feat: implement institutional governance and recovery architecture

tools/assessments/govoplan_assessment/evidence.py

@@ -57,11 +57,21 @@ SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
 POSITIVE_RESULTS = {
     "target_environment": "passed",
     "external_providers": "passed",
+    "accessibility": "passed",
+    "privacy": "passed",
+    "security": "passed",
+    "operations": "passed",
+    "recovery": "passed",
     "production_approval": "approved",
 }
 NEGATIVE_RESULTS = {
     "target_environment": "failed",
     "external_providers": "failed",
+    "accessibility": "failed",
+    "privacy": "failed",
+    "security": "failed",
+    "operations": "failed",
+    "recovery": "failed",
     "production_approval": "rejected",
 }
 PROOF_REQUIREMENTS = {
@@ -75,12 +85,45 @@ PROOF_REQUIREMENTS = {
         "An independently trusted authority key permitted for external_providers proof.",
         "Opaque control IDs and content hashes; credentials and endpoint identifiers stay outside the report.",
     ),
+    "accessibility": (
+        "Accessibility conformance results for the assessed journeys, viewports, keyboard paths, and assistive-technology profile.",
+        "An independently trusted authority key permitted for accessibility proof.",
+        "Opaque control IDs and content hashes for the sanitized conformance artifacts.",
+    ),
+    "privacy": (
+        "Privacy and data-protection controls evaluated against the exact assessed composition and target profile.",
+        "An independently trusted authority key permitted for privacy proof.",
+        "Opaque control IDs and content hashes for the sanitized review artifacts.",
+    ),
+    "security": (
+        "Security controls, scans, and bounded verification results for the exact release and target profile.",
+        "An independently trusted authority key permitted for security proof.",
+        "Opaque control IDs and content hashes for sanitized findings and attestations.",
+    ),
+    "operations": (
+        "Operator procedures, health checks, monitoring, alerting, and failure-response exercises for the target profile.",
+        "An independently trusted authority key permitted for operations proof.",
+        "Opaque control IDs and content hashes for sanitized run evidence.",
+    ),
+    "recovery": (
+        "A completed backup, restore, rollback, and reconciliation drill bound to the exact release and target profile.",
+        "An independently trusted authority key permitted for recovery proof.",
+        "Opaque control IDs and content hashes for drill outcomes and recovery-point/time observations.",
+    ),
     "production_approval": (
         "An explicit approval bound to this assessment release and installed evidence whose release origin is independently anchored.",
         "An independently provisioned authority key permitted for production_approval.",
         "An unexpired signed proof bundle; an assessment or operator cannot approve itself.",
     ),
 }
+REFERENCE_READINESS_SCOPES = (
+    "target_environment",
+    "accessibility",
+    "privacy",
+    "security",
+    "operations",
+    "recovery",
+)
 
 
 @dataclass(frozen=True, slots=True)
@@ -1427,6 +1470,11 @@ def review_boundary_evidence(
     expected_subjects = {
         "target_environment": deployment_subject,
         "external_providers": provider_subject,
+        "accessibility": deployment_subject,
+        "privacy": deployment_subject,
+        "security": deployment_subject,
+        "operations": deployment_subject,
+        "recovery": deployment_subject,
         "production_approval": deployment_subject,
     }
     scopes = _unchecked_boundary_scope(expected_subjects=expected_subjects)