Expand GIEN Governance Platform prototype

.github/linters/.markdown-lint.yml

@@ -0,0 +1,15 @@
+---
+MD004: false
+MD007:
+  indent: 2
+MD013:
+  line_length: 400
+  code_blocks: false
+  tables: false
+  headings: false
+MD026:
+  punctuation: ".,;:!。，；:"
+MD029: false
+MD033: false
+MD036: false
+blank_lines: false

.github/linters/.stylelintrc.json

@@ -0,0 +1,15 @@
+{
+  "extends": "stylelint-config-recommended",
+  "rules": {
+    "at-rule-no-unknown": [
+      true,
+      {
+        "ignoreAtRules": [
+          "tailwind"
+        ]
+      }
+    ],
+    "no-descending-specificity": null,
+    "no-duplicate-selectors": null
+  }
+}

.github/workflows/ci.yml

@@ -2,32 +2,41 @@ name: Python CI
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: python-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
-
+    timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python 3.10
-      uses: actions/setup-python@v3
-      with:
-        python-version: "3.10"
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install ruff pytest
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-    - name: Lint with ruff
-      run: |
-        # stop the build if there are any ruff issues
-        ruff --format=github --select=E9,F63,F7,F82 --target-version=py310 .
-        # default set of ruff rules with GitHub Annotations
-        ruff --format=github --target-version=py310 .
-    - name: Test with pytest
-      run: |
-        pytest
+      - name: Check out repository
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.10"
+      - name: Report toolchain versions
+        run: |
+          python --version
+          python -m pip --version
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ruff pytest
+          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
+      - name: Critical Ruff checks
+        run: ruff --format=github --select=E9,F63,F7,F82 --target-version=py310 .
+      - name: Full Ruff lint
+        run: ruff --format=github --target-version=py310 .
+      - name: Run pytest
+        run: pytest

.github/workflows/gien-platform-ci.yml

@@ -0,0 +1,50 @@
+name: GIEN platform CI
+
+on:
+  pull_request:
+    paths:
+      - "gien-platform/**"
+      - ".github/workflows/gien-platform-ci.yml"
+  push:
+    branches:
+      - main
+      - "feat/gien-governance-platform"
+    paths:
+      - "gien-platform/**"
+      - ".github/workflows/gien-platform-ci.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gien-platform-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Type-check and production build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: gien-platform
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1; pinned to immutable commit
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0; pinned to immutable commit
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - name: Report toolchain versions
+        run: |
+          node --version
+          npm --version
+      - name: Install dependencies
+        run: npm install --no-audit --no-fund
+      - name: Run deterministic evidence regression tests
+        run: npm run test:evidence
+      - name: Build application
+        run: npm run build
+      - name: Smoke-test production preview
+        run: npm run smoke

.github/workflows/governance-docs-lint.yml

@@ -3,25 +3,24 @@
 on:
   pull_request:
     paths:
-      - 'docs/**/*.md'
-      - '.markdownlint.json'
-      - '.markdownlintignore'
-      - 'scripts/lint_governance_docs.sh'
-      - 'tests/test_lint_governance_docs.sh'
-      - 'Makefile'
-      - 'tests/test_lint_governance_docs.sh'
-      - 'Makefile'
-      - '.github/workflows/governance-docs-lint.yml'
+      - "docs/**/*.md"
+      - ".markdownlint.json"
+      - ".markdownlintignore"
+      - "scripts/lint_governance_docs.sh"
+      - "tests/test_lint_governance_docs.sh"
+      - "Makefile"
+      - ".github/workflows/governance-docs-lint.yml"
   push:
-    branches: [ main ]
+    branches: ["main"]
     paths:
-      - 'docs/**/*.md'
-      - '.markdownlint.json'
-      - '.markdownlintignore'
-      - 'scripts/lint_governance_docs.sh'
-      - 'tests/test_lint_governance_docs.sh'
-      - 'Makefile'
-      - '.github/workflows/governance-docs-lint.yml'
+      - "docs/**/*.md"
+      - ".markdownlint.json"
+      - ".markdownlintignore"
+      - "scripts/lint_governance_docs.sh"
+      - "tests/test_lint_governance_docs.sh"
+      - "Makefile"
+      - ".github/workflows/governance-docs-lint.yml"
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -35,25 +34,21 @@
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-
-      - name: Set up Node.js
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up Node.js 24
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '20'
-
+          node-version: "24"
+          package-manager-cache: false
       - name: Validate lint script syntax
         run: bash -n scripts/lint_governance_docs.sh
-
       - name: Validate test script syntax
         run: bash -n tests/test_lint_governance_docs.sh
-
       - name: Shellcheck lint scripts
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
         with:
           scandir: "scripts tests"
           severity: warning
-
       - name: Run governance docs check target
         run: make governance-docs-check

