@transitrix/diagrams 1.8.21 → 1.9.18

package/dist/activity-card/types.js

@@ -1,7 +1,7 @@
 // Activity Card notation — single-project narrative view.
 //
 // Spec: transitrix/methodology `notations/views/18-activity-card.md` (v0.1).
-// Epic vkgeorgia/strategy#97, Studio track #134.
+// Studio track #134.
 //
 // The Activity Card is the first MULTI-DOCUMENT Studio notation. The card
 // YAML itself holds only `id`, `project` (an Activity ID), `description`,

package/dist/agreement.d.ts

@@ -0,0 +1,15 @@
+import type { ValidationError } from './validation-types.js';
+export declare const AGREEMENT_VALUES: readonly ["draft", "agreed", "disputed"];
+export type AgreementValue = (typeof AGREEMENT_VALUES)[number];
+export declare function looksLikeTool(id: unknown): boolean;
+/**
+ * AGREE-001..003 over an element's already-extracted `agreement` /
+ * `agreed_by` fields. Returns an empty list when `agreement` is absent
+ * (back-compat — absent ⇒ `agreed`, nothing to check) or when the fields
+ * are well-formed.
+ *
+ * AGREE-002 and AGREE-003 can both describe an `agreement: agreed` record
+ * with no `agreed_by` — this reports AGREE-003 only, the same choice
+ * `check-agreement.mjs` makes (CONTRACT.md §6.3.1 permits either or both).
+ */
+export declare function checkAgreement(record: Record<string, unknown>): ValidationError[];

package/dist/agreement.js

@@ -0,0 +1,61 @@
+// Agreement axis — methodology CONTRACT.md §6.3 / §6.3.1 (AGREE-001..003).
+//
+// A closed three-value axis (`draft` | `agreed` | `disputed`) carried by
+// REQUIREMENT, CONSTRAINT, and NEED — independent of admission (§6.1),
+// recording whether the accountable party has committed to the statement.
+// Absent ⇒ `agreed` (back-compat; a human-authored element that predates
+// this axis needs no change).
+//
+// Ported from methodology's reference implementation
+// (`scripts/check-agreement.mjs`'s `checkAgreement`/`looksLikeTool`) so a
+// repo carrying the field validates identically here — same closed
+// vocabulary, same tool-id heuristic, same "AGREE-003 wins over AGREE-002
+// when both would fire" precedence.
+export const AGREEMENT_VALUES = ['draft', 'agreed', 'disputed'];
+/** Same convention as `ADMIT-007`'s footgun-catcher: an npm-scoped name, or
+ *  a hyphenated `*-cli` / `*-reviewer[-…]` / `*-bot` / `*-scanner` id, reads
+ *  as a tool; anything else reads as a human handle. Not a security
+ *  boundary — catches the common mistake of a tool defaulting or
+ *  copy-pasting `agreed`. */
+const TOOL_ID_RE = /^@|-cli$|-reviewer(?:-\w+)?$|-bot$|-scanner$/i;
+export function looksLikeTool(id) {
+    return TOOL_ID_RE.test(String(id ?? ''));
+}
+/**
+ * AGREE-001..003 over an element's already-extracted `agreement` /
+ * `agreed_by` fields. Returns an empty list when `agreement` is absent
+ * (back-compat — absent ⇒ `agreed`, nothing to check) or when the fields
+ * are well-formed.
+ *
+ * AGREE-002 and AGREE-003 can both describe an `agreement: agreed` record
+ * with no `agreed_by` — this reports AGREE-003 only, the same choice
+ * `check-agreement.mjs` makes (CONTRACT.md §6.3.1 permits either or both).
+ */
+export function checkAgreement(record) {
+    const agreement = record.agreement;
+    if (agreement === undefined)
+        return [];
+    if (typeof agreement !== 'string' || !AGREEMENT_VALUES.includes(agreement)) {
+        return [{
+                code: 'AGREE-001',
+                message: `agreement "${String(agreement)}" must be one of ${AGREEMENT_VALUES.join(', ')}.`,
+                path: 'agreement',
+            }];
+    }
+    const agreedBy = record.agreed_by;
+    if (typeof agreedBy !== 'string' || agreedBy.trim() === '') {
+        return [{
+                code: 'AGREE-003',
+                message: 'agreed_by is required whenever agreement is present.',
+                path: 'agreed_by',
+            }];
+    }
+    if (agreement === 'agreed' && looksLikeTool(agreedBy)) {
+        return [{
+                code: 'AGREE-002',
+                message: `agreement: agreed but agreed_by "${agreedBy}" identifies a tool — a tool must never write "agreed".`,
+                path: 'agreed_by',
+            }];
+    }
+    return [];
+}

