Docs(claims): Pre-v0.11.0 claim-accuracy sweep — first-mover registry, parity 93.4%, machine-gated counts

CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- **Claim-accuracy sweep across the public docs** (pre-v0.11.0; every change
+  traced to the 2026-07-15 primary-source verification pass): CLI↔GUI parity
+  claims recomputed from the manifest (98% → **93.4%**, 99 full / 7 api-only /
+  0 cli-only — README badge, `parity-coverage.md` regenerated, positioning,
+  enterprise-grade, ROADMAP); count drift fixed to the machine-gated truths
+  (96 catalogs / 16 crosswalks / 14 collectors / 13 MCP tools / 4,900+ tests);
+  the FedRAMP first-mover registry row updated to the shipped `conmon ksi`
+  verb + CR26 SDR schema framing with explicit caveats, and two new
+  first-mover rows registered (M-25-21 practice/waiver-clock tracking,
+  M-25-22 acquisition lifecycle); the CISA SbD Pledge described as an
+  alignment self-attestation everywhere (never a signatory claim; formal
+  signing planned at v1.0); OSCAL-MCP landscape statements aligned to "one
+  of several" (CISO Assistant `ca_mcp` + trestle-mcp exist); the stale
+  "Sept 30 2026 FedRAMP mandate" framing replaced with CR26 FRC-CSO-JSN
+  (mandatory 2027-01-01) + NTC-0009 (2027-11-01, Class D High,
+  format-agnostic — never an "OSCAL mandate"); the unverifiable "18 months
+  ahead" claim removed; GovReady-Q described as dormant, not defunct;
+  OpenVEX / VSA rows moved to planned-tense with no version commitment; the
+  federal-SI walk-through refreshed (M-25-21 primary lens consistently,
+  M-26-05 rescission of the M-22-18 self-attestation form, the v0.11
+  federal-wave surfaces added, resolved limitations pruned).
+
 ### Added
 
 - **OMB M-25-22 AI acquisition-lifecycle tracking — `evidentia ai-gov

README.md

@@ -23,7 +23,7 @@
   <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg" alt="Code of Conduct"></a>
   <a href="https://www.bestpractices.dev/projects/12724"><img src="https://www.bestpractices.dev/projects/12724/badge" alt="OpenSSF Best Practices"></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/Polycentric-Labs/evidentia"><img src="https://api.scorecard.dev/projects/github.com/Polycentric-Labs/evidentia/badge" alt="OpenSSF Scorecard"></a>
-  <a href="docs/parity-coverage.md"><img src="https://img.shields.io/badge/CLI%E2%86%94GUI%20parity-98%25-brightgreen.svg" alt="CLI↔GUI parity"></a>
+  <a href="docs/parity-coverage.md"><img src="https://img.shields.io/badge/CLI%E2%86%94GUI%20parity-93%25-brightgreen.svg" alt="CLI↔GUI parity"></a>
 </p>
 
 </div>
@@ -88,8 +88,9 @@ See it first, no install — a self-hosted [asciinema](https://asciinema.org/) r
 
 ## Features
 
-- **OSCAL-native end-to-end** — Ingest NIST OSCAL catalogs (Catalog 1.2.1); emit OSCAL Assessment Results + Plan-of-Action-and-Milestones (POA&M). Ready for FedRAMP 20x machine-readable submissions.
-- **Cryptographic evidence chain** — Sigstore keyless signing on Assessment Results; PEP 740 attestations on every published wheel; SLSA Provenance v1 on the container; CycloneDX 1.6 SBOM on every GitHub Release.
+- **OSCAL-native end-to-end** — Ingest NIST OSCAL catalogs (Catalog 1.2.1); emit OSCAL Assessment Results + Plan-of-Action-and-Milestones (POA&M) on the established FedRAMP Rev 5 package rail.
+- **FedRAMP CR26 machine-readable SDR emission** — `evidentia conmon ksi` emits the CR26 Security Decision Record `keySecurityIndicators` block (10 families / 46 KSIs) conformant to FedRAMP's official 2026-06-24 schemas (vendored at pinned upstream SHAs, drift-watched weekly) — the first production-grade open-source emitter of the CR26 SDR format.
+- **Cryptographic evidence chain** — Sigstore keyless signing on Assessment Results; PEP 740 attestations on every published wheel; SLSA Provenance v1 on the container; CycloneDX 1.7 SBOM on every GitHub Release.
 - **96 framework catalogs + 16 crosswalks** — NIST 800-53 Rev 5 (full 1,196 controls + Low/Moderate/High/Privacy baselines), CSF 2.0, FedRAMP (Rev 5 baselines + CR26 Key Security Indicators), CMMC 2.0 L1/L2, OpenSSF OSPS Baseline (Maturity 1/2/3 + first public OSCAL serialization), ISO 27001:2022, EU AI Act, DORA, NIS2, GDPR, all 15 US state privacy laws, full FFIEC IT Examination Handbook, OCC Bulletin 2026-13a / FRB SR 26-02. Plus 16 inter-framework crosswalks.
 - **14 evidence collectors** — AWS, GitHub (including v0.10.6 OSPS conformance helpers), Postgres, MySQL, Oracle, SQLite, MS-SQL, Snowflake, Databricks, Okta, Vanta, Drata, BitSight, SecurityScorecard. All OCSF-aligned with `compliance_status` field.
 - **OCSF-aligned findings** — OCSF Compliance Finding (class_uid 2003) via `--format ocsf`; OCSF Detection Finding (class_uid 2004) via `--format ocsf-detection`. SARIF 2.1.0 for CI gates via `--format sarif`. CycloneDX 1.6 VEX via `--format cyclonedx-vex`.
@@ -106,7 +107,7 @@ See it first, no install — a self-hosted [asciinema](https://asciinema.org/) r
 | Evidence collectors | 14 |
 | MCP tools | 13 |
 | OSCAL serializations | 1 (OpenSSF OSPS Baseline; more on the v0.11+ roadmap) |
-| Test suite | 4,000+ tests; mypy strict; ruff clean |
+| Test suite | 4,900+ tests; mypy strict; ruff clean |
 
