From 322899ccfb7bd1f1f477e0466de90bb65abf7e4e Mon Sep 17 00:00:00 2001 From: Victoria824 <232846280+Victoria824@users.noreply.github.com> Date: Mon, 17 Aug 2026 13:10:54 -0400 Subject: [PATCH 1/2] feat: add enterprise governance and signed evidence --- .github/workflows/ci.yml | 8 +- .github/workflows/release.yml | 3 + .gitignore | 1 + CHANGELOG.md | 19 + CITATION.cff | 2 +- README.md | 31 +- app/page.tsx | 4 +- docs/enterprise-governance.md | 140 + docs/releases/v0.6.0.md | 27 + eslint.config.mjs | 21 - next-env.d.ts | 1 + package-lock.json | 6005 +++-------------- package.json | 21 +- pyproject.toml | 12 +- src/queryassure/__init__.py | 12 +- src/queryassure/cli.py | 132 + src/queryassure/enterprise.py | 181 + src/queryassure/evidence.py | 181 + src/queryassure/governance.py | 325 + src/queryassure/reporting.py | 18 + .../resources/enterprise-policy.yml | 50 + src/queryassure/scaffolding.py | 2 +- tests/rendered-html.test.mjs | 2 +- tests_py/test_core.py | 4 +- tests_py/test_enterprise.py | 295 + 25 files changed, 2199 insertions(+), 5298 deletions(-) create mode 100644 docs/enterprise-governance.md create mode 100644 docs/releases/v0.6.0.md delete mode 100644 eslint.config.mjs create mode 100644 src/queryassure/enterprise.py create mode 100644 src/queryassure/evidence.py create mode 100644 src/queryassure/governance.py create mode 100644 src/queryassure/resources/enterprise-policy.yml create mode 100644 tests_py/test_enterprise.py diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c038362..c5a9b2a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,6 +37,8 @@ jobs: queryassure test --suite evals/retail.yml queryassure m365-demo --output reports/microsoft365.json \ --html reports/microsoft365.html + queryassure enterprise-demo --output reports/enterprise-evidence.json \ + --html reports/enterprise-governance.html queryassure challenge queryassure demo --output reports/demo --no-open queryassure benchmark --report reference=reports/latest.json @@ -44,8 +46,10 @@ jobs: run: | npm ci npm audit --audit-level=high - - name: Build playground - run: npm run build + - name: Type-check and test playground + run: | + npm run lint + npm test - name: Upload benchmark uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 41083c5..d1a9abb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,12 +35,15 @@ jobs: queryassure test --suite evals/retail.yml queryassure m365-demo --output reports/microsoft365.json \ --html reports/microsoft365.html + queryassure enterprise-demo --output reports/enterprise-evidence.json \ + --html reports/enterprise-governance.html queryassure challenge queryassure demo --output reports/demo --no-open - name: Validate playground run: | npm ci npm audit --audit-level=high + npm run lint npm test python-artifacts: diff --git a/.gitignore b/.gitignore index e53dd69..e50d04d 100644 --- a/.gitignore +++ b/.gitignore @@ -8,6 +8,7 @@ __pycache__/ .pytest_cache/ .ruff_cache/ *.egg-info/ +*.tsbuildinfo node_modules/ .next/ out/ diff --git a/CHANGELOG.md b/CHANGELOG.md index 70cd06b..3f36808 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,24 @@ All notable changes to QueryAssure are documented here. The project follows ## [Unreleased] +## [0.6.0] - 2026-08-17 + +### Added + +- deny-by-default enterprise policy engine with tenant isolation, RBAC action/resource + matching, deployment-environment controls, and ordered data-classification clearance +- approval-ticket obligations for external side effects and governed break-glass access + with security notification, session expiry, and post-incident review requirements +- versioned YAML enterprise policy pack and framework-neutral policy decisions with + request fingerprints, reasons, matched roles, obligations, and correlation-safe IDs +- redacted HMAC-SHA256 evidence envelopes with canonical payload digests, constant-time + verification, age limits, malformed-input handling, atomic writes, and owner-only file + permissions +- `queryassure enterprise-demo`, `queryassure policy evaluate`, and `queryassure evidence` + commands for zero-key demonstrations and production CI integration +- enterprise governance operator guide and eleven regression tests for authorization, + tampering, stale evidence, CLI behaviour, and credential-safe artifacts + ## [0.5.0] - 2026-07-27 ### Added @@ -106,6 +124,7 @@ All notable changes to QueryAssure are documented here. The project follows - first public evaluation contracts, validators, benchmark tools, and Docker workflow [0.4.1]: https://github.com/Victoria824/QueryAssure/compare/v0.4.0...v0.4.1 +[0.6.0]: https://github.com/Victoria824/QueryAssure/compare/v0.5.0...v0.6.0 [0.5.0]: https://github.com/Victoria824/QueryAssure/compare/v0.4.1...v0.5.0 [0.4.0]: https://github.com/Victoria824/QueryAssure/compare/v0.3.1...v0.4.0 [0.3.1]: https://github.com/Victoria824/QueryAssure/compare/v0.3.0...v0.3.1 diff --git a/CITATION.cff b/CITATION.cff index a93c6d0..da800cb 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -8,7 +8,7 @@ authors: repository-code: https://github.com/Victoria824/QueryAssure url: https://victoria824.github.io/QueryAssure/ license: Apache-2.0 -version: 0.5.0 +version: 0.6.0 date-released: 2026-07-27 keywords: - SQL Agent diff --git a/README.md b/README.md index 69320a7..fb6126c 100644 --- a/README.md +++ b/README.md @@ -22,9 +22,9 @@ human approvals, and audit-ready workflow evidence. If QueryAssure helps you catch a SQL Agent regression, consider [starring the repository](https://github.com/Victoria824/QueryAssure) and sharing the failing trace. That signal helps prioritize the next adapters and validators. -> **v0.5.0:** adds framework-neutral workflow contracts and a Microsoft Graph reference -> agent for Outlook and Teams, including least-privilege OAuth scopes, approval-gated -> side effects, complete audit traces, credential hygiene checks, and a zero-key demo. +> **v0.6.0:** adds deny-by-default enterprise policy-as-code, multi-tenant isolation, +> RBAC/resource authorization, classification clearance, approval and break-glass +> obligations, plus tamper-evident redacted audit bundles. ## 30-second proof @@ -54,6 +54,16 @@ This runs four Outlook/Teams contracts covering mail triage, draft creation, blo unapproved sends, approved Teams notifications, OAuth scope minimization, and audit completeness. +Exercise the enterprise governance layer without an identity provider or KMS: + +```bash +uvx --from git+https://github.com/Victoria824/QueryAssure queryassure enterprise-demo +``` + +This runs six policy decisions covering same-tenant access, cross-tenant denial, +classification clearance, approval-gated side effects, and audited break-glass access. +It produces a redacted, tamper-evident evidence bundle and a shareable HTML report. + Already have a report or an existing repository? ```bash @@ -110,6 +120,17 @@ Question → metadata retrieval → SQL generation → policy validation - deterministic Microsoft Graph simulator for zero-key CI - fail-closed live Graph client for Outlook and Teams +### Enterprise governance and evidence + +- deny-by-default YAML policy packs with explicit versioning +- tenant-bound resource access and recognized-role enforcement +- wildcard RBAC actions constrained by resource patterns +- ordered public, internal, confidential, and restricted clearances +- approval-ticket obligations for external or irreversible actions +- break-glass roles with incident tickets, justification, expiry, and review obligations +- HMAC-SHA256 evidence envelopes over redacted canonical reports +- atomic owner-only evidence writes plus digest, signature, and age verification + ## Quickstart ### One command @@ -135,7 +156,7 @@ Requires Python 3.10+. Install the verified wheel from the latest GitHub Release: ```bash -pip install https://github.com/Victoria824/QueryAssure/releases/download/v0.5.0/queryassure-0.5.0-py3-none-any.whl +pip install https://github.com/Victoria824/QueryAssure/releases/download/v0.6.0/queryassure-0.6.0-py3-none-any.whl queryassure --version ``` @@ -189,7 +210,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: Victoria824/QueryAssure@v0.5.0 + - uses: Victoria824/QueryAssure@v0.6.0 with: suite: evals/retail.yml ``` diff --git a/app/page.tsx b/app/page.tsx index 8f50d5c..10507e0 100644 --- a/app/page.tsx +++ b/app/page.tsx @@ -129,7 +129,7 @@ const CHECKS = [ ["result_equivalence", "Matches golden result"], ]; -const ACTION_SNIPPET = `- uses: Victoria824/QueryAssure@v0.5.0 +const ACTION_SNIPPET = `- uses: Victoria824/QueryAssure@v0.6.0 with: suite: evals/retail.yml`; const DEMO_COMMAND = @@ -214,7 +214,7 @@ export default function Home() { Q QueryAssure - alpha + v0.6