@greenarmor/ges-web-dashboard 1.3.0 → 1.4.1

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as http from "node:http";
-import type { ScoreFile, Control, FixHistoryEntry, ActivityLogEntry } from "@greenarmor/ges-core";
+import type { ScoreFile, Control, FixHistoryEntry, ActivityLogEntry, GovernanceRecord, GovernanceVerificationResult } from "@greenarmor/ges-core";
 import type { Finding } from "@greenarmor/ges-audit-engine";
 export interface DashboardOptions {
     port?: number;
@@ -78,9 +78,26 @@ export interface DashboardData {
     packs: PackSummary[];
     fixHistory: FixHistoryEntry[];
     activityLog: ActivityLogEntry[];
+    governance: GovernanceData;
     lastAudit: string;
 }
+export interface GovernanceData {
+    records: GovernanceRecord[];
+    verifications: GovernanceVerificationResult[];
+    summary: {
+        total: number;
+        approved: number;
+        pending: number;
+        rejected: number;
+        expired: number;
+        validWithIssues: number;
+        criticalRisk: number;
+        highRisk: number;
+        totalEvidence: number;
+    };
+}
 export declare function collectDashboardData(projectPath: string): DashboardData;
 export declare function collectPackDetail(projectPath: string, packId: string): PackDetailReport | null;
 export declare function collectControlDetail(projectPath: string, controlId: string): ControlDetail | null;
+export declare function collectGovernanceData(projectPath: string): GovernanceData;
 export declare function startDashboard(options: DashboardOptions): http.Server;

