Skip to content

Commit 4074de1

Browse files
OneFineStarstuffOneFineStarstuff
committed
docs(supervisory): deliver GIEN 231 enterprise and treaty assurance package
Preserve September 14 local test results and disclose missing operational evidence, SSP, and named formal/contract implementations. Add portable validation and scoped Terraform/Kubernetes review. Official NIST schema retained byte-for-byte, including upstream whitespace.
1 parent 76738e5 commit 4074de1

21 files changed

Lines changed: 6664 additions & 0 deletions

‎docs/reports/DAILY_GIEN_DOSSIER_2026-09-14_ENTERPRISE_DEPLOYMENT_TREATY_ASSURANCE.md‎

Lines changed: 552 additions & 0 deletions
Large diffs are not rendered by default.

‎docs/reports/artifacts/gien_2026_09_14/annex_iv_assembly_only.json‎

Lines changed: 546 additions & 0 deletions
Large diffs are not rendered by default.

‎docs/reports/artifacts/gien_2026_09_14/assessment-results.json‎

Lines changed: 300 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,300 @@
1+
{
2+
"assessment-results": {
3+
"uuid": "6d8d2b3f-e19e-5ace-91f8-93d0a68ee8dc",
4+
"metadata": {
5+
"title": "GIEN-DOSSIER-2026-231 — repository observations (draft)",
6+
"last-modified": "2026-09-14T17:04:39Z",
7+
"version": "0.1.0",
8+
"oscal-version": "1.1.2",
9+
"props": [
10+
{
11+
"name": "status",
12+
"ns": "https://example.org/gien",
13+
"value": "DRAFT-PENDING-ASSESSMENT-PLAN"
14+
},
15+
{
16+
"name": "fictional-system",
17+
"ns": "https://example.org/gien",
18+
"value": "true"
19+
}
20+
],
21+
"remarks": "Completed September 14; September 14 test timestamps retained. Schema validity is not semantic completeness or conformity."
22+
},
23+
"import-ap": {
24+
"href": "urn:uuid:ca870bca-9222-57db-b1c1-bc0baad5fb00",
25+
"remarks": "UNRESOLVED reserved identifier; no approved assessment plan supplied. Not a complete filing."
26+
},
27+
"results": [
28+
{
29+
"uuid": "1c9cc06e-6baf-5b58-bc40-080d1db4b8aa",
30+
"title": "Post-window repository assurance",
31+
"description": "19/19 fixture/model suite steps passed September 14; no operational evidence for September 13 supplied.",
32+
"start": "2026-09-14T03:54:14Z",
33+
"end": "2026-09-14T03:54:51Z",
34+
"props": [
35+
{
36+
"name": "test-source-commit",
37+
"ns": "https://example.org/gien",
38+
"value": "76738e53d48566c1c3de2b87f8b2d9a0961a0ada"
39+
}
40+
],
41+
"reviewed-controls": {
42+
"control-selections": [
43+
{
44+
"include-controls": [
45+
{
46+
"control-id": "con-04"
47+
},
48+
{
49+
"control-id": "con-07"
50+
},
51+
{
52+
"control-id": "cry-02"
53+
},
54+
{
55+
"control-id": "cry-05"
56+
},
57+
{
58+
"control-id": "env-01"
59+
},
60+
{
61+
"control-id": "env-02"
62+
},
63+
{
64+
"control-id": "rte-01"
65+
}
66+
]
67+
}
68+
]
69+
},
70+
"observations": [
71+
{
72+
"uuid": "d2ef7e76-fc38-5a05-9c9c-b9b3e8dd5c60",
73+
"title": "con-04",
74+
"description": "TLA+ KillSwitchAbstract reachability / dead-man's switch. Local repository evidence, not production or legal conformity.",
75+
"props": [
76+
{
77+
"name": "control-id",
78+
"ns": "https://example.org/gien",
79+
"value": "con-04"
80+
},
81+
{
82+
"name": "result",
83+
"ns": "https://example.org/gien",
84+
"value": "PASS-LOCAL-CHECK"
85+
}
86+
],
87+
"methods": [
88+
"TEST"
89+
],
90+
