an agreed, measurable target to watch against.",
+            to_be: "Every critical service has a complete SLO under version control.",
+            acceptance: [
+                "Every imported SLO lists a service, a time window, an objective target and an indicator.",
+                "Control PC-T-18 evaluates PASS on retest.",
+            ],
+            regression: "OpenSLO files validated in CI (oslo validate) and imported on every assessment.",
+            effort: "S",
+        }),
+    },
+    {
+        id: "PC-T-19",
+        pillar: "technology",
+        tier: "CT-T4",
+        title: "Every SLO is alerted on",
+        expected: "Every imported SLO has an OpenSLO alert policy or an imported alerting rule that names it.",
+        category: "launch-watch",
+        weight: 1,
+        gate: null,
+        severity: "P2",
+        ux: null,
+        pops: ["observability"],
+        impact: {
+            customer: null,
+            technology: "An SLO without an alert is breached silently; users notice before the team does.",
+            trust: null,
+        },
+        root_cause: "SLOs were defined without alert policies or burn-rate alert rules.",
+        remediation: rem({
+            change: "Attach an alert policy to each SLO, or generate burn-rate alerts (Sloth, Pyrra) that carry the SLO name as a label.",
+            why: "Detection speed decides how much error budget an incident consumes.",
+            to_be: "Every SLO pages through a burn-rate alert.",
+            acceptance: [
+                "Every SLO has an alert policy or an alerting rule labelled with its name.",
+                "Control PC-T-19 evaluates PASS on retest.",
+            ],
+            regression: "Alert rules generated from the SLO files in CI.",
+            effort: "S",
+        }),
+    },
+    {
+        id: "PC-T-20",
+        pillar: "technology",
+        tier: "CT-T4",
+        title: "Declared dependencies are observed at runtime",
+        expected: "Each declared relationship that Architecture Check could not confirm statically appears as an edge in an imported service graph.",
+        category: "launch-watch",
+        weight: 1,
+        gate: null,
+        severity: "P2",
+        ux: null,
+        pops: ["observability", "repository"],
+        impact: {
+            customer: null,
+            technology: "The architecture model claims dependencies that may not exist at runtime, or that run through paths nobody traced.",
+            trust: null,
+        },
+        root_cause: "The model lists relationships that neither the code nor runtime traces show.",
+        remediation: rem({
+            change: "Check each listed relationship: remove it from the model if it no longer exists, or instrument the call so traces show it.",
+            why: "Runtime evidence is the only evidence for calls that static analysis cannot see.",
+            to_be: "Every declared relationship has static or runtime evidence.",
+            acceptance: [
+                "No declared relationship lacks both static evidence and a runtime edge.",
+                "Control PC-T-20 evaluates PASS on retest.",
+            ],
+            regression: "Architecture Check and a service-graph export on every release.",
+            effort: "S",
+        }),
+    },
     {
         id: "PC-S-01",
         pillar: "trust",

package/dist/validation/context.d.ts

@@ -4,7 +4,8 @@
 import type { EvidenceCollector } from "../evidence/collector.js";
 import type { ObservationSet } from "../inspectors/http/observe.js";
 import type { RepoFacts } from "../inspectors/source/facts.js";
-import type { AuditSummary, ImpactCheckSummary, OutcomeCheckSummary, SpecCheckSummary } from "../importers/reports.js";
+import type { ArchitectureCheckSummary, AuditSummary, ImpactCheckSummary, OutcomeCheckSummary, SpecCheckSummary } from "../importers/reports.js";
+import type { AlertRulesSummary, OpenSloSummary, ServiceGraphSummary } from "../importers/operational.js";
 import type { TestRun } from "../importers/tests.js";
 import type { Confidence, Epistemic, EvidenceStrength, Results, ScanContract, Severity, UxSeverity, Validation, ValidationStatus } from "../types.js";
 /** An imported artifact with its source path and checksum. */
@@ -27,6 +28,10 @@ export interface EvalContext {
     spec: Imported<SpecCheckSummary> | null;
     impact: Imported<ImpactCheckSummary> | null;
     outcome: Imported<OutcomeCheckSummary> | null;
+    architecture: Imported<ArchitectureCheckSummary> | null;
+    openslo: Imported<OpenSloSummary> | null;
+    alertRules: Imported<AlertRulesSummary> | null;
+    serviceGraph: Imported<ServiceGraphSummary> | null;
     baseline: Results | null;
     aiInScope: boolean;
 }

