OneFineStarstuff.github.io

816e1209 - feat(oscal): OSCAL-native Annex IV dossier generator (13th assurance check)

feat(oscal): OSCAL-native Annex IV dossier generator (13th assurance check) Turns the now-verified OSCAL catalogs + live assurance evidence into an auto-assembled EU AI Act Annex IV technical-documentation dossier — the regulator deliverable the compliance-as-code stack was built to produce. New artifacts: - governance_artifacts/oscal/annex_iv_section_map.yaml: auditable bridge mapping each Annex IV section (A-H) to the OSCAL control ids that evidence it, plus a provider narrative. Control ids must exist in a catalog (no dangling refs). - governance_artifacts/oscal/generate_annex_iv_dossier.py: assembles an OSCAL-flavoured JSON dossier + human-readable Markdown. For each section it resolves controls, pulls statement/tier/SLA/regime-citation/evidence-query, and attaches LIVE evidence by running each control's backing assurance check (TLA+ TLC, PQC WORM pytest, zk proof, routing simulator). Honesty model: * SATISFIED only when a mapped control's runnable check passed in this run; * PARTIAL when runnable-backed but not green this run; * PENDING-EVIDENCE for organisational/hardware-dependent evidence (e.g. env-02 enclave key custody, reported truthfully as n/a organisational). Refuses to assemble on a non-conformant catalog or an unknown control id. Embeds an integrity statement: assembly-integrity artifact, NOT a conformity assessment; does not assert the institution is compliant. Result on repo: 8/8 sections SATISFIED, catalog conformance 0 failures. - governance_artifacts/oscal/generated/annex_iv_dossier.{json,md}: sample output. - governance_artifacts/oscal/README.md: documents the OSCAL tooling + honesty model. Wired in: - run_runnable_assurance.sh: renumbered to 13 steps; step 13 verifies the dossier assembles end-to-end (8 sections A-H, 0 conformance failures). Suite 13/13 PASS. - tests/governance/test_governance_artifacts.py: +3 tests — all section-map controls resolve; live-evidence assembly (SATISFIED implies a green check; integrity statement disclaims conformity); --no-verify never fabricates SATISFIED. Governance pytest 15/15. - CI: unit-test job runs '-k "oscal or annex"'; new steps assemble the dossier with live evidence and upload it as a build artifact (annex-iv-dossier). - Docs synced to 13/13: RUNNABLE_ASSURANCE.md (new row 13 + count), DECADAL plan (ledger + counts), pilot P6-REPRO + README. Tier A (assembly integrity). Regression: assurance 13/13 PASS; pilot 6/6 automated; governance pytest 15/15.