@greenarmor/ges-web-dashboard 1.4.3 → 1.5.1

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as http from "node:http";
-import type { ScoreFile, Control, FixHistoryEntry, ActivityLogEntry, GovernanceRecord, GovernanceVerificationResult } from "@greenarmor/ges-core";
+import type { ScoreFile, Control, FixHistoryEntry, ActivityLogEntry, GovernanceRecord, GovernanceVerificationResult, FixAssignment } from "@greenarmor/ges-core";
 import type { Finding } from "@greenarmor/ges-audit-engine";
 export interface DashboardOptions {
     port?: number;
@@ -79,6 +79,7 @@ export interface DashboardData {
     fixHistory: FixHistoryEntry[];
     activityLog: ActivityLogEntry[];
     governance: GovernanceData;
+    fixAssignments: FixAssignment[];
     lastAudit: string;
 }
 export interface GovernanceData {

package/dist/index.js

@@ -6,6 +6,7 @@ import { getAllPacks, getPack } from "@greenarmor/ges-policy-engine";
 import { generateScoreFile } from "@greenarmor/ges-scoring-engine";
 import { loadFixHistory, loadActivityLog, loadControlsFromDisk, loadControlOverrides, applyOverridesToControls } from "@greenarmor/ges-core";
 import { loadGovernanceRecords, verifyGovernanceRecord, verifyAllGovernanceRecords, createGovernanceRecord, addGovernanceRecord, findGovernanceRecord, setGovernanceApproval, addGovernanceEvidence, createEvidenceRef, deleteGovernanceRecord, setGovernanceRiskAssessment, setGovernancePolicyBasis, setGovernanceReviewCycle, setGovernanceDataInventory, setGovernanceComplianceLinks, setGovernanceCommittee, recordActivity, } from "@greenarmor/ges-core";
+import { loadFixAssignments, createFixAssignment, addFixAssignment, resolveFixAssignment, unassignFix, } from "@greenarmor/ges-core";
 import { getInstalledPackIds as getInstalledPackIdsFromDisk } from "@greenarmor/ges-core";
 import { generateMarkdownReport, generateHtmlReport } from "@greenarmor/ges-report-generator";
 import { renderDashboard } from "./template.js";
@@ -179,6 +180,7 @@ export function collectDashboardData(projectPath) {
     const fixHistory = loadFixHistory(projectPath);
     const activityLog = loadActivityLog(projectPath);
     const governance = collectGovernanceData(projectPath);
+    const fixAssignments = loadFixAssignments(projectPath);
     const metadataPath = path.join(projectPath, ".ges", "metadata.json");
     let lastAudit = "";
     try {
@@ -193,7 +195,7 @@ export function collectDashboardData(projectPath) {
         projectName: config?.project_name || "Unknown Project",
         projectType: config?.project_type || "unknown",
         frameworks: allFrameworks,
-        gesfVersion: "1.4.3",
+        gesfVersion: "1.5.1",
         score,
         controls,
         findings,
@@ -201,6 +203,7 @@ export function collectDashboardData(projectPath) {
         fixHistory,
         activityLog,
         governance,
+        fixAssignments,
         lastAudit,
     };
 }
@@ -543,6 +546,121 @@ export function startDashboard(options) {
             }
             return;
         }
+        if (req.method === "POST" && pathname === "/api/fix-assignments/assign") {
+            try {
+                const body = await readBody(req);
+                const fk = String(body.finding_key || "").trim();
+                const recordId = String(body.governance_record_id || "").trim();
+                const assignee = String(body.assignee || "").trim();
+                if (!fk || !recordId || !assignee) {
+                    jsonError(res, "finding_key, governance_record_id, and assignee are required", 400);
+                    return;
+                }
+                const record = findGovernanceRecord(options.projectPath, recordId);
+                if (!record) {
+                    jsonError(res, `Governance record not found: ${recordId}`, 404);
+                    return;
+                }
+                const assignment = createFixAssignment({
+                    finding_key: fk,
+                    finding_rule_id: String(body.finding_rule_id || ""),
+                    finding_title: String(body.finding_title || ""),
+                    finding_file: String(body.finding_file || ""),
+                    finding_line: body.finding_line ? Number(body.finding_line) : undefined,
+                    finding_severity: body.finding_severity || "medium",
+                    finding_control_ids: parseList(body.finding_control_ids),
+                    governance_record_id: record.id,
+                    governance_system_name: record.system_name,
+                    assignee,
+                    assignee_role: String(body.assignee_role || ""),
+                    assigned_by: String(body.assigned_by || body.actor_name || "dashboard"),
+                    notes: String(body.notes || ""),
+                });
