Neo Governance scroll-world cinematic - #5
Conversation
Extend scf_mapper to resolve SCF crosswalks for ISO/IEC 42001:2023 and NIST AI 100-1, enrich lab hubs with AAT/GOV controls so those sheets populate, and overlay AIUC-1 requirement IDs alongside KSI/CR26.
Absorb upstream patterns without citing external repositories. Introduce a content-addressed evidence lake with scheduled collectors (cron, Actions template, Lambda), control/KSI evaluation, and an academy Trust Center that surfaces persistence and multi-framework mappings.
Move Trust Center export to trust/, remove academy coupling from evidence_lake, add PACKAGE.md + pyproject.toml, and keep the academy as an optional learning site only.
Ship a standalone scroll-scrubbed flight through the assurance spine (edge → datacenter → encrypt → agents → evidence lake → frameworks → Trust Center), with scene stills, Ken-Burns dive/connector clips, a lightning particle overlay, gist talking points, and a pipeline to upgrade to frame-locked AI camera video later.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Important Review skippedToo many files! This PR contains 115 files, which is 15 over the limit of 100. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (20)
📒 Files selected for processing (115)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Assemble world + trust into _site/, publish to gh-pages, and lead docs/PR experience with the public URL.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 13577c5133
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| elif uri.startswith("s3://"): | ||
| # Local mirror path; sync helpers can push to S3 separately. | ||
| self.root = DEFAULT_LAKE_ROOT | ||
| self.s3_uri = uri |
There was a problem hiding this comment.
When the SAM function is invoked with an s3:// lake URI, this branch still selects DEFAULT_LAKE_ROOT under /var/task/evidence/lake; Lambda's deployed code directory is read-only, and the ignored objects/ directory must be created there, so initialization fails before collection. Even if local writes succeeded, s3_uri is only recorded as metadata and no code uploads the results, meaning the hourly function cannot preserve evidence in the configured bucket.
Useful? React with 👍 / 👎.
| if fw_ok: | ||
| notes.append("framework satisfaction collected") | ||
| return "pass", notes |
There was a problem hiding this comment.
Do not pass every remaining control merely because the framework-satisfaction collector succeeded: on a fresh lake, running only cycle --collector framework_satisfaction currently reports 11 of 12 controls as passing, including MFA, encryption, public-access, DLP, and TPRM controls for which no operational evidence was collected. This publishes materially false Trust Center results; framework mappings should describe bindings while each control's status remains unknown until its own required evidence is present.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| "severity": "ok" if summary.get("scf_hubs_errors", 1) == 0 else "warn", | ||
| "lab_controls": summary.get("lab_controls"), | ||
| "scf_hubs_errors": summary.get("scf_hubs_errors"), | ||
| "sha256": obj["sha256"], | ||
| } | ||
| ) | ||
| return lake.finish_run(run, status="ok", findings=findings) |
There was a problem hiding this comment.
When scf_hubs_errors is nonzero, the finding becomes only a warning but the run is still finalized as ok. The evaluator defines fw_ok from this run status, so a stale or incomplete SCF cache is subsequently treated as successful framework satisfaction and can produce passing control claims despite unresolved mappings; finalize such runs as degraded/fail or make the evaluator inspect the error count.
Useful? React with 👍 / 👎.
| obj = self.put_json(snapshot, meta={"kind": "trust_snapshot"}) | ||
| snapshot["sha256"] = obj["sha256"] | ||
| out = self.trust / "latest.json" | ||
| out.write_text(json.dumps(snapshot, indent=2) + "\n") |
There was a problem hiding this comment.
Compute the public digest over the representation that is actually exported, or explicitly export the hashed payload separately. put_json(snapshot) hashes the snapshot before the sha256 field is inserted, after which a different JSON document is written to latest.json and trust/trust-snapshot.json; consequently the committed snapshot's advertised SHA-256 does not match its bytes, so a Trust Center reviewer cannot verify the displayed digest against the public artifact.
AGENTS.md reference: AGENTS.md:L30-L30
Useful? React with 👍 / 👎.
| [tool.setuptools.packages.find] | ||
| include = ["practice*"] | ||
| exclude = ["academy*", "boards*", "research*"] | ||
|
|
||
| [tool.setuptools.package-data] | ||
| practice = ["**/*.json", "**/*.md", "**/*.yaml", "**/*.yml"] |
There was a problem hiding this comment.
Package the top-level mappings/, evidence/, scripts/, and Trust Center assets, or stop resolving them relative to the source checkout. A normal wheel/install includes only practice* packages and package data beneath practice, while the neo-evidence entrypoint reads ${ROOT}/mappings/lab-control-scf.json, public evidence, and verifier scripts; outside an editable source checkout, neo-evidence cycle therefore fails with missing files instead of providing the advertised offline-first package.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| ## 2026-07-31 — Public parity with grc-engineering-pipeline | ||
|
|
||
| - Aligned with https://github.com/jtflack-grc/grc-engineering-pipeline public proof patterns. | ||
| - Aligned with public proof patterns. |
There was a problem hiding this comment.
Add a new dated entry describing the evidence lake, Trust Center, SCF expansion, packaging, and scroll-world work. This commit only rewrites wording in two existing July 31 entries, leaving all of its meaningful new functionality unrecorded despite the repository's explicit edit-log requirement.
AGENTS.md reference: AGENTS.md:L7-L7
Useful? React with 👍 / 👎.
| @@ -0,0 +1,56 @@ | |||
| # Package layout — Neo Governance (standalone) vs Academy | |||
There was a problem hiding this comment.
Move this newly authored package-layout synthesis under wiki/ and link to it from operational entrypoints as needed. Adding a standalone synthesis document at the repository root directly violates the repository rule that synthesis be written only in wiki/.
AGENTS.md reference: AGENTS.md:L6-L6
Useful? React with 👍 / 👎.
| @@ -0,0 +1,56 @@ | |||
| # Package layout — Neo Governance (standalone) vs Academy | |||
|
|
|||
| This repository contains **two products**. They must not depend on each other at runtime. | |||
There was a problem hiding this comment.
Split this change into focused sessions: it simultaneously introduces the evidence-lake runtime and deployment, expands SCF mappings, creates packaging, and adds a large cinematic product, while explicitly describing multiple products in the same change and not updating handoff/agent-progress.md or features.json. That conflicts with the repository's one-feature-per-session and handoff requirement and makes the resulting state difficult to review or resume safely.
AGENTS.md reference: AGENTS.md:L32-L32
Useful? React with 👍 / 👎.
1 participant
Summary
world/scroll-scrubbed camera flight through the Neo assurance spine (not academy)/, Trust Center at/trust/Experience (canonical)
https://kfcain.github.io/Neo-Governance-GRC-Agent/
Trust Center: https://kfcain.github.io/Neo-Governance-GRC-Agent/trust/
# republish after content changes ./scripts/publish-gh-pages.shLocal preview of the same tree:
Docs:
deploy/pages/README.md·world/GIST.md·world/pipeline/Test plan
/trust/./world/scripts/encode-from-stills.shregenerates clips