remedi(ghx): residual containment notes after #133

packages/governance-assurance/src/data/evidence.cjs

@@ -267,16 +267,19 @@ const EVIDENCE_BINDINGS = [
     controls: ["GA-39"],
     informs: false,
     counts: false,
-    artifacts: ["docs/internal/investor-demo-wave2/WAVE2-MANIFEST.json"],
+    artifacts: [],
     producer: "investor-demo package",
-    source: "WAVE2-MANIFEST.json",
-    version: "0.0.0-unstable-pre-1.0",
+    source: "unavailable on the public tip",
+    version: "unavailable",
     timestamp: "UNKNOWN",
     freshness: "NOT_APPLICABLE",
     proof: "NOT_COMPLIANCE_ELIGIBLE",
-    result: "NOT_COMPLIANCE_PROOF",
-    state: "DEMO_NOT_COMPLIANCE_PROOF",
-    limits: ["external_proof is NOT_PROVED_EXTERNAL. A demo is never compliance proof."],
+    result: "UNAVAILABLE_PRIVATE_TREE_REMOVED",
+    state: "UNAVAILABLE_PRIVATE_TREE_REMOVED",
+    limits: [
+      "docs/internal/investor-demo-wave2/WAVE2-MANIFEST.json is not on the public tip. This row does not add a public substitute.",
+      "external_proof is NOT_PROVED_EXTERNAL. A demo is never compliance proof.",
+    ],
     banned: ["Do not use the investor demo as evidence that a control is met."],
   }),
   binding({

tests/governance-assurance/catalog.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -58,3 +67,4 @@ test("package stays private and off the shipping workspace", () => {
   assert.match(boundary, /PENDING_INDEPENDENT_COUNCIL/);
   assert.match(boundary, /WS17_GOVERNANCE_ASSURANCE_0_2_0_INTERNAL_REBIND_READY_FOR_COUNCIL/);
 });
+}

tests/governance-assurance/evidence.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
@@ -122,3 +131,4 @@ test("rejected sole proofs and producer self-verification cannot count", () => {
   const promoted = { ...control, verification_state: "INDEPENDENTLY_TESTED" };
   assert.equal(api.bindingCountsFor(self, promoted), false);
 });
+}

tests/governance-assurance/holds.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -128,3 +137,4 @@ test("merged ingress, egress, and Unit E stay off satisfaction", () => {
     }
   }
 });
+}

tests/governance-assurance/posture.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -139,3 +148,4 @@ test("committed reports match a fresh generation", () => {
     assert.equal(text, expected, name);
   }
 });
+}

tests/governance-assurance/rebind.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -120,3 +129,4 @@ test("installer denylist and frozen packages stay untouched", () => {
   assert.equal(cli.version, "0.3.24");
   assert.equal(npmSdk.version, "0.2.4");
 });
+}

tests/optics-node-adapter/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
@@ -203,3 +212,4 @@ test("internal docs carry the inert banner", () => {
   const report = read("docs/internal/optics-pkg02-unit-b/IMPLEMENTATION-REPORT.md");
   assert.equal(report.includes("OPTICS_PKG02_UNIT_B_READY_FOR_COUNCIL"), true);
 });
+}

tests/optics-o7-node-binding-council/direct.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const os = require("node:os");
@@ -128,3 +137,4 @@ test("no package manifest gained a sqlite dependency and the live facade uses th
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+}

tests/optics-o7-runtime/direct.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const { spawnSync } = require("node:child_process");
 const crypto = require("node:crypto");
@@ -439,3 +448,4 @@ floorTest("a lock does not wait and a symlink store path is refused", () => {
     fs.rmSync(linkDir, { recursive: true, force: true });
   }
 });
+}

tests/optics-otel-i3/direct.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -229,3 +238,4 @@ test("mapping package export stays disabled", () => {
   assert.equal(JSON.stringify(result).includes(prompt), false);
   assert.equal(mapping.mappingDocument().i3_status, "NOT_AUTHORIZED");
 });
+}

tests/optics-otel-i3/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -110,3 +119,4 @@ test("new I3 files match the documentation-release stale-name gate", async () =>
     assert.equal(count, 0, path.relative(ROOT, file));
   }
 });
+}

tests/optics-otel-mapping/mapping.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -548,3 +557,4 @@ test("string HTTP status is not coerced and default ports are not invented", ()
   assert.equal(preview.span.client, null);
   assert.equal(preview.candidates["url.scheme"], "https");
 });
+}

tests/optics-pkg02-reader-compat-gates/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
@@ -232,3 +241,4 @@ test("no Unit D or Unit E package is added", () => {
   assert.equal(diff.includes("packages/vantio-agent-sdk-py/"), false);
   assert.equal(diff.includes("packages/vantio-agent-sdk/"), false);
 });
+}

tests/optics-pkg02-unit-d/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const { execFileSync, spawnSync } = require("node:child_process");
 const fs = require("node:fs");
@@ -126,3 +135,4 @@ test("the future launcher does not start a Python writer", () => {
   assert.equal(child.status, 1);
   assert.equal(String(child.stdout || "").includes("1"), false);
 });
+}

tests/optics-pkg02-unit-f/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
@@ -224,3 +233,4 @@ test("internal docs carry the inert banner and the council classification", () =
   assert.equal(report.includes("OPTICS_PKG02_UNIT_F_READY_FOR_COUNCIL"), true);
   assert.equal(report.includes("NOT_AUTHORIZED"), true);
 });
+}

tests/optics-python-adapter/test_isolation.py

@@ -8,6 +8,13 @@
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[2]
+
+
+def setUpModule():
+    if not (ROOT / "docs" / "internal").exists():
+        raise unittest.SkipTest("PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP")
+
+
 sys.path.insert(0, str(ROOT / "packages" / "optics-python-adapter" / "src"))
 sys.path.insert(0, str(ROOT / "packages" / "vantio-agent-sdk-py"))
 

tests/optics-record-vocabulary/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const { execFileSync, spawnSync } = require("node:child_process");
 const fs = require("node:fs");
@@ -287,3 +296,4 @@ test("internal docs carry the inert banner", () => {
   const report = read("docs/internal/optics-pkg02-unit-a/IMPLEMENTATION-REPORT.md");
   assert.equal(report.includes("OPTICS_PKG02_UNIT_A_READY_FOR_COUNCIL"), true);
 });
+}

tests/pe-egress/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -74,3 +83,4 @@ describe("isolation", () => {
     assert.equal(manifest.python_version_untouched, "3.1.0");
   });
 });
+}

tests/pe-host-authority/isolation.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -44,3 +53,4 @@ test("the proof tree does not carry a council pass token", () => {
     assert.equal(text.includes("PE_HOST_AUTHORITY_COUNCIL_PASSED"), false, file);
   }
 });
+}

tests/pe-host-authority/manifest.test.cjs

@@ -1,5 +1,14 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
+const { test: privateTreeSkipTest } = require("node:test");
+
+if (!fs.existsSync(path.resolve(__dirname, "../../docs/internal"))) {
+  privateTreeSkipTest("docs/internal", { skip: "PRIVATE_TREE_REMOVED_FROM_PUBLIC_TIP" }, () => {});
+} else {
+"use strict";
+
 const assert = require("node:assert/strict");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
@@ -45,3 +54,4 @@ test("coverage notes name every surface and stay internal", () => {
     }
   }
 });
+}