gauntlet-evals 0.1.0__tar.gz

gauntlet_evals-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,8 @@
+*                                          @ChelseaKR
+/.github/                                  @ChelseaKR
+/SECURITY.md                               @ChelseaKR
+/pyproject.toml                            @ChelseaKR
+/docs/california-mapping.md                @ChelseaKR
+/src/gauntlet/cases.py                     @ChelseaKR
+/src/gauntlet/gates/                       @ChelseaKR
+/src/gauntlet/toy/                         @ChelseaKR

gauntlet_evals-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Change
+
+Describe the bounded behavior changed and the evidence supporting it.
+
+## Gates
+
+- [ ] `make verify` (ruff format, ruff lint, mypy strict, pytest with the 90% coverage gate)
+- [ ] `make demo` (the gates run against the toy and a report renders)
+- [ ] New or changed gate has a paired self-test proving it can fail (self-test doctrine)
+- [ ] English and Spanish cases changed as peers, not one bolted onto the other
+- [ ] No em dashes in prose; counts are emitted by the harness, not asserted
+- [ ] Any SIMM/SAM/GC identifier added to docs was read against the source, or omitted and said so
+- [ ] No claim of California approval, endorsement, or compliance

gauntlet_evals-0.1.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7

gauntlet_evals-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,202 @@
+# Merge-blocking CI. Least-privilege GITHUB_TOKEN, SHA-pinned actions, and the
+# same gates run locally (`make verify`) plus supply-chain checks. Every action
+# is pinned to a full 40-char commit SHA with its version in a trailing comment.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Install locked environment
+        run: uv sync --frozen
+      - name: Verify (ruff, mypy strict, pytest with 90% coverage gate)
+        run: make verify
+      - name: Run the gates against the toy and render a report
+        run: make demo
+
+  # The documentation site, built and then checked without a browser: HTML
+  # conformance and the markup-level accessibility rules through html-validate,
+  # and the WCAG 2.0/2.1/2.2 A and AA rule sets through axe-core in a headless
+  # DOM. Nothing is served and nothing is deployed here; both checkers read files
+  # off disk. Deploying is a separate workflow that runs only on main.
+  site:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+      - name: Install locked environment
+        run: uv sync --frozen
+      - name: Build the site and check it (html-validate, axe-core, npm audit)
+        run: make pages
+      - name: The site build must produce byte-identical output twice
+        run: |
+          set -euo pipefail
+          find site -type f | sort | xargs shasum -a 256 > /tmp/site-first.txt
+          rm -rf site
+          make site
+          find site -type f | sort | xargs shasum -a 256 > /tmp/site-second.txt
+          diff /tmp/site-first.txt /tmp/site-second.txt
+
+  # Exercises the published composite action the way an external consumer would,
+  # from a checkout that is not on PATH and with no local environment set up.
+  # A gate failure must block, so this job also proves the blocking path.
+  action:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run the action against the built-in suites
+        id: gauntlet
+        uses: ./
+        with:
+          job-summary: "false"
+      - name: The action reported counts the harness produced
+        env:
+          PASSED: ${{ steps.gauntlet.outputs.passed }}
+          GATES_TOTAL: ${{ steps.gauntlet.outputs.gates-total }}
+          GATES_FAILED: ${{ steps.gauntlet.outputs.gates-failed }}
+          CASES_TOTAL: ${{ steps.gauntlet.outputs.cases-total }}
+          REPORT: ${{ steps.gauntlet.outputs.report-path }}
+          JSON: ${{ steps.gauntlet.outputs.json-path }}
+        run: |
+          set -euo pipefail
+          test "$PASSED" = "true"
+          test "$GATES_FAILED" = "0"
+          test "$GATES_TOTAL" -ge 1
+          test "$CASES_TOTAL" -ge 1
+          test -s "$REPORT"
+          test -s "$JSON"
+          grep -q "not approved or endorsed by, the State of California" "$REPORT"
+      - name: Run the action against the deliberately broken example target
+        id: broken
+        uses: ./
+        with:
+          working-directory: examples
+          cases: cases
+          target-callable: broken_target:make_target
+          results-path: broken-results.json
+          report-path: broken-evidence.md
+          json-path: broken-evidence.json
+          fail-on-gate-failure: "false"
+          job-summary: "false"
+      - name: The failing run is reported as failing, not swallowed
+        working-directory: examples
+        env:
+          PASSED: ${{ steps.broken.outputs.passed }}
+          GATES_FAILED: ${{ steps.broken.outputs.gates-failed }}
+          CASES_FAILED: ${{ steps.broken.outputs.cases-failed }}
+        run: |
+          set -euo pipefail
+          test "$PASSED" = "false"
+          test "$GATES_FAILED" -ge 1
+          test "$CASES_FAILED" -ge 1
+          grep -q "uncited answer" broken-evidence.md
+
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+      - name: Build the wheel and sdist
+        run: uv build
+
+  dependency-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+      - name: Audit locked runtime dependencies
+        run: |
+          uv export --frozen --no-dev --no-emit-project --no-hashes > /tmp/runtime-requirements.txt
+          if test -s /tmp/runtime-requirements.txt; then
+            uvx --from pip-audit==2.10.1 pip-audit --strict --requirement /tmp/runtime-requirements.txt
+          else
+            echo "No runtime dependencies to audit."
+          fi
+
+  secret-scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # required on private repos: gitleaks-action lists the PR's commits
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  sast:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+      - name: Semgrep
+        run: uvx --from semgrep==1.168.0 semgrep scan --error --metrics off --config p/python src tests examples
+
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          # Code scanning / GitHub Advanced Security is not enabled on this
+          # private repo, so the default SARIF-upload path fails at the upload
+          # step. Emit plain GitHub Actions annotations instead; zizmor's own
+          # exit code still fails the job on real findings.
+          advanced-security: false
+          annotations: true

