feat: generate evidence-based fit assessments
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"$schema": "./capability-fit.schema.json",
|
||||
"schema_version": "0.1.0",
|
||||
"schema_version": "0.2.0",
|
||||
"assessment_id": "campaign-reference-2026-07-22",
|
||||
"assessed_at": "2026-07-22",
|
||||
"scope": {
|
||||
@@ -13,16 +13,30 @@
|
||||
"Workflow and workflow-driven user stories"
|
||||
]
|
||||
},
|
||||
"facts": [
|
||||
"The assessment is pinned to signed stable catalog sequence 202607220843 and the exact module commits listed below.",
|
||||
"The Campaign authoring, validation, build, mock-delivery, managed-file, local-access, and local-audit paths have direct test or contract evidence.",
|
||||
"The production-like development profile runs PostgreSQL and Redis in containers while application processes use editable source trees.",
|
||||
"No installed-target, external-provider, reference-readiness, recovery, or production-approval evidence bundle is attached to this assessment."
|
||||
],
|
||||
"decisions": [
|
||||
"Use Campaign as the first reference journey and flagship pilot scenario.",
|
||||
"Keep Workflow and workflow-driven user stories planned and explicitly postponed for this assessment.",
|
||||
"Use local GovOPlaN accounts for the bounded pilot; do not claim federated identity support.",
|
||||
"Do not approve small production until installed-artifact, target mail, monitoring, backup/restore, and recovery proof checks pass."
|
||||
],
|
||||
"release": {
|
||||
"kind": "tagged_release",
|
||||
"ref": "stable-catalog-202607220843",
|
||||
"meta_commit": "5447299289a1",
|
||||
"reproducible": true,
|
||||
"configuration_packages": [],
|
||||
"configuration_packages": [
|
||||
"none: environment-profile basis only"
|
||||
],
|
||||
"notes": [
|
||||
"The live stable catalog has a valid Ed25519 signature trusted through release-key-1.",
|
||||
"Core v0.1.13 and Campaign v0.1.10 are tagged and package-integrated; this is not target-environment or production approval.",
|
||||
"No configuration revision or configuration package is pinned yet."
|
||||
"The absence of a configuration package is pinned explicitly as an environment-profile-only basis; this remains a promotion gap."
|
||||
]
|
||||
},
|
||||
"composition": [
|
||||
@@ -188,6 +202,125 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"scenarios": [
|
||||
{
|
||||
"id": "campaign-pilot",
|
||||
"label": "Controlled Campaign pilot",
|
||||
"status": "partial",
|
||||
"recommendation": "Proceed with a bounded internal pilot after its provider, privacy, workload, and recovery proof checks are assigned and passed.",
|
||||
"composition": [
|
||||
"core",
|
||||
"tenancy",
|
||||
"organizations",
|
||||
"identity",
|
||||
"access",
|
||||
"admin",
|
||||
"dashboard",
|
||||
"policy",
|
||||
"audit",
|
||||
"campaigns",
|
||||
"files",
|
||||
"mail",
|
||||
"docs",
|
||||
"ops"
|
||||
],
|
||||
"topology": [
|
||||
"One supervised GovOPlaN API process and one immutable built WebUI behind deployment-owned TLS termination",
|
||||
"One PostgreSQL database and a durable single-node or shared managed-file path",
|
||||
"One persistent private Redis broker and one supervised Celery worker when asynchronous delivery is enabled",
|
||||
"One dedicated non-production SMTP/IMAP account with a restricted safe-recipient policy",
|
||||
"External health checks, centralized logs, protected secret injection, and coordinated backup storage"
|
||||
],
|
||||
"conditions": [
|
||||
"Use one internal tenant or office and controlled operators.",
|
||||
"Keep recipient volume non-critical until measured.",
|
||||
"Enable Addresses only when reusable recipient lists or CardDAV are explicitly in scope.",
|
||||
"Do not enable or claim Workflow from this assessment."
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "small-production-candidate",
|
||||
"label": "Small-production candidate",
|
||||
"status": "partial",
|
||||
"recommendation": "Do not approve production until every listed operational gate has target evidence and the residual risks have named owners.",
|
||||
"composition": [
|
||||
"core",
|
||||
"tenancy",
|
||||
"organizations",
|
||||
"identity",
|
||||
"access",
|
||||
"admin",
|
||||
"dashboard",
|
||||
"policy",
|
||||
"audit",
|
||||
"campaigns",
|
||||
"files",
|
||||
"mail",
|
||||
"docs",
|
||||
"ops"
|
||||
],
|
||||
"topology": [
|
||||
"Immutable separately supervised WebUI, API, and worker artifacts behind monitored reverse-proxy TLS",
|
||||
"Dedicated or managed PostgreSQL with measured coordinated backup and isolated restore",
|
||||
"Persistent authenticated Redis with queue-age, queue-depth, and worker-health alerts",
|
||||
"Durable shared or S3-compatible object storage with versioning, lifecycle, and restore evidence",
|
||||
"Target-native secret management, centralized monitoring/logging/audit export, and an exercised incident and disaster-recovery procedure"
|
||||
],
|
||||
"conditions": [
|
||||
"Pin and promote a configuration package instead of relying on an environment-only basis.",
|
||||
"Pass installed-release, target SMTP/IMAP, accessibility, privacy, security, operations, and recovery evidence gates.",
|
||||
"Agree availability, RPO, RTO, retention, support, and procurement requirements.",
|
||||
"Run only one scheduler unless distributed leadership or locking is proved."
