From a20746b4bbbe985067b45a8624bdbd34deba257a Mon Sep 17 00:00:00 2001
From: Jennifer Power <barnabei.jennifer@gmail.com>
Date: Tue, 28 Jul 2026 13:13:37 -0400
Subject: [PATCH] BREAKING: change frequency type and remove
 evidence-requirements

frequency field in #AssessmentPlan now int (days) instead of string.
evidence-requirements field removed; replaced with evidence-types array
of #EvidenceTypeDefinition entries defining valid evidence types and
their validity periods.

Consumers must update:
- Parse frequency as integer days, not string
- Use evidence-types array instead of evidence-requirements string
- No automatic migration path; requires manual assessment plan updates

Assisted-by: Claude (Anthropic, Claude Haiku 4.5)
Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
---
 policy.cue                      | 17 +++++++++++++++--
 test/test-data/good-policy.yaml | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/policy.cue b/policy.cue
index 916031c7..25ced4e8 100644
--- a/policy.cue
+++ b/policy.cue
@@ -108,12 +108,25 @@ package gemara
 #AssessmentPlan: {
 	id:               string
 	"requirement-id": string @go(RequirementId)
-	frequency:        string
+	// frequency is the control review frequency in days
+	frequency: int
+	"evidence-types"?: [#EvidenceTypeDefinition, ...#EvidenceTypeDefinition] @go(EvidenceTypes)
 	"evaluation-methods": [#AcceptedMethod & {type: #EvaluationMethodType}, ...#AcceptedMethod & {type: #EvaluationMethodType}] @go(EvaluationMethods)
-	"evidence-requirements"?: string @go(EvidenceRequirements)
 	parameters?: [#Parameter, ...#Parameter]
 }
 
+// EvidenceTypeDefinition defines expected evidence for an assessment plan.
+#EvidenceTypeDefinition: {
+	// id matches the type field on #Evidence instances
+	id: string
+
+	// description explains what this evidence type represents
+	description?: string
+
+	// valid-for is the evidence validity period in days
+	"valid-for": int @go(ValidFor)
+}
+
 // AcceptedMethod defines a method for evaluation or enforcement.
 #AcceptedMethod: {
 	id:           string
diff --git a/test/test-data/good-policy.yaml b/test/test-data/good-policy.yaml
index 28190b6f..b9f3857b 100644
--- a/test/test-data/good-policy.yaml
+++ b/test/test-data/good-policy.yaml
@@ -88,6 +88,25 @@ adherence:
       type: "Behavioral"
       mode: "Manual"
       description: "Annual security audit by external assessors"
+  assessment-plans:
+    - id: "plan-ac01"
+      requirement-id: "AC-1.1"
+      frequency: 90
+      evidence-types:
+        - id: "api-response"
+          description: "Live API query of platform settings"
+          valid-for: 1
+        - id: "config-file"
+          description: "Security configuration file check"
+          valid-for: 1
+        - id: "quarterly-access-review"
+          description: "Human review of access control enforcement status"
+          valid-for: 90
+      evaluation-methods:
+        - id: "EV-AUTO-01"
+          type: "Behavioral"
+          mode: "Automated"
+          required: true
   enforcement-methods:
     - id: "EM-GATE-01"
       type: "Gate"