.pre-commit-config.yaml

@@ -44,7 +44,7 @@ repos:
         pass_filenames: false
       - id: governance-evidence-checks
         name: governance-evidence-checks
-        entry: make governance-evidence-manifest && make governance-evidence-verify && make governance-evidence-schema && make governance-report-schema && make governance-check-generated
+        entry: bash scripts/governance-evidence-checks.sh
         language: system
         pass_filenames: false
   - repo: local

GIEN_Daily_Dossier_2026-10-12.md

@@ -0,0 +1,154 @@
+# GIEN DAILY DOSSIER — 2026-10-12
+
+---
+
+**Document ID:** GIEN-DOSSIER-2026-285
+**Work Package:** WP-047
+**Date of Attestation:** 2026-10-12
+**Evaluation Window:** 2026-10-11 09:00 UTC → 2026-10-12 09:00 UTC
+**Governance Epoch:** Epoch I (2026–2035); Phase VI-δ (planetary); Phase VII (galactic readiness)
+**System:** GIEN Planetary Governance Mesh — Sentinel AI Governance Stack v2.4 — Omni-Sentinel Governance Mesh v4.0 — Unified Supervisory Control Plane v3.0
+**Applicability:** Global systemically important financial institutions (G-SIFIs); large financial institutions (LFIs); supervisory colleges; treaty secretariats
+**Classification:** TOP SECRET // SUPERVISORY EYES ONLY
+**Merkle Root (Sealed Archive):** `0xb7e4d1a9c5f28306e1c7d4a9b5e2f8c3d6a1b9e4f7c2d5a8b3e6f1c9d4a7b2e5`
+**Artefacts Sealed This Cycle:** 26
+
+> **Fictional simulation notice.** This dossier is a governance-simulation artefact produced for the fictional GIEN planetary governance mesh. All indices, drills, filings, and signatures are simulated data.
+
+---
+
+## SECTION 1 — SUPERVISORY DASHBOARD CHECKLIST
+
+| Control ID | Control Domain | Status | Evidence Ref | Verifier | Notes |
+|---|---|---|---|---|---|
+| GIEN-DSO-2026-285-01 | 01 — Constitutional Invariant Verification (CFE-1.0 / SGR-028) | 🟢 PASS | TLA+ suite rev. 1147 | TLC model checker | 72/72 proofs; 0 violations; Epoch I & II liveness confirmed |
+| GIEN-DSO-2026-285-02 | 02 — Systemic Risk Telemetry & Indices | 🟢 GREEN | STLM-agg-2026-285 | SystemicRiskTelemetry | All core indices inside GREEN bands |
+| GIEN-DSO-2026-285-03 | 03 — Zero-Trust & Attestation (GIEN-ZTAI-02) | 🟡 AMBER | ZTAI-02-CL-0093 | Attestation Coherence Verifier | 97% remediated; closure evidence complete; containment stable |
+| GIEN-DSO-2026-285-04 | 04 — zkML / zk-SNARK/STARK Proof Pipeline | 🟢 PASS | zkML-QR-2026-285 | Intervention Proof Verifier | 95.5% pipeline health (record); p99 latency 7.1 s |
+| GIEN-DSO-2026-285-05 | 05 — PQC WORM / Merkle-DAG Audit Ledger | 🟢 PASS | WORM-LDGR-285 | Ledger Integrity Monitor | FIPS 203/204/205 primitives; ML-DSA-87 + Falcon-1024 + SLH-DSA |
+| GIEN-DSO-2026-285-06 | 06 — OSCAL 1.1.2 / OPA-Rego Compliance-as-Code | 🟢 PASS | OSCAL-VAL-2026-285 | OPA policy engine | 16/16 regimes PASS; Δ_OSCAL +1 |
+| GIEN-DSO-2026-285-07 | 07 — Supervisory Digital Twin (Panels 13–15) | 🟢 PASS | SDT-RB-2026-285-13/14/15 | Replay Determinism Checker | Deterministic Replay Bundles sealed |
+| GIEN-DSO-2026-285-08 | 08 — Kubernetes / GitOps Zero-Trust Deployment | 🟢 PASS | GITOPS-SYNC-285 | Cluster Drift Monitor | 147 clusters; zero configuration drift |
+| GIEN-DSO-2026-285-09 | 09 — Autonomous Supervisory Agent Containment | 🟢 PASS | ASA-HB-2026-285 | Containment Heartbeat Verifier | All agents within drift envelope |
+| GIEN-DSO-2026-285-10 | 10 — Compute Governance & Kill-Switch Coherence | 🟢 PASS | CGOV-BASE-285 | Allocation Regime Monitor | BASELINE regime; ELEVATED not invoked this window |
