@transitrix/diagrams 1.0.0 → 1.1.0

package/dist/compliance/impact.d.ts

@@ -10,6 +10,7 @@ export interface ImpactObligationFilter {
 export interface ImpactSubjects {
     products?: string[];
     processes?: string[];
+    capabilities?: string[];
 }
 export interface ImpactStatusDisplay {
     show?: AssertionStatus[];
@@ -28,30 +29,56 @@ export interface ImpactEmptyCellLabels {
  * single subject: `{ subjectId, label: subjectId }`.
  *
  * At `grouping.columns: 'product-stage'` a column represents one (product,
- * stage) pair: `{ subjectId: productId, stageId, label: productId + ':' + stageId }`.
+ * stage) pair: `{ subjectId, stageId, label: subjectId + ':' + stageId }`.
  * A cell is populated when an ASSERTION has `subject === subjectId` and
  * `stageId ∈ assertion.realised_via` (or `realised_via` is absent, meaning
  * the assertion covers the entire subject — it then contributes to every
  * stage column for that subject).
+ *
+ * At `grouping.columns: 'product-stage-task'` a column represents one
+ * (product, stage, task) triple: `{ subjectId, stageId, taskId,
+ * label: subjectId + ':' + stageId + ':' + taskId }`. A cell is populated
+ * when an ASSERTION's `realised_via` contains the `taskId` directly, OR
+ * contains the `stageId` (stage-level claim applies to all tasks in that stage),
+ * OR `realised_via` is absent (claim covers the entire subject).
  */
 export interface ImpactColumn {
     /** Subject (product / process / capability) the column belongs to. */
     subjectId: string;
-    /** Stage ID — present only when grouping.columns is not 'product'. */
+    /** Stage ID — present at product-stage and product-stage-task grain. */
     stageId?: string;
+    /** Task ID — present only at product-stage-task grain. */
+    taskId?: string;
     /** Human-readable column header. */
     label: string;
+    /** Display name for the subject (product/process name, not the id). */
+    subjectName?: string;
+    /** Which subjects pool this column derives from (product / process / capability).
+     *  Used to enforce the subject type label invariant (§5.2, COMPIMP-010). */
+    subjectType: 'product' | 'process' | 'capability';
+}
+/** A structural validation finding emitted by the matrix builder. */
+export interface ImpactFinding {
+    code: string;
+    severity: 'error' | 'warning';
+    message: string;
 }
 /**
  * Grouping options for matrix columns.
  *
- * `columns` controls the column grain:
+ * `columns` controls the column grain (COMPIMP-004 validates the value set):
  *   - `'product'` (default) — one column per subject.
- *   - `'product-stage'`     — one column per (subject, stage) pair derived
- *     from `objectDetails` passed to `buildImpactMatrix`.
+ *   - `'product-stage'`     — one column per (subject, stage) pair; pass
+ *     `objectDetails` (from `extractObjectDetails`) into `buildImpactMatrix`.
+ *   - `'product-stage-task'` — one column per (subject, stage, task) triple;
+ *     pass `objectDetails` with stages that carry `tasks[]` (built via
+ *     `extractObjectDetails` + `extractProcessFlowTasks` + `mergeStageTaskDetails`).
+ *   - `'process'` / `'process-stage'` / `'process-stage-task'` — process-centric
+ *     equivalents used when `view.subjects.processes` is the sole entry point
+ *     (§7.1 process compliance variant). Avoids COMPIMP-010 for process subjects.
  */
 export interface ImpactGrouping {
-    columns: 'object' | 'object-details';
+    columns: 'product' | 'product-stage' | 'product-stage-task' | 'process' | 'process-stage' | 'process-stage-task';
 }
 /**
  * Named, versioned view-config — the report *definition*.
@@ -69,6 +96,15 @@ export interface ImpactViewConfig {
     id: string;
     name: string;
     description?: string;
+    /**
+     * Declares the subject scope of the view (§4, COMPIMP-011 enforcement).
+     * `product`  — covers products only; `subjects.processes` MUST be absent.
+     * `process`  — covers processes directly; `subjects.products` MUST be absent.
+     * `combined` — both subject types allowed; column headers carry explicit badges.
+     * Omitting the field preserves backward-compatible behaviour (auto-detected
+     * from `subjects.*` presence).
+     */
+    report_type?: 'product' | 'process' | 'combined';
     /**
      * ISO 8601 date of the last report snapshot (YYYY-MM-DD).