package/dist/index.js

@@ -5,7 +5,9 @@ import { runAudit, deduplicateFindings } from "@greenarmor/ges-audit-engine";
 import { getAllPacks, getPack } from "@greenarmor/ges-policy-engine";
 import { generateScoreFile } from "@greenarmor/ges-scoring-engine";
 import { loadFixHistory, loadActivityLog, loadControlsFromDisk, loadControlOverrides, applyOverridesToControls } from "@greenarmor/ges-core";
+import { loadGovernanceRecords, verifyGovernanceRecord, verifyAllGovernanceRecords } from "@greenarmor/ges-core";
 import { getInstalledPackIds as getInstalledPackIdsFromDisk } from "@greenarmor/ges-core";
+import { generateMarkdownReport, generateHtmlReport } from "@greenarmor/ges-report-generator";
 import { renderDashboard } from "./template.js";
 function loadConfig(projectPath) {
     const configPath = path.join(projectPath, ".ges", "config.json");
@@ -176,6 +178,7 @@ export function collectDashboardData(projectPath) {
     const packs = allPacks.map(p => buildPackSummary(p, controls, findings, installedPacks));
     const fixHistory = loadFixHistory(projectPath);
     const activityLog = loadActivityLog(projectPath);
+    const governance = collectGovernanceData(projectPath);
     const metadataPath = path.join(projectPath, ".ges", "metadata.json");
     let lastAudit = "";
     try {
@@ -190,13 +193,14 @@ export function collectDashboardData(projectPath) {
         projectName: config?.project_name || "Unknown Project",
         projectType: config?.project_type || "unknown",
         frameworks: allFrameworks,
-        gesfVersion: "1.3.0",
+        gesfVersion: "1.4.1",
         score,
         controls,
         findings,
         packs,
         fixHistory,
         activityLog,
+        governance,
         lastAudit,
     };
 }
@@ -317,6 +321,22 @@ export function collectControlDetail(projectPath, controlId) {
         packName: matchingPack?.name || "",
     };
 }
+export function collectGovernanceData(projectPath) {
+    const records = loadGovernanceRecords(projectPath);
+    const verifications = verifyAllGovernanceRecords(projectPath);
+    const summary = {
+        total: records.length,
+        approved: records.filter(r => r.status === "approved").length,
+        pending: records.filter(r => r.status === "draft" || r.status === "pending-review").length,
+        rejected: records.filter(r => r.status === "rejected" || r.status === "revoked").length,
+        expired: records.filter(r => r.status === "expired").length,
+        validWithIssues: verifications.filter(v => !v.valid && v.completeness.has_approval).length,
+        criticalRisk: records.filter(r => r.risk_level === "critical").length,
+        highRisk: records.filter(r => r.risk_level === "high").length,
+        totalEvidence: records.reduce((sum, r) => sum + r.evidence.length, 0),
+    };
+    return { records, verifications, summary };
+}
 function jsonResponse(res, data, status = 200) {
     res.writeHead(status, { "Content-Type": "application/json" });
     res.end(JSON.stringify(data));
@@ -394,6 +414,33 @@ export function startDashboard(options) {
             }
             return;
         }
+        if (pathname === "/api/governance") {
+            try {
+                const data = collectDashboardData(options.projectPath);
+                jsonResponse(res, data.governance);
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
+        const governanceMatch = pathname.match(/^\/api\/governance\/(.+)$/);
+        if (governanceMatch) {
+            try {
+                const govData = collectGovernanceData(options.projectPath);
+                const record = govData.records.find(r => r.id === governanceMatch[1] || r.system_name.toLowerCase() === decodeURIComponent(governanceMatch[1]).toLowerCase());
+                if (!record) {
+                    jsonError(res, `Governance record not found: ${governanceMatch[1]}`, 404);
+                    return;
+                }
+                const verification = verifyGovernanceRecord(record);
+                jsonResponse(res, { record, verification });
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
         const packMatch = pathname.match(/^\/api\/packs\/([a-z0-9-]+)$/);
         if (packMatch) {
             try {
@@ -454,6 +501,63 @@ export function startDashboard(options) {
             }
             return;
         }
+        const governanceDetailMatch = pathname.match(/^\/api\/governance\/(.+)$/);
+        if (governanceDetailMatch) {
+            try {
+                const govData = collectGovernanceData(options.projectPath);
+                const record = govData.records.find(r => r.id === governanceDetailMatch[1] || r.system_name.toLowerCase() === decodeURIComponent(governanceDetailMatch[1]).toLowerCase());
+                if (!record) {
+                    jsonError(res, `Governance record not found: ${governanceDetailMatch[1]}`, 404);
+                    return;
+                }
+                const verification = verifyGovernanceRecord(record);
+                jsonResponse(res, { record, verification });
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
+        if (pathname === "/api/report/compliance") {
+            try {
+                const data = collectDashboardData(options.projectPath);
+                const format = url.searchParams.get("format") || "markdown";
+                const reportOptions = {
+                    format,
+                    title: `Compliance Report - ${data.projectName}`,
+                    include_executive_summary: true,
+                    include_risk_assessment: true,
+                    include_compliance: true,
+                    include_security: true,
+                };
+                if (format === "html") {
+                    const html = generateHtmlReport(reportOptions, data.score, data.controls, data.findings);
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Content-Disposition": `attachment; filename="compliance-report.html"` });
+                    res.end(html);
+                }
+                else {
+                    const md = generateMarkdownReport(reportOptions, data.score, data.controls, data.findings);
+                    res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8", "Content-Disposition": `attachment; filename="compliance-report.md"` });
