feat: add enterprise governance and signed evidence

.github/workflows/ci.yml

@@ -37,15 +37,19 @@ jobs:
           queryassure test --suite evals/retail.yml
           queryassure m365-demo --output reports/microsoft365.json \
             --html reports/microsoft365.html
+          queryassure enterprise-demo --output reports/enterprise-evidence.json \
+            --html reports/enterprise-governance.html
           queryassure challenge
           queryassure demo --output reports/demo --no-open
           queryassure benchmark --report reference=reports/latest.json
       - name: Install web dependencies
         run: |
           npm ci
           npm audit --audit-level=high
-      - name: Build playground
-        run: npm run build
+      - name: Type-check and test playground
+        run: |
+          npm run lint
+          npm test
       - name: Upload benchmark
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:

.github/workflows/release.yml

@@ -35,12 +35,15 @@ jobs:
           queryassure test --suite evals/retail.yml
           queryassure m365-demo --output reports/microsoft365.json \
             --html reports/microsoft365.html
+          queryassure enterprise-demo --output reports/enterprise-evidence.json \
+            --html reports/enterprise-governance.html
           queryassure challenge
           queryassure demo --output reports/demo --no-open
       - name: Validate playground
         run: |
           npm ci
           npm audit --audit-level=high
+          npm run lint
           npm test
 
   python-artifacts:

.gitignore

@@ -8,6 +8,7 @@ __pycache__/
 .pytest_cache/
 .ruff_cache/
 *.egg-info/
+*.tsbuildinfo
 node_modules/
 .next/
 out/

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to QueryAssure are documented here. The project follows
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-08-17
+
+### Added
+
+- deny-by-default enterprise policy engine with tenant isolation, RBAC action/resource
+  matching, deployment-environment controls, and ordered data-classification clearance
+- approval-ticket obligations for external side effects and governed break-glass access
+  with security notification, session expiry, and post-incident review requirements
+- versioned YAML enterprise policy pack and framework-neutral policy decisions with
+  request fingerprints, reasons, matched roles, obligations, and correlation-safe IDs
+- redacted HMAC-SHA256 evidence envelopes with canonical payload digests, constant-time
+  verification, age limits, malformed-input handling, atomic writes, and owner-only file
+  permissions
+- `queryassure enterprise-demo`, `queryassure policy evaluate`, and `queryassure evidence`
+  commands for zero-key demonstrations and production CI integration
+- enterprise governance operator guide and eleven regression tests for authorization,
+  tampering, stale evidence, CLI behaviour, and credential-safe artifacts
+
 ## [0.5.0] - 2026-07-27
 
 ### Added
@@ -106,6 +124,7 @@ All notable changes to QueryAssure are documented here. The project follows
 - first public evaluation contracts, validators, benchmark tools, and Docker workflow
 
 [0.4.1]: https://github.com/Victoria824/QueryAssure/compare/v0.4.0...v0.4.1
+[0.6.0]: https://github.com/Victoria824/QueryAssure/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/Victoria824/QueryAssure/compare/v0.4.1...v0.5.0
 [0.4.0]: https://github.com/Victoria824/QueryAssure/compare/v0.3.1...v0.4.0
 [0.3.1]: https://github.com/Victoria824/QueryAssure/compare/v0.3.0...v0.3.1

CITATION.cff

@@ -8,7 +8,7 @@ authors:
 repository-code: https://github.com/Victoria824/QueryAssure
 url: https://victoria824.github.io/QueryAssure/
 license: Apache-2.0
-version: 0.5.0
+version: 0.6.0
 date-released: 2026-07-27
 keywords:
   - SQL Agent

Dockerfile.web

@@ -7,7 +7,7 @@ COPY build ./build
 COPY public ./public
 COPY worker ./worker
 COPY .openai ./.openai
-COPY next.config.ts tsconfig.json vite.config.ts eslint.config.mjs ./
+COPY next.config.ts tsconfig.json vite.config.ts ./
 ENV NEXT_PUBLIC_QUERYASSURE_API=http://localhost:8000
 RUN chown -R node:node /app
 USER node

README.md

@@ -22,9 +22,9 @@ human approvals, and audit-ready workflow evidence.
 
 If QueryAssure helps you catch a SQL Agent regression, consider [starring the repository](https://github.com/Victoria824/QueryAssure) and sharing the failing trace. That signal helps prioritize the next adapters and validators.
 
-> **v0.5.0:** adds framework-neutral workflow contracts and a Microsoft Graph reference
-> agent for Outlook and Teams, including least-privilege OAuth scopes, approval-gated
-> side effects, complete audit traces, credential hygiene checks, and a zero-key demo.
+> **v0.6.0:** adds deny-by-default enterprise policy-as-code, multi-tenant isolation,
+> RBAC/resource authorization, classification clearance, approval and break-glass
+> obligations, plus tamper-evident redacted audit bundles.
 