gauntlet_evals-0.1.0/.github/workflows/pages.yml

@@ -0,0 +1,64 @@
+# Publish the documentation site to GitHub Pages.
+#
+# The site is a build artifact, not a tracked directory: `gauntlet site` renders it from
+# the harness itself. The gate counts come from the suites the package loads, and the
+# evidence excerpts are runs made against the in-repo toy target while the pages build.
+# So this workflow needs no network, no secrets, and no data: the published pages are
+# reproducible from the commit they were built at.
+#
+# The merge-blocking accessibility and conformance checks live in ci.yml, which runs on
+# every pull request. This workflow only deploys what that already checked.
+#
+# Every action is pinned to a full 40-character commit SHA with its version in a
+# trailing comment, resolved 2026-08-07 via `gh api repos/OWNER/REPO/commits/TAG`.
+name: pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Install locked environment
+        run: uv sync --frozen
+      - name: Render the site from the harness
+        run: uv run gauntlet site --out site --generated "$(date -u +%F)"
+      - name: Fail if the render produced nothing
+        run: test -s site/index.html
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

gauntlet_evals-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,76 @@
+# Publishes a tagged version to PyPI through Trusted Publishing (OIDC), so no
+# API token is ever created, stored, or rotated. PyPI verifies the claim that
+# this workflow, in this repository, on this environment, produced the upload.
+#
+# The build job re-runs the same gates as `make verify` before anything is
+# uploaded: a release that cannot pass CI must not reach PyPI. Artifacts are
+# built once and handed to the publish job, so the files that were verified are
+# byte-for-byte the files that get uploaded.
+#
+# One-time setup on PyPI (nothing to do here, and no secret to add):
+#   https://pypi.org/manage/account/publishing/  ->  add a pending publisher
+#     PyPI project name:  gauntlet-evals
+#     Owner:              ChelseaKR
+#     Repository:         gauntlet
+#     Workflow name:      release.yml
+#     Environment name:   pypi
+name: release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.11.29"
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      # `--locked` fails when uv.lock has drifted from pyproject.toml. `--frozen`
+      # (used in ci.yml) exits 0 in that case, so a release must not rely on it.
+      - name: Install locked environment, failing on lockfile drift
+        run: uv sync --locked
+      - name: Verify (ruff, mypy strict, pytest with 90% coverage gate)
+        run: make verify
+      - name: Build sdist and wheel
+        run: uv build
+      - name: Check distribution metadata
+        run: uvx --from 'twine@latest' twine check dist/*
+      - name: Upload built distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/gauntlet-evals
+    permissions:
+      id-token: write # the OIDC claim Trusted Publishing verifies; no token needed
+    steps:
+      - name: Download built distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

gauntlet_evals-0.1.0/.gitignore

@@ -0,0 +1,22 @@
+__pycache__/
+*.pyc
+*.py[cod]
+.venv/
+.DS_Store
+dist/
+.coverage
+coverage.xml
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+demo-results.json
+demo-evidence.md
+demo-evidence.json
+demo-evidence-drift.md
+gauntlet-results.json
+gauntlet-evidence.md
+gauntlet-evidence.json
+
+# The documentation site is a build artifact, rendered by `make site`.
+site/
+node_modules/