+                addFixAssignment(options.projectPath, assignment);
+                recordActivity(options.projectPath, {
+                    source: "cli",
+                    action: "fix_assign",
+                    title: `Fix assigned: ${assignment.finding_rule_id} → ${record.system_name}`,
+                    description: `Assigned ${assignment.finding_rule_id} (${assignment.finding_title}) to ${assignee} (${assignment.assignee_role || "unspecified role"}), linked to governance record ${record.system_name}.`,
+                    details: {
+                        finding_key: fk,
+                        governance_record_id: record.id,
+                        assignee,
+                        governance_system_name: record.system_name,
+                    },
+                    actor_name: body.actor_name ? String(body.actor_name) : undefined,
+                    actor_role: body.actor_role ? String(body.actor_role) : undefined,
+                });
+                jsonResponse(res, { success: true, assignment });
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
+        if (req.method === "POST" && pathname === "/api/fix-assignments/resolve") {
+            try {
+                const body = await readBody(req);
+                const fk = String(body.finding_key || "").trim();
+                if (!fk) {
+                    jsonError(res, "finding_key is required", 400);
+                    return;
+                }
+                const resolved = resolveFixAssignment(options.projectPath, fk, {
+                    resolved_by: String(body.resolved_by || body.actor_name || "dashboard"),
+                    resolved_by_role: String(body.resolved_by_role || body.actor_role || ""),
+                    method: body.method || "manual",
+                    resolution_notes: String(body.resolution_notes || ""),
+                });
+                if (!resolved) {
+                    jsonError(res, `Fix assignment not found for finding_key: ${fk}`, 404);
+                    return;
+                }
+                recordActivity(options.projectPath, {
+                    source: "cli",
+                    action: "fix_resolve",
+                    title: `Fix resolved: ${resolved.finding_rule_id}`,
+                    description: `Resolved ${resolved.finding_rule_id} via ${body.method || "manual"} by ${body.resolved_by || body.actor_name || "dashboard"}.`,
+                    details: {
+                        finding_key: fk,
+                        governance_record_id: resolved.governance_record_id,
+                        method: body.method || "manual",
+                    },
+                    actor_name: body.actor_name ? String(body.actor_name) : undefined,
+                    actor_role: body.actor_role ? String(body.actor_role) : undefined,
+                });
+                jsonResponse(res, { success: true, assignment: resolved });
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
+        const fixAssignDeleteMatch = req.method === "POST" ? pathname.match(/^\/api\/fix-assignments\/([^/]+)\/unassign$/) : null;
+        if (fixAssignDeleteMatch) {
+            try {
+                const fkey = decodeURIComponent(fixAssignDeleteMatch[1]);
+                const deleted = unassignFix(options.projectPath, fkey);
+                if (!deleted) {
+                    jsonError(res, `Fix assignment not found for finding: ${fkey}`, 404);
+                    return;
+                }
+                recordActivity(options.projectPath, {
+                    source: "cli",
+                    action: "fix_assign",
+                    title: `Fix assignment removed`,
+                    description: `Removed fix assignment for finding ${fkey}.`,
+                    details: { finding_key: fkey },
+                    actor_name: undefined,
+                    actor_role: undefined,
+                });
+                jsonResponse(res, { success: true });
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
         if (req.method !== "GET") {
             jsonError(res, "Method not allowed", 405);
             return;
@@ -590,6 +708,16 @@ export function startDashboard(options) {
             }
             return;
         }
+        if (pathname === "/api/fix-assignments") {
+            try {
+                const data = collectDashboardData(options.projectPath);
+                jsonResponse(res, data.fixAssignments);
+            }
+            catch (err) {
+                jsonError(res, err instanceof Error ? err.message : String(err));
+            }
+            return;
+        }
         if (pathname === "/api/activity-log") {
             try {
                 const data = collectDashboardData(options.projectPath);

