From 322899ccfb7bd1f1f477e0466de90bb65abf7e4e Mon Sep 17 00:00:00 2001
From: Victoria824 <232846280+Victoria824@users.noreply.github.com>
Date: Mon, 17 Aug 2026 13:10:54 -0400
Subject: [PATCH 1/2] feat: add enterprise governance and signed evidence
---
.github/workflows/ci.yml | 8 +-
.github/workflows/release.yml | 3 +
.gitignore | 1 +
CHANGELOG.md | 19 +
CITATION.cff | 2 +-
README.md | 31 +-
app/page.tsx | 4 +-
docs/enterprise-governance.md | 140 +
docs/releases/v0.6.0.md | 27 +
eslint.config.mjs | 21 -
next-env.d.ts | 1 +
package-lock.json | 6005 +++--------------
package.json | 21 +-
pyproject.toml | 12 +-
src/queryassure/__init__.py | 12 +-
src/queryassure/cli.py | 132 +
src/queryassure/enterprise.py | 181 +
src/queryassure/evidence.py | 181 +
src/queryassure/governance.py | 325 +
src/queryassure/reporting.py | 18 +
.../resources/enterprise-policy.yml | 50 +
src/queryassure/scaffolding.py | 2 +-
tests/rendered-html.test.mjs | 2 +-
tests_py/test_core.py | 4 +-
tests_py/test_enterprise.py | 295 +
25 files changed, 2199 insertions(+), 5298 deletions(-)
create mode 100644 docs/enterprise-governance.md
create mode 100644 docs/releases/v0.6.0.md
delete mode 100644 eslint.config.mjs
create mode 100644 src/queryassure/enterprise.py
create mode 100644 src/queryassure/evidence.py
create mode 100644 src/queryassure/governance.py
create mode 100644 src/queryassure/resources/enterprise-policy.yml
create mode 100644 tests_py/test_enterprise.py
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c038362..c5a9b2a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,8 @@ jobs:
queryassure test --suite evals/retail.yml
queryassure m365-demo --output reports/microsoft365.json \
--html reports/microsoft365.html
+ queryassure enterprise-demo --output reports/enterprise-evidence.json \
+ --html reports/enterprise-governance.html
queryassure challenge
queryassure demo --output reports/demo --no-open
queryassure benchmark --report reference=reports/latest.json
@@ -44,8 +46,10 @@ jobs:
run: |
npm ci
npm audit --audit-level=high
- - name: Build playground
- run: npm run build
+ - name: Type-check and test playground
+ run: |
+ npm run lint
+ npm test
- name: Upload benchmark
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41083c5..d1a9abb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,12 +35,15 @@ jobs:
queryassure test --suite evals/retail.yml
queryassure m365-demo --output reports/microsoft365.json \
--html reports/microsoft365.html
+ queryassure enterprise-demo --output reports/enterprise-evidence.json \
+ --html reports/enterprise-governance.html
queryassure challenge
queryassure demo --output reports/demo --no-open
- name: Validate playground
run: |
npm ci
npm audit --audit-level=high
+ npm run lint
npm test
python-artifacts:
diff --git a/.gitignore b/.gitignore
index e53dd69..e50d04d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@ __pycache__/
.pytest_cache/
.ruff_cache/
*.egg-info/
+*.tsbuildinfo
node_modules/
.next/
out/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 70cd06b..3f36808 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,24 @@ All notable changes to QueryAssure are documented here. The project follows
## [Unreleased]
+## [0.6.0] - 2026-08-17
+
+### Added
+
+- deny-by-default enterprise policy engine with tenant isolation, RBAC action/resource
+ matching, deployment-environment controls, and ordered data-classification clearance
+- approval-ticket obligations for external side effects and governed break-glass access
+ with security notification, session expiry, and post-incident review requirements
+- versioned YAML enterprise policy pack and framework-neutral policy decisions with
+ request fingerprints, reasons, matched roles, obligations, and correlation-safe IDs
+- redacted HMAC-SHA256 evidence envelopes with canonical payload digests, constant-time
+ verification, age limits, malformed-input handling, atomic writes, and owner-only file
+ permissions
+- `queryassure enterprise-demo`, `queryassure policy evaluate`, and `queryassure evidence`
+ commands for zero-key demonstrations and production CI integration
+- enterprise governance operator guide and eleven regression tests for authorization,
+ tampering, stale evidence, CLI behaviour, and credential-safe artifacts
+
## [0.5.0] - 2026-07-27
### Added
@@ -106,6 +124,7 @@ All notable changes to QueryAssure are documented here. The project follows
- first public evaluation contracts, validators, benchmark tools, and Docker workflow
[0.4.1]: https://github.com/Victoria824/QueryAssure/compare/v0.4.0...v0.4.1
+[0.6.0]: https://github.com/Victoria824/QueryAssure/compare/v0.5.0...v0.6.0
[0.5.0]: https://github.com/Victoria824/QueryAssure/compare/v0.4.1...v0.5.0
[0.4.0]: https://github.com/Victoria824/QueryAssure/compare/v0.3.1...v0.4.0
[0.3.1]: https://github.com/Victoria824/QueryAssure/compare/v0.3.0...v0.3.1
diff --git a/CITATION.cff b/CITATION.cff
index a93c6d0..da800cb 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -8,7 +8,7 @@ authors:
repository-code: https://github.com/Victoria824/QueryAssure
url: https://victoria824.github.io/QueryAssure/
license: Apache-2.0
-version: 0.5.0
+version: 0.6.0
date-released: 2026-07-27
keywords:
- SQL Agent
diff --git a/README.md b/README.md
index 69320a7..fb6126c 100644
--- a/README.md
+++ b/README.md
@@ -22,9 +22,9 @@ human approvals, and audit-ready workflow evidence.
