fix(assessment): keep release origin unproven

tools/assessments/govoplan_assessment/capability_fit.py

@@ -363,6 +363,9 @@ def review_capability_fit(
     evidence_verification_mode = (
         "historical_override" if verification_time is not None else "current"
     )
+    catalog_dependency_trusted = not any(
+        item.severity == "blocker" for item in findings
+    )
     installed_review = review_installed_composition(
         assessment=assessment,
         catalog_entries=catalog_entries,
@@ -373,6 +376,7 @@ def review_capability_fit(
         observation_mode=installed_evidence_mode,
         verification_time=evidence_verification_time,
         verification_mode=evidence_verification_mode,
+        catalog_trusted=catalog_dependency_trusted,
     )
     findings.extend(
         Finding(item.severity, item.code, item.message, item.assessment_ids)
@@ -884,7 +888,17 @@ def build_report(
         else {
             "installed_artifacts": {"checked": False, "valid": None},
             "installed_record_integrity": {"checked": False, "valid": None},
-            "installed_source_provenance": {"checked": False, "valid": None},
+            "installed_source_provenance": {
+                "checked": False,
+                "valid": None,
+                "basis": "local-pep610-metadata",
+                "release_origin_bound": False,
+            },
+            "installed_release_origin": {
+                "checked": False,
+                "valid": None,
+                "release_origin_bound": False,
+            },
             "runtime_activation": {"checked": False, "valid": None},
         }
     )
@@ -925,7 +939,7 @@ def build_report(
         **boundary_scope,
     }
     return {
-        "report_version": "0.3.0",
+        "report_version": "0.4.0",
         "status": status,
         "assessment_id": assessment.get("assessment_id"),
         "assessment_release": assessment.get("release", {}).get("ref")
@@ -950,6 +964,9 @@ def render_review(report: dict[str, Any]) -> str:
     proof_scope = report.get("proof_scope", {})
     installed_scope = proof_scope.get("installed_artifacts", {})
     installed_checked = installed_scope.get("checked") is True
+    release_origin_checked = (
+        proof_scope.get("installed_release_origin", {}).get("checked") is True
+    )
     installed_supplied = bool(installed_scope.get("evidence_sha256")) or (
         "installed_evidence_observation" in proof_scope
     )
@@ -960,7 +977,7 @@ def render_review(report: dict[str, Any]) -> str:
         (
             "Scope: schema, signed release metadata, optional local tag provenance, "
             + (
-                "and locally observed installed-composition evidence."
+                "and locally observed installed-composition consistency evidence; release origin remains a separate proof boundary."
                 if installed_checked
                 else (
                     "and supplied installed-composition evidence that did not establish local proof."
@@ -1006,12 +1023,12 @@ def render_review(report: dict[str, Any]) -> str:
         if report.get("proof_scope", {}).get(key, {}).get("checked") is not True
     ]
     if not installed_checked:
-        unchecked_boundaries.insert(0, "installed-artifact")
-    if not installed_checked and len(unchecked_boundaries) == 4:
-        lines.append(
-            "No installed-artifact, target-provider, or production proof was performed."
+        unchecked_boundaries.insert(0, "installed-composition")
+    if not release_origin_checked:
+        unchecked_boundaries.insert(
+            1 if not installed_checked else 0, "installed-release-origin"
         )
-    elif unchecked_boundaries:
+    if unchecked_boundaries:
         lines.append("No " + ", ".join(unchecked_boundaries) + " proof was performed.")
     return "\n".join(lines) + "\n"