package/dist/template.js

@@ -74,6 +74,10 @@ export function renderDashboard(data) {
     const controls = data.controls;
     const packs = data.packs;
     const governance = data.governance;
+    const fixAssignmentMap = new Map();
+    for (const a of data.fixAssignments) {
+        fixAssignmentMap.set(a.finding_key, a);
+    }
     const findingsBySeverity = {
         critical: findings.filter(f => f.severity === "critical").length,
         high: findings.filter(f => f.severity === "high").length,
@@ -574,7 +578,7 @@ export function renderDashboard(data) {
     </div>
 
     <div id="fixes-tab-pending" class="tab-panel">
-      ${renderComplianceFixCards(complianceIssues, "fix")}
+      ${renderComplianceFixCards(complianceIssues, "fix", fixAssignmentMap, governance.records)}
     </div>
   </div>
 
@@ -656,7 +660,7 @@ export function renderDashboard(data) {
     </div>
 
     <div id="trace-tab-fixes" class="tab-panel">
-      ${renderComplianceFixCards(complianceIssues, "trace")}
+      ${renderComplianceFixCards(complianceIssues, "trace", fixAssignmentMap, governance.records)}
     </div>
 
     <div id="trace-tab-controls" class="tab-panel">
@@ -695,10 +699,14 @@ export function renderDashboard(data) {
 
   <div id="control-detail-modal" style="display:none;"></div>
 
+  <div class="gov-modal-overlay" id="assign-modal-overlay" onclick="if(event.target===this)closeAssignModal()">
+    <div class="gov-modal" id="assign-modal"></div>
+  </div>
+
 </div>
 
 <div class="footer">
-  Generated by GESF v${escapeHtml(data.gesfVersion)} | Last audit: ${escapeHtml(new Date(data.lastAudit).toLocaleString())} | <a href="/api/data">JSON API</a> | <a href="/api/packs">Packs API</a> | <a href="/api/fix-history">Fix History API</a> | <a href="/api/activity-log">Activity Log API</a> | <a href="/api/governance">Governance API</a>
+  Generated by GESF v${escapeHtml(data.gesfVersion)} | Last audit: ${escapeHtml(new Date(data.lastAudit).toLocaleString())} | <a href="/api/data">JSON API</a> | <a href="/api/packs">Packs API</a> | <a href="/api/fix-history">Fix History API</a> | <a href="/api/fix-assignments">Fix Assignments API</a> | <a href="/api/activity-log">Activity Log API</a> | <a href="/api/governance">Governance API</a>
 </div>
 