+                    res.end(md);
+                }
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
+        if (pathname === "/api/report/governance") {
+            try {
+                const govData = collectGovernanceData(options.projectPath);
+                const md = generateGovernanceMarkdownReport(govData, collectDashboardData(options.projectPath).projectName);
+                res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8", "Content-Disposition": `attachment; filename="governance-provenance-report.md"` });
+                res.end(md);
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
         if (pathname === "/health") {
             jsonResponse(res, { status: "ok", timestamp: new Date().toISOString() });
             return;
@@ -464,3 +568,114 @@ export function startDashboard(options) {
     server.listen(port, host);
     return server;
 }
+function generateGovernanceMarkdownReport(data, projectName) {
+    const lines = [];
+    lines.push(`# Governance Provenance Report`);
+    lines.push(`\n**Project**: ${projectName}`);
+    lines.push(`**Generated**: ${new Date().toISOString()}\n`);
+    const s = data.summary;
+    lines.push(`## Summary\n`);
+    lines.push(`| Metric | Value |`);
+    lines.push(`|--------|-------|`);
+    lines.push(`| Total Systems | ${s.total} |`);
+    lines.push(`| Approved | ${s.approved} |`);
+    lines.push(`| Pending | ${s.pending} |`);
+    lines.push(`| Expired / With Issues | ${s.expired + s.validWithIssues} |`);
+    lines.push(`| Critical Risk | ${s.criticalRisk} |`);
+    lines.push(`| High Risk | ${s.highRisk} |`);
+    lines.push(`| Total Evidence References | ${s.totalEvidence} |`);
+    if (data.records.length === 0) {
+        lines.push(`\n_No governance records found._`);
+        return lines.join("\n");
+    }
+    for (let i = 0; i < data.records.length; i++) {
+        const r = data.records[i];
+        const v = data.verifications[i] || data.verifications.find(vv => vv.record_id === r.id);
+        lines.push(`\n---\n`);
+        lines.push(`## ${r.system_name}\n`);
+        lines.push(`| Field | Value |`);
+        lines.push(`|-------|-------|`);
+        lines.push(`| ID | ${r.id} |`);
+        lines.push(`| Type | ${r.system_type} |`);
+        lines.push(`| Version | ${r.system_version || "(none)"} |`);
+        lines.push(`| Status | ${r.status} |`);
+        lines.push(`| Risk Level | ${r.risk_level} |`);
+        if (v) {
+            lines.push(`| Verification | ${v.valid ? "VALID" : "ISSUES"} |`);
+            lines.push(`| Approval Status | ${v.approval_status} |`);
+            if (v.days_until_expiry !== null) {
+                lines.push(`| Days Until Expiry | ${v.days_until_expiry} |`);
+            }
+        }
+        if (r.approval) {
+            const a = r.approval;
+            lines.push(`\n### Approval Decision\n`);
+            lines.push(`- **Approver**: ${a.approver_name} (${a.approver_role})`);
+            lines.push(`- **Authority**: ${a.approval_authority}`);
+            lines.push(`- **Decision**: ${a.decision.toUpperCase()}`);
+            lines.push(`- **Date**: ${a.decision_date}`);
+            lines.push(`- **Validity**: ${a.valid_from} → ${a.valid_until || "indefinite"}`);
+            if (a.conditions.length > 0)
+                lines.push(`- **Conditions**: ${a.conditions.join("; ")}`);
+            if (a.rationale)
+                lines.push(`- **Rationale**: ${a.rationale}`);
+        }
+        if (r.risk_assessment) {
+            const ra = r.risk_assessment;
+            lines.push(`\n### Risk Assessment\n`);
+            lines.push(`- **Assessor**: ${ra.assessor}`);
+            lines.push(`- **Methodology**: ${ra.methodology}`);
+            lines.push(`- **Risk Score**: ${ra.risk_score}`);
+            lines.push(`- **Residual Risk**: ${ra.residual_risk}`);
+            lines.push(`- **Date**: ${ra.assessment_date}`);
+            if (ra.identified_risks.length > 0)
+                lines.push(`- **Identified Risks**: ${ra.identified_risks.join(", ")}`);
+        }
+        if (r.policy_basis) {
+            const pb = r.policy_basis;
+            lines.push(`\n### Policy Basis\n`);
+            lines.push(`- **Policy**: ${pb.policy_name} (${pb.policy_id} v${pb.version})`);
+            lines.push(`- **Standard**: ${pb.standard}`);
+            if (pb.clauses.length > 0)
+                lines.push(`- **Clauses**: ${pb.clauses.join(", ")}`);
+        }
+        lines.push(`\n### Evidence Chain (${r.evidence.length})\n`);
+        if (r.evidence.length === 0) {
+            lines.push(`_No evidence references._`);
+        }
+        else {
+            lines.push(`| # | Title | Type | Source | Reference |`);
+            lines.push(`|---|-------|------|--------|-----------|`);
+            r.evidence.forEach((e, j) => {
+                lines.push(`| ${j + 1} | ${e.title} | ${e.type} | ${e.source_system} | ${e.reference} |`);
+            });
+        }
+        if (r.review_cycle) {
+            const rc = r.review_cycle;
+            lines.push(`\n### Review Cycle\n`);
+            lines.push(`- **Frequency**: ${rc.frequency}`);
+            lines.push(`- **Last Review**: ${rc.last_review}`);
+            lines.push(`- **Next Review**: ${rc.next_review}`);
+        }
+        if (r.committee) {
+            const c = r.committee;
+            lines.push(`\n### Committee Approval\n`);
+            lines.push(`- **Committee**: ${c.committee_name}`);
+            lines.push(`- **Meeting**: ${c.meeting_date} (${c.meeting_reference})`);
+            if (c.attendees.length > 0)
+                lines.push(`- **Attendees**: ${c.attendees.join(", ")}`);
+        }
+        if (v && v.issues.length > 0) {
+            lines.push(`\n### Blocking Issues\n`);
+            for (const iss of v.issues)
+                lines.push(`- ${iss}`);
+        }
+        if (v && v.warnings.length > 0) {
+            lines.push(`\n### Warnings\n`);
+            for (const w of v.warnings)
+                lines.push(`- ${w}`);
+        }
+        lines.push(`\n_Created: ${r.created_at} by ${r.created_by} | Updated: ${r.updated_at} by ${r.updated_by} (v${r.record_version})_`);
+    }
+    return lines.join("\n");
+}