gauntlet_evals-0.1.0/.htmlvalidate.mjs

@@ -0,0 +1,29 @@
+// HTML conformance and markup-level accessibility rules for the documentation site.
+//
+// Where a rule is waived or tightened, the reason is here rather than in a commit
+// message: a waived rule with no reason beside it is indistinguishable from an
+// oversight.
+export default {
+  extends: [
+    "html-validate:recommended",
+    "html-validate:document",
+    "html-validate:a11y",
+  ],
+  rules: {
+    // The WHATWG spec writes the doctype lowercase and HTML5 is case-insensitive here.
+    "doctype-style": ["error", { style: "lowercase" }],
+    // role="list" on a <ul> is redundant per the ARIA-in-HTML mapping, and html-validate
+    // is right about that. It is kept anyway: some of these lists carry list-style:none,
+    // and Safari with VoiceOver drops list semantics from a list styled that way unless
+    // the role is stated explicitly. The redundancy costs nothing; the lost semantics do.
+    "no-redundant-role": "off",
+    // Strict: every <th> must carry a scope, not only those in a table that mixes row
+    // and column headers. Every table here is a data table whose row header names what
+    // the row is about, and a cell read out without its row header is the failure this
+    // catches.
+    "wcag/h63": ["error", { strict: true }],
+    // The pages ship no script and no inline style attribute. Both stay errors, which is
+    // the default; they are named here so a future page cannot quietly introduce either.
+    "no-inline-style": "error",
+  },
+};

gauntlet_evals-0.1.0/CHANGELOG.md

@@ -0,0 +1,87 @@
+# Changelog
+
+All notable changes will be documented here.
+
+## [Unreleased]
+
+### Added
+
+- California mapping (`docs/california-mapping.md`): a table mapping each gate to
+  the SIMM 5305-F (August 2025) items its results inform and the disclosure
+  content it supports, built by reading the source page by page. Cites SIMM
+  5305-F sections by their document structure, SAM 4986.2 and 4986.9, Government
+  Code 11549.64(b), and the genai.ca.gov disclosure page. Lists the identifiers
+  it could not verify and therefore omitted, and carries a prominent
+  aligned-to-not-approved-by notice.
+- Python package skeleton (`src/gauntlet`), `pyproject.toml` (uv-compatible,
+  Apache-2.0, Python 3.12+), a strict YAML case-file schema with validation, and
+  a CLI with `gauntlet run` and `gauntlet report`.
+- Five core gates as a library driven by YAML cases: grounding assertion,
+  adversarial suite (English and Spanish as peers, across system-prompt
+  override, role manipulation, jailbreak, prompt-leak, code-execution, and
+  Unicode/obfuscation), refusal and escalation drills at a 100% threshold,
+  false-positive guard, and golden-answer regression.
+- Target adapters for any Python callable or HTTP endpoint, with a strict
+  response contract and no dependency on any model vendor.
+- A deliberately breakable grounded-RAG toy target and a paired self-test for
+  every gate that injects the defect the gate exists to catch and asserts the
+  gate fails.
+- Bilingual built-in suites for every gate. The counts are emitted by
+  `gauntlet inventory` rather than restated here.
+- CI (SHA-pinned actions): `make verify` with a 90% coverage gate, wheel build,
+  dependency audit, secret scan, SAST, and workflow static analysis. Dependabot
+  with a 7-day cooldown, CODEOWNERS, SECURITY, CONTRIBUTING, and a PR template.
+- Evidence pack (`gauntlet report`): one versioned structure rendered as
+  machine-readable JSON and as a human-readable document suitable for attaching
+  to a risk assessment. It states what was tested, what passed, what failed and
+  why, case counts per language, and what the harness does not establish, and it
+  carries the aligned-to-not-approved-by framing in the artifact itself. A run
+  with failures renders through the same sections as a clean one.
+- Framework cross-reference inside the pack: each gate outcome is linked to the
+  specific SIMM 5305-F items its results inform, from `src/gauntlet/mapping.py`.
+  Only identifiers verified in Milestone 1 are cited, the unverified list is
+  reproduced in every pack, and a gate that maps to nothing verified is reported
+  as unmapped rather than given an invented link.
+- Whole-run drift (`gauntlet report --baseline`): gates added and removed,
+  pass-rate deltas per gate and per language, cases newly failing and newly
+  passing, cases added and removed, and threshold changes. Deterministic and
+  free of timestamps, plus a `results_digest` that fingerprints behavior while
+  excluding the clock.
+- `gauntlet inventory`: the gate inventory counted from the loaded suites, in
+  Markdown or JSON, with `--update` to regenerate the README's generated block.
+  A test fails if that block goes stale.
+- A composite GitHub Action (`action.yml`) usable from any repository, with
+  documented inputs and outputs, SHA-pinned internals, no interpolation of
+  inputs into shell commands, and a CI job that exercises it on both the passing
+  and the failing path.
+- `examples/`: a minimal external case file and a target factory, serving as
+  documentation and as the action's failure-path fixture.
+- Documentation site (`gauntlet site`, `make site`): five static pages rendered
+  from the harness rather than typed. The gate inventory comes from
+  `build_inventory` over the suites that load, the same function `make inventory`
+  uses, so the site cannot carry a stale count. The evidence excerpts are real
+  runs made against the toy target while the pages build, healthy and with a
+  named defect injected, rendered through the same reporter a real run uses. No
+  network, no clock unless a date is passed, byte-identical on rebuild.
+- An accessibility gate over the built pages (`make pages`): html-validate for
+  HTML conformance and the markup-level rules, axe-core in a headless DOM for
+  the WCAG 2.0/2.1/2.2 A and AA rule sets, plus structure and two-theme colour
+  contrast measured in pytest so `make verify` keeps a floor with no node
+  toolchain. A CI job runs all of it and proves the build is reproducible.
+- A GitHub Pages workflow (`.github/workflows/pages.yml`) that publishes the
+  rendered site from `main`: empty top-level permissions, per-job scoping, and
+  SHA-pinned actions. Pages has to be set to build from GitHub Actions once, in
+  repository settings, before the first deploy can succeed.
+
+### Fixed
+
+- SCOPE.md placed the contractor GenAI disclosure duty in SAM 4986.2. It is in
+  SAM 4986.9; 4986.2 is the definitions section. Corrected, with the correction
+  recorded in the document rather than quietly applied.
+
+### Notes
+
+- Not a compliance certification. The State of California has not reviewed,
+  approved, endorsed, or certified this project.
+- Nothing has been published to any package registry, and no badge implies
+  otherwise. Publication and any rename remain the owner's decision.