 <script>
@@ -1149,6 +1157,130 @@ export function renderDashboard(data) {
     c.appendChild(t);
     setTimeout(function() { t.style.opacity = '0'; t.style.transition = 'opacity 0.3s'; setTimeout(function() { if(t.parentNode) t.remove(); }, 300); }, 3000);
   };
+
+  var govRecordsForAssign = ${JSON.stringify(governance.records.map(r => ({ id: r.id, name: r.system_name, status: r.status, risk: r.risk_level })))};
+
+  window.openAssignModal = function(fkey, ruleId, title, file, line, severity, controlIds) {
+    var overlay = document.getElementById('assign-modal-overlay');
+    var modal = document.getElementById('assign-modal');
+    if (!overlay || !modal) return;
+    if (govRecordsForAssign.length === 0) {
+      showToast('No governance records found. Create one first on the Governance tab.', 'error');
+      return;
+    }
+    var recordOptions = govRecordsForAssign.map(function(r) {
+      return '<option value="' + r.id + '">' + r.name + ' (' + r.status + ', ' + r.risk + ' risk)</option>';
+    }).join('');
+    modal.innerHTML =
+      '<div class="gov-modal-header"><h3>Assign Fix to Governance Record</h3><button class="gov-modal-close" onclick="closeAssignModal()">&times;</button></div>' +
+      '<div class="gov-modal-body">' +
+      '<div style="margin-bottom:12px;padding:8px 10px;background:#f9fafb;border-radius:6px;font-size:12px;">' +
+      '<strong>' + ruleId + '</strong> &mdash; ' + title + '<br>' +
+      '<span style="color:#6b7280;font-family:monospace;">' + file + (line ? ':' + line : '') + '</span>' +
+      '</div>' +
+      '<label style="font-size:12px;font-weight:600;display:block;margin-bottom:4px;">Governance Record *</label>' +
+      '<select name="governance_record_id" style="width:100%;padding:8px;border:1px solid #d1d5db;border-radius:6px;margin-bottom:12px;">' + recordOptions + '</select>' +
+      '<label style="font-size:12px;font-weight:600;display:block;margin-bottom:4px;">Assignee Name *</label>' +
+      '<input name="assignee" type="text" placeholder="e.g., Jane Doe" style="width:100%;padding:8px;border:1px solid #d1d5db;border-radius:6px;margin-bottom:12px;" />' +
+      '<label style="font-size:12px;font-weight:600;display:block;margin-bottom:4px;">Assignee Role</label>' +
+      '<input name="assignee_role" type="text" placeholder="e.g., Security Engineer" style="width:100%;padding:8px;border:1px solid #d1d5db;border-radius:6px;margin-bottom:12px;" />' +
+      '<label style="font-size:12px;font-weight:600;display:block;margin-bottom:4px;">Notes</label>' +
+      '<textarea name="notes" rows="2" placeholder="Optional context for this assignment..." style="width:100%;padding:8px;border:1px solid #d1d5db;border-radius:6px;margin-bottom:12px;"></textarea>' +
+      '<label style="font-size:12px;font-weight:600;display:block;margin-bottom:4px;">Your Name (for audit log)</label>' +
+      '<input name="actor_name" type="text" placeholder="Who is making this assignment" style="width:100%;padding:8px;border:1px solid #d1d5db;border-radius:6px;margin-bottom:12px;" />' +
+      '<label style="font-size:12px;font-weight:600;display:block;margin-bottom:4px;">Your Role</label>' +
+      '<input name="actor_role" type="text" placeholder="e.g., Tech Lead" style="width:100%;padding:8px;border:1px solid #d1d5db;border-radius:6px;margin-bottom:12px;" />' +
+      '</div>' +
+      '<div class="gov-modal-footer"><button class="gov-btn gov-btn-outline" onclick="closeAssignModal()">Cancel</button><button class="gov-btn gov-btn-primary" onclick="submitAssignForm()">Assign</button></div>';
+    modal.dataset.fkey = fkey;
+    modal.dataset.ruleId = ruleId;
+    modal.dataset.title = title;
+    modal.dataset.file = file;
+    modal.dataset.line = String(line || 0);
+    modal.dataset.severity = severity;
+    modal.dataset.controlIds = controlIds;
+    overlay.classList.add('active');
+  };
+
+  window.closeAssignModal = function() {
+    var overlay = document.getElementById('assign-modal-overlay');
+    var modal = document.getElementById('assign-modal');
+    if (overlay) overlay.classList.remove('active');
+    if (modal) modal.innerHTML = '';
+  };
+
+  window.submitAssignForm = function() {
+    var modal = document.getElementById('assign-modal');
+    if (!modal) return;
+    var inputs = modal.querySelectorAll('[name]');
+    var body = {
+      finding_key: modal.dataset.fkey,
+      finding_rule_id: modal.dataset.ruleId,
+      finding_title: modal.dataset.title,
+      finding_file: modal.dataset.file,
+      finding_line: parseInt(modal.dataset.line, 10),
+      finding_severity: modal.dataset.severity,
+      finding_control_ids: (modal.dataset.controlIds || '').split(',').filter(Boolean),
+    };
+    for (var i = 0; i < inputs.length; i++) {
+      body[inputs[i].name] = inputs[i].value;
+    }
+    var btn = modal.querySelector('.gov-btn-primary');
+    if (btn) { btn.textContent = 'Saving...'; btn.disabled = true; }
+    fetch('/api/fix-assignments/assign', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+      .then(function(r) { return r.json(); })
+      .then(function(d) {
+        if (d.success) { closeAssignModal(); showToast('Fix assigned! Reloading...', 'success'); setTimeout(function() { location.reload(); }, 800); }
+        else { showToast(d.error || 'Failed', 'error'); if (btn) { btn.textContent = 'Assign'; btn.disabled = false; } }
+      })
+      .catch(function(e) { showToast('Error: ' + (e.message||'network'), 'error'); if (btn) { btn.textContent = 'Assign'; btn.disabled = false; } });
+  };
+
+  window.resolveFindingFix = function(fkey) {
+    if (!confirm('Mark this fix as resolved?')) return;
+    var resolver = prompt('Your name:', '') || 'dashboard';
+    var resolverRole = prompt('Your role:', '') || '';
+    var method = prompt('Method (auto-fix / manual / not-applicable):', 'manual') || 'manual';
+    var notes = prompt('Resolution notes (optional):', '') || '';
+    fetch('/api/fix-assignments/resolve', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        finding_key: fkey,
+        resolved_by: resolver,
+        resolved_by_role: resolverRole,
+        method: method,
+        resolution_notes: notes,
+        actor_name: resolver,
+        actor_role: resolverRole,
+      }),
+    })
+      .then(function(r) { return r.json(); })
+      .then(function(d) {
+        if (d.success) { showToast('Fix resolved! Reloading...', 'success'); setTimeout(function() { location.reload(); }, 800); }
+        else { showToast(d.error || 'Failed', 'error'); }
+      })
+      .catch(function(e) { showToast('Error: ' + (e.message||'network'), 'error'); });
+  };
+
+  window.unassignFix = function(fkey) {
+    if (!confirm('Remove this fix assignment?')) return;
+    fetch('/api/fix-assignments/' + encodeURIComponent(fkey) + '/unassign', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}',
+    })
+      .then(function(r) { return r.json(); })
+      .then(function(d) {
+        if (d.success) { showToast('Unassigned! Reloading...', 'success'); setTimeout(function() { location.reload(); }, 800); }
+        else { showToast(d.error || 'Failed', 'error'); }
+      })
+      .catch(function(e) { showToast('Error: ' + (e.message||'network'), 'error'); });
+  };
 })();
 </script>
 
