feat: enforce signed target maturity evidence

tests/test_capability_fit_review.py

@@ -26,6 +26,7 @@ for tools_root in (ASSESSMENT_TOOLS_ROOT, RELEASE_TOOLS_ROOT):
         sys.path.insert(0, str(tools_root))
 
 from govoplan_assessment.capability_fit import (  # noqa: E402
+    enforce_required_boundary_scopes,
     local_tag_provenance,
     render_review,
     review_capability_fit,
@@ -74,6 +75,34 @@ class CapabilityFitReviewTests(unittest.TestCase):
             json.dumps(report, sort_keys=True), json.dumps(repeated, sort_keys=True)
         )
 
+    def test_required_boundary_scope_blocks_admission_until_positive(self) -> None:
+        catalog, keyring = signed_catalog(self.assessment)
+        report = review_capability_fit(
+            assessment=deepcopy(self.assessment),
+            schema=self.schema,
+            catalog=catalog,
+            published_keyring=keyring,
+            trusted_keyring=keyring,
+        )
+
+        enforce_required_boundary_scopes(
+            report, required_scopes=("security", "recovery")
+        )
+
+        self.assertEqual("blocked", report["status"])
+        self.assertFalse(report["proof_scope"]["admission"]["valid"])
+        self.assertEqual(
+            ["recovery", "security"],
+            report["proof_scope"]["admission"]["failed_scopes"],
+        )
+        self.assertEqual(
+            2,
+            sum(
+                item["code"] == "required_boundary_scope_unsatisfied"
+                for item in report["findings"]
+            ),
+        )
+
     def test_release_drift_identifies_affected_conclusions(self) -> None:
         catalog, keyring = signed_catalog(
             self.assessment, versions={"campaigns": "0.1.11"}, sequence=202607230001
@@ -360,7 +389,7 @@ class CapabilityFitReviewTests(unittest.TestCase):
 
         self.assertIn("Capability fit rerun: current", rendered)
         self.assertIn(
-            "No installed-composition, installed-release-origin, target-environment, external-provider, production-approval proof",
+            "No installed-composition, installed-release-origin, target-environment, external-providers, accessibility, privacy, security, operations, recovery, production-approval proof",
             rendered,
         )