      * Populated automatically by the CLI on each run and stored back to the
@@ -99,7 +135,7 @@ export interface ImpactViewConfig {
  * are auditable ("what I assumed").
  */
 export declare const COMPLIANCE_IMPACT_DEFAULTS: {
-    /** Accept all four active statuses + n_a in cell aggregation. */
+    /** Accept all active statuses + n_a in cell aggregation. */
     readonly status_display: {
         readonly show: AssertionStatus[];
     };
@@ -119,10 +155,11 @@ export declare const COMPLIANCE_IMPACT_DEFAULTS: {
     readonly subjects: {
         readonly products: string[];
         readonly processes: string[];
+        readonly capabilities: string[];
     };
-    /** Column grain: one column per business object (no stage decomposition). */
+    /** Column grain: one column per subject (no stage/task decomposition). */
     readonly grouping: {
-        readonly columns: "object";
+        readonly columns: "product";
     };
 };
 export type ParseImpactViewConfigResult = {
@@ -204,6 +241,8 @@ export interface ImpactMatrix {
      * Empty array when no requirement in the column has a `derived_from`.
      */
     obligationsLane: string[][];
+    /** Structural validation findings emitted during matrix build (COMPIMP-009, COMPIMP-010, etc.). */
+    findings: ImpactFinding[];
 }
 /**
  * Classify a REQUIREMENT deadline relative to a reference date.
@@ -216,18 +255,26 @@ export declare function computeDeadlineStatus(deadline: string | undefined, toda
  * Build the matrix per §5.2.
  *
  * At the default `grouping.columns: 'product'` grain, one column per subject.
- * At `grouping.columns: 'product-stage'`, pass `objectDetails` to expand each
- * subject into per-stage sub-columns (typically extracted from a
- * process-blueprint document via `extractObjectDetails`).  Subjects with no
- * stage mapping fall back to a single product-grain column automatically.
  *
- * Subjects are taken from `config.subjects.products` and
- * `config.subjects.processes` (in that order).  Subjects with no binding
+ * At `grouping.columns: 'product-stage'`, pass `objectDetails` (from
+ * `extractObjectDetails` on a process-blueprint) to expand each subject into
+ * per-stage sub-columns.  Subjects with no stage mapping fall back to a single
+ * product-grain column.
+ *
+ * At `grouping.columns: 'product-stage-task'`, pass `objectDetails` where each
+ * stage carries a `tasks[]` array (combine blueprint stages and process-flow
+ * tasks via `mergeStageTaskDetails`).  Each task becomes a
+ * `(subject, stage, task)` column.  Stages with no tasks fall back to
+ * stage-grain columns.
+ *
+ * Subjects are taken from `config.subjects.products`, `config.subjects.processes`,
+ * and `config.subjects.capabilities` (in that order).  Subjects with no binding
  * obligation still appear as columns so the gap is visible.
  */
 export declare function buildImpactMatrix(canon: ComplianceCanon, config: ImpactViewConfig, objectDetails?: ObjectDetailInput[]): ImpactMatrix;
 /**
- * Extract `ObjectDetailInput` from a raw (YAML-parsed) process-blueprint document.
+ * Extract stage-level `ObjectDetailInput` from a raw (YAML-parsed)
+ * process-blueprint document.
  *
  * Accepts both the bare document object and the wrapped form
  * (`{ process_blueprint: { id, stages: […] } }`).
@@ -236,8 +283,45 @@ export declare function buildImpactMatrix(canon: ComplianceCanon, config: Impact
  *
  * Pass the returned value into `buildImpactMatrix` as part of the
  * `objectDetails` array when `grouping.columns: 'product-stage'` is configured.
+ * For `grouping.columns: 'product-stage-task'`, combine with
+ * `extractProcessFlowTasks` via `mergeStageTaskDetails`.
  */
 export declare function extractObjectDetails(doc: unknown): ObjectDetailInput | null;
+/**
+ * Extract task-type steps from a raw (YAML-parsed) PROCESS element document.
+ *
+ * Reads `notation: process` documents with an inline `flow.steps[]` array.
+ * Filters for task-type nodes (`task`, `userTask`, `serviceTask`) — start/end
+ * events and gateways are excluded.  Returns a flat `ObjectDetailInput` where
+ * `details` are the extracted task steps in declaration order.
+ *
+ * Returns `null` when the document is not a recognisable process element or
+ * has no `id` / `flow.steps` array.
+ *
+ * Use the returned value with `mergeStageTaskDetails` to embed tasks into
+ * blueprint stages for `grouping.columns: product-stage-task`.
