120 lines
4.0 KiB
Python
120 lines
4.0 KiB
Python
#!/usr/bin/env python3
|
|
"""CASAN unified governance evidence report (Plan-09 tie-in, harness-owned).
|
|
|
|
Aggregates the harness governance controls into ONE certified-run artifact so a
|
|
reviewer can verify the whole posture from a single file instead of scattered
|
|
outputs. Deterministic and offline — it composes existing harness cores:
|
|
|
|
- Traceability : traceability-matrix.py (REQ→code→test, incl. symbol/line)
|
|
- Control Plane : control-plane-settings.py verify-audit (audit hash-chain)
|
|
- RBAC : rbac-check.py list-roles (policy present)
|
|
- RAI/Data Gov : rai-guard.py presence + optional model-cards
|
|
- Self-improve : self-improve.py presence
|
|
|
|
A run is CERTIFIED only when: traceability has 0 failing FRs AND the control-plane
|
|
audit chain is intact. `--gate` exits non-zero when not certified (no false
|
|
certification).
|
|
"""
|
|
import argparse
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
|
|
|
|
def here() -> str:
|
|
return os.path.dirname(os.path.abspath(__file__))
|
|
|
|
|
|
def run(cmd):
|
|
return subprocess.run(cmd, capture_output=True, text=True)
|
|
|
|
|
|
def traceability_summary(out_dir):
|
|
script = os.path.join(here(), "traceability-matrix.py")
|
|
out = os.path.join(out_dir, "traceability-matrix.json")
|
|
res = run([sys.executable, script, "--out", out, "--gate"])
|
|
summary = {"available": os.path.isfile(out), "gate_pass": res.returncode == 0}
|
|
if summary["available"]:
|
|
try:
|
|
data = json.load(open(out, encoding="utf-8"))
|
|
summary.update(data.get("summary", {}))
|
|
except ValueError:
|
|
pass
|
|
return summary
|
|
|
|
|
|
def audit_integrity():
|
|
script = os.path.join(here(), "control-plane-settings.py")
|
|
res = run([sys.executable, script, "verify-audit"])
|
|
return {"ok": res.returncode == 0, "detail": (res.stdout or res.stderr).strip()}
|
|
|
|
|
|
def rbac_present():
|
|
script = os.path.join(here(), "rbac-check.py")
|
|
res = run([sys.executable, script, "list-roles"])
|
|
return {"available": res.returncode == 0, "roles": len([l for l in res.stdout.splitlines() if l.strip()])}
|
|
|
|
|
|
def control_present(name):
|
|
return os.path.isfile(os.path.join(here(), name))
|
|
|
|
|
|
def build_report(out_dir):
|
|
trace = traceability_summary(out_dir)
|
|
audit = audit_integrity()
|
|
rbac = rbac_present()
|
|
controls = {
|
|
"traceability": control_present("traceability-matrix.py"),
|
|
"control_plane_settings": control_present("control-plane-settings.py"),
|
|
"rbac": control_present("rbac-check.py"),
|
|
"rai_data_governance": control_present("rai-guard.py"),
|
|
"self_improve": control_present("self-improve.py"),
|
|
"compression": control_present("context-compress.py"),
|
|
}
|
|
certified = (
|
|
trace.get("gate_pass", False)
|
|
and int(trace.get("failed", 1)) == 0
|
|
and audit["ok"]
|
|
and all(controls.values())
|
|
)
|
|
return {
|
|
"certified": certified,
|
|
"controls_present": controls,
|
|
"traceability": trace,
|
|
"control_plane_audit": audit,
|
|
"rbac": rbac,
|
|
}
|
|
|
|
|
|
def main() -> int:
|
|
ap = argparse.ArgumentParser()
|
|
ap.add_argument("--out", default=os.path.join(
|
|
os.path.abspath(os.path.join(here(), "..", "..", "..")),
|
|
"docs/output/casan/governance-report.json",
|
|
))
|
|
ap.add_argument("--gate", action="store_true")
|
|
args = ap.parse_args()
|
|
|
|
out_dir = os.path.dirname(args.out)
|
|
os.makedirs(out_dir, exist_ok=True)
|
|
report = build_report(out_dir)
|
|
with open(args.out, "w", encoding="utf-8") as fh:
|
|
json.dump(report, fh, indent=2, ensure_ascii=False)
|
|
fh.write("\n")
|
|
|
|
badge = "CERTIFIED" if report["certified"] else "NOT_CERTIFIED"
|
|
print(
|
|
f"GOVERNANCE_REPORT badge={badge} traceability_fail={report['traceability'].get('failed')} "
|
|
f"audit_ok={report['control_plane_audit']['ok']} controls={sum(report['controls_present'].values())}/"
|
|
f"{len(report['controls_present'])} out={args.out}"
|
|
)
|
|
if args.gate and not report["certified"]:
|
|
print("GOVERNANCE_NOT_CERTIFIED", file=sys.stderr)
|
|
return 1
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|