package/dist/applications/index.d.ts

@@ -1,2 +1,4 @@
 export type { ApplicationType, ApplicationStatus, IntegrationDirection, ApplicationIntegration, Application, ApplicationsCatalogueHeader, ApplicationsCatalogueFile, } from './types.js';
 export { validateApplicationsCatalogue } from './validate.js';
+export type { ResolvedApplicationAttributes } from './resolve-maturity.js';
+export { resolveApplicationAttributes, withResolvedAttributes } from './resolve-maturity.js';

package/dist/applications/index.js

@@ -1 +1,2 @@
 export { validateApplicationsCatalogue } from './validate.js';
+export { resolveApplicationAttributes, withResolvedAttributes } from './resolve-maturity.js';

package/dist/applications/resolve-maturity.d.ts

@@ -0,0 +1,16 @@
+import type { Application } from './types.js';
+export interface ResolvedApplicationAttributes {
+    owner_role?: string;
+    vendor?: string;
+    maturity?: number;
+}
+/** Pick every sidecar out of a raw canon/elements/** doc pool and resolve
+ *  owner_role/vendor/maturity at `atDate`, keyed by the sidecar's target id
+ *  (== an application's `app_id`, per the notation's element-file pairing). */
+export declare function resolveApplicationAttributes(rawElementDocs: unknown[], atDate: string): Map<string, ResolvedApplicationAttributes>;
+/** Merge resolved sidecar values into a rendering copy of an application row.
+ *  An inline value would win if present, but VERSIONED-004 already forbids
+ *  that on an admitted document — this is a display fallback, not a
+ *  migration tool. The returned object is a plain copy; nothing here writes
+ *  it anywhere. */
+export declare function withResolvedAttributes(app: Application, resolved: Map<string, ResolvedApplicationAttributes>): Application;

package/dist/applications/resolve-maturity.js

@@ -0,0 +1,57 @@
+// Render-time resolution of the applications-catalogue's sidecar-bound
+// time_varying fields (owner_role, vendor, maturity — notations/views/
+// 10-applications.md §5a, CONTRACT.md §9.4). VERSIONED-004 rejects these
+// inline on an admitted catalogue entry, so a compliant document never
+// carries them — a renderer that only reads the document straight shows
+// blank cells for every field the maturity decision moved out.
+//
+// Pure: no I/O, no repo walk. The host (VS Code extension, IntelliJ/JCEF,
+// CLI) already owns loading canon/elements/** (canon-loader.ts's shared FS
+// layer) — this module only knows how to pick sidecars out of that pool and
+// resolve them at a date.
+//
+// Per the 2026-08-05 hub decision (proposal #1022): this is a read model,
+// never storage. Callers render an augmented, ephemeral copy of the
+// application row and must never serialise it back — the sidecar stays the
+// only place these fields are written.
+import { parseSidecar, resolveAttributes } from '../versioned-attribute/index.js';
+/** Pick every sidecar out of a raw canon/elements/** doc pool and resolve
+ *  owner_role/vendor/maturity at `atDate`, keyed by the sidecar's target id
+ *  (== an application's `app_id`, per the notation's element-file pairing). */
+export function resolveApplicationAttributes(rawElementDocs, atDate) {
+    const byAppId = new Map();
+    for (const doc of rawElementDocs) {
+        if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+            continue;
+        const sidecar = parseSidecar(doc);
+        if (!sidecar)
+            continue;
+        const resolved = resolveAttributes(sidecar, atDate);
+        const entry = {};
+        if (typeof resolved['owner_role'] === 'string')
+            entry.owner_role = resolved['owner_role'];
+        if (typeof resolved['vendor'] === 'string')
+            entry.vendor = resolved['vendor'];
+        if (typeof resolved['maturity'] === 'number')
+            entry.maturity = resolved['maturity'];
+        if (Object.keys(entry).length > 0)
+            byAppId.set(sidecar.target, entry);
+    }
+    return byAppId;
+}
+/** Merge resolved sidecar values into a rendering copy of an application row.
+ *  An inline value would win if present, but VERSIONED-004 already forbids
+ *  that on an admitted document — this is a display fallback, not a
+ *  migration tool. The returned object is a plain copy; nothing here writes
+ *  it anywhere. */
+export function withResolvedAttributes(app, resolved) {
+    const r = resolved.get(app.app_id);
+    if (!r)
+        return app;
+    return {
+        ...app,
+        owner_role: app.owner_role ?? r.owner_role,
+        vendor: app.vendor ?? r.vendor,
+        maturity: app.maturity ?? r.maturity,
+    };
+}