@@ -1531,13 +1663,14 @@ function renderComplianceIssuesTable(issues) {
     </tbody>
   </table>`;
 }
-function renderComplianceFixCards(issues, idPrefix) {
+function renderComplianceFixCards(issues, idPrefix, assignmentMap, govRecords) {
     if (issues.length === 0) {
         return '<div class="card"><div class="empty-state"><div class="icon">&#10003;</div><div class="msg" style="color:#22c55e;">All controls passing</div><div class="sub">No fixes needed</div></div></div>';
     }
     const totalAuditFindings = issues.reduce((sum, i) => sum + i.auditFindings.length, 0);
     const criticalCount = issues.filter(i => i.severity === "critical").length;
     const highCount = issues.filter(i => i.severity === "high").length;
+    const assignedCount = assignmentMap ? assignmentMap.size : 0;
     let html = '';
     html += `<div style="margin-bottom:20px;">`;
     html += `<div class="grid grid-4" style="margin-bottom:20px;">`;
@@ -1545,6 +1678,7 @@ function renderComplianceFixCards(issues, idPrefix) {
     html += `<div class="card stat"><div class="num" style="color:#ef4444;">${criticalCount}</div><div class="label">Critical</div></div>`;
     html += `<div class="card stat"><div class="num" style="color:#f97316;">${highCount}</div><div class="label">High</div></div>`;
     html += `<div class="card stat"><div class="num">${totalAuditFindings}</div><div class="label">Audit Findings</div></div>`;
+    html += `<div class="card stat"><div class="num" style="color:${assignedCount > 0 ? "#3b82f6" : "#9ca3af"};">${assignedCount}</div><div class="label">Assigned</div></div>`;
     html += `</div>`;
     html += `</div>`;
     for (let i = 0; i < issues.length; i++) {
@@ -1571,8 +1705,10 @@ function renderComplianceFixCards(issues, idPrefix) {
         html += `<div style="font-size:13px;color:#4b5563;line-height:1.6;">${escapeHtml(issue.description)}</div>`;
         html += `</div>`;
         if (issue.auditFindings.length > 0) {
-            html += `<div class="fix-section"><div class="fix-section-title">Audit Evidence (${issue.auditFindings.length})</div>`;
+            html += `<div class="fix-section"><div class="fix-section-title">Audit Evidence &amp; Fix Assignments (${issue.auditFindings.length})</div>`;
             for (const f of issue.auditFindings) {
+                const fkey = `${f.ruleId}:${f.file}:${f.line || 0}`;
+                const assignment = assignmentMap?.get(fkey);
                 html += `<div class="fix-finding-item ${f.severity}">`;
                 html += `<div style="display:flex;align-items:center;gap:8px;margin-bottom:4px;">`;
                 html += `<span class="badge badge-sev" style="background:${severityColor(f.severity)};font-size:10px;">${f.severity.toUpperCase()}</span>`;
@@ -1582,6 +1718,30 @@ function renderComplianceFixCards(issues, idPrefix) {
                     html += `<div style="font-size:12px;color:#4b5563;margin-top:4px;">${escapeHtml(f.description)}</div>`;
                 if (f.evidence)
                     html += `<div class="fix-evidence">${escapeHtml(f.evidence)}</div>`;
+                if (assignment) {
+                    const statusColorAssign = assignment.status === "fixed" || assignment.status === "verified" ? "#22c55e" : assignment.status === "in-progress" ? "#3b82f6" : "#eab308";
+                    html += `<div class="fix-assign-box" style="margin-top:8px;padding:10px 12px;border-radius:8px;background:#f0fdf4;border:1px solid #bbf7d0;">`;
+                    html += `<div style="display:flex;align-items:center;gap:8px;flex-wrap:wrap;">`;
+                    html += `<span class="badge" style="background:${statusColorAssign};color:#fff;font-size:10px;text-transform:uppercase;">${escapeHtml(assignment.status)}</span>`;
+                    html += `<span style="font-size:12px;font-weight:600;color:#166534;">Linked: ${escapeHtml(assignment.governance_system_name)}</span>`;
+                    html += `<span style="font-size:11px;color:#4b5563;">Assignee: ${escapeHtml(assignment.assignee)}${assignment.assignee_role ? ' (' + escapeHtml(assignment.assignee_role) + ')' : ''}</span>`;
+                    html += `</div>`;
+                    if (assignment.resolution) {
+                        html += `<div style="font-size:11px;color:#4b5563;margin-top:4px;">Resolved by ${escapeHtml(assignment.resolution.resolved_by)} via ${escapeHtml(assignment.resolution.method)} on ${escapeHtml(new Date(assignment.resolution.resolved_at).toLocaleDateString())}</div>`;
+                    }
+                    html += `<div style="margin-top:6px;display:flex;gap:6px;">`;
+                    if (assignment.status !== "fixed" && assignment.status !== "verified") {
+                        html += `<button class="gov-action-btn" style="background:#22c55e;color:#fff;border:none;padding:4px 10px;border-radius:4px;font-size:11px;cursor:pointer;" onclick="event.stopPropagation();resolveFindingFix('${escapeHtml(fkey)}')">Mark Fixed</button>`;
+                    }
+                    html += `<button class="gov-action-btn" style="background:#fee2e2;color:#991b1b;border:none;padding:4px 10px;border-radius:4px;font-size:11px;cursor:pointer;" onclick="event.stopPropagation();unassignFix('${escapeHtml(fkey)}')">Unassign</button>`;
+                    html += `</div>`;
+                    html += `</div>`;
+                }
+                else {
