Government-readiness review + Pass 1 hardening

.github/dependabot.yml

@@ -0,0 +1,45 @@
+version: 2
+updates:
+  # MCP server (TypeScript)
+  - package-ecosystem: "npm"
+    directory: "/mcp-server"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+
+  # Web viewer
+  - package-ecosystem: "npm"
+    directory: "/viewer"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  # Pattern engine (Python)
+  - package-ecosystem: "pip"
+    directory: "/pattern-engine"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Container base images
+  - package-ecosystem: "docker"
+    directory: "/mcp-server"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "docker"
+    directory: "/pattern-engine"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "docker"
+    directory: "/viewer"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -225,10 +225,64 @@
       - name: Run prediction demo
         run: npx tsx ../demos/predict_outcome_demo.ts
 
+  # ============================================================================
+  # Security & Supply Chain (non-blocking for now — reports only)
+  # ============================================================================
+  security:
+    name: Security & SBOM
+    runs-on: ubuntu-latest
+    # Do not fail the pipeline yet: surface dependency advisories and produce
+    # SBOMs while the flagged issues are triaged. Flip continue-on-error to
+    # false (and add audit-level gating) once the backlog is clean.
+    continue-on-error: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: npm audit (mcp-server, production deps)
+        working-directory: mcp-server
+        run: npm audit --omit=dev || true
+
+      - name: npm audit (viewer, production deps)
+        working-directory: viewer
+        run: npm audit --omit=dev || true
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: pip-audit (pattern-engine)
+        run: |
+          python -m pip install --upgrade pip pip-audit
+          pip-audit -r pattern-engine/requirements.txt || true
+
+      - name: Generate SBOMs (CycloneDX)
+        run: |
+          # Node SBOMs from the committed lockfiles.
+          (cd mcp-server && npm ci --ignore-scripts && npm sbom --sbom-format cyclonedx > ../mcp-server-sbom.cdx.json) || true
+          (cd viewer && npm ci --ignore-scripts && npm sbom --sbom-format cyclonedx > ../viewer-sbom.cdx.json) || true
+          # Python SBOM.
+          python -m pip install cyclonedx-bom || true
+          cyclonedx-py requirements pattern-engine/requirements.txt -o pattern-engine-sbom.cdx.json || true
+
+      - name: Upload SBOM artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sboms
+          path: '*-sbom.cdx.json'
+          if-no-files-found: warn
+
   # ============================================================================
   # Build Artifacts
   # ============================================================================
   build-check:
     name: Build Check
     runs-on: ubuntu-latest
     needs: [mcp-server, pattern-engine]
@@ -267,5 +321,5 @@
           echo "| Pattern Engine | ✅ Tests Passed |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### Test Results" >> $GITHUB_STEP_SUMMARY
-          echo "- MCP Server: 605+ tests" >> $GITHUB_STEP_SUMMARY
+          echo "- MCP Server: see the test job output for the current count" >> $GITHUB_STEP_SUMMARY
           echo "- Pattern Engine: See pytest output" >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -26,7 +26,9 @@ logs/
 
 # Environment
 .env
-.env.local
+.env.*
+!.env.*.example
+.env.rfc
 
 # Coverage
 coverage/
@@ -45,7 +47,9 @@ output/*.svg
 output/*.png
 output/datasphere_analysis/
 output/e2e_test/
+output/*.md
 pattern-engine/csv_test_output/
+pattern-engine/test_output/
 synthetic-data/external_data/
 
 # Downloaded datasets (keep .gitkeep)

.nvmrc

@@ -0,0 +1 @@
+20

.python-version

@@ -0,0 +1 @@
+3.11

CLAUDE.md

@@ -46,22 +46,26 @@ cd pattern-engine && pytest tests/ -v
 transaction-forensics/
 ├── mcp-server/                 # MCP server with TypeScript
 │   ├── src/
-│   │   ├── index.ts            # Entry point
-│   │   ├── adapters/           # SAP, SFDC, NetSuite, SALT, BPI, CSV adapters
+│   │   ├── index.ts            # Entry point (registers 27 tools; see note below)
+│   │   ├── adapters/           # SAP (ECC RFC + S/4 OData stub), SFDC, SALT, BPI, CSV, synthetic
 │   │   ├── conformance/        # Process conformance checking
-│   │   ├── evidence/           # Provenance graph, extraction registry
+│   │   ├── provenance/         # Provenance graph + replay hashing
+│   │   ├── extraction-registry/# Named extraction paths (incl. NetSuite SuiteQL metadata)
 │   │   ├── contradiction/      # Cross-system contradiction engine
-│   │   ├── schema/             # Schema validator (IDES reference)
+│   │   ├── cross-system/       # Entity resolution across systems
+│   │   ├── schema-validator/   # Schema validator (IDES reference)
 │   │   ├── reality-gap/        # Three-way gap analysis
 │   │   ├── finding-lifecycle/  # 8-state finding manager + SQLite
 │   │   ├── handoff/            # Reviewer handoff packet generator
-│   │   ├── fi-co/              # FI/CO forensic analysis tools
 │   │   ├── governance/         # PromptSpeak integration
 │   │   ├── llm/                # Natural language interface
+│   │   ├── logging/            # Audit logger
 │   │   ├── ocel/               # OCEL 2.0 export
-│   │   ├── policies/           # Business rules
+│   │   ├── policies/           # Business rules / access limits
 │   │   ├── prediction/         # ML predictions
-│   │   ├── tools/              # MCP tool definitions
+│   │   ├── reports/            # FI/CO report generation
+│   │   ├── tools/              # MCP tool definitions (FI/CO tools live here as analyze-*.ts)
+│   │   ├── types/             # Shared TypeScript types (incl. fi-co types)
 │   │   └── visualization/      # Process maps
 ├── pattern-engine/             # Pattern discovery engine (Python)
 │   ├── scripts/                # analyze_sfdc.py, etc.
@@ -120,6 +124,10 @@ transaction-forensics/
 | `generate_fi_assessment` | FI/CO risk assessment report |
 
 ### Evidence Infrastructure Tools
+> Note: these nine tools are implemented and unit-tested but are **not yet
+> registered** on the MCP server (`src/tools/index.ts` exposes 18 analysis + 9
+> governance = 27 tools). Wiring them into the server is tracked in
+> [docs/GOVERNMENT-READINESS-REVIEW.md](docs/GOVERNMENT-READINESS-REVIEW.md).
 | Tool | Purpose |
 |---|---|
 | `query_provenance` | Trace evidence chain for a finding |
@@ -152,14 +160,15 @@ transaction-forensics/
 ## Environment Variables
 ```bash
 # LLM providers (choose one)
-OLLAMA_BASE_URL=http://localhost:11434  # Local, private
+OLLAMA_HOST=http://localhost:11434      # Local, private (default provider)
 OPENAI_API_KEY=sk-...                   # Cloud option
 ANTHROPIC_API_KEY=sk-ant-...            # Cloud option
 
-# SAP RFC (optional)
-SAP_HOST=...
-SAP_SYSNR=...
-SAP_CLIENT=...
-SAP_USER=...
-SAP_PASSWORD=...
+# SAP RFC (optional) — see .env.rfc.example for the full list
+SAP_RFC_ASHOST=...
+SAP_RFC_SYSNR=00
+SAP_RFC_CLIENT=100
+SAP_RFC_USER=...
+SAP_RFC_PASSWD=...
+SAP_RFC_LANG=EN
 ```