package/dist/applications/validate.js

@@ -5,6 +5,16 @@ const VALID_SENSITIVITY = new Set(['public', 'internal', 'confidential', 'restri
 const VALID_DIRECTIONALITY = new Set(['producer', 'consumer', 'request_reply', 'bidirectional_stream']);
 const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 const IFACE_CONDITIONAL = ['protocol', 'payload_class', 'sensitivity', 'directionality'];
+// VERSIONED-004 (CONTRACT.md §9.3) — `owner_role`, `vendor`, `maturity` are
+// declared `time_varying` by notations/views/10-applications.md §5/§5a and
+// belong in the sidecar `<app_id>.history.yaml`, not inline on the catalogue
+// entry. Unlike capability's VERSIONED-004 (packages/diagrams/src/
+// repo-validate/check-versioned-attributes.ts), which walks standalone
+// element files under canon/elements/**, an applications-catalogue entry has
+// no file of its own to check inline-vs-sidecar on — the entry lives in this
+// view document — so the check runs here, at the per-file notation
+// validator, rather than in the repo-scope element sweep.
+const TIME_VARYING_FIELDS = ['owner_role', 'vendor', 'maturity'];
 export function validateApplicationsCatalogue(input) {
     const errors = [];
     const warnings = [];
@@ -92,6 +102,16 @@ export function validateApplicationsCatalogue(input) {
                 errors.push({ code: 'APP-006', message: `${idx}: maturity must be an integer 1–5, got "${m}"` });
             }
         }
+        // VERSIONED-004: time_varying fields must live in the sidecar, not inline.
+        for (const field of TIME_VARYING_FIELDS) {
+            if (a[field] !== undefined) {
+                errors.push({
+                    code: 'VERSIONED-004',
+                    message: `${idx}: '${field}' is time_varying (CONTRACT.md §9) and belongs in the sidecar ` +
+                        `'${typeof a['app_id'] === 'string' ? a['app_id'] : idx}.history.yaml', not inline on the catalogue entry.`,
+                });
+            }
+        }
         // APP-009: integrations[].direction enum
         if (Array.isArray(a['integrations'])) {
             const integrations = a['integrations'];

package/dist/capability-map/CapabilityCardNode.d.ts

@@ -15,5 +15,5 @@ export interface CapabilityCardNodeData {
 }
 declare const CapabilityCardNode: React.MemoExoticComponent<({ data }: {
     data: CapabilityCardNodeData;
-}) => import("react/jsx-runtime").JSX.Element>;
+}) => React.JSX.Element>;
 export default CapabilityCardNode;

package/dist/capability-map/CapabilityRootNode.d.ts

@@ -8,5 +8,5 @@ export interface CapabilityRootNodeData {
  *  add/delete/collapse affordances (it isn't a mutable Capability). */
 declare const CapabilityRootNode: React.MemoExoticComponent<({ data }: {
     data: CapabilityRootNodeData;
-}) => import("react/jsx-runtime").JSX.Element>;
+}) => React.JSX.Element>;
 export default CapabilityRootNode;

package/dist/capability-map/index.d.ts

@@ -1,5 +1,7 @@
 export type { CapabilityType, CapabilityNode, CapabilityMapHeader, CapabilityMapFile, } from './types.js';
 export { validateCapabilityMap } from './validate.js';
+export type { ResolvedCapabilityAttributes } from './resolve-maturity.js';
+export { resolveCapabilityAttributes, withResolvedAttributes, withResolvedCapabilityMap, } from './resolve-maturity.js';
 export type { CapabilityTreeNode, CapabilityTreeEdge, CapabilityTreeLevelCounts, CapabilityTreeLayout, } from './layout-tree.js';
 export { layoutCapabilityTree, TREE_NODE_WIDTH, TREE_NODE_HEIGHT, TREE_RANK_SEP, TREE_NODE_SEP } from './layout-tree.js';
 export type { RenderCapabilityTreeOptions } from './render-capability-tree.js';