"collected": "2026-09-14T03:54:42Z",
91+
"relevant-evidence": [
92+
{
93+
"href": "evidence_freshness_ledger.json",
94+
"description": "Original collection timestamps and evidence classification."
95+
},
96+
{
97+
"href": "assurance.log",
98+
"description": "September 14 canonical suite output."
99+
}
100+
],
101+
"remarks": "Command: java -cp governance_artifacts/tla/tools/tla2tools.jar tlc2.TLC -config governance_artifacts/tla/KillSwitchAbstract.cfg governance_artifacts/tla/KillSwitchAbstract.tla"
102+
},
103+
{
104+
"uuid": "cda25cfe-fb57-5403-810e-81b1276e05f2",
105+
"title": "con-07",
106+
"description": "TLA+ KillSwitchAbstract one-way ratchet (ASA cannot de-escalate). Local repository evidence, not production or legal conformity.",
107+
"props": [
108+
{
109+
"name": "control-id",
110+
"ns": "https://example.org/gien",
111+
"value": "con-07"
112+
},
113+
{
114+
"name": "result",
115+
"ns": "https://example.org/gien",
116+
"value": "PASS-LOCAL-CHECK"
117+
}
118+
],
119+
"methods": [
120+
"TEST"
121+
],
122+
"collected": "2026-09-14T03:54:43Z",
123+
"relevant-evidence": [
124+
{
125+
"href": "evidence_freshness_ledger.json",
126+
"description": "Original collection timestamps and evidence classification."
127+
},
128+
{
129+
"href": "assurance.log",
130+
"description": "September 14 canonical suite output."
131+
}
132+
],
133+
"remarks": "Command: java -cp governance_artifacts/tla/tools/tla2tools.jar tlc2.TLC -config governance_artifacts/tla/KillSwitchAbstract.cfg governance_artifacts/tla/KillSwitchAbstract.tla"
134+
},
135+
{
136+
"uuid": "1e826ac9-35cd-540f-9958-978ff116ae35",
137+
"title": "cry-02",
138+
"description": "PQC WORM audit log (ML-DSA-65 sign + hash chain + tamper detect). Local repository evidence, not production or legal conformity.",
139+
"props": [
140+
{
141+
"name": "control-id",
142+
"ns": "https://example.org/gien",
143+
"value": "cry-02"
144+
},
145+
{
146+
"name": "result",
147+
"ns": "https://example.org/gien",
148+
"value": "PASS-LOCAL-CHECK"
149+
}
150+
],
151+
"methods": [
152+
"TEST"
153+
],
154+
"collected": "2026-09-14T03:54:45Z",
155+
"relevant-evidence": [
156+
{
157+
"href": "evidence_freshness_ledger.json",
158+
"description": "Original collection timestamps and evidence classification."
159+
},
160+
{
161+
"href": "assurance.log",
162+
"description": "September 14 canonical suite output."
163+
}
164+
],
165+
"remarks": "Command: python3 -m pytest governance_artifacts/kafka/test_pqc_worm_logger_v2.py -q"
166+
},
167+
{
168+
"uuid": "88a39fe7-32c8-5500-8cbd-497194a48235",
169+
"title": "cry-05",
170+
"description": "SRC-1 Groth16 systemic-risk concentration bound proof. Local repository evidence, not production or legal conformity.",
171+
"props": [
172+
{
173+
"name": "control-id",
174+
"ns": "https://example.org/gien",
175+
"value": "cry-05"
176+
},
177+
{
178+
"name": "result",
179+
"ns": "https://example.org/gien",
180+
"value": "PASS-LOCAL-CHECK"
181+
}
182+
],
183+
"methods": [
184+
"TEST"
185+
],
186+
"collected": "2026-09-14T03:54:48Z",
187+
"relevant-evidence": [
188+
{
189+
"href": "evidence_freshness_ledger.json",
190+
"description": "Original collection timestamps and evidence classification."
191+
},
192+
{
193+
"href": "assurance.log",