package/dist/validation/import-evaluators.js

@@ -2,11 +2,13 @@
 // SPDX-FileCopyrightText: 2026 EnWithAI Technologies
 /**
  * Evaluators backed by imported artifacts: executed test results (including contract control_mappings that link
- * named tests to any control), npm audit, and Spec/Impact/Outcome Check reports. Imported results are evidence
+ * named tests to any control), npm audit, Spec/Impact/Outcome/Architecture Check reports, and the operational
+ * files of CT-T4 (operational-evaluators.ts). Imported results are evidence
  * of executions that happened elsewhere; Product Check records where they came from and their checksum.
  */
 import { isEndToEnd, tally } from "../importers/tests.js";
 import { checked, unchecked, } from "./context.js";
+import { OPERATIONAL_EVALUATORS } from "./operational-evaluators.js";
 /** Evidence for a set of test cases from one results file. */
 function testEv(ctx, run, cases, what) {
     const t = tally(cases);
@@ -270,6 +272,35 @@ const PC_T_12 = (ctx) => {
         },
     ]);
 };
+const PC_T_17 = (ctx) => {
+    if (!ctx.architecture)
+        return unchecked("NOT_TESTED", "No Architecture Check report was imported (optional; pass --architecture-check <report.json>).");
+    const s = ctx.architecture.data;
+    const rules = s.verified_rules.length > 0 ? ` (${s.verified_rules.join(", ")})` : "";
+    const id = ctx.ev.add({
+        kind: "imported-report",
+        pop: "repository",
+        strength: "imported-report",
+        provenance: "imported",
+        locator: ctx.architecture.source,
+        revision: null,
+        summary: `Architecture Check ${s.schema_version}: ${s.model_path ?? "model"} (${s.model_format ?? "unknown format"}), ${s.findings} finding(s); ${s.verified_drift} verified drift${rules}, ${s.hypotheses} hypotheses, ${s.unknown} unknown`,
+        checksum: ctx.architecture.sha256,
+    });
+    if (s.verified_drift === 0)
+        return checked("PASS", "No verified architecture drift of medium severity or above.", "imported-report", "imported-report", [id]);
+    return checked("PARTIAL", `${s.verified_drift} verified architecture drift finding(s)${rules}.`, "imported-report", "imported-report", [id], [
+        {
+            fingerprint: "architecture-drift",
+            location: s.model_path ?? ctx.architecture.source,
+            actual: `${s.verified_drift} verified drift finding(s) of medium severity or above${rules}.`,
+            evidence: [id],
+            epistemic: "fact",
+            confidence: "HIGH",
+            title: "The architecture model and the code have drifted",
+        },
+    ]);
+};
 const PC_T_15 = (ctx) => {
     if (!ctx.outcome)
         return unchecked("NOT_TESTED", "No Outcome Check report was imported (optional; pass --outcome-check <report.json>).");
@@ -327,9 +358,12 @@ export const IMPORT_EVALUATORS = {
     "PC-T-03": PC_T_03,
     "PC-T-12": PC_T_12,
     "PC-T-13": mappedOnly("PC-T-13", "Rollback needs an executed rehearsal."),
-    "PC-T-14": (ctx) => mappedOutcome(ctx, "PC-T-14") ??
-        unchecked("NOT_TESTED", "No production monitoring adapter exists in this release (read-only telemetry import is planned)."),
+    "PC-T-14": (ctx) => mappedOutcome(ctx, "PC-T-14") ?? OPERATIONAL_EVALUATORS["PC-T-14"](ctx),
     "PC-T-15": PC_T_15,
+    "PC-T-17": PC_T_17,
+    "PC-T-18": OPERATIONAL_EVALUATORS["PC-T-18"],
+    "PC-T-19": OPERATIONAL_EVALUATORS["PC-T-19"],
+    "PC-T-20": OPERATIONAL_EVALUATORS["PC-T-20"],
     "PC-S-13": (ctx) => ctx.contract.product.has_user_accounts === false
         ? unchecked("NOT_APPLICABLE", "The contract declares that the product has no user accounts or privileged paths.")
         : mappedOnly("PC-S-13", "Authorization bypass testing needs credentialed negative tests, which Product Check does not run itself.")(ctx),