package/dist/template.js

@@ -15,6 +15,8 @@ function matchPackForControl(controlId, packs) {
             return p;
         if (p.id === "government" && idUpper.startsWith("GOV-"))
             return p;
+        if (p.id === "governance" && idUpper.startsWith("GOVP-"))
+            return p;
         if (p.id === "iso27001" && idUpper.startsWith("ISO27K-"))
             return p;
         if (p.id === "iso27701" && idUpper.startsWith("ISO277-"))
@@ -71,6 +73,7 @@ export function renderDashboard(data) {
     const findings = data.findings;
     const controls = data.controls;
     const packs = data.packs;
+    const governance = data.governance;
     const findingsBySeverity = {
         critical: findings.filter(f => f.severity === "critical").length,
         high: findings.filter(f => f.severity === "high").length,
@@ -119,6 +122,8 @@ export function renderDashboard(data) {
                 return idUpper.startsWith("BC-");
             if (packId === "government")
                 return idUpper.startsWith("GOV-");
+            if (packId === "governance")
+                return idUpper.startsWith("GOVP-");
             if (packId === "iso27001")
                 return idUpper.startsWith("ISO27K-");
             if (packId === "iso27701")
@@ -327,12 +332,18 @@ export function renderDashboard(data) {
     <button class="nav-tab" onclick="showPage('findings', this)">Findings</button>
     <button class="nav-tab" onclick="showPage('traceability', this)">Traceability</button>
     <button class="nav-tab" onclick="showPage('activity', this)">Activity Log</button>
+    <button class="nav-tab" onclick="showPage('governance', this)">Governance</button>
   </div>
 </div>
 
 <div class="container">
 
   <div id="page-overview" class="page active">
+    <div style="display:flex;justify-content:flex-end;gap:8px;margin-bottom:12px;">
+      <a href="/api/report/compliance?format=markdown" class="report-btn" style="background:#0f766e;color:white;padding:6px 14px;border-radius:6px;text-decoration:none;font-size:12px;font-weight:600;">📄 Compliance Report (MD)</a>
+      <a href="/api/report/compliance?format=html" class="report-btn" style="background:#0f766e;color:white;padding:6px 14px;border-radius:6px;text-decoration:none;font-size:12px;font-weight:600;">📄 Compliance Report (HTML)</a>
+      <a href="/api/report/governance" class="report-btn" style="background:#6366f1;color:white;padding:6px 14px;border-radius:6px;text-decoration:none;font-size:12px;font-weight:600;">📋 Governance Report</a>
+    </div>
     <div class="grid">
       <div class="grid grid-3">
         <div class="card stat">
@@ -637,12 +648,16 @@ export function renderDashboard(data) {
     ${renderActivityLogSection(data.activityLog || [])}
   </div>
 
+  <div id="page-governance" class="page">
+    ${renderGovernanceSection(governance)}
+  </div>
+
   <div id="control-detail-modal" style="display:none;"></div>
 
 </div>
 
 <div class="footer">
-  Generated by GESF v${escapeHtml(data.gesfVersion)} | Last audit: ${escapeHtml(new Date(data.lastAudit).toLocaleString())} | <a href="/api/data">JSON API</a> | <a href="/api/packs">Packs API</a> | <a href="/api/fix-history">Fix History API</a> | <a href="/api/activity-log">Activity Log API</a>
+  Generated by GESF v${escapeHtml(data.gesfVersion)} | Last audit: ${escapeHtml(new Date(data.lastAudit).toLocaleString())} | <a href="/api/data">JSON API</a> | <a href="/api/packs">Packs API</a> | <a href="/api/fix-history">Fix History API</a> | <a href="/api/activity-log">Activity Log API</a> | <a href="/api/governance">Governance API</a>
 </div>
 
 <script>
@@ -663,7 +678,7 @@ export function renderDashboard(data) {
     }
   };
 
-  var navTabMap = { overview: 0, packs: 1, fixes: 2, findings: 3, traceability: 4, activity: 5 };
+  var navTabMap = { overview: 0, packs: 1, fixes: 2, findings: 3, traceability: 4, activity: 5, governance: 6 };
 
