feat(standards): Closes GT-663 — the ISO/IEC 5055 measurement now says what it is a fraction of

reference/core/control-center/evidence/gap-closure-evidence.json

@@ -9908,6 +9908,23 @@
       ],
       "dependencyDisposition": "accepted-scope",
       "dependencyRationale": "Coverage of this pack is the coverage of whatever analyser the tenant points it at, never the 138 weaknesses the standard names, and notEvaluableHere records that rather than leaving a reader to infer it. Publishing a rule per weakness would advertise 138 checks nothing performs - GT-585 measured what that produces here. Deliberately NOT done: scoring. A count of weaknesses is not a compliance verdict and the standard's scoring is a policy decision belonging to a tenant's selected ruleset. Two defects were surfaced and fixed rather than recorded: GOV-CORE-UNRESOLVED misdiagnosing a narrowed run as an unresolved Core, and a run reporting passed over skipped rules once that misdiagnosis was out of the way."
+    },
+    {
+      "id": "GT-663",
+      "closedAt": "2026-08-09",
+      "closureCommit": "059c8772",
+      "evidence": [
+        "src/packages/core-domain/src/application/validators/standards/iso-5055-coverage.ts",
+        "src/packages/core-domain/src/application/validators/standards/iso-5055-coverage.spec.ts",
+        "src/packages/core-domain/src/application/validators/enforcement/adapters/iso-5055-adapter.ts"
+      ],
+      "validationCommands": [
+        "npx jest --config src/packages/core-domain/jest.config.js --testPathPatterns iso-5055 -> 35 passed.",
+        "iso5055CoverageFromSarif over the 75 live CodeQL alerts -> observed 10 of 138; Security 10/74 (34 findings), Reliability 0/74, Performance Efficiency 0/18, Maintainability 2/31; 28 out of scope, 13 untagged.",
+        "describeIso5055Coverage -> the sentence names the floor as a FLOOR and states it says nothing about the remaining 128."
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Deliberately NOT computed: what the analyser COULD have found. That needs the scanner's own rule catalogue - a vendor call for CodeQL, a registry fetch for semgrep - and a 'could have' number derived from anything less would invent the assurance this row exists to withhold. observed is a floor and is labelled one. The measurement also makes the next step evidenced rather than asserted: Reliability 0/74 and Performance Efficiency 0/18 say CodeQL does not look there at all, which is the concrete argument for adding a second analyser."
     }
   ]
 }

reference/core/control-center/gaps/gap-reference-catalog.es.md

@@ -8617,3 +8617,37 @@ La lección es la del propio tablero y esta vez la pagó quien medía: un `conta
 
 **Lo que la rebanada 1 deliberadamente NO hace:** puntuar, ni descartar hallazgos fuera de alcance. Un conteo de debilidades no es un veredicto de cumplimiento, y la puntuación del estándar es una decisión de política que pertenece al ruleset que el tenant seleccione. Los hallazgos cuyos CWE el estándar no nombra se devuelven con medidas vacías en vez de descartarse, porque «este escaneo no encontró nada que a ISO 5055 le importe» y «este escaneo no encontró nada» son reportes distintos y solo uno habla del código.
 
+#### GT-663
+
+**Title:** La medición ISO/IEC 5055 no tenía denominador — «no encontró ninguna» se leía igual que «no busca ninguna»
+
+- **Purpose:** Hacer legible un veredicto ISO/IEC 5055 publicando de qué es fracción.
+- **Evidence:** `GT-662` hizo real la medición: los hallazgos de CodeQL de este repositorio mapean a **34 violaciones sobre 10 debilidades distintas**. Lo que el reporte no podía decir es *de cuántas*. El estándar nombra **138**, así que una corrida que no encuentra nada se lee idéntica tanto si el analizador busca las 138 como si no busca ninguna — **y lo segundo es el caso común**, porque la cobertura aquí es la del ANALIZADOR y nunca la del estándar. Es la forma exacta que `GT-569` arregló para la cobertura de reglas un nivel más abajo: un conteo sin su denominador redefine en silencio lo que cuenta.
+- **Impact:** Un veredicto ISO/IEC 5055 verde es la salida más citable que produce este motor para el ICP de la §11.2 del posicionamiento. Enviado sin denominador es una garantía que nadie se ganó.
+- **Affected files:** `src/packages/core-domain/src/application/validators/standards/iso-5055-coverage.ts`
+- **Component:** `Evolith Core` · **Criticality:** P2 · **Complexity:** S
+- **Principal:** `S` · **Interest:** `MED` · **Basis:** `estimate`
+- **Acceptance criteria:**
+  - [x] Todo reporte ISO/IEC 5055 lleva el número de debilidades distintas observadas Y las 138 que nombra el estándar, por medida y en total.
+  - [x] El número se etiqueta como SUELO en el texto que viaja con él, y nunca afirma que las no observadas estén ausentes.
+  - [x] «Fuera del estándar» y «el analizador no etiquetó nada» se cuentan por separado, porque significan cosas distintas.
+  - [x] Medido contra los hallazgos reales de este repositorio, no contra un fixture.
+- **Status:** `COMPLETADO` (2026-08-09)
+
+**ENTREGADO el 2026-08-09.** `iso5055CoverageFromSarif` reporta **observadas / 138**, por medida, junto a los hallazgos; `describeIso5055Coverage` escribe la única frase que comparten todas las superficies, para que el matiz no lo pueda quitar quien renderice.
+
+**Medido sobre los hallazgos vivos de CodeQL de este repositorio — y el resultado es un hallazgo de producto, no solo de test:**
+
+| medida | observadas / total | hallazgos |
+|---|---|---|
+| Security | **10 / 74** | 34 |
+| Reliability | **0 / 74** | 0 |
+| Performance Efficiency | **0 / 18** | 0 |
+| Maintainability | **2 / 31** | 2 |
+
+**Dos de las cuatro medidas están en cero, y nada lo decía antes.** CodeQL no busca debilidades de Reliability ni de Performance Efficiency en absoluto — que es el argumento concreto y con evidencia para añadir un segundo analizador, y era invisible mientras el reporte no tenía denominador. También sale a la luz: **28 hallazgos llevaban un CWE fuera del estándar y 13 no llevaban ninguno**, contados por separado porque «no está en ISO/IEC 5055» y «el analizador no nos dijo nada mapeable» son hechos distintos y solo uno habla del código.
+
+**El aviso se emite SOLO en una corrida limpia, y una vez.** Es cuando el denominador importa y cuando el reporte antes callaba; cuando hay hallazgos el lector ya tiene algo concreto que hacer, y repetir el matiz por hallazgo le enseñaría a saltárselo. No bloqueante por construcción —las reglas del pack son `blocking: false`— así que informa un veredicto y nunca lo decide.
+
+**Lo que se niega a calcular deliberadamente:** qué PODRÍA haber encontrado el analizador. Eso necesita el catálogo de reglas del propio escáner —una llamada al proveedor para CodeQL, una al registro para semgrep— y un número de «podría» derivado de menos que eso inventaría justo la garantía que esta ficha existe para no dar. Por eso `observed` es un suelo y está etiquetado como tal.
+