194+
"description": "September 14 canonical suite output."
195+
}
196+
],
197+
"remarks": "Command: bash governance_artifacts/zk/run_src1_proof.sh"
198+
},
199+
{
200+
"uuid": "1cf90da8-b53b-5c3b-9629-186af5d1a143",
201+
"title": "env-01",
202+
"description": "TLA+ AdmissionWithAttestation (no T0 run without valid attestation). Local repository evidence, not production or legal conformity.",
203+
"props": [
204+
{
205+
"name": "control-id",
206+
"ns": "https://example.org/gien",
207+
"value": "env-01"
208+
},
209+
{
210+
"name": "result",
211+
"ns": "https://example.org/gien",
212+
"value": "PASS-LOCAL-CHECK"
213+
}
214+
],
215+
"methods": [
216+
"TEST"
217+
],
218+
"collected": "2026-09-14T03:54:49Z",
219+
"relevant-evidence": [
220+
{
221+
"href": "evidence_freshness_ledger.json",
222+
"description": "Original collection timestamps and evidence classification."
223+
},
224+
{
225+
"href": "assurance.log",
226+
"description": "September 14 canonical suite output."
227+
}
228+
],
229+
"remarks": "Command: java -cp governance_artifacts/tla/tools/tla2tools.jar tlc2.TLC -config governance_artifacts/tla/AdmissionWithAttestation.cfg governance_artifacts/tla/AdmissionWithAttestation.tla"
230+
},
231+
{
232+
"uuid": "b467ba5b-4e76-5daf-8704-40bb72b1efb2",
233+
"title": "env-02",
234+
"description": "Enclave-bound PQC key custody (hardware-dependent). Local repository evidence, not production or legal conformity.",
235+
"props": [
236+
{
237+
"name": "control-id",
238+
"ns": "https://example.org/gien",
239+
"value": "env-02"
240+
},
241+
{
242+
"name": "result",
243+
"ns": "https://example.org/gien",
244+
"value": "NOT-RUNNABLE-EVIDENCE-MISSING"
245+
}
246+
],
247+
"methods": [
248+
"EXAMINE"
249+
],
250+
"collected": "2026-09-14T03:54:51Z",
251+
"relevant-evidence": [
252+
{
253+
"href": "evidence_freshness_ledger.json",
254+
"description": "Original collection timestamps and evidence classification."
255+
},
256+
{
257+
"href": "assurance.log",
258+
"description": "September 14 canonical suite output."
259+
}
260+
],
261+
"remarks": "Examination of missing hardware evidence; timestamp does not represent a hardware measurement."
262+
},
263+
{
264+
"uuid": "4ccde138-feb4-5c71-81c7-6f5080c00179",
265+
"title": "rte-01",
266+
"description": "SARA/ACR MoE routing stabilization invariants. Local repository evidence, not production or legal conformity.",
267+
"props": [
268+
{
269+
"name": "control-id",
270+
"ns": "https://example.org/gien",
271+
"value": "rte-01"
272+
},
273+
{
274+
"name": "result",
275+
"ns": "https://example.org/gien",
276+
"value": "PASS-LOCAL-CHECK"
277+
}
278+
],
279+
"methods": [
280+
"TEST"
281+
],
282+
"collected": "2026-09-14T03:54:50Z",
283+
"relevant-evidence": [
284+
{
285+
"href": "evidence_freshness_ledger.json",
286+
"description": "Original collection timestamps and evidence classification."
287+
},
288+
{
289+
"href": "assurance.log",
290+
"description": "September 14 canonical suite output."
291+
}
292+
],
293+
"remarks": "Command: python3 -m pytest governance_artifacts/routing/test_sara_acr_router.py -q"
294+
}
295+
],
296+
"remarks": "No institutional findings, approval, risk acceptance or production attestation is invented."
297+
}
298+
]
299+
}
300+
}

