feat: Governance Twin Phase 2 — 4 core files [2026-04-19]

[romanchaa997]

Governance Twin Phase 2 — Core Files

What's included (4 commits, 4 files):

File	Purpose
docs/governance-twin-mapping.md	TOC mapping v1.0: NotebookLM → Space → OPA/YAML → ClickUp
policy-packs/quantum-ai-dual-architecture.yaml	Policy pack v1.0: 7 deep-dives, PPE baseline anchors, fallback config
scripts/bakhmach-pilot-score.sh	Pilot scoring script: 4-step, evidence snippet for Diia.City/Horizon
docs/meta-checklist.md	Full operational checklist: Phase 2 + Revenue + CRM + Telegram

PPE Phase 2 Baseline anchors:

• modelhash: 5b755eb6d308fb24d9c9c8b68fe9b21e21574523edf84e03da34215e9856318c
• commitment: 0x9cf4c685c410c2bff9694c45aded915249fa2f79f2455a673def78aa18039c40
• baselinepred: 8.38

Next steps after merge:

1. Run bash scripts/bakhmach-pilot-score.sh on VPS
2. Commit 7 deep-dive docs files
3. Deploy RISC Zero zk proof (Due: 2026-05-09)
4. Deploy PPEComplianceVerifier.sol on Polygon Amoy (Due: 2026-05-16)

Evidence target: Diia.City / Horizon EU / BRAVE1 Tier 3 annex

Related: PPE Phase 2 Epic — Dynamo zk-SNARKs on-chain attestation

---

Summary by cubic

Introduces Governance Twin Phase 2 core: a policy pack, mapping, pilot scoring script, and meta checklist. Establishes PPE baseline anchors and enables Bakhmach pilot scoring with evidence output for Diia.City/Horizon.

• New Features

  • docs/governance-twin-mapping.md: Links NotebookLM → Space → policy-packs/quantum-ai-dual-architecture.yaml → ClickUp with priorities and Phase 2 acceptance checks.
  • policy-packs/quantum-ai-dual-architecture.yaml: v1.0 pack with 7 deep-dives (PQC, AI SBOM, RLHF/NIS2, DFIR, Gov Twin, IAM, Productization), fallback behavior, and Bakhmach pilot settings.
  • scripts/bakhmach-pilot-score.sh: 4-step scoring (health, baseline check, /scan, evidence snippet), JSON report output, urgent queue when riskscore ≥ 75, offline-safe.
  • docs/meta-checklist.md: Phase 2 workstreams, revenue tracks, CRM risk pipeline, and Telegram bots with due dates and metrics.

• Migration

  • Run bash scripts/bakhmach-pilot-score.sh on the VPS to generate the first report.
  • Commit the 7 deep-dive docs referenced in the mapping.
  • Build and verify the RISC Zero proof, then deploy PPEComplianceVerifier.sol on Polygon Amoy.

^{Written for commit 94c65bf. Summary will update on new commits.}

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Error		Apr 19, 2026 9:04pm

[netlify]

❌ Deploy Preview for audityzer failed. Why did it fail? →

Name	Link
🔨 Latest commit	94c65bf
🔍 Latest deploy log	https://app.netlify.com/projects/audityzer/deploys/69e5436ad20ece0008d80c2e

[netlify]

❌ Deploy Preview for audityzer-security-platform failed. Why did it fail? →

Name	Link
🔨 Latest commit	94c65bf
🔍 Latest deploy log	https://app.netlify.com/projects/audityzer-security-platform/deploys/69e5436ad20ece0008d80c32

[cubic-dev-ai]

6 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/governance-twin-mapping.md">

<violation number="1" location="docs/governance-twin-mapping.md:29">
P2: This mapping row points to a repo file that does not exist. As written, the new table introduces seven broken "Space File Path" references, so readers cannot navigate from the mapping to the actual implementation artifacts.</violation>
</file>

<file name="docs/meta-checklist.md">

<violation number="1" location="docs/meta-checklist.md:32">
P2: This checklist command points to a Helm chart path that does not exist in the repository, so it will fail as written.</violation>
</file>

<file name="scripts/bakhmach-pilot-score.sh">

<violation number="1" location="scripts/bakhmach-pilot-score.sh:78">
P2: Offline PPE responses are misclassified as model drift because `null` becomes `None` instead of `N/A`.</violation>

<violation number="2" location="scripts/bakhmach-pilot-score.sh:84">
P1: The baseline integrity check only validates `modelhash`, so `baselinepred` or `commitment` drift will still pass as healthy.</violation>

<violation number="3" location="scripts/bakhmach-pilot-score.sh:135">
P2: A valid `riskscore` of `0` is converted to `null`, so zero-risk scans are reported as missing data.</violation>
</file>

<file name="policy-packs/quantum-ai-dual-architecture.yaml">

<violation number="1" location="policy-packs/quantum-ai-dual-architecture.yaml:171">
P1: `---` starts a second YAML document, so `fallback` and `bakhmach_pilot` can be dropped by single-document loaders.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: The baseline integrity check only validates modelhash, so baselinepred or commitment drift will still pass as healthy.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/bakhmach-pilot-score.sh, line 84:

<comment>The baseline integrity check only validates `modelhash`, so `baselinepred` or `commitment` drift will still pass as healthy.</comment>