reference/core/control-center/gaps/gap-reference-catalog.md

@@ -8711,3 +8711,37 @@ The lesson is the board's own, and this time the measurer paid it: a `contains`
 
 **What slice 1 deliberately does NOT do:** score, and drop out-of-scope findings. A count of weaknesses is not a compliance verdict, and the standard's scoring is a policy decision belonging to a tenant's selected ruleset. Findings whose CWEs the standard does not name are returned with empty measures rather than discarded, because «this scan found nothing ISO 5055 cares about» and «this scan found nothing» are different reports and only one is about the code.
 
+#### GT-663
+
+**Title:** The ISO/IEC 5055 measurement had no denominator — «found none» read the same as «looks for none»
+
+- **Purpose:** Make an ISO/IEC 5055 verdict legible by publishing what it is a fraction OF.
+- **Evidence:** `GT-662` made the measurement real: this repository's CodeQL findings map to **34 violations across 10 distinct weaknesses**. What the report could not say is *of how many*. The standard names **138**, so a run that finds nothing reads identically whether the analyser looks for all 138 or for none of them — **and the second is the common case**, because coverage here is the ANALYSER's and never the standard's. This is the exact shape `GT-569` fixed for rule coverage one level down: a count without its denominator silently redefines what it counts.
+- **Impact:** A green ISO/IEC 5055 verdict is the single most quotable output this engine produces for the ICP in §11.2 of the positioning. Shipped without a denominator it is an assurance nobody earned.
+- **Affected files:** `src/packages/core-domain/src/application/validators/standards/iso-5055-coverage.ts`
+- **Component:** `Evolith Core` · **Criticality:** P2 · **Complexity:** S
+- **Principal:** `S` · **Interest:** `MED` · **Basis:** `estimate`
+- **Acceptance criteria:**
+  - [x] Every ISO/IEC 5055 report carries the number of distinct weaknesses observed AND the 138 the standard names, per measure as well as overall.
+  - [x] The number is labelled a FLOOR in the text that travels with it, and never claims the unobserved weaknesses are absent.
+  - [x] «Outside the standard» and «the analyser tagged nothing» are counted separately, because they mean different things.
+  - [x] Measured against this repository's real findings, not a fixture.
+- **Status:** `DONE` (2026-08-09)
+
+**DELIVERED 2026-08-09.** `iso5055CoverageFromSarif` reports **observed / 138**, per measure, alongside the findings; `describeIso5055Coverage` writes the one sentence all surfaces share, so the caveat cannot be dropped by whoever renders it.
+
+**Measured on this repository's live CodeQL findings — and the result is a product finding, not just a test:**
+
+| measure | observed / total | findings |
+|---|---|---|
+| Security | **10 / 74** | 34 |
+| Reliability | **0 / 74** | 0 |
+| Performance Efficiency | **0 / 18** | 0 |
+| Maintainability | **2 / 31** | 2 |
+
+**Two of the four measures are at zero, and nothing said so before.** CodeQL does not look for Reliability or Performance Efficiency weaknesses at all — which is the concrete, evidenced argument for adding a second analyser, and it was invisible while the report had no denominator. Also surfaced: **28 findings carried a CWE outside the standard and 13 carried none at all**, both counted separately because «not in ISO/IEC 5055» and «the analyser told us nothing we could map» are different facts and only one of them is about the code.
+
+**The advisory is emitted ONLY on a clean run, and once.** That is when the denominator matters and when the report used to be silent; when there are findings the reader already has something concrete to act on, and repeating the caveat per finding would train them to skip it. Non-blocking by construction — the pack's rules are `blocking: false` — so it informs a verdict and never decides one.
+
+**What it deliberately refuses to compute:** what the analyser COULD have found. That needs the scanner's own rule catalogue — a vendor call for CodeQL, a registry fetch for semgrep — and a «could have» number derived from anything less would invent the very assurance this row exists to withhold. So `observed` is a floor and is labelled one.
+