+                    html += `<div style="margin-top:8px;">`;
+                    html += `<button class="gov-action-btn" style="background:#3b82f6;color:#fff;border:none;padding:4px 12px;border-radius:4px;font-size:11px;cursor:pointer;" onclick="event.stopPropagation();openAssignModal('${escapeHtml(fkey)}','${escapeHtml(f.ruleId)}','${escapeHtml(f.title.replace(/'/g, "\\'"))}','${escapeHtml(f.file)}',${f.line || 0},'${escapeHtml(f.severity)}','${escapeHtml(f.controlIds.join(","))}')">+ Assign to Governance Record</button>`;
+                    html += `</div>`;
+                }
                 html += `</div>`;
             }
             html += `</div>`;
@@ -1594,6 +1754,9 @@ function renderComplianceFixCards(issues, idPrefix) {
             }
         }
         html += `</div>`;
+        const ctrlFkey = `${issue.controlId}::0`;
+        const ctrlAssignment = assignmentMap?.get(ctrlFkey);
+        html += renderGovernanceProvenanceSection(issue.controlId, issue.controlName, issue.severity, ctrlFkey, ctrlAssignment, govRecords);
         html += `<div class="fix-section"><div class="fix-section-title">Traceability</div>`;
         html += `<table><tbody>`;
         html += `<tr><td style="font-weight:600;width:160px;">Control</td><td><span class="link" onclick="showControlDetail('${escapeHtml(issue.controlId)}')">${escapeHtml(issue.controlId)}</span> &mdash; ${escapeHtml(issue.controlName)}</td></tr>`;
@@ -1610,6 +1773,142 @@ function renderComplianceFixCards(issues, idPrefix) {
     }
     return html;
 }
+function renderGovernanceProvenanceSection(controlId, controlName, severity, ctrlFkey, ctrlAssignment, govRecords) {
+    let html = `<div class="fix-section"><div class="fix-section-title">Governance Provenance Chain</div>`;
+    if (ctrlAssignment && govRecords) {
+        const record = govRecords.find(r => r.id === ctrlAssignment.governance_record_id);
+        const aStatusColor = ctrlAssignment.status === "fixed" || ctrlAssignment.status === "verified"
+            ? "#22c55e"
+            : ctrlAssignment.status === "in-progress"
+                ? "#3b82f6"
+                : "#eab308";
+        html += `<div style="padding:12px 16px;border-radius:8px;background:#f0fdf4;border:1px solid #bbf7d0;margin-bottom:10px;">`;
+        html += `<div style="display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-bottom:8px;">`;
+        html += `<span class="badge" style="background:${aStatusColor};color:#fff;font-size:10px;text-transform:uppercase;">${escapeHtml(ctrlAssignment.status)}</span>`;
+        html += `<span style="font-size:12px;font-weight:600;color:#166534;">Assignee: ${escapeHtml(ctrlAssignment.assignee)}${ctrlAssignment.assignee_role ? ' (' + escapeHtml(ctrlAssignment.assignee_role) + ')' : ''}</span>`;
+        html += `<span style="font-size:11px;color:#6b7280;">Assigned by ${escapeHtml(ctrlAssignment.assigned_by)} on ${escapeHtml(new Date(ctrlAssignment.assigned_at).toLocaleDateString())}</span>`;
+        html += `</div>`;
+        if (ctrlAssignment.notes) {
+            html += `<div style="font-size:12px;color:#4b5563;margin-bottom:6px;"><strong>Notes:</strong> ${escapeHtml(ctrlAssignment.notes)}</div>`;
+        }
+        if (ctrlAssignment.resolution) {
+            const r = ctrlAssignment.resolution;
+            html += `<div style="font-size:12px;padding:6px 10px;background:#dcfce7;border-radius:6px;margin-top:6px;">`;
+            html += `<strong>&#10003; Resolved</strong> by ${escapeHtml(r.resolved_by)}${r.resolved_by_role ? ' (' + escapeHtml(r.resolved_by_role) + ')' : ''} via <strong>${escapeHtml(r.method)}</strong> on ${escapeHtml(new Date(r.resolved_at).toLocaleDateString())}`;
+            if (r.resolution_notes)
+                html += `<br><span style="color:#4b5563;">${escapeHtml(r.resolution_notes)}</span>`;
+            html += `</div>`;
+        }
+        html += `<div style="margin-top:8px;display:flex;gap:6px;">`;
+        if (ctrlAssignment.status !== "fixed" && ctrlAssignment.status !== "verified") {
+            html += `<button class="gov-action-btn" style="background:#22c55e;color:#fff;border:none;padding:4px 10px;border-radius:4px;font-size:11px;cursor:pointer;" onclick="event.stopPropagation();resolveFindingFix('${escapeHtml(ctrlFkey)}')">Mark Fixed</button>`;
+        }
+        html += `<button class="gov-action-btn" style="background:#fee2e2;color:#991b1b;border:none;padding:4px 10px;border-radius:4px;font-size:11px;cursor:pointer;" onclick="event.stopPropagation();unassignFix('${escapeHtml(ctrlFkey)}')">Unassign</button>`;
+        html += `</div>`;
+        html += `</div>`;
+        if (record) {
+            html += renderProvenanceChainInline(record);
+        }
+    }
+    else {
+        html += `<div style="padding:12px 16px;border-radius:8px;background:#f9fafb;border:1px dashed #d1d5db;">`;
+        html += `<div style="display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;">`;
+        html += `<div style="font-size:13px;color:#6b7280;">This control is not linked to any governance record. Assign it to create a provenance chain for auditors.</div>`;
+        html += `<button class="gov-action-btn" style="background:#4f46e5;color:#fff;border:none;padding:6px 14px;border-radius:6px;font-size:12px;cursor:pointer;font-weight:600;white-space:nowrap;" onclick="event.stopPropagation();openAssignModal('${escapeHtml(ctrlFkey)}','${escapeHtml(controlId)}','${escapeHtml(controlName.replace(/'/g, "\\'"))}','',0,'${escapeHtml(severity)}','${escapeHtml(controlId)}')">+ Assign to Governance Record</button>`;