package/dist/capability-map/index.js

@@ -1,4 +1,5 @@
 export { validateCapabilityMap } from './validate.js';
+export { resolveCapabilityAttributes, withResolvedAttributes, withResolvedCapabilityMap, } from './resolve-maturity.js';
 export { layoutCapabilityTree, TREE_NODE_WIDTH, TREE_NODE_HEIGHT, TREE_RANK_SEP, TREE_NODE_SEP } from './layout-tree.js';
 export { renderCapabilityTreeSvg } from './render-capability-tree.js';
 export { parseAddress, formatAddress, getLevel, getParentAddress, getFirstFreeAddress, isAddressTaken, } from './address.js';

package/dist/capability-map/resolve-maturity.d.ts

@@ -0,0 +1,20 @@
+import type { CapabilityMapHeader, CapabilityNode } from './types.js';
+export interface ResolvedCapabilityAttributes {
+    current_maturity?: number;
+    target_maturity?: number;
+    owner_role?: string;
+    target_date?: string;
+}
+/** Pick every sidecar out of a raw canon/elements/** doc pool and resolve
+ *  current_maturity/target_maturity/owner_role/target_date at `atDate`,
+ *  keyed by the sidecar's target id (== a capability entry's `id`, per the
+ *  CAPABILITY-* primitive that entry references). */
+export declare function resolveCapabilityAttributes(rawElementDocs: unknown[], atDate: string): Map<string, ResolvedCapabilityAttributes>;
+/** Merge resolved sidecar values into a rendering copy of a capability node
+ *  and its descendants. An inline value always wins if present — this is a
+ *  display fallback for fields the document doesn't carry inline, not a
+ *  migration tool. Returns a new node tree; nothing here writes it
+ *  anywhere. */
+export declare function withResolvedAttributes(node: CapabilityNode, resolved: Map<string, ResolvedCapabilityAttributes>): CapabilityNode;
+/** Same merge, applied across a capability map's whole top-level tree. */
+export declare function withResolvedCapabilityMap(map: CapabilityMapHeader, resolved: Map<string, ResolvedCapabilityAttributes>): CapabilityMapHeader;

package/dist/capability-map/resolve-maturity.js

@@ -0,0 +1,72 @@
+// Render-time resolution of a nested capability-map entry's sidecar-bound
+// time_varying fields (current_maturity, target_maturity, owner_role,
+// target_date — 05-capability-map.md §13/§14, CONTRACT.md §9.4).
+// check-versioned-attributes.ts's VERSIONED-004 already rejects these inline
+// on the standalone CAPABILITY-*.yaml primitive; a nested capability-map
+// entry references that same primitive by id (the 2026-08-05 packages
+// decision — no separate per-nested-entry sidecar convention), so this
+// resolves the same way applications/resolve-maturity.ts does for the
+// applications catalogue.
+//
+// Pure: no I/O, no repo walk. The host (VS Code extension, IntelliJ/JCEF,
+// CLI) already owns loading canon/elements/** — this module only knows how
+// to pick sidecars out of that pool and resolve them at a date.
+//
+// Per the 2026-08-05 packages decision: this is a read model, never
+// storage. Callers render an augmented, ephemeral copy of the capability
+// tree and must never serialise it back — the sidecar stays the only place
+// these fields are written.
+import { parseSidecar, resolveAttributes } from '../versioned-attribute/index.js';
+/** Pick every sidecar out of a raw canon/elements/** doc pool and resolve
+ *  current_maturity/target_maturity/owner_role/target_date at `atDate`,
+ *  keyed by the sidecar's target id (== a capability entry's `id`, per the
+ *  CAPABILITY-* primitive that entry references). */
+export function resolveCapabilityAttributes(rawElementDocs, atDate) {
+    const byId = new Map();
+    for (const doc of rawElementDocs) {
+        if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+            continue;
+        const sidecar = parseSidecar(doc);
+        if (!sidecar)
+            continue;
+        const resolved = resolveAttributes(sidecar, atDate);
+        const entry = {};
+        if (typeof resolved['current_maturity'] === 'number')
+            entry.current_maturity = resolved['current_maturity'];
+        if (typeof resolved['target_maturity'] === 'number')
+            entry.target_maturity = resolved['target_maturity'];
+        if (typeof resolved['owner_role'] === 'string')
+            entry.owner_role = resolved['owner_role'];
+        if (typeof resolved['target_date'] === 'string')
+            entry.target_date = resolved['target_date'];
+        if (Object.keys(entry).length > 0)
+            byId.set(sidecar.target, entry);
+    }
+    return byId;
+}
+/** Merge resolved sidecar values into a rendering copy of a capability node
+ *  and its descendants. An inline value always wins if present — this is a
+ *  display fallback for fields the document doesn't carry inline, not a
+ *  migration tool. Returns a new node tree; nothing here writes it
+ *  anywhere. */
+export function withResolvedAttributes(node, resolved) {
+    const r = resolved.get(node.id);
+    const merged = r
+        ? {
+            ...node,
+            current_maturity: node.current_maturity ?? r.current_maturity,
+            target_maturity: node.target_maturity ?? r.target_maturity,
+            owner_role: node.owner_role ?? r.owner_role,
+            target_date: node.target_date ?? r.target_date,
+        }
+        : node;
+    if (!node.children || node.children.length === 0)
+        return merged;
+    return { ...merged, children: node.children.map((c) => withResolvedAttributes(c, resolved)) };
+}
+/** Same merge, applied across a capability map's whole top-level tree. */
+export function withResolvedCapabilityMap(map, resolved) {
+    if (resolved.size === 0)
+        return map;
+    return { ...map, capabilities: map.capabilities.map((c) => withResolvedAttributes(c, resolved)) };
+}