+
+---
+
+## SECTION 2 — UNIFIED CORPUS INDEX TRACEABILITY
+
+| Index | Value | 24h Δ | Band | Notes |
+|---|---|---|---|---|
+| S_sys | 0.198 | −0.002 | 🟢 GREEN | Composite stability improving |
+| G-SRI | 28.6 | −0.3 | 🟢 GREEN | Lowest since dossier 210 (29.60) |
+| C-SRI | 30.0 | −0.2 | 🟢 GREEN | Compliance-side risk stable |
+| G-SRI-VII | 28.9 | −0.2 | 🟢 GREEN | Phase VII galactic readiness band |
+| A-SRI | 24.4 | −0.1 | 🟢 GREEN | Alignment-side risk |
+| P-SRI | 26.5 | +0.1 | 🟢 GREEN | Planetary propagation risk |
+| CGR-I | 73.2 | +0.4 | 🟢 GREEN | Constitutional-grade readiness improving |
+| CCR-I | 68.6 | +0.3 | 🟢 GREEN | Cryptographic governance readiness |
+| p(doom) | 0.30% | −0.01 pp | 🟢 GREEN | Ensemble estimate |
+| p(doom)_kernel | 0.29% | −0.01 pp | 🟢 GREEN | Kernel density estimate |
+| Δ_drift | +0.2σ | −0.1σ | 🟢 GREEN | Within ±1σ envelope |
+| Δ_OSCAL | +1 | 0 | 🟢 GREEN | Net control additions |
+| Mean quote age | 29 min | −2 min | 🟢 GREEN | Ledger quote freshness |
+
+---
+
+## SECTION 3 — CONTROL DOMAIN STATUS & PERTURBATION LIBRARY
+
+**Domain 03 — GIEN-ZTAI-02 Remediation (sole AMBER):**
+- Remediation at 97%; final sweep scheduled 2026-10-13; closure ETA 2026-10-14.
+- Closure evidence bundle complete and pre-staged for SGR-030 counter-verification.
+- Ahead of Protocol SGR-030 window close on 2026-10-15.
+
+**Perturbations registered this cycle:**
+- P-285-α: ZTAI-02 residual-node attestation edge case (contained; tracked to closure sweep).
+- P-285-β: zkML Stage B proving queue depth spike (auto-scaled; no deadline breach).
+- P-285-γ: Minor MoE routing flap on expert shard E-17 (rebalanced in 41 s; StaR-MoE stability held).
+
+---
+
+## SECTION 4 — SCENARIO EXECUTION TABLE (SDT STRESS-TESTS)
+
+| Drill ID | Scenario | Panel | Result | Notes |
+|---|---|---|---|---|
+| DRILL-047 | Black-Unicorn-7 (supervisory failover under systemic stress) | 13–15 | ✓ CONTAINED | Execution replay determinism confirmed; escalation auto-reverted at EL-3 |
+| DRILL-048 | Ashen-Lantern (multi-region attestation failover under ELEVATED load with zk degradation injection) | 13–15 | ⏳ FROZEN | Choreography frozen for execution 2026-10-13 |
+| REPLAY-RB-285 | Deterministic replay of Panels 13–15 archive | 13–15 | ✓ BIT-IDENTICAL | Zero divergence across replay bundles |
+
+---
+
+## SECTION 5 — SDT REPLAYS (PANEL 15 EXCERPT)
+
+Panel 15 replay of DRILL-047 (Black-Unicorn-7) confirmed containment in 14 m 22 s with escalation authority correctly auto-reverting at EL-3 after supervisory override signature verification. zkML degradation injection during DRILL-048 pre-rehearsal showed proof pipeline graceful-degrade thresholds holding at 95.5% health with no fairness regression (Disparate Impact Ratio 0.851; ≥ 0.800 threshold maintained).
+
+---
+
+## SECTION 6 — CRYPTOGRAPHIC & LEDGER INTEGRITY
+
+- **PQC signature stack:** ML-DSA-87 (primary, FIPS 204), Falcon-1024 (FIPS 206 draft alignment, review at 94%), SLH-DSA / SPHINCS+ (hash-based fallback, FIPS 205).
+- **Falcon-1024 independent review:** 94% (up from 91% at dossier 284).
+- **vkFMv3 key rotation:** 100% complete across all verifiers; vkFMv2 fully retired from active verification paths.
+- **WORM / Merkle-DAG ledger:** 26 artefacts sealed; Merkle root `0xb7e4d1a9c5f28306e1c7d4a9b5e2f8c3d6a1b9e4f7c2d5a8b3e6f1c9d4a7b2e5`; PQC continuity verified across all 52 RTEE nodes.
+- **TEE/TPM/vTPM attestation:** 52/52 nodes coherent; attestation density 96.5%.