package/dist/validation/integrity.js

@@ -8,6 +8,7 @@
 import { formatErrors, validateAgainst } from "../schema/registry.js";
 import { computeScorecard } from "../scoring/score.js";
 import { computeVerdict } from "../scoring/verdict.js";
+import { RUBRIC_VERSIONS } from "../types.js";
 import { CONTROL_BY_ID } from "./catalog.js";
 /** Stable JSON for comparisons. */
 const canon = (v) => JSON.stringify(v);
@@ -90,6 +91,9 @@ export function checkResults(doc) {
         errors.push("comparison.baseline_run_id does not match run.baseline.");
     const previous = r.history.length >= 2 ? (r.history.at(-2) ?? null) : null;
     const scorecard = computeScorecard(r.validations, r.findings, r.scorecard.parameters, previous);
+    // Earlier rubrics share the scoring rules; keep the stored version so their results still recompute.
+    if (RUBRIC_VERSIONS.includes(r.scorecard.rubric_version))
+        scorecard.rubric_version = r.scorecard.rubric_version;
     if (canon(scorecard) !== canon(r.scorecard))
         errors.push("The scorecard does not recompute from the validations and findings (edited after generation?).");
     else {

package/dist/validation/operational-evaluators.d.ts

@@ -0,0 +1,3 @@
+import { type Evaluator } from "./context.js";
+/** Evaluators for the operational controls, keyed by control ID. */
+export declare const OPERATIONAL_EVALUATORS: Record<string, Evaluator>;