   window.navigateToPage = function(page) {
     var tabs = document.querySelectorAll('.nav-tab');
@@ -1065,6 +1080,8 @@ function renderDetailedFixesList(findings, controls, packs) {
                 return idUpper.startsWith("BC-");
             if (p.id === "government")
                 return idUpper.startsWith("GOV-");
+            if (p.id === "governance")
+                return idUpper.startsWith("GOVP-");
             if (p.id === "iso27001")
                 return idUpper.startsWith("ISO27K-");
             if (p.id === "iso27701")
@@ -1288,6 +1305,9 @@ function renderFixHistorySection(entries, complianceIssues = []) {
         html += `<tr><td style="font-weight:600;">Description</td><td>${escapeHtml(entry.fix.description)}</td></tr>`;
         html += `<tr><td style="font-weight:600;">Status</td><td>${entry.fix.applied ? '<span style="color:#22c55e;font-weight:600;">Applied successfully</span>' : `<span style="color:#ef4444;font-weight:600;">Failed: ${escapeHtml(entry.fix.error || 'Unknown error')}</span>`}</td></tr>`;
         html += `<tr><td style="font-weight:600;">Source</td><td>${entry.source === 'mcp' ? 'MCP auto_fix tool' : 'CLI ges fix command'}</td></tr>`;
+        if (entry.actor_name) {
+            html += `<tr><td style="font-weight:600;">Actor</td><td>${escapeHtml(entry.actor_name)}${entry.actor_role ? ' (' + escapeHtml(entry.actor_role) + ')' : ''}</td></tr>`;
+        }
         html += `<tr><td style="font-weight:600;">Timestamp</td><td>${new Date(entry.timestamp).toLocaleString()}</td></tr>`;
         if (entry.dry_run) {
             html += `<tr><td style="font-weight:600;">Mode</td><td><span class="badge" style="background:#eab308;color:white;">DRY RUN</span></td></tr>`;
@@ -1501,12 +1521,15 @@ function renderActivityLogSection(entries) {
     html += `</div></div>`;
     html += `</div>`;
     html += `<div class="card"><div class="card-title">Timeline (newest first)</div>`;
-    html += `<table><thead><tr><th>Time</th><th>Source</th><th>Action</th><th>Status</th><th>Description</th><th>Impact</th></tr></thead><tbody>`;
+    html += `<table><thead><tr><th>Time</th><th>Source</th><th>Actor</th><th>Action</th><th>Status</th><th>Description</th><th>Impact</th></tr></thead><tbody>`;
     for (const entry of sorted) {
         const time = new Date(entry.timestamp).toLocaleString();
         const sourceBadge = entry.source === "mcp"
             ? '<span class="badge" style="background:#7c3aed;font-size:10px;">MCP</span>'
             : '<span class="badge" style="background:#0f766e;font-size:10px;">CLI</span>';
+        const actorHtml = entry.actor_name
+            ? `<div style="font-size:12px;font-weight:600;">${escapeHtml(entry.actor_name)}</div>${entry.actor_role ? '<div style="font-size:11px;color:#6b7280;">' + escapeHtml(entry.actor_role) + '</div>' : ''}`
+            : '<span style="color:#9ca3af;font-size:11px;">-</span>';
         const actionLabel = actionLabels[entry.action] || entry.action;
         const actionColor = actionColors[entry.action] || "#6b7280";
         const actionBadge = `<span class="badge" style="background:${actionColor};font-size:10px;">${escapeHtml(actionLabel)}</span>`;
@@ -1532,6 +1555,7 @@ function renderActivityLogSection(entries) {
         html += `<tr>
       <td style="font-size:11px;white-space:nowrap;">${time}</td>
       <td>${sourceBadge}</td>
+      <td>${actorHtml}</td>
       <td>${actionBadge}</td>
       <td>${statusBadge}</td>
       <td>
@@ -1544,6 +1568,223 @@ function renderActivityLogSection(entries) {
     html += `</tbody></table></div>`;
     return html;
 }
+function govStatusColor(status) {
+    const m = {
+        approved: "#22c55e",
+        conditional: "#eab308",
+        "pending-review": "#3b82f6",
+        draft: "#6b7280",
+        rejected: "#ef4444",
+        revoked: "#ef4444",
+        expired: "#f97316",
+    };
+    return m[status] || "#6b7280";
+}
+function govRiskColor(level) {
+    const m = {
+        low: "#22c55e",
+        medium: "#eab308",
+        high: "#f97316",
+        critical: "#ef4444",
+    };
+    return m[level] || "#6b7280";
+}
+function renderGovernanceSection(data) {
+    const { records, verifications, summary } = data;
+    if (records.length === 0) {
+        return `<div class="card">
+      <div class="card-title">Governance Provenance Chain</div>
+      <div class="empty-state">
+        <div class="icon">&#128203;</div>