 ## Documentation
 

docs/ROADMAP.md

@@ -85,8 +85,9 @@ leads with the CLI.
   Evidentia hosts no state. Best fit for a CLI / library-shaped tool.
 - **Local writable GUI demo (pending a store-seeder):** a one-command
   `docker compose -f docker-compose.demo.yml up` with a seeded store + mock collectors.
-  The web console now surfaces ~98% of coverable CLI leaves; this is gated only on a
-  store-seeder.
+  The web console now surfaces 93.4% of coverable CLI leaves (the 7 api-only leaves are
+  the v0.11 federal AI-governance verbs plus two chrome-surfaced utilities); this is
+  gated only on a store-seeder.
 - **Not planned:** a public, hosted, *stateful* backend demo. A credentialed GRC backend
   exposed publicly is a real security surface (SSRF / secret exfiltration / prompt-injection
   via collected evidence — the class the `--block-private-ips` hardening addresses). A durable

docs/api-stability.md

@@ -456,7 +456,7 @@ The release pipeline validates API stability via:
 
 1. **Type checking** (mypy strict): catches signature changes
    that would break callers
-2. **Test suite** (2747+ tests): exercises public interfaces
+2. **Test suite** (4,900+ tests): exercises public interfaces
    against expected behavior
 3. **Import smoke test**: `scripts/check_imports.py` (reserved
    for v1.0) will validate that all documented entry points

docs/cli-gui-parity.yaml

@@ -36,6 +36,13 @@
 # GUI coverage = full / (full + api-only + cli-only) = 13 / 98 = 13.3%.
 # (The "~30% GUI reaches the CLI" figure was API breadth: 55/98 leaves have an
 #  API; 13 are now surfaced as a dedicated GUI screen.)
+#
+# Current distribution (2026-07-16, post-v0.11 Wave 2): 99 full / 7 api-only /
+# 0 cli-only / 11 exempt (117 leaves) = 93.4% GUI coverage. The 7 api-only rows
+# are the five v0.11 federal AI-governance verbs (`ai-gov set-practice` +
+# `ai-gov acquisition *`) pending their console pass, plus the two
+# chrome/index-surfaced utilities (`version`, `init`). Rendered view:
+# docs/parity-coverage.md (generated by check_parity.py --emit-coverage-md).
 version: 1
 