package/dist/capability-map/validate.js

@@ -3,8 +3,7 @@ const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 // Canonical form per `IDS_AND_REFERENCES.md` §2: `CAPABILITY-V…` /
 // `CAPABILITY-H…` with the dotted address (`V1`, `V1.2.1`, `H1`). The bare
 // legacy form (`V1`, `H1`) is still accepted so existing maps without the
-// canonical prefix do not break — migration is tracked under
-// vkgeorgia/strategy#36.
+// canonical prefix do not break; migration is tracked separately.
 const CAP_ID_RE = /^(CAPABILITY-)?(V|H)\d+(\.\d+)*$/;
 export function validateCapabilityMap(input) {
     const errors = [];

package/dist/compliance/classify.d.ts

@@ -1,4 +1,4 @@
-import type { IndexAssertion, IndexRequirement } from './types.js';
+import type { IndexAssertion, IndexRequirement, IndexVerification, IndexNeed, IndexValidation } from './types.js';
 export interface ComplianceProduct {
     id: string;
     name: string;
@@ -14,6 +14,8 @@ export interface ComplianceCanon {
     products: ComplianceProduct[];
     requirements: IndexRequirement[];
     assertions: IndexAssertion[];
+    /** VERIFICATION artefacts (27-verification.md) — the engineering V&V peer of `assertions`. */
+    verifications: IndexVerification[];
     codex: ComplianceCodexDoc[];
     /**
      * Named elements that can serve as assertion subjects beyond `products`:
@@ -21,6 +23,13 @@ export interface ComplianceCanon {
      * `ingestComplianceDoc` for the corresponding notation values.
      */
     subjects: ComplianceProduct[];
+    /** NEED elements (ELEMENT_PRIMITIVES.md §7.28) — upstream of `requirements`.
+     *  Ingested so NEED-COVERAGE-001 / NEED-VALIDATION-COVERAGE-001..002 can
+     *  compute coverage over the full needs catalogue. */
+    needs: IndexNeed[];
+    /** VALIDATION artefacts (28-validation.md) — the validation-domain peer of
+     *  `verifications`, anchored on NEED instead of REQUIREMENT. */
+    validations: IndexValidation[];
 }
 export declare function emptyCanon(): ComplianceCanon;
 /**