‎docs/reports/artifacts/gien_2026_09_14/assurance.log‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
==============================================================
2+
Sentinel v2.4 — Runnable Assurance Suite
3+
==============================================================
4+
[1/19] OPA policy tests (release gate + credit + attestation/PCR_MATCH)
5+
PASS PASS: 21/21
6+
[2/19] TLA+ TLC model check (KillSwitchAbstract — con-04/con-07)
7+
PASS containment ratchet invariants hold (13 distinct states)
8+
[3/19] TLA+ TLC model check (AdmissionWithAttestation — env-01)
9+
PASS no T0 workload runs without valid attestation (64 distinct states)
10+
[4/19] TLA+ TLC model check (SentinelContainmentProtocol — dead-man's switch)
11+
PASS TrippedStaysTripped + KillSwitchIntegrity hold (75 distinct states)
12+
[5/19] GC-IR cross-target conformance (Rego <=> circuit <=> expectation)
13+
PASS PASS: Rego, circuit, and declared expectations agree on all fixtures
14+
[6/19] SRC-1 Groth16 proof flow (cry-05 concentration bound)
15+
PASS compliant proof verified; violation fixture rejected (soundness)
16+
[7/19] zk-SNARK relayer pipeline (Solidity Groth16 verifier + calldata)
17+
PASS OK Groth16Verifier compiles (bytecode 1663 bytes)
18+
[8/19] SARA/ACR MoE routing stabilization (rte-01)
19+
PASS STABILIZED (SARA+ACR) : entropy=0.995 load_ratio=1.250 drop=0.0000 loads=[640, 640, 456, 474, 454, 469, 497, 466]
20+
[9/19] PQC WORM audit log (ML-DSA-65 / CRYSTALS-Dilithium — cry-02)
21+
PASS ML-DSA-65 signatures + hash chain verify; tampering detected
22+
[10/19] Solidity compile + OmegaActual hardening logic (SEC-01..06)
23+
PASS both contracts compile (0 warnings); 7 passed contract-logic tests
24+
[11/19] Governance artifact schema validation
25+
PASS Governance artifacts validation: PASS
26+
[12/19] OSCAL catalog conformance (prop/href cross-reference integrity)
27+
PASS OSCAL conformance: 43 passed, 0 failed across 2 catalog(s)
28+
[13/19] Annex IV dossier auto-assembly (8 sections from conformant catalog)
29+
PASS Annex IV dossier assembles: 8 sections, catalog conformance 0 failures
30+
[14/19] DORA ICT-risk register auto-assembly (5 pillars; gaps reported)
31+
PASS DORA register assembles: 5 pillars (P4/P5 coverage gaps reported), 0 conformance failures
32+
[15/19] NIST AI RMF profile crosswalk auto-assembly (GOVERN/MAP/MEASURE/MANAGE)
33+
PASS NIST AI RMF crosswalk assembles: 4 functions, 0 conformance failures
34+
[16/19] Distribution bundle packaging (SHA-256 manifest; refuses non-conformant)
35+
PASS distribution bundle assembles: 6 artifacts, provenance + reproducible content digest recompute, all catalogs conformant
36+
[17/19] Recipient-side bundle verification (independent verifier + ML-DSA-65 signature)
37+
PASS received bundle VERIFIED by independent verifier: 10/10 checks incl. ML-DSA-65 manifest signature
38+
[18/19] Evidence freshness-SLA gate (catalog SLAs enforced against digest-protected ledger)
39+
PASS freshness audit: PASS (6 runnable, 6 fresh, 1 organisational disclosed)
40+
[19/19] Multi-jurisdiction override consistency + Sentinel Governance Index v6.0
41+
PASS MultiJurisdictionOverrideConsistency holds (2523 distinct states); SGI v6.0 index truthful (24 artifacts, 8/8 checks)
42+
==============================================================
43+
ALL RUNNABLE ASSURANCE CHECKS PASSED
44+
==============================================================

0 commit comments

Comments
 (0)