Add zero-trust solutions matrix and integrate metrics into release dashboard

Author: hkevin01

README.md

@@ -905,6 +905,37 @@ jobs:
 
 The suite now includes proof-style parity tests that run the same function behavior in both legacy Java and translated Python and assert identical outputs for shared input vectors.
 
+### What Is A Vector, Vectoring, And A Vector Runner?
+
+In this repository, a **vector** means one structured test case: input values plus the expected output.
+
+Example vector concept:
+- Input: `base=5`, `multiplier=10`, `premium=true`
+- Expected output: `75`
+
+That single row is one vector. A vector file is a list of many such rows (normal, edge, and negative scenarios).
+
+**Vectoring** is the testing approach where both runtimes (legacy Java and translated Python) are driven from that same shared vector dataset instead of hardcoded test values in multiple places.
+
+Why vectoring is useful:
+- Single source of truth for migration parity expectations
+- Less duplicated test data across languages
+- Easier reviews and audits of behavioral requirements
+- Faster updates when business rules change
+
+**Vector Runner** in this project:
+- `LegacyCalculatorVectorRunner.java` reads the shared JSON vectors
+- Executes the legacy Java function for each vector
+- Emits per-case output (`id, actual, expected`) for parity checks
+
+This is how we prove output equivalence:
+1. Define vectors in shared JSON/CSV fixture files
+2. Run legacy Java against those vectors
+3. Run translated Python against those same vectors
+4. Assert Java output equals Python output for each vector id
+
+This pattern gives an explicit migration proof: same inputs, same outputs, across runtimes.
+
 | Proof Test | What It Verifies | Location |
 |---|---|---|
 | Java fixture expected-value test | Legacy Java behavior is stable and explicit | `tests/correctness/test_legacy_java_python_equivalence.py` |
@@ -939,6 +970,25 @@ Fixture sources:
 
 Practical recommendation: keep a shared vector file and run both Java and Python against it, treating Java output as the initial oracle during migration.
 
+### Zero-Trust Solutions Matrix
+
+| Zero-Trust Control | What It Means | Project Implementation | Evidence |
+|---|---|---|---|
+| Verify identity on every request | No implicit trust by network location | JWT verification + RBAC dependency checks in API routes | `tests/negative/test_rbac_enforcement.py` |
+| Explicit policy decision per request | Each request must be allow/deny evaluated | Input guardrails, model lock, egress policy lock, blocked audit path | `tests/negative/test_model_blocking.py`, `tests/negative/test_egress_blocking.py`, `tests/adversarial/test_prompt_injection.py` |
+| Least privilege access | Users only get required capabilities | Role-permission mapping with permission-scoped endpoints | `core/auth.py`, `tests/negative/test_rbac_enforcement.py` |
+| Continuous verification | Runtime signals prove controls remain active | Audit report includes zero-trust rates, quality attestations, deny rate | `/api/v1/audit-report` zero-trust section |
+| Assume breach + contain blast radius | Treat unsafe inputs as hostile by default | Block injection/secret payloads and sanitize audit records | `guardrails/input_guard.py`, `guardrails/output_guard.py`, `tests/integration/test_audit_trail.py` |
+
+The release dashboard now includes a dedicated `zero_trust` section with:
+- `posture`
+- `identity_verification_rate`
+- `policy_decision_rate`
+- `continuous_verification_rate`
+- `policy_deny_rate`
+
+This makes zero-trust status measurable release-over-release instead of purely descriptive.
+
 ### Requirements-to-Implementation Mapping
 
 | Requirement (README) | Test (pytest) | Security Check | Quality Gate | Coverage |

core/audit_dashboard.py

@@ -68,18 +68,26 @@ def build_release_dashboard(records: list[dict[str, Any]]) -> dict[str, Any]:
     action_latencies: dict[str, list[float]] = defaultdict(list)
     action_loadrunner_pass: Counter[str] = Counter()
     action_loadrunner_total: Counter[str] = Counter()
+    identity_verified_count = 0
+    policy_decision_count = 0
+    continuous_verification_count = 0
 
     for record in records:
         action = str(record.get("action") or "unknown")
         action_counts[action] += 1
 
         status = str(record.get("status") or "unknown")
         status_counts[status] += 1
+        if status in {"ok", "blocked"} or isinstance(record.get("blocked"), bool):
+            policy_decision_count += 1
         if status == "ok":
             total_ok += 1
         if record.get("blocked") is True or status == "blocked":
             total_blocked += 1
 
+        if record.get("user_id") is not None or record.get("sub") is not None:
+            identity_verified_count += 1
+
         latency = record.get("latency_ms")
         if isinstance(latency, (int, float)):
             numeric_latency = float(latency)
@@ -109,6 +117,10 @@ def build_release_dashboard(records: list[dict[str, Any]]) -> dict[str, Any]:
             if isinstance(dpmo, (int, float)):
                 all_dpmo.append(float(dpmo))
 