 ## 30-second proof
 
@@ -54,6 +54,16 @@ This runs four Outlook/Teams contracts covering mail triage, draft creation, blo
 unapproved sends, approved Teams notifications, OAuth scope minimization, and audit
 completeness.
 
+Exercise the enterprise governance layer without an identity provider or KMS:
+
+```bash
+uvx --from git+https://github.com/Victoria824/QueryAssure queryassure enterprise-demo
+```
+
+This runs six policy decisions covering same-tenant access, cross-tenant denial,
+classification clearance, approval-gated side effects, and audited break-glass access.
+It produces a redacted, tamper-evident evidence bundle and a shareable HTML report.
+
 Already have a report or an existing repository?
 
 ```bash
@@ -110,6 +120,17 @@ Question → metadata retrieval → SQL generation → policy validation
 - deterministic Microsoft Graph simulator for zero-key CI
 - fail-closed live Graph client for Outlook and Teams
 
+### Enterprise governance and evidence
+
+- deny-by-default YAML policy packs with explicit versioning
+- tenant-bound resource access and recognized-role enforcement
+- wildcard RBAC actions constrained by resource patterns
+- ordered public, internal, confidential, and restricted clearances
+- approval-ticket obligations for external or irreversible actions
+- break-glass roles with incident tickets, justification, expiry, and review obligations
+- HMAC-SHA256 evidence envelopes over redacted canonical reports
+- atomic owner-only evidence writes plus digest, signature, and age verification
+
 ## Quickstart
 
 ### One command
@@ -135,7 +156,7 @@ Requires Python 3.10+.
 Install the verified wheel from the latest GitHub Release:
 
 ```bash
-pip install https://github.com/Victoria824/QueryAssure/releases/download/v0.5.0/queryassure-0.5.0-py3-none-any.whl
+pip install https://github.com/Victoria824/QueryAssure/releases/download/v0.6.0/queryassure-0.6.0-py3-none-any.whl
 queryassure --version
 ```
 
@@ -189,7 +210,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Victoria824/QueryAssure@v0.5.0
+      - uses: Victoria824/QueryAssure@v0.6.0
         with:
           suite: evals/retail.yml
 ```

app/page.tsx

@@ -129,7 +129,7 @@ const CHECKS = [
   ["result_equivalence", "Matches golden result"],
 ];
 
-const ACTION_SNIPPET = `- uses: Victoria824/QueryAssure@v0.5.0
+const ACTION_SNIPPET = `- uses: Victoria824/QueryAssure@v0.6.0
   with:
     suite: evals/retail.yml`;
 const DEMO_COMMAND =
@@ -214,7 +214,7 @@ export default function Home() {
         <a className="brand" href="#top" aria-label="QueryAssure home">
           <span className="brand-mark">Q</span>
           <span>QueryAssure</span>
-          <em>alpha</em>
+          <em>v0.6</em>
         </a>
         <nav aria-label="Primary navigation">
           <button className={view === "chat" ? "nav-active" : ""} onClick={() => setView("chat")}>