package/dist/validation/operational-evaluators.js

@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: 2026 EnWithAI Technologies
+/**
+ * CT-T4 evaluators backed by exported operational files (docs/operational-imports.md): PC-T-14 (monitoring and
+ * alerting), PC-T-18 (SLOs complete), PC-T-19 (SLOs alerted) and PC-T-20 (declared dependencies observed at
+ * runtime). Configuration files are facts about configuration; a service graph is a snapshot of one time window.
+ */
+import { sloMatchesRule } from "../importers/operational.js";
+import { checked, unchecked, } from "./context.js";
+/** Evidence for the imported OpenSLO files. */
+function sloEvidence(ctx, s, summary) {
+    return ctx.ev.add({
+        kind: "imported-report",
+        pop: "observability",
+        strength: "imported-report",
+        provenance: "imported",
+        locator: s.source,
+        revision: null,
+        summary,
+        checksum: s.sha256,
+    });
+}
+const PC_T_18 = (ctx) => {
+    if (!ctx.openslo)
+        return unchecked("NOT_TESTED", "No OpenSLO files were imported (optional; pass --openslo <file>).");
+    const s = ctx.openslo.data;
+    const incomplete = s.slos.filter((o) => o.missing.length > 0);
+    const services = [...new Set(s.slos.map((o) => o.service).filter((x) => x !== null))].sort();
+    const id = sloEvidence(ctx, ctx.openslo, `OpenSLO: ${s.slos.length} SLO(s) for ${services.length} service(s)${services.length ? ` (${services.slice(0, 10).join(", ")})` : ""}; ${incomplete.length} incomplete; ${s.slis} SLI(s), ${s.alert_policies} alert polic(ies); ${s.unsupported} document(s) of another OpenSLO version`);
+    if (s.slos.length === 0)
+        return checked("PARTIAL", "The imported OpenSLO files define no SLO.", "imported-report", "imported-report", [id], [
+            {
+                fingerprint: "no-slo",
+                location: ctx.openslo.source,
+                actual: "No SLO is defined in the imported OpenSLO files.",
+                evidence: [id],
+                epistemic: "fact",
+                confidence: "HIGH",
+                title: "No SLO is defined",
+            },
+        ]);
+    if (incomplete.length === 0)
+        return checked("PASS", `All ${s.slos.length} SLO(s) define a service, a time window, an objective target and an indicator.`, "imported-report", "imported-report", [id]);
+    return checked("PARTIAL", `${incomplete.length} of ${s.slos.length} SLO(s) are incomplete.`, "imported-report", "imported-report", [id], incomplete.map((o) => ({
+        fingerprint: `slo-incomplete:${o.name}`,
+        location: o.name,
+        actual: `SLO ${o.name} is missing: ${o.missing.join(", ")}.`,
+        evidence: [id],
+        epistemic: "fact",
+        confidence: "HIGH",
+        title: "SLO is incomplete",
+    })));
+};
+const PC_T_19 = (ctx) => {
+    if (!ctx.openslo)
+        return unchecked("NOT_TESTED", "No OpenSLO files were imported (optional; pass --openslo <file>).");
+    const s = ctx.openslo.data;
+    if (s.slos.length === 0)
+        return unchecked("NOT_TESTED", "The imported OpenSLO files define no SLO.");
+    const rules = ctx.alertRules?.data.alerting ?? [];
+    const byPolicy = s.slos.filter((o) => o.has_alert_policy);
+    const byRule = s.slos.filter((o) => !o.has_alert_policy && rules.some((r) => sloMatchesRule(o.name, r)));
+    const uncovered = s.slos.filter((o) => !byPolicy.includes(o) && !byRule.includes(o));
+    const id = sloEvidence(ctx, ctx.openslo, `OpenSLO alerting: ${s.slos.length} SLO(s); ${byPolicy.length} by alert policy, ${byRule.length} by alert-rule name match (inference)${ctx.alertRules ? ` against ${rules.length} alerting rule(s) in ${ctx.alertRules.source}` : "; no alert rules imported"}; ${uncovered.length} without an alert`);
+    if (uncovered.length === 0)
+        return checked("PASS", "Every SLO has an alert policy or a matching alerting rule.", "imported-report", "imported-report", [id]);
+    return checked("PARTIAL", `${uncovered.length} of ${s.slos.length} SLO(s) have no alert policy and no matching alerting rule.`, "imported-report", "imported-report", [id], uncovered.map((o) => ({
+        fingerprint: `slo-unalerted:${o.name}`,
+        location: o.name,
+        actual: `SLO ${o.name} has no alert policy and no alerting rule names it${o.dangling_policy_refs.length ? ` (unresolved alertPolicyRef: ${o.dangling_policy_refs.join(", ")})` : ""}.`,
+        evidence: [id],
+        epistemic: "fact",
+        confidence: "HIGH",
+        title: "SLO is not alerted on",
+    })));
+};
+/** Lower case, letters and digits only. */
+const norm = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+const lastSegment = (id) => id.split(".").at(-1) ?? id;
+const PC_T_20 = (ctx) => {
+    if (!ctx.serviceGraph)
+        return unchecked("NOT_TESTED", "No service graph was imported (optional; pass --service-graph <file>).");
+    if (!ctx.architecture)
+        return unchecked("NOT_TESTED", "A service graph was imported, but the declared relationships come from an Architecture Check report (--architecture-check).");
+    const g = ctx.serviceGraph.data;
+    const candidates = ctx.architecture.data.unobserved;
