Implement milestone 10 consolidated security evidence and reporting

Author: Ibraheem Olasupo

.github/workflows/security-evidence.yml

@@ -0,0 +1,53 @@
+name: Security Evidence
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-evidence-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  evidence:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      # actions/setup-python v5.6.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip==25.1.1
+          python -m pip install -e ".[dev]"
+
+      - name: Evidence tests
+        run: pytest tests/security/test_consolidated_evidence.py -q
+
+      - name: Source evidence verifiers
+        run: make verify-threat-model-evidence verify-api-security-evidence verify-infrastructure-evidence verify-appsec-evidence verify-dynamic-evidence verify-findings-evidence verify-release-evidence verify-lifecycle-evidence
+
+      - name: Consolidated evidence
+        run: make evidence-full
+
+      - name: Upload evidence artefacts
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+        with:
+          name: security-evidence
+          path: |
+            outputs/security/evidence/
+            reports/security/*security*.md
+            reports/security/*assurance*.md
+            reports/security/*integrity*.md
+          retention-days: 14

CONTRIBUTING.md

@@ -13,6 +13,7 @@ make dynamic-fast
 make findings-full
 make release-full
 make lifecycle-full
+make evidence-full
 ```
 
 Use deterministic synthetic data only. Do not add real patient, NHS, genomic, credential, or cloud account data.
@@ -29,3 +30,4 @@ Use deterministic synthetic data only. Do not add real patient, NHS, genomic, cr
 - Keep findings IDs deterministic and avoid absolute local paths, raw JWTs, private keys or real data in canonical findings outputs.
 - Keep release-gate evidence deterministic. Use `make release-gate-enforce` only when you intentionally want enforcement exit codes; evidence-mode release targets must still run for block and conditional decisions.
 - Keep lifecycle evidence deterministic. Scanner suppressions may inform lifecycle records, but only security exceptions under `config/lifecycle/` and `outputs/security/lifecycle/` may support risk acceptance or deferral.
+- Keep consolidated evidence deterministic. Update `config/evidence/source-registry.yaml` when adding a source domain, and do not add reports with manually maintained counts.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-fast dynamic-full findings-normalise findings-deduplicate findings-enrich findings-validate findings-evidence verify-findings-evidence findings-report findings-full release-policy-validate release-gate-evaluate release-gate-enforce release-evidence verify-release-evidence release-report release-full lifecycle-policy-validate lifecycle-initialise lifecycle-validate lifecycle-expiry lifecycle-evidence verify-lifecycle-evidence lifecycle-report lifecycle-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
+.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-fast dynamic-full findings-normalise findings-deduplicate findings-enrich findings-validate findings-evidence verify-findings-evidence findings-report findings-full release-policy-validate release-gate-evaluate release-gate-enforce release-evidence verify-release-evidence release-report release-full lifecycle-policy-validate lifecycle-initialise lifecycle-validate lifecycle-expiry lifecycle-evidence verify-lifecycle-evidence lifecycle-report lifecycle-full evidence-source-validate evidence-aggregate evidence-generate verify-consolidated-evidence evidence-report evidence-full security-assurance-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
 
 PYTHON ?= python3
 VENV ?= .venv
@@ -251,6 +251,25 @@ lifecycle-report:
 
 lifecycle-full: verify-findings-evidence verify-release-evidence lifecycle-policy-validate lifecycle-initialise lifecycle-expiry lifecycle-validate lifecycle-evidence verify-lifecycle-evidence lifecycle-report
 
+evidence-source-validate:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.evidence validate-sources
+
+evidence-aggregate:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.evidence aggregate --timestamp 2026-01-01T00:00:00Z --as-of-date 2026-01-01
+
+evidence-generate:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.evidence generate --timestamp 2026-01-01T00:00:00Z --as-of-date 2026-01-01
+
+verify-consolidated-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.evidence verify
+
+evidence-report:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.evidence report
+
+evidence-full: verify-threat-model-evidence verify-api-security-evidence verify-infrastructure-evidence verify-appsec-evidence verify-dynamic-evidence verify-findings-evidence verify-release-evidence verify-lifecycle-evidence evidence-source-validate evidence-generate verify-consolidated-evidence evidence-report
