feat: implement institutional governance and recovery architecture

2026-08-01 17:46:53 +02:00
parent 3c658fa32d
commit d78b13f9d3
45 changed files with 4388 additions and 262 deletions
@@ -1007,6 +1007,44 @@ class CapabilityFitEvidenceTests(unittest.TestCase):
            report["proof_scope"]["target_environment"]["observed_subject_id"],
        )

+    def test_reference_readiness_scopes_require_release_bound_signed_proof(
+        self,
+    ) -> None:
+        installed = matching_installed_evidence(self.assessment)
+        catalog, keyring = signed_catalog(
+            self.assessment,
+            release_artifacts=catalog_artifacts_for(installed),
+        )
+        readiness_scopes = (
+            "target_environment",
+            "accessibility",
+            "privacy",
+            "security",
+            "operations",
+            "recovery",
+        )
+        proof, authority = signed_boundary_evidence(
+            assessment=self.assessment,
+            installed=installed,
+            claims=[boundary_claim(scope, "passed") for scope in readiness_scopes],
+            allowed_scopes=list(readiness_scopes),
+        )
+
+        report = self.review(
+            catalog=catalog,
+            keyring=keyring,
+            installed_evidence=installed,
+            boundary_evidence=proof,
+            authority_keyring=authority,
+        )
+
+        self.assertEqual("current", report["status"])
+        for scope in readiness_scopes:
+            with self.subTest(scope=scope):
+                self.assertTrue(report["proof_scope"][scope]["checked"])
+                self.assertTrue(report["proof_scope"][scope]["valid"])
+        self.assertTrue(report["proof_scope"]["reference_readiness"]["valid"])
+
    def test_external_provider_claim_requires_explicit_matching_subject(self) -> None:
        catalog, keyring = signed_catalog(self.assessment)
        installed = matching_installed_evidence(self.assessment)