+- **zkML pipeline:** 95.5% health (record); p99 proving latency 7.1 s; zk-STARK Stage B migration at 78% (80% gate); SnarkPack batching active.
+
+---
+
+## SECTION 7 — REGULATORY ALIGNMENT ANNEXES (OSCAL 1.1.2 / OPA-REGO)
+
+| # | Regime | Result | # | Regime | Result |
+|---|---|---|---|---|---|
+| 1 | EU AI Act (Annex IV; Arts. 51/35/15/17/22) | 🟢 PASS | 9 | FCA SMCR & Consumer Duty | 🟢 PASS |
+| 2 | NIST AI RMF 1.0 / AI 600-1 (GenAI profile) | 🟢 PASS | 10 | HKMA Fintech 2030 AI² | 🟢 PASS |
+| 3 | ISO/IEC 42001 (AIMS) | 🟢 PASS | 11 | SEC Rule 17a-4 | 🟢 PASS |
+| 4 | Basel III/IV | 🟢 PASS | 12 | FCRA/ECOA (fair lending) | 🟢 PASS |
+| 5 | SR 11-7 (model risk) | 🟢 PASS | 13 | ICGC/GASO | 🟢 PASS |
+| 6 | SR 26-2 (scenario design) | 🟢 PASS | 14 | Interstellar AI Governance Accord | 🟢 PASS |
+| 7 | DORA | 🟢 PASS | 15 | Galactic Treaty Framework | 🟢 PASS |
+| 8 | NIS2 | 🟢 PASS | 16 | GDPR (Arts. 22/35, DPIA) | 🟢 PASS |
+
+**OSCAL 1.1.2 SSP and assessment-results JSON: validated.** Δ_OSCAL = +1 (one net control addition under EU AI Act Art. 17 mapping).
+
+---
+
+## SECTION 8 — TREATY-GRADE CONSTITUTIONAL VERIFICATION
+
+- TLA+ specification suite (rev. 1147) verified **72/72 invariants** under CFE-1.0 and Protocol SGR-028 with zero violations for both governance epochs (2026–2035 and 2035–2100+).
+- Transcript Registry: 418 sealed transcripts this epoch; Intervention Proof Verifier smart contracts: no unexplained interventions.
+- Zero-knowledge voting: round N-33 sealed; no coercion patterns detected.
+- SGR-031 (next supervisory college filing) at 41% preparation.
+- Protocol SGR-030 Guardian Attestation window: on track, closes 2026-10-15.
+
+---
+
+## SECTION 9 — SUBMISSION READINESS CERTIFICATE
+
+| Field | Value |
+|---|---|
+| Dossier ID | GIEN-DOSSIER-2026-285 |
+| Work Package | WP-047 |
+| Archive Seal | `0xb7e4d1a9c5f28306e1c7d4a9b5e2f8c3d6a1b9e4f7c2d5a8b3e6f1c9d4a7b2e5` |
+| Signature (ML-DSA-87) | `0x4e9f2c8a1d6b3f7e5c0a9d2e8b4f1a6c3d7e9b2f5a8c1d4e6b9f3a2c5d8e1b4f` |
+| Signature (Falcon-1024) | `0x8c1d4e6b9f3a2c5d8e1b4f7a0c3d6e9b2f5a8c1d4e6b9f3a2c5d8e1b4f7a0c3d6` |
+| Signature (SLH-DSA) | `0xa3f6c9d2e5b8f1a4c7d0e3b6f9a2c5d8e1b4f7a0c3d6e9b2f5a8c1d4e6b9f3a2` |
+| Cycle Closure | 23:59 UTC 2026-10-12 (scheduled) |
+| Status | READY FOR SUPERVISORY COLLEGE TRANSMISSION |
+
+---
+
+## SECTION 10 — TRANSMITTAL & SEALED DOSSIER STATUS
+
+**Transmission Package Manifest (26 artefacts):** Executive Summary; Annotated Compliance Matrix (16 regimes); Redacted Stakeholder Version; Supervisory Corpus Manifest; SDT Replay Bundles (Panels 13–15); TLA+ proof transcripts (72); zkML fairness attestations; PQC ledger continuity proofs; TEE attestation coherence report (52/52); ZTAI-02 closure evidence bundle (pre-staged); Drive exports (docx + pdf pair); Notion closing summary.
+
+**External exports this cycle:**
+- Google Drive dossier export (docx + pdf pair) — filed under the daily dossier folder.
+- Notion closing summary — filed under Genspark Integration workspace page.
+
+**GitHub delivery:** This dossier is delivered to the OneFineStarstuff.github.io repository as work package WP-047 via pull request from `genspark_ai_developer` into `main`.
+
+**Next dossier:** GIEN-DOSSIER-2026-286 (Tuesday 2026-10-13; DRILL-048 Ashen-Lantern execution day; ZTAI-02 closure sweep day).
+
+---
+
+*This document is a fictional governance-simulation artefact for the GIEN planetary governance mesh. All indices, drills, filings, signatures, and Merkle roots are simulated data and do not describe real systems.*