+ */
+export declare function extractProcessFlowTasks(doc: unknown): ObjectDetailInput | null;
+/**
+ * Combine blueprint stage details (from `extractObjectDetails`) with
+ * process-flow task details (from `extractProcessFlowTasks`) into a
+ * stage-with-tasks hierarchy for `grouping.columns: product-stage-task`.
+ *
+ * All tasks from `taskInput.details` are distributed into their parent stage
+ * by matching the `stageOwner` map: `stageId → taskId[]`.  If `stageOwner` is
+ * omitted (no stage-to-task mapping is available), all tasks are placed into
+ * every stage (`undefined` key `→` all tasks).
+ *
+ * When `taskInput` is `null` or its `objectId` does not match `stageInput`,
+ * returns `stageInput` unchanged (callers can safely chain the result into
+ * `buildImpactMatrix` — it will degrade to stage-grain columns).
+ *
+ * @param stageInput   Stage-level detail (from `extractObjectDetails`).
+ * @param taskInput    Task-level detail  (from `extractProcessFlowTasks`).
+ * @param stageOwner   Optional mapping `stageId → taskId[]`. When provided,
+ *                     only tasks listed for a stage are embedded in it.
+ */
+export declare function mergeStageTaskDetails(stageInput: ObjectDetailInput, taskInput: ObjectDetailInput | null, stageOwner?: Record<string, string[]>): ObjectDetailInput;
 /**
  * Render the matrix as a GitHub-flavoured markdown table.
  *

package/dist/compliance/impact.js

@@ -16,9 +16,9 @@ import { buildComplianceIndex } from './reverse-index.js';
  * are auditable ("what I assumed").
  */
 export const COMPLIANCE_IMPACT_DEFAULTS = {
-    /** Accept all four active statuses + n_a in cell aggregation. */
+    /** Accept all active statuses + n_a in cell aggregation. */
     status_display: {
-        show: ['compliant', 'partial', 'non_compliant', 'under_review', 'n_a'],
+        show: ['compliant', 'partial', 'non_compliant', 'under_review', 'pending_owner', 'n_a'],
     },
     /** Order rows by canonical REQUIREMENT ID (lexicographic). */
     order_rows_by: 'id',
@@ -30,9 +30,9 @@ export const COMPLIANCE_IMPACT_DEFAULTS = {
     /** Obligation scope: all known REQUIREMENTs in the canon (no filter). */
     obligations: { include: undefined, filter: undefined },
     /** Subjects: empty — must be supplied explicitly in the view config. */
-    subjects: { products: [], processes: [] },
-    /** Column grain: one column per business object (no stage decomposition). */
-    grouping: { columns: 'object' },
+    subjects: { products: [], processes: [], capabilities: [] },
+    /** Column grain: one column per subject (no stage/task decomposition). */
+    grouping: { columns: 'product' },
 };
 /**
  * Validate and normalise a raw (YAML-parsed) value into an ImpactViewConfig.
@@ -81,10 +81,28 @@ export function parseImpactViewConfig(raw) {
     const emptyCells = v.empty_cells && typeof v.empty_cells === 'object' && !Array.isArray(v.empty_cells)
         ? v.empty_cells
         : {};
+    // Parse grouping.columns — accept spec-canonical values plus backward-compat aliases.
+    const rawGrouping = v.grouping && typeof v.grouping === 'object' && !Array.isArray(v.grouping)
+        ? v.grouping
+        : null;
+    const rawColumns = typeof rawGrouping?.columns === 'string' ? rawGrouping.columns : undefined;
+    const VALID_COLUMNS = new Set([
+        'product', 'product-stage', 'product-stage-task',
+        'process', 'process-stage', 'process-stage-task',
+    ]);
+    const normalizedColumns = rawColumns === 'object-details' ? 'product-stage' // backward-compat alias
+        : rawColumns === 'object' ? 'product' // backward-compat alias
+            : VALID_COLUMNS.has(rawColumns ?? '') ? rawColumns
+                : undefined;
+    const VALID_REPORT_TYPES = new Set(['product', 'process', 'combined']);
+    const rawReportType = typeof v.report_type === 'string' ? v.report_type : undefined;
     const config = {
         id: v.id,
         name: v.name,
         description: typeof v.description === 'string' ? v.description : undefined,
+        report_type: rawReportType && VALID_REPORT_TYPES.has(rawReportType)
+            ? rawReportType
+            : undefined,
         snapshot_at: typeof v.snapshot_at === 'string' ? v.snapshot_at : undefined,
         subjects: {
             products: Array.isArray(subjects.products)
@@ -93,6 +111,9 @@ export function parseImpactViewConfig(raw) {
             processes: Array.isArray(subjects.processes)
                 ? subjects.processes.filter((x) => typeof x === 'string')
                 : [...COMPLIANCE_IMPACT_DEFAULTS.subjects.processes],
+            capabilities: Array.isArray(subjects.capabilities)
+                ? subjects.capabilities.filter((x) => typeof x === 'string')
+                : [...COMPLIANCE_IMPACT_DEFAULTS.subjects.capabilities],
         },
         obligations: {
             include: Array.isArray(obligations.include)
@@ -120,6 +141,7 @@ export function parseImpactViewConfig(raw) {
                 : COMPLIANCE_IMPACT_DEFAULTS.empty_cells.no_obligation_applies_label,
         },
         order_rows_by: v.order_rows_by === 'name' ? 'name' : COMPLIANCE_IMPACT_DEFAULTS.order_rows_by,
+        grouping: normalizedColumns !== undefined ? { columns: normalizedColumns } : undefined,
     };
     return { ok: true, config };
 }
@@ -182,9 +204,11 @@ function orderRows(rows, key) {
     return sorted;
 }
 /** Aggregate multiple matching assertions into one cell value, per §5.2 step 4.