docs/enterprise-governance.md

@@ -0,0 +1,140 @@
+# Enterprise governance and tamper-evident evidence
+
+QueryAssure's governance layer sits before agent tool execution. It evaluates an
+authenticated subject, tenant, role set, requested action, target resource, data
+classification, deployment environment, and approval context. The engine is framework
+neutral and denies requests whenever policy context is missing or ambiguous.
+
+```text
+Identity provider / API gateway
+          │
+          ▼
+     PolicyRequest ─────► versioned EnterprisePolicy
+          │                         │
+          ▼                         ▼
+     PolicyDecision ─────► allow / deny + reasons + obligations
+          │
+          ├── deny: return a controlled error and emit decision evidence
+          └── allow: execute the tool, retain correlation ID, fulfill obligations
+                                      │
+                                      ▼
+                      redacted report → signed EvidenceEnvelope
+```
+
+## Control coverage
+
+| Control | QueryAssure behaviour |
+|---|---|
+| Default effect | Only `deny` is accepted when loading an enterprise policy |
+| Tenant isolation | Resource tenant is mandatory and must equal the authenticated tenant |
+| RBAC | A recognized role must grant both the action and resource pattern |
+| Data clearance | Role clearance must meet the ordered classification level |
+| Side effects | Configured actions require a correctly formatted approval ticket |
+| Break glass | Restricted to emergency roles with incident ticket and justification |
+| Auditability | Decisions include policy version, fingerprint, reasons, roles, and obligations |
+| Evidence integrity | Redacted canonical reports are hashed and signed with HMAC-SHA256 |
+
+These controls supplement authentication and infrastructure authorization. QueryAssure
+does not issue identities, OAuth tokens, database credentials, or cloud IAM grants.
+
+## Run the zero-key control demonstration
+
+```bash
+queryassure enterprise-demo \
+  --output reports/enterprise-evidence.json \
+  --html reports/enterprise-governance.html
+```
+
+The demo verifies six decisions: same-tenant access, cross-tenant denial, restricted-data
+denial, missing approval denial, approved side effect, and audited emergency access. Its
+signing key is generated in memory and discarded after the bundle is verified.
+
+## Evaluate a policy in CI or at an agent boundary
+
+The bundled policy pack is suitable for evaluation and examples. Production teams should
+copy it into their configuration repository, review it through pull requests, and load it
+from an immutable release artifact.
+
+```bash
+queryassure policy evaluate \
+  --tenant northstar \
+  --resource-tenant northstar \
+  --subject analyst@example.test \
+  --role analyst \
+  --action sql.read \
+  --resource warehouse:analytics.orders \
+  --classification confidential \
+  --policy policies/enterprise-policy.yml
+```
+
+Exit code `0` means the request is allowed. A denial returns exit code `1` and a complete
+decision object. Do not interpret an unavailable policy service as an allow decision.
+
+## Policy pack structure
+
+```yaml
+version: "2026-08-17.1"
+default_effect: deny
+environments: [development, staging, production]
+classifications: [public, internal, confidential, restricted]
+
+roles:
+  analyst:
+    actions: [sql.read, catalog.read]
+    resources: ["warehouse:*"]
+    clearance: confidential
+
+approval:
+  required_for: [agent.notification.send]
+  ticket_pattern: "^APR-[0-9]{4,}$"
+
+break_glass:
+  roles: [security-admin]
+  ticket_pattern: "^INC-[0-9]{4,}$"
+```
+
+Action and resource patterns use case-sensitive shell-style matching. Keep patterns narrow;
+the policy engine deliberately does not infer permissions from similar names.
+
+## Sign and verify audit evidence
+
+Signing material is read from an environment variable, not a command-line argument. In a
+production pipeline, populate that variable from a KMS, HSM, or CI secret manager and use a
+key identifier that allows rotation and incident investigation.
+
+```bash
+export QUERYASSURE_EVIDENCE_KEY="$(security find-generic-password -w -s qa-evidence)"
+
+queryassure evidence sign reports/latest.json \
+  --output reports/latest.evidence.json \
+  --key-id kms/queryassure/prod-2026-08
+
+queryassure evidence verify reports/latest.evidence.json \
+  --max-age-seconds 86400
+```
+
+Before signing, QueryAssure removes result rows, email addresses, and common credential
+fields or credential-shaped values. The evidence file is written atomically with owner-only
+permissions. Verification checks the canonical
+payload digest, constant-time HMAC signature comparison, supported envelope version,
+timezone-aware issue date, future clock skew, and optional maximum age.
+
+HMAC proves that a holder of the shared secret created the bundle; it does not provide
+public-key non-repudiation. Organizations requiring independent verification should replace
+the signer with KMS-backed asymmetric signatures while preserving the envelope contract.
+
+## Production integration checklist
+
+1. Authenticate the subject and tenant before constructing `PolicyRequest`.
+2. Derive roles from trusted identity claims, never from model output or user prompts.
+3. Bind the resource tenant from server-side metadata.
+4. Store policy packs in version control and deploy immutable versions.
+5. Execute no tool call until the policy decision is allowed.
+6. Fulfill every returned obligation and preserve the decision ID in telemetry.
+7. Sign only redacted reports and rotate signing keys through a managed key service.
+8. Alert on cross-tenant denials, break-glass decisions, and verification failures.
+
+For OAuth and human-approval controls, see
+[enterprise-agent-security.md](enterprise-agent-security.md). For cross-service traces and
+failure replay, use the independent
+[SpanReplay reference stack](https://github.com/Victoria824/SpanReplay).

docs/releases/v0.6.0.md

@@ -0,0 +1,27 @@
+# QueryAssure v0.6.0 — Enterprise governance and signed evidence
+
+QueryAssure v0.6.0 turns enterprise agent authorization and audit integrity into testable,
+framework-neutral software contracts.
+
+## Highlights
+
+- deny-by-default, versioned YAML policy packs
+- same-tenant resource binding and cross-tenant access denial
+- RBAC action/resource matching and ordered data-classification clearance
+- approval requirements for side effects
+- audited break-glass access with explicit operational obligations
+- redacted HMAC-SHA256 evidence envelopes with digest and age verification
+- atomic owner-only evidence storage
+- zero-key enterprise governance demonstration and production-oriented CLI commands
+
+## Try it
+
+```bash
+uvx --from git+https://github.com/Victoria824/QueryAssure queryassure enterprise-demo
+```
+
+The command evaluates six allow/deny scenarios and generates a signed JSON evidence bundle
+plus a self-contained HTML report.
+
+Read the [enterprise governance guide](../enterprise-governance.md) for policy integration,
+key-management guidance, trust boundaries, and production rollout controls.

next-env.d.ts

@@ -1,6 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
 import "./.next/types/routes.d.ts";
+import "./.next/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.