 # Debt-ratchet floor: the count of `cli-only` rows at seed time. check_parity.py

docs/enterprise-grade.md

@@ -47,7 +47,8 @@ posture has advanced materially across the v0.8.x–v0.10.x line:
   cross-platform Hypothesis property tests (v0.10.12) harden the
   untrusted-input parsers and credit the OpenSSF Scorecard "Fuzzing"
   check (advances **M1**'s intent via coverage-guided fuzzing; classic
-  mutation testing remains unscheduled).
+  mutation testing runs weekly out-of-band via `mutmut.yml` without an
+  enforced kill-rate gate).
 - **WORM evidence store + retention / legal-hold** (v0.9.6) provide
   first-class anti-tamper evidence lineage at the product layer, advancing
   **H8** and **H13** beyond operator-only responsibility.
@@ -60,11 +61,13 @@ posture has advanced materially across the v0.8.x–v0.10.x line:
   rescinded M-24-10), and a signed Control↔Threat traceability **OSCAL
   profile** (v0.10.11 — partially addresses **L4**'s "not OSCAL Profile
   format" note).
-- **CLI↔GUI parity** — the local web console reaches ~98% parity across
-  22 consoles (v0.10.12), with a documented web-console security model and
+- **CLI↔GUI parity** — the local web console reaches 93.4% parity across
+  22 consoles (99 of 106 coverable CLI leaves; the 7 api-only leaves are
+  the v0.11 federal AI-governance verbs plus two chrome-surfaced
+  utilities), with a documented web-console security model and
   a default-on SSRF / anti-DNS-rebind network guard across collectors,
   integrations, and the Tableau publish path.
-- **95 bundled framework catalogs** across four redistribution tiers
+- **96 bundled framework catalogs** across four redistribution tiers
   (updates **L4**'s "82 frameworks" count).
 - **Release + CI hardening (v0.10.13–v0.10.17)** — a distroless
   **Docker Hardened Images** runtime base (v0.10.16), **air-gapped DSSE /
@@ -128,9 +131,9 @@ evidence lineage).
 
 | # | Item | v0.7.0 status |
 |---|---|---|
-| M1 | Mutation testing ≥ 65% | ❌ Not currently run in CI; planned for v0.8 |
+| M1 | Mutation testing ≥ 65% | ❌ Not run in CI at v0.7.0. *Later: weekly out-of-band mutmut CI runs since v0.8.2 (`mutmut.yml`: Sundays 03:00 UTC + dispatch); the ≥65% kill-rate gate is not yet enforced.* |
 | M2 | Air-gapped deployment mode | ✅ `--offline` flag refuses network egress; GPG signing works offline |
-| M3 | Multi-cloud + SaaS support | ⚠️ AWS + GitHub in v0.7.0; Okta, Azure, GCP planned |
+| M3 | Multi-cloud + SaaS support | ⚠️ AWS + GitHub at v0.7.0. *Later: grown to 14 collectors (adds Okta, 5 SQL adapters, Databricks, Snowflake, Vanta, Drata, BitSight, SecurityScorecard); Azure, GCP remain roadmap.* |
 | M4 | Performance benchmarks | ⚠️ Not documented; ad-hoc testing on 10k-resource sample |
 | M5 | Dry-run mode | ✅ `dry_run=True` kwarg on all collectors; `--dry-run` CLI flag |
 | M6 | Custom OSCAL finding fields | ✅ `back-matter.resources[].props[]` with Evidentia-namespaced prop extensions |

docs/gemara-mapping.md

@@ -52,7 +52,7 @@ Adopters (as of 2026-05-23):
 
 | Gemara component | Evidentia surface | Notes |
 |---|---|---|
-| **Catalog: Control** | `evidentia_core.models.catalog.ControlCatalog` (95 bundled — NIST 800-53, SOC 2, ISO 27001 stub, CIS, CMMC, PCI DSS, EU GDPR, EU AI Act, …) | Tier-classified (A/B/C/D — see `ATTRIBUTION.md`); JSON or YAML format (v0.10.3+ via `docs/contributing-a-catalog.md`). 1:1 conceptual match. |
+| **Catalog: Control** | `evidentia_core.models.catalog.ControlCatalog` (96 bundled — NIST 800-53, SOC 2, ISO 27001 stub, CIS, CMMC, PCI DSS, EU GDPR, EU AI Act, …) | Tier-classified (A/B/C/D — see `ATTRIBUTION.md`); JSON or YAML format (v0.10.3+ via `docs/contributing-a-catalog.md`). 1:1 conceptual match. |
 | **Catalog: Capability** | partial — `Control.implementation_status` enum (`implemented` / `partial` / `planned` / `missing`) | Evidentia tracks implementation state per control, not as a separate capability registry. Could be promoted to a first-class Capability model if Gemara conformance becomes a goal. |
 | **Catalog: Principle** | no direct equivalent | Evidentia treats principles as "tier-D obligations" inside `ObligationCatalog` (statutes, regulatory edicts). Functionally adjacent but not 1:1. |
 | **Catalog: Risk** | `evidentia_ai.risk_statements.RiskStatement` (NIST SP 800-30 Rev 1) + `evidentia_core.models.governance.AISystemClassification` (EU AI Act tiers, NIST AI RMF) | Risk catalogs in Evidentia are generated, not pre-defined — the LLM-driven `RiskStatementGenerator` produces statements from gaps + system context. Pre-defined risk catalogs are a v0.11+ candidate. |