|
||||
]
|
||||
}
|
||||
],
|
||||
"functional_context": {
|
||||
"required_modules": [
|
||||
"core",
|
||||
"tenancy",
|
||||
"organizations",
|
||||
"identity",
|
||||
"access",
|
||||
"admin",
|
||||
"dashboard",
|
||||
"policy",
|
||||
"audit",
|
||||
"campaigns",
|
||||
"files",
|
||||
"mail",
|
||||
"docs",
|
||||
"ops"
|
||||
],
|
||||
"optional_modules": [
|
||||
"addresses"
|
||||
],
|
||||
"external_systems": [
|
||||
"Deployment-owned reverse proxy and TLS certificate lifecycle",
|
||||
"Target SMTP/IMAP service and its DNS, certificate, throttling, bounce, and reply policies",
|
||||
"Target-native secret store, monitoring/logging platform, backup storage, and incident-response process"
|
||||
],
|
||||
"missing_contracts": [
|
||||
"End-to-end federated identity provider and lifecycle contract",
|
||||
"Target monitoring, alert delivery, and central audit/SIEM acceptance contract",
|
||||
"Production configuration-package promotion and approval evidence"
|
||||
],
|
||||
"policy_decisions": [
|
||||
"Recipient allow-list, permitted sender, attachment, retention, and external-disclosure policy",
|
||||
"Identity, MFA, break-glass, service-account, and joiner/mover/leaver policy",
|
||||
"Availability, RPO, RTO, support, procurement, and residual-risk ownership"
|
||||
],
|
||||
"manual_workarounds": [
|
||||
"Use controlled local accounts while federation remains outside the verified slice",
|
||||
"Use one supervised scheduler where periodic work is unavoidable",
|
||||
"Keep provider reconciliation and production promotion under explicit operator review"
|
||||
],
|
||||
"blockers": [
|
||||
"No promoted configuration package is pinned",
|
||||
"No installed-target or target SMTP/IMAP proof is attached",
|
||||
"No coherent target backup/restore or disaster-recovery drill with measured RPO/RTO is attached",
|
||||
"No target privacy, security, accessibility, operations, or production-approval evidence is attached"
|
||||
]
|
||||
},
|
||||
"questionnaire": {
|
||||
"scope_outcomes": [
|
||||
{
|
||||
@@ -203,6 +336,20 @@
|
||||
"state": "answered",
|
||||
"answer": "No; Workflow is planned and explicitly postponed.",
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "scope.users_tenants_organizations",
|
||||
"question": "Which users, roles, tenants, organization units, and delegated functions participate?",
|
||||
"state": "assumed",
|
||||
"answer": "One internal tenant or office with controlled Campaign operators; detailed organization and delegation shape remains target-specific.",
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "outcome.acceptance",
|
||||
"question": "What constitutes pilot success and production acceptance?",
|
||||
"state": "answered",
|
||||
"answer": "Pilot success requires the bounded Campaign journey and proof checks; production additionally requires installed-artifact, provider, privacy, security, operations, recovery, and approval evidence.",
|
||||
"evidence": []
|
||||
}
|
||||
],
|
||||
"data_policy": [
|
||||
@@ -219,6 +366,13 @@
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "data.privacy_security_disclosure",
|
||||
"question": "Which privacy, security, residency, minimization, access, and external-disclosure constraints apply?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
}
|
||||
],
|
||||
"identity_integrations": [
|
||||
@@ -235,22 +389,50 @@
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "identity.protocols_lifecycle",
|
||||
"question": "Which identity protocols, MFA, joiner/mover/leaver, service-account, and break-glass rules are mandatory?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "integration.protocols_network",
|
||||
"question": "Which connector protocols, versions, directions, authentication, certificate, rate-limit, egress, and degraded-mode requirements apply?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
}
|
||||
],
|
||||
"workload_growth": [
|
||||
{
|
||||
"id": "workload.campaign",
|
||||
"id": "workload.campaign_volume_peaks",
|
||||
"question": "What are Campaign frequency, recipients per Campaign, send window, import size and attachment volume?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "workload.platform",
|
||||
"id": "workload.tenants_users_concurrency",
|
||||
"question": "What are tenant, named-user, active-user, concurrent-user, and peak-request assumptions?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "workload.files_jobs_audit_growth_retention",
|
||||
"question": "What are tenant, user, concurrency, file, database, queue and audit growth assumptions?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "workload.connector_traffic_batches",
|
||||
"question": "What connector traffic, scheduled-job, batch, queue-depth, queue-age, and external-rate-limit peaks apply?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
}
|
||||
],
|
||||
"availability_operations": [
|
||||
@@ -267,6 +449,13 @@
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
},
|
||||
{
|
||||
"id": "hosting.network_constraints",
|
||||
"question": "Which hosting, network-zone, egress, proxy, DNS, NTP, certificate-authority, residency, or disconnected-operation constraints apply?",
|
||||
"state": "not_assessed",
|
||||
"answer": null,
|
||||
"evidence": []
|
||||
}
|
||||
],
|
||||
"procurement_decisions": [
|
||||
@@ -754,6 +943,63 @@
|
||||
"recommendation": "Use target-native secret injection and document rotation/recovery.",
|
||||
"proof_check": "Rotate a non-production credential and recover from a protected backup."