+ *  Precedence: non_compliant > partial > pending_owner > under_review > compliant > n_a.
  *  Assumes at least one assertion matches an allowed status; caller filters. */
 function aggregateStatus(assertions) {
     let sawPartial = false;
+    let sawPendingOwner = false;
     let sawUnderReview = false;
     let sawCompliant = false;
     for (const a of assertions) {
@@ -192,6 +216,8 @@ function aggregateStatus(assertions) {
             return 'non_compliant';
         if (a.status === 'partial')
             sawPartial = true;
+        else if (a.status === 'pending_owner')
+            sawPendingOwner = true;
         else if (a.status === 'under_review')
             sawUnderReview = true;
         else if (a.status === 'compliant')
@@ -199,6 +225,8 @@ function aggregateStatus(assertions) {
     }
     if (sawPartial)
         return 'partial';
+    if (sawPendingOwner)
+        return 'pending_owner';
     if (sawUnderReview)
         return 'under_review';
     if (sawCompliant)
@@ -206,22 +234,99 @@ function aggregateStatus(assertions) {
     return 'n_a';
 }
 // ── Column builder helpers (CV-3a) ──────────────────────────────────────────
-function buildProductColumns(config) {
-    const subjects = [...(config.subjects.products ?? []), ...(config.subjects.processes ?? [])];
-    return subjects.map(id => ({ subjectId: id, label: id }));
+function buildProductColumns(config, namedItems, isCombined) {
+    const nameMap = new Map(namedItems.map(p => [p.id, p.name]));
+    const cols = [];
+    for (const id of (config.subjects.products ?? [])) {
+        cols.push({
+            subjectId: id,
+            label: isCombined ? `[PRODUCT] ${id}` : id,
+            subjectName: nameMap.get(id),
+            subjectType: 'product',
+        });
+    }
+    for (const id of (config.subjects.processes ?? [])) {
+        cols.push({
+            subjectId: id,
+            label: isCombined ? `[PROCESS] ${id}` : id,
+            subjectName: nameMap.get(id),
+            subjectType: 'process',
+        });
+    }
+    for (const id of (config.subjects.capabilities ?? [])) {
+        cols.push({
+            subjectId: id,
+            label: id,
+            subjectName: nameMap.get(id),
+            subjectType: 'capability',
+        });
+    }
+    return cols;
 }
-function buildObjectDetailColumns(config, objectDetails) {
+function buildObjectDetailColumns(config, objectDetails, isCombined) {
     const detailMap = new Map(objectDetails.map(d => [d.objectId, d.details]));
-    const subjects = [...(config.subjects.products ?? []), ...(config.subjects.processes ?? [])];
+    const productSet = new Set(config.subjects.products ?? []);
+    const processSet = new Set(config.subjects.processes ?? []);
+    const subjects = [
+        ...(config.subjects.products ?? []),
+        ...(config.subjects.processes ?? []),
+        ...(config.subjects.capabilities ?? []),
+    ];
     const cols = [];
     for (const subjectId of subjects) {
+        const subjectType = productSet.has(subjectId) ? 'product' : processSet.has(subjectId) ? 'process' : 'capability';
+        const badge = isCombined && subjectType !== 'capability' ? `[${subjectType.toUpperCase()}] ` : '';
         const details = detailMap.get(subjectId);
         if (!details || details.length === 0) {
-            cols.push({ subjectId, label: subjectId });
+            cols.push({ subjectId, label: `${badge}${subjectId}`, subjectType });
         }
         else {
             for (const detail of details) {
-                cols.push({ subjectId, stageId: detail.id, label: `${subjectId}:${detail.id}` });
+                cols.push({ subjectId, stageId: detail.id, label: `${badge}${subjectId}:${detail.id}`, subjectType });
+            }
+        }
+    }
+    return cols;
+}
+/**
+ * Build `product-stage-task` columns: one column per (subject, stage, task) triple.
