Feat(ai-gov): OMB M-25-21 minimum-practice tracking (v0.11 Wave 2)

[allenfbyrd]

v0.11 Wave 2 item 2 — OMB M-25-21 minimum-practice tracking

Fills the per-practice extension point reserved on OMBHighImpactAssessment at v0.10.12 (the carried obligation the v0.11 plan lists as sequencing constraint 4). The seven practice headings and the waiver mechanics were re-verified against the M-25-21 memo text before modeling (§4(b) practices; §4(a)(ii) CAIO waiver — written determination, annual re-certification, 30-day OMB report, non-delegable).

What's in here

• Model: MinimumPractice (7, stable string values) + PracticeStatus (implemented / in_progress / not_started / waived) + MinimumPracticeRecord + PracticeWaiver; a validator makes WAIVED and a waiver record require each other. practices rides OMBHighImpactAssessment as a defaulted dict, so persisted v0.10.12-era assessments load unchanged.
• practice_compliance() reports recorded / missing / satisfied and never fabricates a status for an unrecorded practice (satisfied = all 7 recorded AND implemented-or-waived). waiver_certification_due() / waiver_omb_report_overdue() evaluate the memo's two waiver clocks against a caller-supplied "today" (no hidden clock reads).
• CLI ai-gov set-practice (requires an existing assessment; waiver via --waiver-* flags; prints the roll-up + a not-high-impact advisory) and API mirror POST /api/ai-gov/systems/{system_id}/set-practice (structured invalid_body 400s; returns entry + practice_compliance). New AI_SYSTEM_PRACTICE_RECORDED audit event.
• Parity: api-only with reason (the /ai-gov GUI form flip rides the next parity pass, v0.10.8 Wave-2 pattern); openapi.json + UI types regenerated; wiki CLI/API references regenerated; capability-matrix row 11 extended.

Verification

• Full suite 4886 passed / 0 failed; 28 new tests (model validators, compliance roll-up, waiver clocks, persisted-JSON string-key round-trip, CLI happy/error paths, API happy/400/404/422).
• ruff, mypy --strict-optional, consistency scope 8/8, parity, doc-counts, UI typecheck + 142 vitest — all green locally.

Note: merges after the item-1 PR (both add a CHANGELOG ## [Unreleased] block at the same anchor; this branch takes a trivial both-keep update once item 1 lands).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
evidentia	Ready	Preview, Comment	Jul 15, 2026 3:07am

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing feat/w2-m2521-practices (8026e73) with main (85ee426)}

[codecov]

Codecov Report

❌ Patch coverage is 91.35802% with 14 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/evidentia/src/evidentia/cli/ai_gov.py	78.46%	14 Missing ⚠️

📢 Thoughts on this report? Let us know!