Add step 601 compliance evidence bundle

editor/CMakeLists.txt

@@ -4288,4 +4288,13 @@ target_link_libraries(step600_test PRIVATE
     tree_sitter_javascript tree_sitter_typescript
     tree_sitter_java tree_sitter_rust tree_sitter_go)
 
+add_executable(step601_test tests/step601_test.cpp)
+target_include_directories(step601_test PRIVATE src)
+target_link_libraries(step601_test PRIVATE
+    nlohmann_json::nlohmann_json
+    unofficial::tree-sitter::tree-sitter
+    tree_sitter_python tree_sitter_cpp tree_sitter_elisp
+    tree_sitter_javascript tree_sitter_typescript
+    tree_sitter_java tree_sitter_rust tree_sitter_go)
+
 # Step 12: Dear ImGui shell scaffolding created (main.cpp exists but not built due to dependencies)

editor/src/ComplianceEvidenceBundle.h

@@ -0,0 +1,57 @@
+#pragma once
+// Step 601: Compliance Evidence Bundle
+
+#include <map>
+#include <string>
+#include <vector>
+
+struct ComplianceEvidenceItem {
+    std::string itemId;
+    std::string controlId;
+    std::string artifactPath;
+    std::string summary;
+};
+
+class ComplianceEvidenceBundle {
+public:
+    bool addEvidence(const ComplianceEvidenceItem& item, std::string* error) {
+        if (!error) return false;
+        error->clear();
+        if (item.itemId.empty()) return fail(error, "item_id_missing");
+        if (item.controlId.empty()) return fail(error, "control_id_missing");
+        if (item.artifactPath.empty()) return fail(error, "artifact_path_missing");
+        if (item.summary.empty()) return fail(error, "summary_missing");
+        if (items_.count(item.itemId) != 0) return fail(error, "item_duplicate");
+        items_[item.itemId] = item;
+        order_.push_back(item.itemId);
+        return true;
+    }
+
+    std::vector<ComplianceEvidenceItem> byControl(const std::string& controlId) const {
+        std::vector<ComplianceEvidenceItem> out;
+        for (const auto& id : order_) {
+            const auto& item = items_.at(id);
+            if (controlId.empty() || item.controlId == controlId) out.push_back(item);
+        }
+        return out;
+    }
+
+    int controlCoverageCount() const {
+        std::map<std::string, bool> controls;
+        for (const auto& id : order_) controls[items_.at(id).controlId] = true;
+        return static_cast<int>(controls.size());
+    }
+
+    int artifactCount() const {
+        return static_cast<int>(order_.size());
+    }
+
+private:
+    std::map<std::string, ComplianceEvidenceItem> items_;
+    std::vector<std::string> order_;
+
+    static bool fail(std::string* error, const char* code) {
+        *error = code;
+        return false;
+    }
+};