package/dist/compliance/classify.js

@@ -1,9 +1,18 @@
-// Canon-artefact classification (vkgeorgia/strategy#84). The single authority
+// Canon-artefact classification. The single authority
 // for "what is a compliance artefact" — used by both the Studio extension scan
 // (webview previews) and the CLI scan (`export-compliance`), so the recognition
 // rules live once. Pure: takes a parsed YAML document, no IO.
 export function emptyCanon() {
-    return { products: [], requirements: [], assertions: [], codex: [], subjects: [] };
+    return {
+        products: [],
+        requirements: [],
+        assertions: [],
+        verifications: [],
+        codex: [],
+        subjects: [],
+        needs: [],
+        validations: [],
+    };
 }
 const str = (v) => (typeof v === 'string' ? v : undefined);
 const strArray = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : undefined;
@@ -46,6 +55,25 @@ export function ingestComplianceDoc(canon, doc) {
             element_kind: d.notation,
             description: str(d.description),
             next_review_at: str(d.next_review_at),
+            serves: str(d.serves),
+        });
+        return id;
+    }
+    if (d.notation === 'need') {
+        canon.needs.push({ id, name: str(d.name) ?? id });
+        return id;
+    }
+    if (d.notation === 'validation') {
+        const validates = str(d.validates);
+        const method = str(d.method);
+        const outcome = str(d.outcome);
+        if (!validates || !method || !outcome)
+            return null;
+        canon.validations.push({
+            id, validates, method, outcome,
+            performed_at: str(d.performed_at),
+            evidenceCount: Array.isArray(d.evidence) ? d.evidence.length : 0,
+            admitted_at: str(d.admitted_at),
         });
         return id;
     }
@@ -66,6 +94,20 @@ export function ingestComplianceDoc(canon, doc) {
         });
         return id;
     }
+    if (d.notation === 'verification') {
+        const verifies = str(d.verifies);
+        const method = str(d.method);
+        const outcome = str(d.outcome);
+        if (!verifies || !method || !outcome)
+            return null;
+        canon.verifications.push({
+            id, verifies, method, outcome,
+            performed_at: str(d.performed_at),
+            evidenceCount: Array.isArray(d.evidence) ? d.evidence.length : 0,
+            admitted_at: str(d.admitted_at),
+        });
+        return id;
+    }
     if (d.zone === 'codex') {
         canon.codex.push({ id, name: str(d.name) ?? id, type: str(d.type), jurisdiction: str(d.jurisdiction) });
         return id;

package/dist/compliance/confidence.js

@@ -1,4 +1,4 @@
-// Confidence bridge for the compliance views (vkgeorgia/strategy#162 — DQ-2).
+// Confidence bridge for the compliance views (DQ-2).
 // Maps the compliance index projections (IndexRequirement / IndexAssertion) onto
 // the DQ-1 ScoringElement shape, scores the view, and renders the §11.6 header
 // line. Lives in @transitrix/diagrams so Studio and DSM share one bridge and

package/dist/compliance/gap-report.d.ts

@@ -1,4 +1,4 @@
-import type { ComplianceIndex, IndexAssertion, IndexRequirement } from './types.js';
+import type { ComplianceIndex, IndexAssertion, IndexRequirement, IndexNeed } from './types.js';
 export interface GapReport {
     /** Requirements with no assertion about them, severity-sorted then id. */
     requirementsWithoutAssertions: IndexRequirement[];
@@ -12,6 +12,36 @@ export interface GapReport {
      * (oldest first). Empty when `today` is not supplied.
      */
     pastDeadlineRequirements: IndexRequirement[];
+    /**
+     * REQ-VERIF-COVERAGE-001: requirements with no VERIFICATION targeting them,
+     * severity-sorted then id — the engineering V&V analogue of
+     * `requirementsWithoutAssertions`.
+     */
+    requirementsWithoutVerification: IndexRequirement[];
+    /**
+     * REQ-VERIF-COVERAGE-002: requirements with one or more VERIFICATIONs
+     * targeting them, but none closed (`pass`/`fail`) — every one is still
+     * `not_yet_run`/`inconclusive`. Severity-sorted then id.
+     */
+    requirementsWithUnresolvedVerification: IndexRequirement[];
+    /**
+     * NEED-COVERAGE-001: needs with no REQUIREMENT whose `serves` names them —
+     * the NEED-side analogue of `requirementsWithoutAssertions`, id-sorted.
+     */
+    needsWithoutRequirements: IndexNeed[];
+    /**
+     * NEED-VALIDATION-COVERAGE-001: needs with no VALIDATION targeting them,
+     * id-sorted — the validation-side analogue of
+     * `requirementsWithoutVerification`.
+     */
+    needsWithoutValidation: IndexNeed[];
+    /**
+     * NEED-VALIDATION-COVERAGE-002: needs with one or more VALIDATIONs
+     * targeting them, but none closed (`pass`/`fail`) — every one is still
+     * `not_yet_run`/`inconclusive`. Mutually exclusive with
+     * `needsWithoutValidation` by construction. Id-sorted.
+     */
+    needsWithUnresolvedValidation: IndexNeed[];
 }
 export interface GapReportOptions {
     /** Today as ISO `YYYY-MM-DD`; required for the stale-assertion list. */