|
||||
},
|
||||
{
|
||||
"id": "identity.access",
|
||||
"requirement": "Authenticate users and enforce tenant-scoped authorization through the selected identity mode.",
|
||||
"status": "verified",
|
||||
"evidence": [
|
||||
{
|
||||
"kind": "test",
|
||||
"scope": "committed_source",
|
||||
"locator": "govoplan-access/tests/test_auth_dependencies.py"
|
||||
},
|
||||
{
|
||||
"kind": "test",
|
||||
"scope": "committed_source",
|
||||
"locator": "govoplan-core/tests/test_api_smoke.py#cookie-session-csrf"
|
||||
}
|
||||
],
|
||||
"conditions": [
|
||||
"The bounded pilot accepts local GovOPlaN accounts."
|
||||
],
|
||||
"gaps": [
|
||||
"Target MFA, federation, provisioning, and joiner/mover/leaver requirements are not assessed."
|
||||
],
|
||||
"risks": [
|
||||
"A local-only identity topology may not satisfy institutional production policy."
|
||||
],
|
||||
"recommendation": "Use controlled local pilot accounts and assess the mandatory production identity topology separately.",
|
||||
"proof_check": "Exercise login, role change, account suspension, protected bootstrap, and break-glass recovery in the target."
|
||||
},
|
||||
{
|
||||
"id": "connectors.mail",
|
||||
"requirement": "Reach the selected SMTP/IMAP and other external connector endpoints under explicit network and provider policy.",
|
||||
"status": "available_unconfigured",
|
||||
"evidence": [
|
||||
{
|
||||
"kind": "test",
|
||||
"scope": "current_workspace",
|
||||
"locator": "govoplan-mail/tests",
|
||||
"note": "Protocol adapters have direct tests; no target provider was exercised"
|
||||
},
|
||||
{
|
||||
"kind": "documentation",
|
||||
"scope": "documented_model",
|
||||
"locator": "govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md"
|
||||
}
|
||||
],
|
||||
"conditions": [
|
||||
"The deployment supplies DNS, egress, proxy, CA trust, scoped service accounts, and provider limits."
|
||||
],
|
||||
"gaps": [
|
||||
"No target endpoint, TLS chain, throttling, sender policy, bounce/reply path, or disclosure agreement is assessed."
|
||||
],
|
||||
"risks": [
|
||||
"Provider rejection, delay, or ambiguous outcomes can affect delivery and evidence completeness."
|
||||
],
|
||||
"recommendation": "Use a dedicated safe provider account for the pilot and require target interoperability evidence before production.",
|
||||
"proof_check": "Exercise target-like SMTP acceptance, IMAP append, throttling, outage, retry, and reconciliation through the approved network path."
|
||||
},
|
||||
{
|
||||
"id": "operations.monitoring",
|
||||
"requirement": "Detect API, database, worker, queue, storage and delivery degradation.",
|
||||
@@ -780,6 +1026,30 @@
|
||||
"recommendation": "Integrate external monitoring before small production.",
|
||||
"proof_check": "Trigger each readiness/delivery failure and verify an actionable alert."
|
||||
},
|
||||
{
|
||||
"id": "operations.audit",
|
||||
"requirement": "Retain, monitor, review, and where required export security and business audit evidence.",
|
||||
"status": "partial",
|
||||
"evidence": [
|
||||
{
|
||||
"kind": "test",
|
||||
"scope": "current_workspace",
|
||||
"locator": "govoplan-audit/tests",
|
||||
"note": "Local audit persistence and retry behavior are exercised"
|
||||
}
|
||||
],
|
||||
"conditions": [
|
||||
"Local database audit evidence is part of coordinated backup and access review."
|
||||
],
|
||||
"gaps": [
|
||||
"Target retention enforcement, tamper-evident export, SIEM integration, alerting, and privileged review are not verified."
|
||||
],
|
||||
"risks": [
|
||||
"Local evidence alone may not meet institutional security, records, or incident-response requirements."
|
||||
],
|
||||
"recommendation": "Define the target audit retention, export, monitoring, and review controls before production approval.",
|
||||
"proof_check": "Exercise privileged-event review, retention, export failure/retry, and target SIEM or archive ingestion."
|
||||
},
|
||||
{
|
||||
"id": "operations.backup_restore",
|
||||
"requirement": "Back up and restore database, files, configuration and keys as a coherent service.",
|
||||
|
||||
Reference in New Issue
Block a user