+        html += `</div>`;
+        html += `</div>`;
+        if (issueHasFindingLevelAssignments(ctrlFkey, controlId)) {
+            html += `<div style="margin-top:8px;font-size:11px;color:#6b7280;">&#8505; Individual audit findings within this control may already be assigned at the finding level below.</div>`;
+        }
+    }
+    html += `</div>`;
+    return html;
+}
+function issueHasFindingLevelAssignments(ctrlFkey, controlId) {
+    return false;
+}
+function renderProvenanceChainInline(record) {
+    let html = `<div style="border:1px solid #e5e7eb;border-radius:8px;overflow:hidden;">`;
+    html += `<div style="background:#f3f4f6;padding:10px 14px;display:flex;align-items:center;gap:8px;flex-wrap:wrap;">`;
+    html += `<span style="font-size:14px;font-weight:700;color:#1f2937;">${escapeHtml(record.system_name)}</span>`;
+    html += `<span class="badge" style="background:${record.status === "approved" ? "#22c55e" : record.status === "rejected" || record.status === "revoked" ? "#ef4444" : "#eab308"};color:#fff;font-size:10px;text-transform:uppercase;">${escapeHtml(record.status)}</span>`;
+    html += `<span class="badge" style="background:${record.risk_level === "critical" ? "#ef4444" : record.risk_level === "high" ? "#f97316" : record.risk_level === "medium" ? "#eab308" : "#22c55e"};color:#fff;font-size:10px;text-transform:uppercase;">${escapeHtml(record.risk_level)} RISK</span>`;
+    html += `<span style="font-size:11px;color:#9ca3af;font-family:monospace;">${escapeHtml(record.id)}</span>`;
+    html += `</div>`;
+    html += `<div style="padding:10px 14px;">`;
+    html += `<table style="width:100%;font-size:12px;border-collapse:collapse;">`;
+    if (record.approval) {
+        const a = record.approval;
+        const decColor = a.decision === "approved" ? "#22c55e" : "#ef4444";
+        html += `<tr style="border-bottom:1px solid #f3f4f6;">`;
+        html += `<td style="padding:6px 8px;font-weight:600;width:140px;color:#374151;">Approval</td>`;
+        html += `<td style="padding:6px 8px;">`;
+        html += `<span style="color:${decColor};font-weight:600;">${escapeHtml(a.decision.toUpperCase())}</span> by ${escapeHtml(a.approver_name)} (${escapeHtml(a.approver_role)})`;
+        if (a.valid_until)
+            html += ` &mdash; valid until ${escapeHtml(a.valid_until)}`;
+        html += `</td></tr>`;
+    }
+    else {
+        html += `<tr style="border-bottom:1px solid #f3f4f6;"><td style="padding:6px 8px;font-weight:600;width:140px;color:#374151;">Approval</td><td style="padding:6px 8px;color:#ef4444;">&#10007; Not recorded</td></tr>`;
+    }
+    if (record.risk_assessment) {
+        const ra = record.risk_assessment;
+        html += `<tr style="border-bottom:1px solid #f3f4f6;">`;
+        html += `<td style="padding:6px 8px;font-weight:600;color:#374151;">Risk Assessment</td>`;
+        html += `<td style="padding:6px 8px;">Score: <strong>${escapeHtml(ra.risk_score)}</strong> &mdash; Residual: ${escapeHtml(ra.residual_risk)} (${escapeHtml(ra.methodology)})</td>`;
+        html += `</tr>`;
+    }
+    else {
+        html += `<tr style="border-bottom:1px solid #f3f4f6;"><td style="padding:6px 8px;font-weight:600;color:#374151;">Risk Assessment</td><td style="padding:6px 8px;color:#9ca3af;">&#10007; Not assessed</td></tr>`;
+    }
+    if (record.policy_basis) {
+        const pb = record.policy_basis;
+        html += `<tr style="border-bottom:1px solid #f3f4f6;">`;
+        html += `<td style="padding:6px 8px;font-weight:600;color:#374151;">Policy Basis</td>`;
+        html += `<td style="padding:6px 8px;">${escapeHtml(pb.policy_name)} v${escapeHtml(pb.version)} (${escapeHtml(pb.standard)})</td>`;
+        html += `</tr>`;
+    }
+    else {
+        html += `<tr style="border-bottom:1px solid #f3f4f6;"><td style="padding:6px 8px;font-weight:600;color:#374151;">Policy Basis</td><td style="padding:6px 8px;color:#9ca3af;">&#10007; Not documented</td></tr>`;
+    }
+    html += `<tr style="border-bottom:1px solid #f3f4f6;">`;
+    html += `<td style="padding:6px 8px;font-weight:600;color:#374151;">Evidence Chain</td>`;
+    if (record.evidence.length > 0) {
+        html += `<td style="padding:6px 8px;">`;
+        for (const e of record.evidence) {
+            html += `<span style="display:inline-block;margin-right:6px;margin-bottom:2px;padding:2px 8px;background:#eff6ff;border:1px solid #bfdbfe;border-radius:4px;font-size:11px;">${escapeHtml(e.title)} <span style="color:#6b7280;">(${escapeHtml(e.source_system)}: ${escapeHtml(e.reference)})</span></span>`;
+        }
+        html += `</td>`;
+    }
+    else {
+        html += `<td style="padding:6px 8px;color:#9ca3af;">&#10007; No evidence references</td>`;
+    }
+    html += `</tr>`;
+    if (record.review_cycle) {
+        const rc = record.review_cycle;
+        html += `<tr style="border-bottom:1px solid #f3f4f6;">`;
+        html += `<td style="padding:6px 8px;font-weight:600;color:#374151;">Review Cycle</td>`;
+        html += `<td style="padding:6px 8px;">${escapeHtml(rc.frequency)} &mdash; next review: ${escapeHtml(rc.next_review)}</td>`;
+        html += `</tr>`;
+    }
+    else {
+        html += `<tr style="border-bottom:1px solid #f3f4f6;"><td style="padding:6px 8px;font-weight:600;color:#374151;">Review Cycle</td><td style="padding:6px 8px;color:#9ca3af;">&#10007; Not scheduled</td></tr>`;