gauntlet_evals-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,62 @@
+# Contributing
+
+Read [SCOPE.md](SCOPE.md), [SECURITY.md](SECURITY.md), and
+[docs/california-mapping.md](docs/california-mapping.md) before proposing
+changes.
+
+```sh
+make install
+make verify     # ruff format check, ruff lint, mypy strict, pytest with the coverage gate
+make demo       # gates against the toy, then both forms of the evidence pack
+make inventory  # regenerate the gate inventory block in the README
+make pages      # build the documentation site, then html-validate and axe-core over it
+```
+
+Run `make verify` before pushing, and `make pages` as well if you touched
+`src/gauntlet/site.py`. CI runs the same things, plus a wheel build, a dependency
+audit, a secret scan, SAST, workflow static analysis, and a job that uses the
+GitHub Action the way an external consumer would.
+
+## Rules that are not negotiable
+
+- **Every gate must be able to fail.** A new or changed gate needs a paired
+  self-test that injects the defect it catches and asserts the gate fails
+  (see `tests/test_self_test_doctrine.py`). A check that has never failed is not
+  evidence of health.
+- **English and Spanish cases are peers.** Add or change them together; do not
+  bolt a translation onto an English-first suite.
+- **Counts are counted.** Case totals, pass thresholds, and coverage are emitted
+  by the harness. Do not assert a count in prose that the harness does not
+  produce. The README's gate inventory is generated: change a suite, then run
+  `make inventory`. A test fails if the block is stale.
+- **The evidence pack stays honest under failure.** A run with failures has to
+  read as easily as a clean one, and every section present in one must be
+  present in the other. `tests/test_report.py` enforces that.
+- **Drift output stays deterministic.** No timestamps and no unstable ordering:
+  two runs that behaved identically must produce a byte-identical comparison.
+- **No em dashes in prose.** A test scans the Markdown and the source for them.
+- **No unverified framework citations.** Any SIMM 5305-F, SAM, or Government Code
+  identifier added to the docs must be read against the source first. If you
+  cannot verify it, omit it and say so, the way `docs/california-mapping.md`
+  already does. Add it to `UNVERIFIED_IDENTIFIERS` in
+  `src/gauntlet/mapping.py`, which a test then keeps out of every mapping row
+  and every evidence pack.
+- **A gate that maps to nothing verified says so.** Do not invent a framework
+  link to make the cross-reference look complete.
+- **No California approval or compliance claims.** The language is "aligned to",
+  never "approved by" or "compliant with". A test scans the Markdown, the
+  documentation site's source, and the rendered pages for the phrasings that
+  would break this.
+- **The documentation site prints nothing it did not compute.** Gate counts come
+  from the inventory, evidence excerpts come from runs made while the pages
+  build, and the action's inputs and outputs are read from `action.yml`. A number
+  in site prose that no run produced fails a test unless it is added, with a
+  reason, to the reviewed list in `tests/test_site.py`.
+- **The site stays accessible.** New markup has to pass html-validate and
+  axe-core in `make pages`, and any new colour has to be a token in both palettes
+  with its contrast pair measured in `tests/test_site.py`.
+- **No network in tests.** The toy runs locally; the HTTP adapter is tested
+  against a loopback stub. Do not add a test that reaches the internet.
+
+Do not add a model-vendor SDK, network fetching in a gate, or arbitrary code
+execution without an explicit product-scope decision.