package/dist/compliance/gap-report.js

@@ -1,6 +1,7 @@
-// Gap dashboard report (vkgeorgia/strategy#84 Phase 4 / CV-5).
+// Gap dashboard report (Phase 4 / CV-5; REQ-VERIF-COVERAGE-001/002 per
+// 15-requirement.md §4).
 //
-// Four operational gap lists computed from the shared reverse-index (Phase 3):
+// Operational gap lists computed from the shared reverse-index (Phase 3):
 //   1. Requirements with no Assertion targeting them (severity-sorted).
 //   2. Assertions without evidence — the ASSERT-007 case: status ∈
 //      {compliant, partial} AND no evidence. `under_review` / `non_compliant` /
@@ -9,7 +10,16 @@
 //   3. Stale Assertions — the ASSERT-008 case: `next_review_at` is in the past.
 //   4. Past-deadline requirements (CV-5) — REQUIREMENT.deadline < today AND
 //      the requirement has no fully-compliant assertion. Deadline-missed gaps.
+//   5. Requirements with no Verification targeting them — REQ-VERIF-COVERAGE-001
+//      (27-verification.md §5 / 15-requirement.md §4). Independent of #1 — the
+//      ASSERTION and VERIFICATION catalogues never disagree with each other by
+//      construction; a requirement may have one, both, or neither.
+//   6. Requirements whose verifications exist but never closed — every one is
+//      still `not_yet_run` / `inconclusive` — REQ-VERIF-COVERAGE-002. Mutually
+//      exclusive with #5 by construction.
 import { computeDeadlineStatus } from './impact.js';
+import { CLOSED_VERIFICATION_OUTCOMES } from '../verification/types.js';
+import { CLOSED_VALIDATION_OUTCOMES } from '../validation/types.js';
 const SEVERITY_RANK = { high: 0, medium: 1, low: 2 };
 function severityRank(s) {
     return s !== undefined && s in SEVERITY_RANK ? SEVERITY_RANK[s] : 3;
@@ -60,5 +70,47 @@ export function buildGapReport(index, options = {}) {
             return da < db ? -1 : da > db ? 1 : a.id < b.id ? -1 : 1;
         })
         : [];
-    return { requirementsWithoutAssertions, assertionsWithoutEvidence, staleAssertions, pastDeadlineRequirements };
+    // REQ-VERIF-COVERAGE-001 — no VERIFICATION targets the requirement at all.
+    const requirementsWithoutVerification = [...index.requirementById.values()]
+        .filter(r => (index.verificationsByRequirement.get(r.id) ?? []).length === 0)
+        .sort((a, b) => {
+        const d = severityRank(a.severity) - severityRank(b.severity);
+        return d !== 0 ? d : a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+    });
+    // REQ-VERIF-COVERAGE-002 — has verifications, but none closed (pass/fail).
+    // Mutually exclusive with -001 by construction (only requirements with at
+    // least one verification are considered here).
+    const requirementsWithUnresolvedVerification = [...index.requirementById.values()]
+        .filter(r => {
+        const verifications = index.verificationsByRequirement.get(r.id) ?? [];
+        return verifications.length > 0
+            && !verifications.some(v => CLOSED_VERIFICATION_OUTCOMES.includes(v.outcome));
+    })
+        .sort((a, b) => {
+        const d = severityRank(a.severity) - severityRank(b.severity);
+        return d !== 0 ? d : a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+    });
+    // NEED-COVERAGE-001 — no REQUIREMENT.serves names this need.
+    const needsWithoutRequirements = [...index.needById.values()]
+        .filter(n => (index.requirementsByNeed.get(n.id) ?? []).length === 0)
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    // NEED-VALIDATION-COVERAGE-001 — no VALIDATION targets the need at all.
+    const needsWithoutValidation = [...index.needById.values()]
+        .filter(n => (index.validationsByNeed.get(n.id) ?? []).length === 0)
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    // NEED-VALIDATION-COVERAGE-002 — has validations, but none closed (pass/fail).
+    // Mutually exclusive with -001 by construction (only needs with at least
+    // one validation are considered here).
+    const needsWithUnresolvedValidation = [...index.needById.values()]
+        .filter(n => {
+        const validations = index.validationsByNeed.get(n.id) ?? [];
+        return validations.length > 0
+            && !validations.some(v => CLOSED_VALIDATION_OUTCOMES.includes(v.outcome));
+    })
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return {
+        requirementsWithoutAssertions, assertionsWithoutEvidence, staleAssertions, pastDeadlineRequirements,
+        requirementsWithoutVerification, requirementsWithUnresolvedVerification,
+        needsWithoutRequirements, needsWithoutValidation, needsWithUnresolvedValidation,
+    };
 }