+        <div class="msg">No governance records found</div>
+        <div class="sub">Create records using <code>ges governance add</code> or the MCP <code>create_governance_record</code> tool</div>
+        <div class="sub" style="margin-top:12px;">The governance tab provides end-to-end traceability for auditors:<br>
+          System &rarr; Risk Assessment &rarr; Policy &rarr; Approval &rarr; Evidence &rarr; Review Cycle</div>
+      </div>
+    </div>`;
+    }
+    let html = "";
+    html += `<div style="margin-bottom:20px;">`;
+    html += `<h2 style="font-size:20px;font-weight:700;margin-bottom:4px;">Governance Provenance Chain</h2>`;
+    html += `<p style="color:#6b7280;font-size:14px;margin-bottom:16px;">End-to-end approval traceability for auditors and regulators. Each record links: System &rarr; Risk Assessment &rarr; Policy &rarr; Approval &rarr; Evidence &rarr; Review Cycle.</p>`;
+    html += `<div style="margin-bottom:12px;"><a href="/api/report/governance" style="background:#6366f1;color:white;padding:6px 14px;border-radius:6px;text-decoration:none;font-size:12px;font-weight:600;">&#128203; Export Provenance Report</a></div>`;
+    html += `<div class="grid grid-4" style="margin-bottom:20px;">`;
+    html += `<div class="card stat"><div class="num">${summary.total}</div><div class="label">Total Systems</div></div>`;
+    html += `<div class="card stat"><div class="num" style="color:#22c55e;">${summary.approved}</div><div class="label">Approved</div></div>`;
+    html += `<div class="card stat"><div class="num" style="color:#3b82f6;">${summary.pending}</div><div class="label">Pending</div></div>`;
+    html += `<div class="card stat"><div class="num" style="color:#f97316;">${summary.expired + summary.validWithIssues}</div><div class="label">Expired / Issues</div></div>`;
+    html += `</div>`;
+    html += `</div>`;
+    if (summary.criticalRisk > 0 || summary.highRisk > 0) {
+        html += `<div class="card" style="margin-bottom:20px;border-left:4px solid #ef4444;">`;
+        html += `<div class="card-title" style="color:#ef4444;">High-Risk Systems</div>`;
+        html += `<div style="display:flex;gap:16px;font-size:14px;">`;
+        html += `<span><span style="color:#ef4444;font-weight:700;">${summary.criticalRisk}</span> critical risk</span>`;
+        html += `<span><span style="color:#f97316;font-weight:700;">${summary.highRisk}</span> high risk</span>`;
+        html += `</div></div>`;
+    }
+    html += `<div id="governance-records-list">`;
+    for (let i = 0; i < records.length; i++) {
+        const r = records[i];
+        const v = verifications[i] || verifications.find(vv => vv.record_id === r.id);
+        const statusBg = govStatusColor(r.status);
+        const riskBg = govRiskColor(r.risk_level);
+        html += `<div class="fix-detail-card" style="margin-bottom:12px;">`;
+        html += `<div class="fix-detail-header" onclick="toggleFix('gov-${i}')" style="cursor:pointer;">`;
+        html += `<div class="fix-detail-info" style="flex:1;">`;
+        html += `<div class="fix-detail-title">${escapeHtml(r.system_name)}</div>`;
+        html += `<div class="fix-detail-meta">${escapeHtml(r.system_type)} | ${escapeHtml(r.id)}${r.system_version ? ' | v' + escapeHtml(r.system_version) : ''}</div>`;
+        html += `</div>`;
+        html += `<div class="fix-detail-badges">`;
+        html += `<span class="badge badge-sev" style="background:${statusBg};font-size:10px;">${r.status.toUpperCase()}</span>`;
+        html += `<span class="badge badge-sev" style="background:${riskBg};font-size:10px;">${r.risk_level.toUpperCase()} RISK</span>`;
+        if (v) {
+            html += `<span class="badge badge-sev" style="background:${v.valid ? '#22c55e' : '#ef4444'};font-size:10px;">${v.valid ? '&#10003; VALID' : '&#10007; ISSUES'}</span>`;
+        }
+        html += `<span class="fix-toggle" id="gov-${i}-toggle">Expand</span>`;
+        html += `</div>`;
+        html += `</div>`;
+        html += `<div class="fix-detail-body" id="gov-${i}">`;
+        if (v) {
+            html += `<div class="fix-section"><div class="fix-section-title">Verification Checklist</div>`;
+            html += `<ul class="check-list">`;
+            const checks = [
+                [v.completeness.has_approval, "Approval Decision"],
+                [v.completeness.has_risk_assessment, "Risk Assessment"],
