[DuqueOM]

What and why

R16-2: docs/COMPLIANCE_MAPPING.md, the NIST CSF 2.0 self-assessment, had gone stale in seven places while nothing checked it, and every one of them understated the controls. It said:

• Bandit ran in no workflow;
• Trivy could not fail a build;
• branch protection required two of four jobs;
• C7 was red at a commit count two months old;
• and it quoted sizes for the audit trail and the ADR index that the repository had outgrown.

The rows are re-verified against the tree. GV.OV, GV.SC, ID.RA, ID.IM, PR.AA, PR.PS, DE.CM, RS.MA and RC.RP are rewritten. The verdicts hold at 3 Satisfied, 14 Partial and 5 Not satisfied. The stale notice is removed, because nothing it listed is still true.

scripts/check_compliance_mapping.py is quality gate C3, the gate the gate table had reserved since Phase 1. It:

• derives every figure the mapping rests on into a generated block (--write);
• holds the prose's counts to that block;
• refuses a measurement it can't re-derive — a Checkov count, C7's commit count, the audit trail's length — unless its paragraph carries the date it was measured, in the mapping, SECURITY.md and docs/ADOPTION.md;
• checks every sentence about whether a scanner blocks against SECURITY.md's Blocking column;
• requires one row and one verdict for each of CSF 2.0's 22 Categories, with a summary that agrees;
• resolves every file::symbol citation.

It runs in CI's fast gates, make verify, make sync and pre-commit.

The Checkov count was wrong in three documents and undated in all of them. SECURITY.md said it "currently finds 114". CI's Checkov reported 104 on 2026-10-09. Of the 91 Kubernetes findings, 58 are scan-scope artifacts, and most of the real ones are in the local stack's manifests, not the cloud Terraform.

A new test asserts every implemented quality gate runs in a workflow. Nothing asserted that before: removing a gate's step from CI while leaving it in the Makefile went unnoticed.

Class

• AUTO: a new gate and corrected documents. No threshold is lowered. Gate C3 goes from ⏳ PENDING to implemented.

Evidence

$ make -i verify          # this commit before its last rebase onto main; no ignored failures
  ok   L1/L2 libs/            94.55% combined (floor 90)
  ok   P12   scripts/         88.25% combined (floor 86)
  ok   P17   projects/        97.40% combined (floor 97)
  ok   P17   orchestration/  100.00% combined (floor 100)
EXIT=0

$ uv run python scripts/check_compliance_mapping.py     # on 2031095, rebased onto main
[compliance] OK — 22 Categories assessed, 17 figures derived and current

$ uv run python scripts/mutation_harness.py R16-2a R16-2b R16-2c R16-2d R16-2e R16-2f R16-2g R16-2h R16-2i R16-2j R16-2k
[mutation] 11/11 expected kills

$ checkov -d platform/ --framework terraform,kubernetes --compact --quiet      # 3.3.10, 2026-10-09
terraform 14 failed, kubernetes 91 failed      # CI's 3.3.22 at 331a495: 13 and 91

Layer this evidence reaches:

• L1 — contract: the full suite passes (make verify)
• L2 — component: Checkov run over platform/ for the dated figures
• L3 — cluster
• L4 — cloud

Derived documents

The mapping's derived-figures block is generated by check_compliance_mapping.py --write. Inventory, status and README checks pass.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 98.85496% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
scripts/check_compliance_mapping.py	98.8%	0 Missing and 3 partials ⚠️

📢 Thoughts on this report? Let us know!