+
+security-assurance-full: quality verify-threat-model-evidence verify-api-security-evidence verify-infrastructure-evidence verify-appsec-evidence verify-dynamic-evidence findings-full release-full lifecycle-full evidence-full
+
 pre-commit-install:
 	$(PYTHON) -m pip install pre-commit==3.8.0
 	$(VENV)/bin/pre-commit install

README.md

@@ -34,6 +34,8 @@ Milestone 8 adds risk-based release gates over the Milestone 7 canonical finding
 
 Milestone 9 adds deterministic vulnerability lifecycle and exception governance over canonical findings and release outputs. It produces a vulnerability register, lifecycle history, security exception register, expiry reports, verification evidence, audit reports and a pinned lifecycle workflow. It does not start Security Champions, deploy, push containers, create AWS resources, commit or push.
 
+Milestone 10 adds consolidated security evidence and reporting across Milestones 1-9. It produces a deterministic evidence bundle, source lineage, control coverage, security metrics, integrity summaries and audience-oriented reports. It does not start Milestone 11 developer enablement, Security Champions, dashboards, ticketing, external reporting, deployment or AWS resource creation.
+
 ## Milestone 1 Scope
 
 Implemented:
@@ -143,6 +145,19 @@ Implemented as local governance, evidence and reports:
 
 Not implemented in Milestone 9: Security Champions, production ticketing integration, deployment approvals, artefact signing/provenance, AWS deployment, container push or production vulnerability-management operations.
 
+## Milestone 10 Scope
+
+Implemented as local evidence aggregation and reports:
+
+- Explicit source registry for threat model, API security, infrastructure, AppSec, dynamic security, findings, release assurance and lifecycle evidence.
+- Deterministic consolidated evidence bundle and manifest.
+- Evidence lineage, control coverage, metrics and integrity summaries.
+- Executive, product-security, engineering and audit reports.
+- Sensitive-content validation for consolidated outputs.
+- A security-evidence CI workflow with minimal permissions and no AWS credentials.
+
+Not implemented in Milestone 10: Milestone 11 developer enablement, Security Champions, dashboards, ticketing, external reporting systems, regulatory certification, AWS deployment or production monitoring.
+
 ## API Capabilities
 
 - `GET /health`
@@ -230,6 +245,13 @@ Open `http://127.0.0.1:8000/docs` for FastAPI's local OpenAPI UI.
 - `make verify-lifecycle-evidence`: verify lifecycle evidence checksums and determinism.
 - `make lifecycle-report`: generate lifecycle governance reports.
 - `make lifecycle-full`: verify findings and release evidence, then run the full lifecycle workflow.
+- `make evidence-source-validate`: validate all consolidated evidence source manifests.
+- `make evidence-aggregate`: aggregate source evidence into a deterministic bundle preview.
+- `make evidence-generate`: write consolidated evidence outputs.
+- `make verify-consolidated-evidence`: verify consolidated evidence checksums and content safety.
+- `make evidence-report`: generate consolidated reports.
+- `make evidence-full`: verify source evidence, generate consolidated evidence, verify it and write reports.
+- `make security-assurance-full`: run quality, source evidence, findings, release, lifecycle and consolidated evidence workflows.
 - `make secrets-scan`: run Gitleaks via local binary or pinned container.
 - `make semgrep-test`: run Semgrep custom rule tests.
 - `make sast`: run Semgrep and Bandit.

SECURITY.md

@@ -6,7 +6,7 @@ If you identify a vulnerability or unsafe pattern in this demonstration code, op
 
 Do not submit real patient data, NHS data, genomic data, credentials, cloud account identifiers, or sensitive operational details in reports.
 
-Current implemented security controls include local JWT authentication, role-based and object-level authorisation, threat-model validation, non-deployed Terraform reference controls, a Milestone 5 AppSec pipeline, Milestone 6 local dynamic API security validation, Milestone 7 canonical findings normalisation, Milestone 8 local release-assurance gates, and Milestone 9 vulnerability lifecycle and exception governance.
+Current implemented security controls include local JWT authentication, role-based and object-level authorisation, threat-model validation, non-deployed Terraform reference controls, a Milestone 5 AppSec pipeline, Milestone 6 local dynamic API security validation, Milestone 7 canonical findings normalisation, Milestone 8 local release-assurance gates, Milestone 9 vulnerability lifecycle and exception governance, and Milestone 10 consolidated security evidence reporting.
 
 Run local security checks with:
 
@@ -17,6 +17,7 @@ make dynamic-fast
 make findings-full
 make release-full
 make lifecycle-full
+make evidence-full
 ```
 