+                [v.completeness.has_policy_basis, "Policy Basis"],
+                [v.completeness.has_evidence, `Evidence Chain (${v.completeness.evidence_count} refs)`],
+                [v.completeness.has_review_cycle, "Review Cycle"],
+                [v.completeness.has_data_inventory, "Data Inventory"],
+                [v.completeness.has_compliance_links, "Compliance Links"],
+                [v.completeness.is_current, "Currently Valid"],
+            ];
+            for (const [ok, label] of checks) {
+                const icon = ok ? "&#10003;" : "&#10007;";
+                const bg = ok ? "#22c55e" : "#ef4444";
+                html += `<li><span class="check-icon" style="background:${bg};">${icon}</span> <span>${label}</span></li>`;
+            }
+            html += `</ul>`;
+            if (v.approval_status !== "none") {
+                html += `<div style="margin-top:8px;font-size:13px;">`;
+                html += `<strong>Approval Status:</strong> `;
+                const apColor = v.approval_status === "valid" ? "#22c55e" : v.approval_status === "expired" ? "#ef4444" : "#eab308";
+                html += `<span style="color:${apColor};font-weight:600;">${v.approval_status.toUpperCase()}</span>`;
+                if (v.days_until_expiry !== null) {
+                    const dayText = v.days_until_expiry < 0
+                        ? `${Math.abs(v.days_until_expiry)} days ago (EXPIRED)`
+                        : `${v.days_until_expiry} days remaining`;
+                    html += ` &mdash; ${dayText}`;
+                }
+                html += `</div>`;
+            }
+            if (v.issues.length > 0) {
+                html += `<div style="margin-top:8px;"><strong style="color:#ef4444;">Blocking Issues:</strong><ul style="margin-top:4px;">`;
+                for (const iss of v.issues) {
+                    html += `<li style="font-size:13px;color:#ef4444;">${escapeHtml(iss)}</li>`;
+                }
+                html += `</ul></div>`;
+            }
+            if (v.warnings.length > 0) {
+                html += `<div style="margin-top:4px;"><strong style="color:#eab308;">Warnings:</strong><ul style="margin-top:4px;">`;
+                for (const w of v.warnings) {
+                    html += `<li style="font-size:13px;color:#92400e;">${escapeHtml(w)}</li>`;
+                }
+                html += `</ul></div>`;
+            }
+            html += `</div>`;
+        }
+        html += `<div class="fix-section"><div class="fix-section-title">Approval Decision</div>`;
+        if (r.approval) {
+            const a = r.approval;
+            html += `<div style="font-size:13px;line-height:1.8;">`;
+            html += `<div><strong>Approver:</strong> ${escapeHtml(a.approver_name)} (${escapeHtml(a.approver_role)})</div>`;
+            html += `<div><strong>Authority:</strong> ${escapeHtml(a.approval_authority)}</div>`;
+            html += `<div><strong>Decision:</strong> <span style="color:${a.decision === "approved" ? "#22c55e" : "#ef4444"};font-weight:600;">${a.decision.toUpperCase()}</span></div>`;
+            html += `<div><strong>Date:</strong> ${escapeHtml(a.decision_date)}</div>`;
+            html += `<div><strong>Validity:</strong> ${escapeHtml(a.valid_from)} &rarr; ${escapeHtml(a.valid_until || "indefinite")}</div>`;
+            if (a.conditions.length > 0) {
+                html += `<div><strong>Conditions:</strong> ${a.conditions.map(c => escapeHtml(c)).join("; ")}</div>`;
+            }
+            if (a.rationale) {
+                html += `<div><strong>Rationale:</strong> ${escapeHtml(a.rationale)}</div>`;
+            }
+            html += `</div>`;
+        }
+        else {
+            html += `<div style="color:#ef4444;font-size:13px;">&#9888; NOT RECORDED</div>`;
+        }
+        html += `</div>`;
+        if (r.risk_assessment) {
+            const ra = r.risk_assessment;
+            html += `<div class="fix-section"><div class="fix-section-title">Risk Assessment</div>`;
+            html += `<div style="font-size:13px;line-height:1.8;">`;
+            html += `<div><strong>Assessor:</strong> ${escapeHtml(ra.assessor)}</div>`;
+            html += `<div><strong>Methodology:</strong> ${escapeHtml(ra.methodology)}</div>`;
+            html += `<div><strong>Risk Score:</strong> ${escapeHtml(ra.risk_score)} &mdash; <strong>Residual:</strong> ${escapeHtml(ra.residual_risk)}</div>`;