<file context>
@@ -0,0 +1,212 @@
+
+echo " Expected modelhash:  ${EXPECTED_MODELHASH}"
+echo " Actual modelhash:    ${ACTUAL_MODELHASH}"
+if [ "${ACTUAL_MODELHASH}" = "${EXPECTED_MODELHASH}" ]; then
+  echo -e " ${GREEN}[PASS] modelhash matches baseline${NC}"
+elif [ "${ACTUAL_MODELHASH}" = "N/A" ]; then
</file context>

[cubic-dev-ai]

P1: --- starts a second YAML document, so fallback and bakhmach_pilot can be dropped by single-document loaders.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At policy-packs/quantum-ai-dual-architecture.yaml, line 171:

<comment>`---` starts a second YAML document, so `fallback` and `bakhmach_pilot` can be dropped by single-document loaders.</comment>

<file context>
@@ -0,0 +1,187 @@
+            rule: "saas_first_paid_client == true OR immunefi_first_submission == true"
+            failure_msg: "No first revenue event recorded"
+
+---
+# Fallback behavior
+fallback:
</file context>

[cubic-dev-ai]

P2: This mapping row points to a repo file that does not exist. As written, the new table introduces seven broken "Space File Path" references, so readers cannot navigate from the mapping to the actual implementation artifacts.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/governance-twin-mapping.md, line 29:

<comment>This mapping row points to a repo file that does not exist. As written, the new table introduces seven broken "Space File Path" references, so readers cannot navigate from the mapping to the actual implementation artifacts.</comment>

<file context>
@@ -0,0 +1,77 @@
+
+| # | NotebookLM Section | Space File Path | OPA / YAML Path | ClickUp Custom Field | PPE Baseline Anchor | Priority |
+|---|---|---|---|---|---|---|
+| 1 | PQC TEE/HSM Hybrid KEM | `docs/pqc-tee-hsm.md` | `quantum-ai-dual-architecture.yaml#pqcteehsm.hybridkem` | `pqcteehsmlevel` | `mldsapublickeyprefix: 4445565f46414c4c` | P0 |
+| 2 | AI Supply Chain / SBOM | `docs/ai-supply-chain.md` | `quantum-ai-dual-architecture.yaml#aisupplychain.sbomformat` | `aisbomstatus` | `modelhash: 5b755eb6d308fb24...` | P0 |
+| 3 | RLHF/RAIL NIS2 Controls | `docs/rlhf-rail-nis2.md` | `quantum-ai-dual-architecture.yaml#rlhfrail.nis2controls` | `nis2compliancelevel` | Telegram audit_events table | P1 |
</file context>

[cubic-dev-ai]

P2: This checklist command points to a Helm chart path that does not exist in the repository, so it will fail as written.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/meta-checklist.md, line 32:

<comment>This checklist command points to a Helm chart path that does not exist in the repository, so it will fail as written.</comment>

<file context>
@@ -0,0 +1,142 @@
+### Workstream 1: GPU DOKS + Dynamo (Due: 2026-05-02)
+- [ ] `doctl kubernetes node-pool create ppe-auditorsec --name gpu-pool --size gd-l4-1x --count 1`
+- [ ] Dynamo CRDs installed from `oci://nvcr.io/nvidia/ai-dynamo/dynamo-crds:v1.0.1`
+- [ ] `helm install ppe ./deploy/helm/ppe-dynamo -n ppe` completes
+- [ ] `kubectl -n ppe get dynamographdeployment` shows Ready
+- [ ] `/health` returns `dynamo` URL reachable
</file context>

[cubic-dev-ai]

P2: A valid riskscore of 0 is converted to null, so zero-risk scans are reported as missing data.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/bakhmach-pilot-score.sh, line 135:

<comment>A valid `riskscore` of `0` is converted to `null`, so zero-risk scans are reported as missing data.</comment>

<file context>
@@ -0,0 +1,212 @@
+# -----------------------------------------------------------
+echo -e "${YELLOW}[4/4] Evidence extraction...${NC}"
+
+RISK_SCORE=$(echo "${SCAN_RESPONSE}" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('riskscore') or 'null')" 2>/dev/null || echo "null")
+
+echo "================================================================"
</file context>

[cubic-dev-ai]

P2: Offline PPE responses are misclassified as model drift because null becomes None instead of N/A.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/bakhmach-pilot-score.sh, line 78:

<comment>Offline PPE responses are misclassified as model drift because `null` becomes `None` instead of `N/A`.</comment>

<file context>
@@ -0,0 +1,212 @@
+  -d "{\"taskid\":\"t-bakhmach-001\",\"esthours\":3.0,\"priority\":0.92,\"ergonomicsscore\":8,\"filerefs\":[\"file1\",\"file2\"],\"ownerid\":\"romanenko\"}" \
+  2>/dev/null || echo '{"baselinepred":null,"modelhash":null,"commitment":null,"status":"offline"}')
+
+ACTUAL_MODELHASH=$(echo "${PPE_RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin).get('modelhash','N/A'))" 2>/dev/null || echo "N/A")
+ACTUAL_PRED=$(echo "${PPE_RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin).get('baselinepred','N/A'))" 2>/dev/null || echo "N/A")
+ACTUAL_COMMITMENT=$(echo "${PPE_RESPONSE}" | python3 -c "import sys,json; print(json.load(sys.stdin).get('commitment','N/A'))" 2>/dev/null || echo "N/A")
</file context>