-Docker-backed Gitleaks, Trivy, Schemathesis and ZAP scans require a running Docker daemon when native binaries or scanner containers are used. Dynamic scan targets must remain local-only. Do not treat local scanner, findings, release or lifecycle evidence as a production vulnerability-management programme, penetration test, deployment approval system or Security Champions programme.
+Docker-backed Gitleaks, Trivy, Schemathesis and ZAP scans require a running Docker daemon when native binaries or scanner containers are used. Dynamic scan targets must remain local-only. Do not treat local scanner, findings, release, lifecycle or consolidated evidence as a production vulnerability-management programme, penetration test, deployment approval system, regulatory certification or Security Champions programme.

config/evidence/control-mapping.yaml

@@ -0,0 +1,14 @@
+{
+  "schema_version": "1.0",
+  "control_mapping_version": "1.0",
+  "domains": {
+    "api_security": ["api_security", "authentication", "authorisation"],
+    "appsec": ["supply_chain", "secrets", "container_security", "infrastructure_security"],
+    "dynamic_security": ["api_security", "authentication", "authorisation", "configuration"],
+    "findings": ["governance", "supply_chain"],
+    "infrastructure": ["infrastructure_security", "iam", "data_protection", "audit_logging"],
+    "lifecycle": ["vulnerability_management", "governance", "audit"],
+    "release_assurance": ["release_assurance"],
+    "threat_model": ["secure_design"]
+  }
+}

config/evidence/evidence-policy.yaml

@@ -0,0 +1,24 @@
+{
+  "schema_version": "1.0",
+  "policy_version": "1.0",
+  "controlled_timestamp": "2026-01-01T00:00:00Z",
+  "as_of_date": "2026-01-01",
+  "deployment_status": "not_deployed",
+  "required_domain_policy": "all_required_domains_must_verify",
+  "integrity_rules": [
+    "source_manifest_exists",
+    "source_manifest_schema_supported",
+    "required_outputs_exist",
+    "output_checksums_match",
+    "input_checksums_match",
+    "controlled_timestamp_consistent",
+    "deployment_status_consistent",
+    "no_absolute_local_paths_in_consolidated_outputs",
+    "no_secret_bearing_content"
+  ],
+  "limitations": [
+    "Local portfolio evidence, not regulatory certification.",
+    "Deployment status is not_deployed.",
+    "Milestone 10 does not implement dashboards, external reporting, ticketing or Security Champions."
+  ]
+}

config/evidence/fixtures/local-path-evidence.json

@@ -0,0 +1,3 @@
+{
+  "path": "/Users/example/local/path"
+}

config/evidence/fixtures/secret-bearing-evidence.json

@@ -0,0 +1,3 @@
+{
+  "authorization": "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJkZW1vIn0.signaturevalue"
+}

config/evidence/fixtures/unsupported-schema-manifest.json

@@ -0,0 +1,4 @@
+{
+  "schema_version": "9.9",
+  "output_files": {}
+}