+        # Continuous verification evidence: request carried runtime quality signals
+        if isinstance(record.get("ctq_metrics"), dict) and isinstance(record.get("loadrunner"), dict):
+            continuous_verification_count += 1
+
         loadrunner = record.get("loadrunner")
         if isinstance(loadrunner, dict):
             action_loadrunner_total[action] += 1
@@ -137,6 +149,20 @@ def build_release_dashboard(records: list[dict[str, Any]]) -> dict[str, Any]:
             "pass_rate": round(ctq_pass_counts[metric_name] / total, 3) if total else 0.0,
         }
 
+    total_records = len(records)
+    identity_rate = round(identity_verified_count / total_records, 3) if total_records else 0.0
+    policy_decision_rate = round(policy_decision_count / total_records, 3) if total_records else 0.0
+    continuous_verification_rate = round(continuous_verification_count / total_records, 3) if total_records else 0.0
+
+    if total_records == 0:
+        posture = "insufficient_data"
+    elif identity_rate >= 0.99 and policy_decision_rate >= 0.99 and continuous_verification_rate >= 0.95:
+        posture = "strong"
+    elif identity_rate >= 0.95 and policy_decision_rate >= 0.95:
+        posture = "moderate"
+    else:
+        posture = "needs_hardening"
+
     return {
         "generated_at": datetime.now(timezone.utc).isoformat(),
         "summary": {
@@ -159,6 +185,18 @@ def build_release_dashboard(records: list[dict[str, Any]]) -> dict[str, Any]:
             "sigma_band_counts": dict(sigma_band_counts),
             "control_state_counts": dict(control_state_counts),
         },
+        "zero_trust": {
+            "posture": posture,
+            "identity_verification_rate": identity_rate,
+            "policy_decision_rate": policy_decision_rate,
+            "continuous_verification_rate": continuous_verification_rate,
+            "policy_deny_rate": round(total_blocked / total_records, 3) if total_records else 0.0,
+            "signals": {
+                "identity_per_request": identity_rate >= 0.99,
+                "explicit_policy_decision_per_request": policy_decision_rate >= 0.99,
+                "runtime_quality_attestation": continuous_verification_rate >= 0.95,
+            },
+        },
     }
 
 

tests/integration/test_audit_trail.py

@@ -252,5 +252,9 @@ async def test_audit_report_endpoint_aggregates_release_dashboard(engineer_clien
     assert "translate_project" in body["actions"]
     assert "performance" in body
     assert "quality" in body
+    assert "zero_trust" in body
     assert "ctq_metrics" in body["quality"]
+    assert "posture" in body["zero_trust"]
+    assert 0.0 <= body["zero_trust"]["identity_verification_rate"] <= 1.0
+    assert 0.0 <= body["zero_trust"]["policy_decision_rate"] <= 1.0
     assert body["viewer"] == "audit-test-user"

tests/unit/test_audit_dashboard.py

@@ -0,0 +1,48 @@
+import pytest
+
+from core.audit_dashboard import build_release_dashboard
+
+
+pytestmark = pytest.mark.unit
+
+
+def test_release_dashboard_contains_zero_trust_section():
+    records = [
+        {
+            "action": "translate",
+            "status": "ok",
+            "blocked": False,
+            "user_id": "u1",
+            "latency_ms": 55.0,
+            "performance_status": "within_control",
+            "ctq_metrics": {"latency": "within_control", "reliability": "pass"},
+            "six_sigma": {"dpmo": 0.0, "sigma_band": "world_class", "control_state": "in_control"},
+            "loadrunner": {"transaction": "translate", "passed": True},
+        }
+    ]
+
+    dashboard = build_release_dashboard(records)
+
+    assert "zero_trust" in dashboard
+    assert dashboard["zero_trust"]["posture"] in {"strong", "moderate", "needs_hardening", "insufficient_data"}
+    assert dashboard["zero_trust"]["identity_verification_rate"] == 1.0
+    assert dashboard["zero_trust"]["policy_decision_rate"] == 1.0
+
+
+def test_release_dashboard_zero_trust_needs_hardening_without_identity_signal():
+    records = [
+        {
+            "action": "translate",
+            "status": "ok",
+            "blocked": False,
+            "latency_ms": 60.0,
+            "performance_status": "within_control",
+            "ctq_metrics": {"latency": "within_control"},
+            "loadrunner": {"transaction": "translate", "passed": True},
+        }
+    ]
+
+    dashboard = build_release_dashboard(records)
+
+    assert dashboard["zero_trust"]["identity_verification_rate"] == 0.0
+    assert dashboard["zero_trust"]["posture"] == "needs_hardening"