editor/tests/step601_test.cpp

@@ -0,0 +1,155 @@
+// Step 601: Compliance Evidence Bundle (12 tests)
+
+#include "ComplianceEvidenceBundle.h"
+
+#include <iostream>
+
+static int passed = 0, failed = 0;
+#define TEST(name) { std::cout << "  " << #name << "... "; }
+#define PASS() { std::cout << "PASS\n"; ++passed; }
+#define FAIL(msg) { std::cout << "FAIL: " << msg << "\n"; ++failed; }
+#define CHECK(cond, msg) if (!(cond)) { FAIL(msg); return; } else {}
+
+static ComplianceEvidenceItem item(const std::string& id,
+                                   const std::string& control) {
+    return {id, control, "/artifacts/" + id + ".json", "summary"};
+}
+
+void test_add_evidence_success() {
+    TEST(add_evidence_success);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "add should succeed");
+    CHECK(b.artifactCount() == 1, "artifact count mismatch");
+    PASS();
+}
+
+void test_add_evidence_rejects_missing_item_id() {
+    TEST(add_evidence_rejects_missing_item_id);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    auto e = item("", "ctrl-a");
+    CHECK(!b.addEvidence(e, &error), "add should fail");
+    CHECK(error == "item_id_missing", "wrong error");
+    PASS();
+}
+
+void test_add_evidence_rejects_missing_control_id() {
+    TEST(add_evidence_rejects_missing_control_id);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    auto e = item("e1", "");
+    CHECK(!b.addEvidence(e, &error), "add should fail");
+    CHECK(error == "control_id_missing", "wrong error");
+    PASS();
+}
+
+void test_add_evidence_rejects_missing_artifact_path() {
+    TEST(add_evidence_rejects_missing_artifact_path);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    auto e = item("e1", "ctrl-a");
+    e.artifactPath.clear();
+    CHECK(!b.addEvidence(e, &error), "add should fail");
+    CHECK(error == "artifact_path_missing", "wrong error");
+    PASS();
+}
+
+void test_add_evidence_rejects_missing_summary() {
+    TEST(add_evidence_rejects_missing_summary);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    auto e = item("e1", "ctrl-a");
+    e.summary.clear();
+    CHECK(!b.addEvidence(e, &error), "add should fail");
+    CHECK(error == "summary_missing", "wrong error");
+    PASS();
+}
+
+void test_add_evidence_rejects_duplicate() {
+    TEST(add_evidence_rejects_duplicate);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "first add failed");
+    CHECK(!b.addEvidence(item("e1", "ctrl-b"), &error), "duplicate should fail");
+    CHECK(error == "item_duplicate", "wrong error");
+    PASS();
+}
+
+void test_by_control_filters_results() {
+    TEST(by_control_filters_results);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "add e1 failed");
+    CHECK(b.addEvidence(item("e2", "ctrl-b"), &error), "add e2 failed");
+    CHECK(b.byControl("ctrl-a").size() == 1, "filter size mismatch");
+    PASS();
+}
+
+void test_by_control_empty_returns_all() {
+    TEST(by_control_empty_returns_all);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "add e1 failed");
+    CHECK(b.addEvidence(item("e2", "ctrl-b"), &error), "add e2 failed");
+    CHECK(b.byControl("").size() == 2, "empty filter should return all");
+    PASS();
+}
+
+void test_control_coverage_count_unique_controls() {
+    TEST(control_coverage_count_unique_controls);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "add e1 failed");
+    CHECK(b.addEvidence(item("e2", "ctrl-a"), &error), "add e2 failed");
+    CHECK(b.addEvidence(item("e3", "ctrl-b"), &error), "add e3 failed");
+    CHECK(b.controlCoverageCount() == 2, "coverage count mismatch");
+    PASS();
+}
+
+void test_artifact_count_matches_entries() {
+    TEST(artifact_count_matches_entries);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "add e1 failed");
+    CHECK(b.addEvidence(item("e2", "ctrl-b"), &error), "add e2 failed");
+    CHECK(b.artifactCount() == 2, "artifact count mismatch");
+    PASS();
+}
+
+void test_empty_bundle_counts_zero() {
+    TEST(empty_bundle_counts_zero);
+    ComplianceEvidenceBundle b;
+    CHECK(b.artifactCount() == 0, "empty artifact count should be zero");
+    CHECK(b.controlCoverageCount() == 0, "empty control count should be zero");
+    PASS();
+}
+
+void test_by_control_unknown_returns_empty() {
+    TEST(by_control_unknown_returns_empty);
+    ComplianceEvidenceBundle b;
+    std::string error;
+    CHECK(b.addEvidence(item("e1", "ctrl-a"), &error), "add e1 failed");
+    CHECK(b.byControl("missing").empty(), "unknown control should return empty");
+    PASS();
+}
+
+int main() {
+    std::cout << "Step 601: Compliance Evidence Bundle\n";
+
+    test_add_evidence_success();                      // 1
+    test_add_evidence_rejects_missing_item_id();     // 2
+    test_add_evidence_rejects_missing_control_id();  // 3
+    test_add_evidence_rejects_missing_artifact_path();// 4
+    test_add_evidence_rejects_missing_summary();     // 5
+    test_add_evidence_rejects_duplicate();           // 6
+    test_by_control_filters_results();               // 7
+    test_by_control_empty_returns_all();             // 8
+    test_control_coverage_count_unique_controls();   // 9
+    test_artifact_count_matches_entries();           // 10
+    test_empty_bundle_counts_zero();                 // 11
+    test_by_control_unknown_returns_empty();         // 12
+
+    std::cout << "\nResults: " << passed << "/" << (passed + failed) << " passed\n";
+    return failed == 0 ? 0 : 1;
+}

progress.md

@@ -11574,3 +11574,34 @@ operations requiring explicit reviewer adjudication.
 - `editor/src/SecurityExceptionReviewBoard.h` within header-size limit (`86` <= `600`)
 - `editor/tests/step600_test.cpp` within test-file size guidance (`146` lines)
 - Header-only architecture and naming conventions remain aligned with `ARCHITECTURE.md`
+
+### Step 601: Compliance Evidence Bundle
+**Status:** PASS (12/12 tests)
+
+Implements a compliance evidence bundle for control-linked artifacts and
+coverage accounting.
+
+**Files added:**
+- `editor/src/ComplianceEvidenceBundle.h` - compliance evidence module:
+  - evidence item registration with validation/duplicate guards
+  - control-filtered evidence retrieval
+  - control-coverage and artifact-count metrics
+- `editor/tests/step601_test.cpp` - 12 tests covering:
+  - evidence add success/failure behavior
+  - duplicate/field validation behavior
+  - control filter behavior
+  - coverage/count metric behavior
+
+**Files modified:**
+- `editor/CMakeLists.txt` - `step601_test` target
+
+**Verification run:**
+- `cmake -S editor -B editor/build-native` - PASS
+- `cmake --build editor/build-native --target step601_test step600_test` - PASS
+- `./editor/build-native/step601_test` - PASS (12/12)
+- `./editor/build-native/step600_test` - PASS (12/12) regression coverage
+
+**Architecture gate check:**
+- `editor/src/ComplianceEvidenceBundle.h` within header-size limit (`57` <= `600`)
+- `editor/tests/step601_test.cpp` within test-file size guidance (`155` lines)
+- Header-only architecture and naming conventions remain aligned with `ARCHITECTURE.md`