feat: enforce signed target maturity evidence

tools/assessments/govoplan_assessment/capability_fit.py

@@ -930,10 +930,7 @@ def build_report(
     boundary_scope = (
         boundary_review.proof_scope
         if boundary_review is not None
-        else {
-            scope: {"checked": False, "valid": None}
-            for scope in PROOF_REQUIREMENTS
-        }
+        else {scope: {"checked": False, "valid": None} for scope in PROOF_REQUIREMENTS}
     )
     proof_scope = {
         "assessment_schema": {"checked": True, "valid": schema_valid},
@@ -1002,6 +999,63 @@ def build_report(
     }
 
 
+def enforce_required_boundary_scopes(
+    report: dict[str, Any], *, required_scopes: Iterable[str]
+) -> dict[str, Any]:
+    """Turn missing or negative external proof into an admission blocker."""
+
+    requested = tuple(dict.fromkeys(sorted(required_scopes)))
+    unknown = sorted(set(requested) - set(PROOF_REQUIREMENTS))
+    if unknown:
+        raise ValueError("unknown boundary scopes: " + ", ".join(unknown))
+    proof_scope = report.get("proof_scope")
+    if not isinstance(proof_scope, dict):
+        raise ValueError("capability-fit report has no proof scope")
+    failed = tuple(
+        scope
+        for scope in requested
+        if not isinstance(proof_scope.get(scope), dict)
+        or proof_scope[scope].get("checked") is not True
+        or proof_scope[scope].get("valid") is not True
+    )
+    proof_scope["admission"] = {
+        "checked": True,
+        "valid": not failed,
+        "required_scopes": list(requested),
+        "failed_scopes": list(failed),
+    }
+    if not failed:
+        return report
+    findings = report.setdefault("findings", [])
+    existing = {
+        (item.get("code"), item.get("message"))
+        for item in findings
+        if isinstance(item, dict)
+    }
+    for scope in failed:
+        message = (
+            f"Admission requires current positive boundary evidence for {scope!r}."
+        )
+        if ("required_boundary_scope_unsatisfied", message) not in existing:
+            findings.append(
+                {
+                    "severity": "blocker",
+                    "code": "required_boundary_scope_unsatisfied",
+                    "message": message,
+                    "assessment_ids": ["assessment.external_proof"],
+                }
+            )
+    findings.sort(
+        key=lambda item: (
+            _severity_rank(str(item.get("severity") or "")),
+            str(item.get("code") or ""),
+            str(item.get("message") or ""),
+        )
+    )
+    report["status"] = "blocked"
+    return report
+
+
 def render_review(report: dict[str, Any]) -> str:
     proof_scope = report.get("proof_scope", {})
     installed_scope = proof_scope.get("installed_artifacts", {})
@@ -1062,8 +1116,7 @@ def render_review(report: dict[str, Any]) -> str:
     unchecked_boundaries = [
         label
         for key, label in (
-            (scope, scope.replace("_", "-"))
-            for scope in PROOF_REQUIREMENTS
+            (scope, scope.replace("_", "-")) for scope in PROOF_REQUIREMENTS
         )
         if report.get("proof_scope", {}).get(key, {}).get("checked") is not True
     ]