fix(assessment): harden capability evidence trust

tools/assessments/govoplan_assessment/capability_fit.py

@@ -28,6 +28,7 @@ from govoplan_release.version_alignment import candidate_catalog_version_issues
 from .evidence import (
     BoundaryEvidenceReview,
     InstalledEvidenceReview,
+    public_key_material_from_keyrings,
     review_boundary_evidence,
     review_installed_composition,
 )
@@ -63,6 +64,8 @@ def review_capability_fit(
     boundary_authority_keyring: dict[str, Any] | None = None,
     boundary_authority_keyring_schema: dict[str, Any] | None = None,
     verification_time: datetime | None = None,
+    installed_evidence_mode: str = "imported_unsigned",
+    expected_external_provider_subject: str | None = None,
 ) -> dict[str, Any]:
     """Return a secret-free release-drift report for one fit assessment."""
 
@@ -356,6 +359,10 @@ def review_capability_fit(
             )
         )
 
+    evidence_verification_time = verification_time or datetime.now(tz=UTC)
+    evidence_verification_mode = (
+        "historical_override" if verification_time is not None else "current"
+    )
     installed_review = review_installed_composition(
         assessment=assessment,
         catalog_entries=catalog_entries,
@@ -363,6 +370,9 @@ def review_capability_fit(
         selected_commits=source_selection.selected_commits,
         evidence=installed_evidence,
         schema=installed_evidence_schema,
+        observation_mode=installed_evidence_mode,
+        verification_time=evidence_verification_time,
+        verification_mode=evidence_verification_mode,
     )
     findings.extend(
         Finding(item.severity, item.code, item.message, item.assessment_ids)
@@ -378,7 +388,13 @@ def review_capability_fit(
         evidence_schema=boundary_evidence_schema,
         authority_keyring=boundary_authority_keyring,
         authority_keyring_schema=boundary_authority_keyring_schema,
-        verification_time=verification_time,
+        verification_time=evidence_verification_time,
+        verification_mode=evidence_verification_mode,
+        expected_external_provider_subject=expected_external_provider_subject,
+        forbidden_authority_public_keys=public_key_material_from_keyrings(
+            published_keyring,
+            trusted_keyring,
+        ),
     )
     findings.extend(
         Finding(item.severity, item.code, item.message, item.assessment_ids)
@@ -396,6 +412,7 @@ def review_capability_fit(
             assessment=assessment,
             installed_review=installed_review,
         ),
+        boundary_review.review_targets,
     )
     return build_report(
         assessment=assessment,
@@ -908,7 +925,7 @@ def build_report(
         **boundary_scope,
     }
     return {
-        "report_version": "0.2.0",
+        "report_version": "0.3.0",
         "status": status,
         "assessment_id": assessment.get("assessment_id"),
         "assessment_release": assessment.get("release", {}).get("ref")
@@ -930,9 +947,11 @@ def build_report(
 
 
 def render_review(report: dict[str, Any]) -> str:
-    installed_checked = (
-        report.get("proof_scope", {}).get("installed_artifacts", {}).get("checked")
-        is True
+    proof_scope = report.get("proof_scope", {})
+    installed_scope = proof_scope.get("installed_artifacts", {})
+    installed_checked = installed_scope.get("checked") is True
+    installed_supplied = bool(installed_scope.get("evidence_sha256")) or (
+        "installed_evidence_observation" in proof_scope
     )
     lines = [
         f"Capability fit rerun: {report['status']}",
@@ -941,12 +960,29 @@ def render_review(report: dict[str, Any]) -> str:
         (
             "Scope: schema, signed release metadata, optional local tag provenance, "
             + (
-                "and supplied installed-composition evidence."
+                "and locally observed installed-composition evidence."
                 if installed_checked
-                else "and no installed-composition evidence."
+                else (
+                    "and supplied installed-composition evidence that did not establish local proof."
+                    if installed_supplied
+                    else "and no installed-composition evidence."
+                )
             )
         ),
     ]
+    verification = proof_scope.get("boundary_evidence_verification") or proof_scope.get(
+        "installed_evidence_observation"
+    )
+    if isinstance(verification, dict) and verification.get("evaluated_at"):
+        mode = verification.get("verification_mode")
+        mode_label = (
+            "HISTORICAL override"
+            if mode == "historical_override"
+            else "current-time evaluation"
+        )
+        lines.append(
+            f"Evidence verification: {mode_label} at {verification['evaluated_at']}."
+        )
     findings = report.get("findings") or []
     if findings:
         lines.append("Findings:")