+ * Each stage in `objectDetails` that carries a `tasks[]` array is expanded to
+ * per-task columns `{ subjectId, stageId, taskId, label: subjectId:stageId:taskId }`.
+ * Stages with no tasks fall back to a single stage-grain column.
+ */
+function buildTaskColumns(config, objectDetails, isCombined) {
+    const detailMap = new Map(objectDetails.map(d => [d.objectId, d.details]));
+    const productSet = new Set(config.subjects.products ?? []);
+    const processSet = new Set(config.subjects.processes ?? []);
+    const subjects = [
+        ...(config.subjects.products ?? []),
+        ...(config.subjects.processes ?? []),
+        ...(config.subjects.capabilities ?? []),
+    ];
+    const cols = [];
+    for (const subjectId of subjects) {
+        const subjectType = productSet.has(subjectId) ? 'product' : processSet.has(subjectId) ? 'process' : 'capability';
+        const badge = isCombined && subjectType !== 'capability' ? `[${subjectType.toUpperCase()}] ` : '';
+        const stages = detailMap.get(subjectId);
+        if (!stages || stages.length === 0) {
+            cols.push({ subjectId, label: `${badge}${subjectId}`, subjectType });
+        }
+        else {
+            for (const stage of stages) {
+                if (!stage.tasks || stage.tasks.length === 0) {
+                    cols.push({ subjectId, stageId: stage.id, label: `${badge}${subjectId}:${stage.id}`, subjectType });
+                }
+                else {
+                    for (const task of stage.tasks) {
+                        cols.push({
+                            subjectId,
+                            stageId: stage.id,
+                            taskId: task.id,
+                            label: `${badge}${subjectId}:${stage.id}:${task.id}`,
+                            subjectType,
+                        });
+                    }
+                }
             }
         }
     }
@@ -232,8 +337,12 @@ function buildObjectDetailColumns(config, objectDetails) {
  *
  * At `'product'` grain: `a.subject` must match `col.subjectId`.
  * At `'product-stage'` grain: `a.subject` must match AND either
- * `a.realised_via` is absent (claim covers the whole subject, so every stage
- * inherits it) OR `col.stageId` ∈ `a.realised_via`.
+ * `a.realised_via` is absent (claim covers the whole subject) OR
+ * `col.stageId` ∈ `a.realised_via`.
+ * At `'product-stage-task'` grain: as above for stage, plus `col.taskId` ∈
+ * `a.realised_via` counts as a match (task-level claim covers this task column).
+ * A stage-level claim (`col.stageId` ∈ `a.realised_via`) covers all task columns
+ * in that stage.
  */
 function assertionMatchesColumn(a, col) {
     if (a.subject !== col.subjectId)
@@ -242,19 +351,30 @@ function assertionMatchesColumn(a, col) {
         return true;
     if (!a.realised_via || a.realised_via.length === 0)
         return true;
+    if (col.taskId) {
+        // Task grain: match on taskId OR on stageId (stage claim covers all tasks).
+        return a.realised_via.includes(col.taskId) || a.realised_via.includes(col.stageId);
+    }
     return a.realised_via.includes(col.stageId);
 }
 /**
  * Build the matrix per §5.2.
  *
  * At the default `grouping.columns: 'product'` grain, one column per subject.
- * At `grouping.columns: 'product-stage'`, pass `objectDetails` to expand each
- * subject into per-stage sub-columns (typically extracted from a
- * process-blueprint document via `extractObjectDetails`).  Subjects with no
- * stage mapping fall back to a single product-grain column automatically.
  *
- * Subjects are taken from `config.subjects.products` and
- * `config.subjects.processes` (in that order).  Subjects with no binding
+ * At `grouping.columns: 'product-stage'`, pass `objectDetails` (from
+ * `extractObjectDetails` on a process-blueprint) to expand each subject into
+ * per-stage sub-columns.  Subjects with no stage mapping fall back to a single
+ * product-grain column.