package/dist/compliance/html.js

@@ -1,4 +1,4 @@
-// HTML renderers for the compliance views (vkgeorgia/strategy#84 Phase 5,
+// HTML renderers for the compliance views (Phase 5,
 // PDF follow-on). Pure string builders — fed to WeasyPrint by the
 // `transitrix export-compliance --format pdf` path in src/export-compliance.ts.
 //
@@ -163,11 +163,13 @@ export function renderComplianceHtml(canon, scope, options = {}) {
             return htmlDoc(title, options.today, `${summary}<table><thead>${head}</thead><tbody>${rows}</tbody></table>`);
         }
         case 'gap': {
-            const index = buildComplianceIndex({ requirements: canon.requirements, assertions: canon.assertions });
+            const index = buildComplianceIndex({
+                requirements: canon.requirements,
+                assertions: canon.assertions,
+                verifications: canon.verifications,
+            });
             const report = buildGapReport(index, { today: options.today });
             const title = options.title ?? 'Compliance Gap Dashboard';
-            const total = report.requirementsWithoutAssertions.length + report.assertionsWithoutEvidence.length + report.staleAssertions.length;
-            const summary = `<p class="cmp-summary">${total} gap(s)</p>`;
             const section = (heading, count, items) => {
                 const body = items.length === 0
                     ? '<p class="cmp-ok">✓ none</p>'
@@ -178,13 +180,19 @@ export function renderComplianceHtml(canon, scope, options = {}) {
             const noEvidence = report.assertionsWithoutEvidence.map(a => (`<li><code>${escHtml(a.id)}</code> <span class="cmp-meta">about <code>${escHtml(a.about)}</code>, subject <code>${escHtml(a.subject)}</code>, status ${escHtml(a.status)}</span></li>`));
             const stale = report.staleAssertions.map(a => (`<li><code>${escHtml(a.id)}</code> <span class="cmp-meta">review due ${a.next_review_at ? escHtml(a.next_review_at) : '—'}, subject <code>${escHtml(a.subject)}</code></span></li>`));
             const pastDl = report.pastDeadlineRequirements.map(r => (`<li><code>${escHtml(r.id)}</code> ${escHtml(r.name)} <span class="cmp-meta">deadline ${r.deadline ? escHtml(r.deadline) : '—'}${r.severity ? `, severity ${escHtml(r.severity)}` : ''}</span></li>`));
-            const total4 = report.requirementsWithoutAssertions.length + report.assertionsWithoutEvidence.length + report.staleAssertions.length + report.pastDeadlineRequirements.length;
+            const noVerif = report.requirementsWithoutVerification.map(r => (`<li><code>${escHtml(r.id)}</code> ${escHtml(r.name)}${r.severity ? ` <span class="cmp-meta">severity ${escHtml(r.severity)}</span>` : ''}</li>`));
+            const unresolvedVerif = report.requirementsWithUnresolvedVerification.map(r => (`<li><code>${escHtml(r.id)}</code> ${escHtml(r.name)}${r.severity ? ` <span class="cmp-meta">severity ${escHtml(r.severity)}</span>` : ''}</li>`));
+            const total6 = report.requirementsWithoutAssertions.length + report.assertionsWithoutEvidence.length
+                + report.staleAssertions.length + report.pastDeadlineRequirements.length
+                + report.requirementsWithoutVerification.length + report.requirementsWithUnresolvedVerification.length;
             const body = [
-                `<p class="cmp-summary">${total4} gap(s) across 4 checks</p>`,
+                `<p class="cmp-summary">${total6} gap(s) across 6 checks</p>`,
                 section('Requirements without assertions', report.requirementsWithoutAssertions.length, reqs),
                 section('Assertions without evidence — ASSERT-007', report.assertionsWithoutEvidence.length, noEvidence),
                 section('Stale assertions — ASSERT-008', report.staleAssertions.length, stale),
                 section('Past-deadline requirements (CV-5)', report.pastDeadlineRequirements.length, pastDl),
+                section('Requirements without verification — REQ-VERIF-COVERAGE-001', report.requirementsWithoutVerification.length, noVerif),
+                section('Requirements with unresolved verification — REQ-VERIF-COVERAGE-002', report.requirementsWithUnresolvedVerification.length, unresolvedVerif),
             ].join('');
             return htmlDoc(title, options.today, body);
         }

package/dist/compliance/impact.js

@@ -1,5 +1,5 @@
 // Compliance-impact matrix derivation + markdown renderer
-// (vkgeorgia/strategy#166 — interim renderer; CV-1 view-config wiring
+// (interim renderer; CV-1 view-config wiring
 // per strategy#84 decomposition refresh).
 //
 // Implements the render contract from