feat!: change frequency type and remove evidence-requirements

policy.cue

@@ -108,12 +108,25 @@ package gemara
 #AssessmentPlan: {
 	id:               string
 	"requirement-id": string @go(RequirementId)
-	frequency:        string
+	// frequency is the control review frequency in days
+	frequency: int
+	"evidence-types"?: [#EvidenceTypeDefinition, ...#EvidenceTypeDefinition] @go(EvidenceTypes)
 	"evaluation-methods": [#AcceptedMethod & {type: #EvaluationMethodType}, ...#AcceptedMethod & {type: #EvaluationMethodType}] @go(EvaluationMethods)
-	"evidence-requirements"?: string @go(EvidenceRequirements)
 	parameters?: [#Parameter, ...#Parameter]
 }
 
+// EvidenceTypeDefinition defines expected evidence for an assessment plan.
+#EvidenceTypeDefinition: {
+	// id matches the type field on #Evidence instances
+	id: string
+
+	// description explains what this evidence type represents
+	description?: string
+
+	// valid-for is the evidence validity period in days
+	"valid-for": int @go(ValidFor)
+}
+
 // AcceptedMethod defines a method for evaluation or enforcement.
 #AcceptedMethod: {
 	id:           string

test/test-data/good-policy.yaml

@@ -88,6 +88,25 @@ adherence:
       type: "Behavioral"
       mode: "Manual"
       description: "Annual security audit by external assessors"
+  assessment-plans:
+    - id: "plan-ac01"
+      requirement-id: "AC-1.1"
+      frequency: 90
+      evidence-types:
+        - id: "api-response"
+          description: "Live API query of platform settings"
+          valid-for: 1
+        - id: "config-file"
+          description: "Security configuration file check"
+          valid-for: 1
+        - id: "quarterly-access-review"
+          description: "Human review of access control enforcement status"
+          valid-for: 90
+      evaluation-methods:
+        - id: "EV-AUTO-01"
+          type: "Behavioral"
+          mode: "Automated"
+          required: true
   enforcement-methods:
     - id: "EM-GATE-01"
       type: "Gate"