+ *
+ * At `grouping.columns: 'product-stage-task'`, pass `objectDetails` where each
+ * stage carries a `tasks[]` array (combine blueprint stages and process-flow
+ * tasks via `mergeStageTaskDetails`).  Each task becomes a
+ * `(subject, stage, task)` column.  Stages with no tasks fall back to
+ * stage-grain columns.
+ *
+ * Subjects are taken from `config.subjects.products`, `config.subjects.processes`,
+ * and `config.subjects.capabilities` (in that order).  Subjects with no binding
  * obligation still appear as columns so the gap is visible.
  */
 export function buildImpactMatrix(canon, config, objectDetails) {
@@ -263,11 +383,53 @@ export function buildImpactMatrix(canon, config, objectDetails) {
         assertions: canon.assertions,
     });
     const obligations = orderRows(resolveObligations(config, index, canon.requirements), config.order_rows_by);
-    const useStageGrain = config.grouping?.columns === 'object-details' && objectDetails && objectDetails.length > 0;
-    const columns = useStageGrain
-        ? buildObjectDetailColumns(config, objectDetails)
-        : buildProductColumns(config);
-    const allowedStatuses = new Set(config.status_display?.show ?? ['compliant', 'partial', 'non_compliant', 'under_review', 'n_a']);
+    const grain = config.grouping?.columns ?? 'product';
+    const hasDetails = objectDetails !== undefined && objectDetails.length > 0;
+    const hasProducts = (config.subjects.products?.length ?? 0) > 0;
+    const hasProcesses = (config.subjects.processes?.length ?? 0) > 0;
+    // Combined = both products and processes are explicit entry points (§7.1).
+    const isCombined = hasProducts && hasProcesses;
+    let columns = (grain === 'product-stage-task' || grain === 'process-stage-task') && hasDetails
+        ? buildTaskColumns(config, objectDetails, isCombined)
+        : (grain === 'product-stage' || grain === 'process-stage' || grain === 'object-details') && hasDetails
+            ? buildObjectDetailColumns(config, objectDetails, isCombined)
+            : buildProductColumns(config, [...(canon.products ?? []), ...(canon.subjects ?? [])], isCombined);
+    // ── Structural validation (COMPIMP-009, COMPIMP-010, COMPIMP-011) ──────
+    const findings = [];
+    if (!hasProducts && hasProcesses &&
+        (grain === 'product' || grain === 'product-stage' || grain === 'product-stage-task')) {
+        findings.push({
+            code: 'COMPIMP-009',
+            severity: 'warning',
+            message: `view.grouping.columns is '${grain}' but view.subjects.products is absent and subjects.processes is the only entry point. Consider using '${grain.replace('product', 'process')}' for a process-centric view.`,
+        });
+    }
+    if (hasProcesses && (grain === 'product-stage' || grain === 'product-stage-task')) {
+        findings.push({
+            code: 'COMPIMP-010',
+            severity: 'error',
+            message: `view.grouping.columns is '${grain}' but view.subjects.processes has entries — product-stage semantics applied to process columns violate the subject type label invariant (§5.2). Use '${grain.replace('product', 'process')}' for process columns.`,
+        });
+    }
+    // COMPIMP-011: report_type contract — strip cross-type columns and emit an
+    // error when the declared scope contradicts the subjects actually present.
+    if (config.report_type === 'product' && hasProcesses) {
+        findings.push({
+            code: 'COMPIMP-011',
+            severity: 'error',
+            message: `view.report_type is 'product' but view.subjects.processes has entries — process columns are excluded. Remove subjects.processes or set report_type to 'combined'.`,
+        });
+        columns = columns.filter(c => c.subjectType !== 'process');
+    }
+    if (config.report_type === 'process' && hasProducts) {
+        findings.push({
+            code: 'COMPIMP-011',
+            severity: 'error',
+            message: `view.report_type is 'process' but view.subjects.products has entries — product columns are excluded. Remove subjects.products or set report_type to 'combined'.`,
+        });
+        columns = columns.filter(c => c.subjectType !== 'product');
+    }
+    const allowedStatuses = new Set(config.status_display?.show ?? ['compliant', 'partial', 'non_compliant', 'under_review', 'pending_owner', 'n_a']);
     const rowIndex = new Set(obligations.map(r => r.id));
     const cells = obligations.map(() => columns.map(() => emptyCell()));
     for (let c = 0; c < columns.length; c++) {
@@ -347,6 +509,7 @@ export function buildImpactMatrix(canon, config, objectDetails) {
             no_obligation_applies_label: config.empty_cells?.no_obligation_applies_label ?? DEFAULT_NO_OBLIGATION_APPLIES_LABEL,
         },
         obligationsLane,
+        findings,
     };
 }
 function emptyCell() {
@@ -357,9 +520,10 @@ function emptyCell() {
         decoration: { isNew: false, isUrgent: false, deadlineStatus: 'none' },
     };
 }
-// ── Process-blueprint stage extractor (CV-3a) ───────────────────────────────
+// ── Process-blueprint / process-flow extractors (CV-3a) ─────────────────────
 /**
- * Extract `ObjectDetailInput` from a raw (YAML-parsed) process-blueprint document.