If QueryAssure helps you catch a SQL Agent regression, consider [starring the repository](https://github.com/Victoria824/QueryAssure) and sharing the failing trace. That signal helps prioritize the next adapters and validators.
-> **v0.5.0:** adds framework-neutral workflow contracts and a Microsoft Graph reference
-> agent for Outlook and Teams, including least-privilege OAuth scopes, approval-gated
-> side effects, complete audit traces, credential hygiene checks, and a zero-key demo.
+> **v0.6.0:** adds deny-by-default enterprise policy-as-code, multi-tenant isolation,
+> RBAC/resource authorization, classification clearance, approval and break-glass
+> obligations, plus tamper-evident redacted audit bundles.
## 30-second proof
@@ -54,6 +54,16 @@ This runs four Outlook/Teams contracts covering mail triage, draft creation, blo
unapproved sends, approved Teams notifications, OAuth scope minimization, and audit
completeness.
+Exercise the enterprise governance layer without an identity provider or KMS:
+
+```bash
+uvx --from git+https://github.com/Victoria824/QueryAssure queryassure enterprise-demo
+```
+
+This runs six policy decisions covering same-tenant access, cross-tenant denial,
+classification clearance, approval-gated side effects, and audited break-glass access.
+It produces a redacted, tamper-evident evidence bundle and a shareable HTML report.
+
Already have a report or an existing repository?
```bash
@@ -110,6 +120,17 @@ Question → metadata retrieval → SQL generation → policy validation
- deterministic Microsoft Graph simulator for zero-key CI
- fail-closed live Graph client for Outlook and Teams
+### Enterprise governance and evidence
+
+- deny-by-default YAML policy packs with explicit versioning
+- tenant-bound resource access and recognized-role enforcement
+- wildcard RBAC actions constrained by resource patterns
+- ordered public, internal, confidential, and restricted clearances
+- approval-ticket obligations for external or irreversible actions
+- break-glass roles with incident tickets, justification, expiry, and review obligations
+- HMAC-SHA256 evidence envelopes over redacted canonical reports
+- atomic owner-only evidence writes plus digest, signature, and age verification
+
## Quickstart
### One command
@@ -135,7 +156,7 @@ Requires Python 3.10+.
Install the verified wheel from the latest GitHub Release:
```bash
-pip install https://github.com/Victoria824/QueryAssure/releases/download/v0.5.0/queryassure-0.5.0-py3-none-any.whl
+pip install https://github.com/Victoria824/QueryAssure/releases/download/v0.6.0/queryassure-0.6.0-py3-none-any.whl
queryassure --version
```
@@ -189,7 +210,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- - uses: Victoria824/QueryAssure@v0.5.0
+ - uses: Victoria824/QueryAssure@v0.6.0
with:
suite: evals/retail.yml
```
diff --git a/app/page.tsx b/app/page.tsx
index 8f50d5c..10507e0 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -129,7 +129,7 @@ const CHECKS = [
["result_equivalence", "Matches golden result"],
];
-const ACTION_SNIPPET = `- uses: Victoria824/QueryAssure@v0.5.0
+const ACTION_SNIPPET = `- uses: Victoria824/QueryAssure@v0.6.0
with:
suite: evals/retail.yml`;
const DEMO_COMMAND =
@@ -214,7 +214,7 @@ export default function Home() {
Q
QueryAssure
- alpha
+ v0.6