+    const confirmed = candidates.filter((c) => g.edges.some((e) => norm(e.client) === norm(lastSegment(c.from)) && norm(e.server) === norm(lastSegment(c.to))));
+    const missing = candidates.filter((c) => !confirmed.includes(c));
+    const id = ctx.ev.add({
+        kind: "imported-report",
+        pop: "observability",
+        strength: "imported-report",
+        provenance: "imported",
+        locator: ctx.serviceGraph.source,
+        revision: null,
+        summary: `Service graph (${g.format}): ${g.edges.length} edge(s), ${g.external_peers} external peer(s); ${candidates.length} declared relationship(s) without static evidence, ${confirmed.length} observed at runtime (name match). A snapshot of one time window that the export does not record.`,
+        checksum: ctx.serviceGraph.sha256,
+    });
+    if (missing.length === 0)
+        return checked("PASS", candidates.length === 0
+            ? "Every declared relationship already has static evidence; nothing needed runtime confirmation."
+            : `All ${candidates.length} declared relationship(s) without static evidence were observed at runtime.`, "imported-report", "imported-report", [id]);
+    return checked("PARTIAL", `${missing.length} declared relationship(s) have neither static evidence nor a runtime edge in this snapshot.`, "imported-report", "imported-report", [id], missing.map((c) => ({
+        fingerprint: `relationship-not-observed:${c.from}->${c.to}`,
+        location: `${c.from} -> ${c.to}`,
+        actual: `The declared relationship ${c.from} -> ${c.to} has no static evidence and no runtime edge in the imported service graph.`,
+        evidence: [id],
+        epistemic: "inference",
+        confidence: "MEDIUM",
+        title: "Declared dependency not observed at runtime",
+    })));
+};
+const PC_T_14 = (ctx) => {
+    const alerting = (ctx.alertRules?.data.alerting.length ?? 0) > 0 ||
+        (ctx.openslo?.data.slos.some((o) => o.has_alert_policy) ?? false);
+    const telemetry = (ctx.serviceGraph?.data.edges.length ?? 0) > 0;
+    if (!ctx.alertRules && !ctx.openslo && !ctx.serviceGraph)
+        return unchecked("NOT_TESTED", "No operational files were imported (optional; pass --openslo, --alert-rules and/or --service-graph).");
+    const sources = [ctx.openslo, ctx.alertRules, ctx.serviceGraph].filter((x) => x !== null);
+    const id = ctx.ev.add({
+        kind: "imported-report",
+        pop: "observability",
+        strength: "imported-report",
+        provenance: "imported",
+        locator: sources.map((s) => s.source).join(", "),
+        revision: null,
+        summary: `Monitoring: alert configuration ${alerting ? "present" : "absent"} (${ctx.alertRules?.data.alerting.length ?? 0} alerting rule(s), ${ctx.openslo?.data.slos.filter((o) => o.has_alert_policy).length ?? 0} SLO(s) with an alert policy); runtime telemetry ${telemetry ? `present (${ctx.serviceGraph?.data.edges.length ?? 0} service-graph edge(s))` : "absent"}`,
+        checksum: sources.length === 1 ? (sources[0]?.sha256 ?? null) : null,
+    });
+    if (alerting && telemetry)
+        return checked("PASS", "Alert configuration and runtime telemetry were imported.", "imported-report", "imported-report", [id]);
+    const missingHalf = alerting
+        ? "runtime telemetry (a service graph)"
+        : "alert configuration (alert rules or SLO alert policies)";
+    return checked("PARTIAL", `Missing ${missingHalf}.`, "imported-report", "imported-report", [id], [
+        {
+            fingerprint: "monitoring-incomplete",
+            location: sources.map((s) => s.source).join(", "),
+            actual: `The imported files show no ${missingHalf}.`,
+            evidence: [id],
+            epistemic: "inference",
+            confidence: "MEDIUM",
+            title: "Monitoring or alerting evidence is incomplete",
+        },
+    ]);
+};
+/** Evaluators for the operational controls, keyed by control ID. */
+export const OPERATIONAL_EVALUATORS = {
+    "PC-T-14": PC_T_14,
+    "PC-T-18": PC_T_18,
+    "PC-T-19": PC_T_19,
+    "PC-T-20": PC_T_20,
+};

package/dist/validation/source-evaluators.js

@@ -36,7 +36,7 @@ function scopeEv(ctx, files, what) {
         provenance: "observed",
         locator: `repository (${files.length} text files)`,
         revision: ctx.revision,
-        summary: `Searched ${files.length} readable, non-ignored text files for ${what} (rubric pc-rubric-0.1).`,
+        summary: `Searched ${files.length} readable, non-ignored text files for ${what} (rubric pc-rubric-0.2).`,
         checksum: fingerprint,
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enwithai/product-check",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Evidence-led product assurance and software blueprinting: scan a repository and/or an authorized deployed app, validate Customer, Technology and Trust controls with evidence, and get findings, a remediation blueprint, a readiness verdict and a local dashboard. Local-first; JSON is the source of truth.",
   "license": "MIT",
   "author": "EnWithAI Technologies",
@@ -73,5 +73,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "yaml": "2.9.1"
   }
 }