+ * Extract stage-level `ObjectDetailInput` from a raw (YAML-parsed)
+ * process-blueprint document.
  *
  * Accepts both the bare document object and the wrapped form
  * (`{ process_blueprint: { id, stages: […] } }`).
@@ -368,6 +532,8 @@ function emptyCell() {
  *
  * Pass the returned value into `buildImpactMatrix` as part of the
  * `objectDetails` array when `grouping.columns: 'product-stage'` is configured.
+ * For `grouping.columns: 'product-stage-task'`, combine with
+ * `extractProcessFlowTasks` via `mergeStageTaskDetails`.
  */
 export function extractObjectDetails(doc) {
     if (!doc || typeof doc !== 'object' || Array.isArray(doc))
@@ -396,12 +562,90 @@ export function extractObjectDetails(doc) {
     }
     return { objectId: id, details };
 }
+/**
+ * Extract task-type steps from a raw (YAML-parsed) PROCESS element document.
+ *
+ * Reads `notation: process` documents with an inline `flow.steps[]` array.
+ * Filters for task-type nodes (`task`, `userTask`, `serviceTask`) — start/end
+ * events and gateways are excluded.  Returns a flat `ObjectDetailInput` where
+ * `details` are the extracted task steps in declaration order.
+ *
+ * Returns `null` when the document is not a recognisable process element or
+ * has no `id` / `flow.steps` array.
+ *
+ * Use the returned value with `mergeStageTaskDetails` to embed tasks into
+ * blueprint stages for `grouping.columns: product-stage-task`.
+ */
+export function extractProcessFlowTasks(doc) {
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+        return null;
+    const top = doc;
+    if (top.notation !== 'process')
+        return null;
+    const id = typeof top.id === 'string' ? top.id : null;
+    if (!id)
+        return null;
+    const flow = top.flow && typeof top.flow === 'object' && !Array.isArray(top.flow)
+        ? top.flow
+        : null;
+    if (!flow || !Array.isArray(flow.steps))
+        return null;
+    const TASK_TYPES = new Set(['task', 'userTask', 'serviceTask', 'scriptTask',
+        'receiveTask', 'sendTask', 'manualTask', 'businessRuleTask', 'callActivity', 'subProcess']);
+    const details = [];
+    for (const step of flow.steps) {
+        if (!step || typeof step !== 'object' || Array.isArray(step))
+            continue;
+        const s = step;
+        const stepId = typeof s.id === 'string' ? s.id : null;
+        if (!stepId)
+            continue;
+        if (!TASK_TYPES.has(s.type))
+            continue;
+        details.push({ id: stepId, name: typeof s.name === 'string' ? s.name : stepId });
+    }
+    return details.length > 0 ? { objectId: id, details } : null;
+}
+/**
+ * Combine blueprint stage details (from `extractObjectDetails`) with
+ * process-flow task details (from `extractProcessFlowTasks`) into a
+ * stage-with-tasks hierarchy for `grouping.columns: product-stage-task`.
+ *
+ * All tasks from `taskInput.details` are distributed into their parent stage
+ * by matching the `stageOwner` map: `stageId → taskId[]`.  If `stageOwner` is
+ * omitted (no stage-to-task mapping is available), all tasks are placed into
+ * every stage (`undefined` key `→` all tasks).
+ *
+ * When `taskInput` is `null` or its `objectId` does not match `stageInput`,
+ * returns `stageInput` unchanged (callers can safely chain the result into
+ * `buildImpactMatrix` — it will degrade to stage-grain columns).
+ *
+ * @param stageInput   Stage-level detail (from `extractObjectDetails`).
+ * @param taskInput    Task-level detail  (from `extractProcessFlowTasks`).
+ * @param stageOwner   Optional mapping `stageId → taskId[]`. When provided,
+ *                     only tasks listed for a stage are embedded in it.