+            html += `<div><strong>Date:</strong> ${escapeHtml(ra.assessment_date)}</div>`;
+            if (ra.identified_risks.length > 0) {
+                html += `<div><strong>Identified Risks:</strong> ${ra.identified_risks.map(r => escapeHtml(r)).join(", ")}</div>`;
+            }
+            html += `</div>`;
+            html += `</div>`;
+        }
+        if (r.policy_basis) {
+            const pb = r.policy_basis;
+            html += `<div class="fix-section"><div class="fix-section-title">Policy Basis</div>`;
+            html += `<div style="font-size:13px;line-height:1.8;">`;
+            html += `<div><strong>Policy:</strong> ${escapeHtml(pb.policy_name)} (${escapeHtml(pb.policy_id)} v${escapeHtml(pb.version)})</div>`;
+            html += `<div><strong>Standard:</strong> ${escapeHtml(pb.standard)}</div>`;
+            if (pb.clauses.length > 0) {
+                html += `<div><strong>Clauses:</strong> ${pb.clauses.map(c => escapeHtml(c)).join(", ")}</div>`;
+            }
+            html += `</div>`;
+            html += `</div>`;
+        }
+        html += `<div class="fix-section"><div class="fix-section-title">Evidence Chain (${r.evidence.length})</div>`;
+        if (r.evidence.length === 0) {
+            html += `<div style="color:#ef4444;font-size:13px;">&#9888; NO EVIDENCE REFERENCES</div>`;
+        }
+        else {
+            html += `<table><thead><tr><th>Title</th><th>Type</th><th>Source</th><th>Reference</th></tr></thead><tbody>`;
+            for (const e of r.evidence) {
+                html += `<tr>`;
+                html += `<td>${escapeHtml(e.title)}</td>`;
+                html += `<td style="font-size:12px;">${escapeHtml(e.type)}</td>`;
+                html += `<td><span class="badge" style="background:#6b7280;color:white;font-size:10px;padding:2px 8px;">${escapeHtml(e.source_system)}</span></td>`;
+                html += `<td style="font-family:monospace;font-size:11px;">${escapeHtml(e.reference)}</td>`;
+                html += `</tr>`;
+            }
+            html += `</tbody></table>`;
+        }
+        html += `</div>`;
+        if (r.review_cycle) {
+            const rc = r.review_cycle;
+            html += `<div class="fix-section"><div class="fix-section-title">Review Cycle</div>`;
+            html += `<div style="font-size:13px;line-height:1.8;">`;
+            html += `<div><strong>Frequency:</strong> ${escapeHtml(rc.frequency)}</div>`;
+            html += `<div><strong>Last Review:</strong> ${escapeHtml(rc.last_review)} | <strong>Next:</strong> ${escapeHtml(rc.next_review)}</div>`;
+            html += `</div>`;
+            html += `</div>`;
+        }
+        if (r.committee) {
+            const c = r.committee;
+            html += `<div class="fix-section"><div class="fix-section-title">Committee Approval</div>`;
+            html += `<div style="font-size:13px;line-height:1.8;">`;
+            html += `<div><strong>Committee:</strong> ${escapeHtml(c.committee_name)}</div>`;
+            html += `<div><strong>Meeting:</strong> ${escapeHtml(c.meeting_date)} (${escapeHtml(c.meeting_reference)})</div>`;
+            if (c.attendees.length > 0) {
+                html += `<div><strong>Attendees:</strong> ${c.attendees.map(a => escapeHtml(a)).join(", ")}</div>`;
+            }
+            html += `</div>`;
+            html += `</div>`;
+        }
+        html += `<div style="margin-top:8px;font-size:11px;color:#9ca3af;">Created: ${escapeHtml(r.created_at)} by ${escapeHtml(r.created_by)} | Updated: ${escapeHtml(r.updated_at)} (v${r.record_version})</div>`;
+        html += `</div>`;
+        html += `</div>`;
+    }
+    html += `</div>`;
+    return html;
+}
 function escapeHtml(str) {
     return str
         .replace(/&/g, "&amp;")

package/package.json

@@ -1,9 +1,10 @@
 {
   "dependencies": {
-    "@greenarmor/ges-audit-engine": "1.3.0",
-    "@greenarmor/ges-core": "1.3.0",
-    "@greenarmor/ges-policy-engine": "1.3.0",
-    "@greenarmor/ges-scoring-engine": "1.3.0"
+    "@greenarmor/ges-audit-engine": "1.4.1",
+    "@greenarmor/ges-core": "1.4.1",
+    "@greenarmor/ges-policy-engine": "1.4.1",
+    "@greenarmor/ges-report-generator": "1.4.1",
+    "@greenarmor/ges-scoring-engine": "1.4.1"
   },
   "description": "GESF Web Dashboard - Visual compliance dashboard for teams",
   "devDependencies": {
@@ -40,7 +41,7 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",