Scenario 08: Assemble compliance evidence

Use this scenario to answer one bounded compliance question against named requirements, scope and revision. Specify the coding standards, security controls, qualification metrics, licenses, privacy obligations, and organizational evidence with their accountable owners.

Start with a claim-to-evidence matrix

For every requirement record:

• exact standard, policy or contractual clause;
• product, repository, paths and revision in scope;
• evidence producer and collection command;
• expected result and failure rule;
• accountable reviewer and expiry or freshness date;
• known exclusions and manual evidence still required.

The commands below produce operational evidence. The accountable owner records the compliance decision from that evidence and the applicable requirements.

Typed review request

Scenario 08 is conditional for the structural reviewer and requires an explicit compliance signal:

from src.digital_employees.runtime.scenarios import (
    RoleBoundScenarioInvocationRequest,
    invoke_role_bound_scenario_request,
)

request = RoleBoundScenarioInvocationRequest(
    query="Map the accepted coding and security requirements to revision-bound evidence.",
    employee_id="codegraph_reviewer",
    scenario_id="scenario_08",
    event_type="review_start",
    context={
        "project_key": "codegraph",
        "namespace": "default",
        "task_id": "<task-id>",
        "source_refs": ["<requirement-ref>", "<scope-ref>"],
        "file_paths": ["<bounded-path>"],
    },
)

result = invoke_role_bound_scenario_request(request)

Missing project_key, namespace, or task_id fails closed with role_bound_scenario_contract_missing.

Use the command that matches the claim

Imported coding-standard rules

python -m src.cli standards check PATH --fail-on error --output <violations.json>

The check applies active imported standards to a file or directory and can save the findings as JSON. Preserve the selected document, categories, severities and rule versions with that output.

The current standards report implementation prints Report generation not yet implemented (requires stored violations) and returns exit code 1. Use the standards check --output artifact while persistent report generation is implemented and verified.

Code-quality and security-relevant audit

python -m src.cli audit --db PATH --format json --skip-llm-conclusion --skip-persistence

The audit requires an explicitly configured CPG and may refresh a stale graph. Its findings require disposition and the accountable security or review verdict. A no-finding result applies to the configured scope and revision.

Qualification results

python -m src.cli qualification report --results PATH --format json --language en --output <qualification.json>

This command renders an existing results artifact. Preserve the suite, tool versions, dataset, profile, scopes and immutable raw results. Do not copy historical FP/FN values into evergreen documentation.

Keep evidence lanes separate

Failure and freshness rules

Fail closed when the requirement edition is unknown, the scope or revision is missing, the rule set differs from the claimed standard, raw qualification results are unavailable, or a required manual artifact is absent. Mark stale evidence explicitly; do not silently reuse a previous report.

Maintained source contracts

• Standards CLI: src/cli/security_suite/standards_commands.py
• Qualification CLI: src/cli/analysis_commands/qualification_commands.py
• Audit CLI: src/cli/analysis_commands/audit_commands.py
• Reviewer scenario policy: src/digital_employees/runtime/scenarios/employee_scenario_invocation.py
• Typed routing: src/digital_employees/runtime/scenarios/role_bound_scenario_invoker.py

For revision review, continue with Code Review. Use the dedicated GOST guide for a specific GOST assessment rather than treating this scenario as a universal certification workflow.