+ */
+export function mergeStageTaskDetails(stageInput, taskInput, stageOwner) {
+    if (!taskInput || taskInput.objectId !== stageInput.objectId)
+        return stageInput;
+    const allTasks = taskInput.details;
+    return {
+        objectId: stageInput.objectId,
+        details: stageInput.details.map(stage => {
+            const stageTasks = stageOwner
+                ? allTasks.filter(t => (stageOwner[stage.id] ?? []).includes(t.id))
+                : allTasks;
+            return stageTasks.length > 0 ? { ...stage, tasks: stageTasks } : stage;
+        }),
+    };
+}
 // ── Markdown rendering ──────────────────────────────────────────────────────
 const STATUS_GLYPH = {
     compliant: 'OK',
     partial: 'PARTIAL',
     non_compliant: 'FAIL',
     under_review: 'REVIEW',
+    pending_owner: 'PENDING',
     n_a: 'N/A',
 };
 function escMd(s) {
@@ -450,7 +694,7 @@ export function renderImpactMarkdown(matrix) {
     lines.push('');
     lines.push('## Legend');
     lines.push('');
-    lines.push('- **OK / PARTIAL / FAIL / REVIEW / N/A** — aggregated `ASSERTION.status` per §5.2.');
+    lines.push('- **OK / PARTIAL / FAIL / REVIEW / PENDING / N/A** — aggregated `ASSERTION.status` per §5.2.');
     lines.push(`- **${escMd(matrix.emptyLabels.no_obligation_label)}** — modelling gap; no admitted ASSERTION binds this (obligation, subject) pair.`);
     lines.push(`- **${escMd(matrix.emptyLabels.no_obligation_applies_label)}** — modelled fact; an admitted ASSERTION with status \`n_a\` excludes this pair.`);
     return lines.join('\n') + '\n';

package/dist/compliance/index.d.ts

@@ -8,9 +8,9 @@ export { renderComplianceMarkdown } from './markdown.js';
 export type { ReportScope, MarkdownOptions } from './markdown.js';
 export { renderComplianceHtml, renderImpactMatrixHtml } from './html.js';
 export type { HtmlOptions, ImpactMatrixHtmlOptions } from './html.js';
-export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, computeDeadlineStatus } from './impact.js';
+export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
 export type { ImpactCell, ImpactColumn, ImpactEmptyCellLabels, ImpactGrouping, ImpactMatrix, ImpactObligationFilter, ImpactStatusDisplay, ImpactSubjects, ImpactViewConfig, ParseImpactViewConfigResult, } from './impact.js';
 export { assertionToScoringElement, complianceConfidenceHeader, requirementToScoringElement, scoreComplianceView, } from './confidence.js';
 export { parseCoverageMetricConfig, buildCoverageMatrix, } from './coverage-metric.js';
-export type { CoverageMetricConfig, CoverageMetricScope, CoverageMetricSubjects, CoverageMetricThresholds, CoverageMatrix, CoverageRow, ParseCoverageMetricResult, RagStatus, } from './coverage-metric.js';
+export type { CoverageMetricConfig, CoverageMetricRegimes, CoverageMetricRegimesFilter, CoverageMetricSubjects, CoverageMetricThresholds, CoverageMatrix, CoverageRow, ParseCoverageMetricResult, RagStatus, } from './coverage-metric.js';
 export type { ComplianceIndex, ComplianceIndexInput, DeadlineStatus, IndexRequirement, IndexAssertion, LawTree, LawTreeRequirement, ProductView, ProductRequirementStatus, ObjectDetailDef, ObjectDetailInput, } from './types.js';

package/dist/compliance/index.js

@@ -4,6 +4,6 @@ export { buildGapReport } from './gap-report.js';
 export { emptyCanon, ingestComplianceDoc } from './classify.js';
 export { renderComplianceMarkdown } from './markdown.js';
 export { renderComplianceHtml, renderImpactMatrixHtml } from './html.js';
-export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, computeDeadlineStatus } from './impact.js';
+export { buildImpactMatrix, renderImpactMarkdown, parseImpactViewConfig, COMPLIANCE_IMPACT_DEFAULTS, extractObjectDetails, extractProcessFlowTasks, mergeStageTaskDetails, computeDeadlineStatus } from './impact.js';
 export { assertionToScoringElement, complianceConfidenceHeader, requirementToScoringElement, scoreComplianceView, } from './confidence.js';
 export { parseCoverageMetricConfig, buildCoverageMatrix, } from './coverage-metric.js';