Scenario 08: Assemble compliance evidence

Use this scenario to answer one bounded compliance question against named requirements, scope and revision. Specify the coding standards, security controls, qualification metrics, licenses, privacy obligations, and organizational evidence with their accountable owners.

Start with a claim-to-evidence matrix

For every requirement record:

• exact standard, policy or contractual clause;
• product, repository, paths and revision in scope;
• evidence producer and collection command;
• expected result and failure rule;
• accountable reviewer and expiry or freshness date;
• known exclusions and manual evidence still required.

The commands below produce operational evidence. The accountable owner records the compliance decision from that evidence and the applicable requirements.

Typed review request

Prepare the environment using the CLI guide, and configure the project, graph, and LLM provider using the programmatic guide. Run Python and PowerShell from the CodeGraph repository root. Replace the scope, <task-id>, references, and paths with the exact values of an existing accepted task. For CLI commands, supply the source path, CPG database, and available qualification results file; use a new output report path.

Scenario 08 is conditional for the structural reviewer and requires an explicit compliance signal:

from src.digital_employees.runtime.scenarios import (
    RoleBoundScenarioInvocationRequest,
    invoke_role_bound_scenario_request,
)

request = RoleBoundScenarioInvocationRequest(
    query="Map the accepted coding and security requirements to revision-bound evidence.",
    employee_id="codegraph_reviewer",
    scenario_id="scenario_08",
    event_type="review_start",
    context={
        "project_key": "codegraph",
        "namespace": "default",
        "task_id": "<task-id>",
        "source_refs": ["<requirement-ref>", "<scope-ref>"],
        "file_paths": ["<bounded-path>"],
    },
)

result = invoke_role_bound_scenario_request(request)
if result.get("error"):
    raise RuntimeError(result["error"])
print(result["scenario_id"])
print(result.get("answer") or "")

The result contains scenario_08, a response in answer, and invocation details in metadata.role_bound_scenario_invocation. Compare the response with the requirements matrix: check the source or report reference, scope, and revision for each claim. Send this evidence package to the accountable reviewer.

For a negative check, pass context={}. Missing project_key, namespace, or task_id raises RuntimeError containing role_bound_scenario_contract_missing. Restore the task scope before retrying.

Use the command that matches the claim

Imported coding-standard rules

python -m src.cli standards check "<source-path>" --fail-on error --output "<violations.json>"

The check applies active imported standards to a file or directory and can save the findings as JSON. Preserve the selected document, categories, severities and rule versions with that output.

The current standards report implementation prints Report generation not yet implemented (requires stored violations) and returns exit code 1. Use the standards check --output artifact while persistent report generation is implemented and verified.

Code-quality and security-relevant audit

python -m src.cli audit --db "<cpg-path>" --format json --skip-llm-conclusion --skip-persistence

Before running, prepare the registered project and CPG for the revision under review. In the shown --skip-persistence mode, freshness is checked without writing: refresh a stale graph separately through its supported workflow before retrying. Compare the findings and completed checks with the requirements matrix. Send the report and source references to the security or review owner.

Qualification results

python -m src.cli qualification report --results "<results-path>" --format json --language en --output "<qualification.json>"

This command renders an existing results artifact. Preserve the suite, tool versions, dataset, profile, scopes and immutable raw results. Do not copy historical FP/FN values into evergreen documentation.

With --format json, the command reads the JSON in --results and writes its representation to --output. Data values are preserved; --language ru and --language en do not translate JSON content. Both locales can therefore use the same source results artifact.

After the command finishes, open the saved JSON and compare it with the input: check the suite, scope, revision, and metrics. Retain the input alongside the report. If the input file is missing, the command prints Results not found: <path> and returns exit code 1.

Who decides on the results

Failure and freshness rules

Fail closed when the requirement edition is unknown, the scope or revision is missing, the rule set differs from the claimed standard, raw qualification results are unavailable, or a required manual artifact is absent. Mark stale evidence explicitly; do not silently reuse a previous report.

Related guides

For revision review, continue with Code Review. To assess secure development processes, use the GOST R 56939 guide.