expectation/waiver policy layer

src/guide_board/execution.py

@@ -11,6 +11,7 @@ from guide_board.artifacts import build_artifact_manifest
 from guide_board.io import write_json
 from guide_board.mapping import build_mapping_records, summarize_mappings
 from guide_board.planning import build_run_plan
+from guide_board.policy import apply_policy
 from guide_board.runners import run_step
 from guide_board.schema import assert_valid
 
@@ -34,6 +35,7 @@ def run_assessment(
         assert_valid(item, "evidence-item")
 
     findings = _findings_for_evidence(run_id, evidence)
+    findings, policy_summary, applied_waivers = apply_policy(root, plan, findings)
     for finding in findings:
         assert_valid(finding, "finding")
 
@@ -48,6 +50,8 @@ def run_assessment(
         findings,
         artifact_manifest,
         mapping_summary,
+        policy_summary,
+        applied_waivers,
         created_at,
     )
     assert_valid(assessment_package, "assessment-package")
@@ -125,6 +129,7 @@ def _findings_for_evidence(run_id: str, evidence: list[dict[str, Any]]) -> list[
             {
                 "id": f"finding:{item['check_id']}",
                 "run_id": run_id,
+                "check_id": item["check_id"],
                 "status": item["result"],
                 "severity": _severity_for_item(item),
                 "classification": _classification_for_item(item),
@@ -132,6 +137,7 @@ def _findings_for_evidence(run_id: str, evidence: list[dict[str, Any]]) -> list[
                 "evidence_refs": [item["id"]],
                 "expected": _expected_for_item(item),
                 "waiver_ref": None,
+                "policy_ref": None,
                 "remediation": _remediation_for_item(item),
             }
         )
@@ -188,6 +194,8 @@ def _assessment_package(
     findings: list[dict[str, Any]],
     artifact_manifest: list[dict[str, Any]],
     mapping_summary: dict[str, Any],
+    policy_summary: dict[str, Any],
+    applied_waivers: list[dict[str, Any]],
     created_at: str,
 ) -> dict[str, Any]:
     summary = dict(Counter(item["result"] for item in evidence))
@@ -202,10 +210,11 @@ def _assessment_package(
         "source_lock": plan["source_lock"],
         "summary": summary,
         "mapping_summary": mapping_summary,
+        "policy_summary": policy_summary,
         "findings": findings,
         "evidence_refs": [item["id"] for item in evidence],
         "artifact_manifest": artifact_manifest,
-        "waivers": [],
+        "waivers": applied_waivers,
         "certification_boundary": "Guide Board produces preparation evidence only and does not issue certifications or audit assurance.",
         "created_at": created_at,
     }
@@ -246,6 +255,7 @@ def _markdown_report(run_metadata: dict[str, Any], package: dict[str, Any]) -> s
     if not summary_lines:
         summary_lines = "- no evidence produced"
     mapping_lines = _mapping_summary_lines(package)
+    policy_lines = _policy_summary_lines(package)
 
     return "\n".join(
         [
@@ -263,6 +273,10 @@ def _markdown_report(run_metadata: dict[str, Any], package: dict[str, Any]) -> s
             "",
             mapping_lines,
             "",
+            "## Policy",
+            "",
+            policy_lines,
+            "",
             "## Boundary",
             "",
             package["certification_boundary"],
@@ -285,6 +299,17 @@ def _mapping_summary_lines(package: dict[str, Any]) -> str:
     return "\n".join(lines)
 
 
+def _policy_summary_lines(package: dict[str, Any]) -> str:
+    summary = package.get("policy_summary", {})
+    return "\n".join(
+        [
+            f"- applied expectations: {summary.get('applied_expectations', 0)}",
+            f"- applied waivers: {summary.get('applied_waivers', 0)}",
+            f"- unexpected findings: {summary.get('unexpected_findings', 0)}",
+        ]
+    )
+
+
 def _run_status(evidence: list[dict[str, Any]]) -> str:
     if any(item["result"] == "fail" for item in evidence):
         return "failed"