+    }
+    html += `<tr>`;
+    html += `<td style="padding:6px 8px;font-weight:600;color:#374151;">Provenance Chain</td>`;
+    const chainParts = [];
+    chainParts.push(record.approval ? "&#10003;" : "&#10007;");
+    chainParts.push(record.risk_assessment ? "&#10003;" : "&#10007;");
+    chainParts.push(record.policy_basis ? "&#10003;" : "&#10007;");
+    chainParts.push(record.evidence.length > 0 ? "&#10003;" : "&#10007;");
+    chainParts.push(record.review_cycle ? "&#10003;" : "&#10007;");
+    html += `<td style="padding:6px 8px;font-size:11px;">Approval ${chainParts[0]} &rarr; Risk ${chainParts[1]} &rarr; Policy ${chainParts[2]} &rarr; Evidence ${chainParts[3]} &rarr; Review ${chainParts[4]}</td>`;
+    html += `</tr>`;
+    html += `</table>`;
+    html += `</div>`;
+    html += `</div>`;
+    return html;
+}
 function renderActivityLogSection(entries) {
     if (!entries || entries.length === 0) {
         return `<div class="card">
@@ -1886,8 +2185,8 @@ function renderGovernanceSection(data) {
             html += `<div><strong>Decision:</strong> <span style="color:${a.decision === "approved" ? "#22c55e" : "#ef4444"};font-weight:600;">${a.decision.toUpperCase()}</span></div>`;
             html += `<div><strong>Date:</strong> ${escapeHtml(a.decision_date)}</div>`;
             html += `<div><strong>Validity:</strong> ${escapeHtml(a.valid_from)} &rarr; ${escapeHtml(a.valid_until || "indefinite")}</div>`;
-            if (a.conditions.length > 0) {
-                html += `<div><strong>Conditions:</strong> ${a.conditions.map(c => escapeHtml(c)).join("; ")}</div>`;
+            if (a.conditions && a.conditions.length > 0) {
+                html += `<div><strong>Conditions:</strong> ${(a.conditions || []).map(c => escapeHtml(c)).join("; ")}</div>`;
             }
             if (a.rationale) {
                 html += `<div><strong>Rationale:</strong> ${escapeHtml(a.rationale)}</div>`;
@@ -1906,8 +2205,8 @@ function renderGovernanceSection(data) {
             html += `<div><strong>Methodology:</strong> ${escapeHtml(ra.methodology)}</div>`;
             html += `<div><strong>Risk Score:</strong> ${escapeHtml(ra.risk_score)} &mdash; <strong>Residual:</strong> ${escapeHtml(ra.residual_risk)}</div>`;
             html += `<div><strong>Date:</strong> ${escapeHtml(ra.assessment_date)}</div>`;
-            if (ra.identified_risks.length > 0) {
-                html += `<div><strong>Identified Risks:</strong> ${ra.identified_risks.map(r => escapeHtml(r)).join(", ")}</div>`;
+            if (ra.identified_risks && ra.identified_risks.length > 0) {
+                html += `<div><strong>Identified Risks:</strong> ${(ra.identified_risks || []).map(r => escapeHtml(r)).join(", ")}</div>`;
             }
             html += `</div>`;
             html += `</div>`;
@@ -1918,8 +2217,8 @@ function renderGovernanceSection(data) {
             html += `<div style="font-size:13px;line-height:1.8;">`;
             html += `<div><strong>Policy:</strong> ${escapeHtml(pb.policy_name)} (${escapeHtml(pb.policy_id)} v${escapeHtml(pb.version)})</div>`;
             html += `<div><strong>Standard:</strong> ${escapeHtml(pb.standard)}</div>`;
-            if (pb.clauses.length > 0) {
-                html += `<div><strong>Clauses:</strong> ${pb.clauses.map(c => escapeHtml(c)).join(", ")}</div>`;
+            if (pb.clauses && pb.clauses.length > 0) {
+                html += `<div><strong>Clauses:</strong> ${(pb.clauses || []).map(c => escapeHtml(c)).join(", ")}</div>`;
             }
             html += `</div>`;
             html += `</div>`;
@@ -1957,7 +2256,7 @@ function renderGovernanceSection(data) {
             html += `<div><strong>Committee:</strong> ${escapeHtml(c.committee_name)}</div>`;
             html += `<div><strong>Meeting:</strong> ${escapeHtml(c.meeting_date)} (${escapeHtml(c.meeting_reference)})</div>`;
             if (c.attendees.length > 0) {
-                html += `<div><strong>Attendees:</strong> ${c.attendees.map(a => escapeHtml(a)).join(", ")}</div>`;
+                html += `<div><strong>Attendees:</strong> ${(c.attendees || []).map(a => escapeHtml(a)).join(", ")}</div>`;
             }
             html += `</div>`;
             html += `</div>`;
@@ -1983,7 +2282,9 @@ function renderGovernanceSection(data) {
     return html;
 }
 function escapeHtml(str) {
-    return str
+    if (str === null || str === undefined)
+        return "";
+    return String(str)
         .replace(/&/g, "&amp;")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")

package/package.json

@@ -1,10 +1,10 @@
 {
   "dependencies": {
-    "@greenarmor/ges-audit-engine": "1.4.3",
-    "@greenarmor/ges-core": "1.4.3",
-    "@greenarmor/ges-policy-engine": "1.4.3",
-    "@greenarmor/ges-report-generator": "1.4.3",
-    "@greenarmor/ges-scoring-engine": "1.4.3"
+    "@greenarmor/ges-audit-engine": "1.5.1",
+    "@greenarmor/ges-core": "1.5.1",
+    "@greenarmor/ges-policy-engine": "1.5.1",
+    "@greenarmor/ges-report-generator": "1.5.1",
+    "@greenarmor/ges-scoring-engine": "1.5.1"
   },
   "description": "GESF Web Dashboard - Visual compliance dashboard for teams",
   "devDependencies": {
@@ -41,7 +41,7 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "1.4.3",
+  "version": "1.5.1",
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",